@openchambery/web 2.1.10-beta.10 → 2.1.10-beta.12

package/dist/assets/{useWorkerHighlightedLines-hl5s_wXd.js → useWorkerHighlightedLines-DxLthSDl.js}

@@ -1,4 +1,4 @@
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{it as t,rt as n}from"./vendor-base-ui-CdzJ6My_.js";import{v as r}from"./useUIStore-CEqU9Ujv.js";import{n as i}from"./vendor-react-BP2cRVqX.js";import{f as a,r as o,t as s}from"./button-Ca8Z9cOP.js";import{n as c}from"./useThemeSystem-8jhE4Zyk.js";import{n as l}from"./Icon-x0XTu231.js";import{i as u,n as d,t as f}from"./tooltip-B7cKvIho.js";import{n as p}from"./MarkdownRenderer-BZZFoaPb.js";import{n as m,o as h,s as g,t as _}from"./markdown-worker-DFNZ3KJ_.js";import{t as v}from"./vendor-tanstack-react-virtual-B_EO--9t.js";import{n as y}from"./markdownTheme-BUfvCGAn.js";var b=e(t(),1),x=i(),S=n(),C=`w-[min(30rem,calc(100cqw-1rem))] min-w-[280px] max-w-full overflow-hidden rounded-xl shadow-[inset_0_1px_0_0_rgba(255,255,255,0.8),inset_0_0_0_1px_rgba(0,0,0,0.04),0_0_0_1px_rgba(0,0,0,0.10),0_1px_2px_-0.5px_rgba(0,0,0,0.08),0_4px_8px_-2px_rgba(0,0,0,0.08),0_12px_20px_-4px_rgba(0,0,0,0.08)] dark:shadow-[inset_0_1px_0_0_rgba(255,255,255,0.12),inset_0_0_0_1px_rgba(255,255,255,0.08),0_0_0_1px_rgba(0,0,0,0.36),0_1px_1px_-0.5px_rgba(0,0,0,0.22),0_3px_3px_-1.5px_rgba(0,0,0,0.20),0_6px_6px_-3px_rgba(0,0,0,0.16)]`,w={maxWidth:`min(28rem, calc(100cqw - 4ch))`,backgroundColor:`var(--surface-elevated)`,color:`var(--surface-elevated-foreground)`},T=`flex items-center justify-between gap-3 border-b border-[var(--surface-subtle)] px-3 py-2.5`,E=`text-xs font-medium leading-4 text-foreground md:text-[0.8125rem] md:leading-5`,D=`text-xs tabular-nums leading-4 text-muted-foreground md:text-[0.8125rem] md:leading-5`,O=`m-0 list-none divide-y divide-[var(--surface-subtle)] p-0`,k=`${O} max-h-[min(22rem,50vh)] overflow-y-auto`,A=`${O} w-full`,ee={className:`p-0 rounded-none`,maxHeightClass:`max-h-[46vh]`,disableHorizontal:!0},j=`px-2.5 py-1.5 text-xs leading-4 md:py-2 md:text-[0.8125rem] md:leading-5`,M=`flex min-w-0 items-center gap-1 text-xs leading-4 text-muted-foreground md:gap-1.5 md:text-[0.8125rem] md:leading-5`,te=`min-w-0 truncate text-xs leading-4 text-foreground md:text-[0.8125rem] md:leading-5`,ne=`inline-flex shrink-0 items-center gap-1 text-xs leading-4 tabular-nums text-muted-foreground md:text-[0.8125rem] md:leading-5`,re=`h-3 w-3 shrink-0 md:h-3.5 md:w-3.5`,ie={in_progress:`text-foreground`,pending:`text-foreground`,completed:`text-muted-foreground line-through`,cancelled:`text-muted-foreground line-through`},ae={in_progress:`chat.statusRow.todo.status.inProgress`,pending:`chat.statusRow.todo.status.pending`,completed:`chat.statusRow.todo.status.completed`,cancelled:`chat.statusRow.todo.status.cancelled`},N=e=>{let t=(0,x.c)(26),{todo:n,isActive:r,activeRef:i}=e,{t:s}=a(),c=oe.has(n.status)?n.status:`pending`,p=ae[c],m;t[0]!==s||t[1]!==p?(m=s(p),t[0]=s,t[1]=p,t[2]=m):m=t[2];let h=m,g;t[3]===c?g=t[4]:(g=c===`in_progress`?(0,S.jsx)(l,{name:`record-circle`,className:`h-3.5 w-3.5 text-[var(--status-info)]`,"aria-hidden":`true`}):c===`completed`?(0,S.jsx)(l,{name:`checkbox-circle`,className:`h-3.5 w-3.5 text-[var(--status-success)]`,"aria-hidden":`true`}):(0,S.jsx)(l,{name:`time`,className:`h-3.5 w-3.5 text-muted-foreground`,"aria-hidden":`true`}),t[3]=c,t[4]=g);let _=g,v=r?`step`:void 0,y=r&&`bg-[var(--surface-muted)] before:absolute before:inset-y-2 before:left-0 before:w-0.5 before:rounded-full before:bg-[var(--status-info)]`,b;t[5]===y?b=t[6]:(b=o(`group relative grid min-w-0 grid-cols-[1rem_minmax(0,1fr)] items-start gap-2.5`,j,y),t[5]=y,t[6]=b);let C;t[7]!==_||t[8]!==h?(C=(0,S.jsx)(u,{asChild:!0,children:(0,S.jsx)(`span`,{className:`flex size-4 items-center justify-center`,"aria-label":h,children:_})}),t[7]=_,t[8]=h,t[9]=C):C=t[9];let w;t[10]===h?w=t[11]:(w=(0,S.jsx)(d,{side:`left`,sideOffset:6,children:h}),t[10]=h,t[11]=w);let T;t[12]!==C||t[13]!==w?(T=(0,S.jsxs)(f,{children:[C,w]}),t[12]=C,t[13]=w,t[14]=T):T=t[14];let E=ie[c],D;t[15]===E?D=t[16]:(D=o(`block whitespace-normal break-words`,E),t[15]=E,t[16]=D);let O;t[17]!==D||t[18]!==n.content?(O=(0,S.jsx)(`span`,{className:`min-w-0 flex-1`,children:(0,S.jsx)(`span`,{className:D,children:n.content})}),t[17]=D,t[18]=n.content,t[19]=O):O=t[19];let k;return t[20]!==i||t[21]!==O||t[22]!==v||t[23]!==b||t[24]!==T?(k=(0,S.jsxs)(`li`,{ref:i,"aria-current":v,className:b,children:[T,O]}),t[20]=i,t[21]=O,t[22]=v,t[23]=b,t[24]=T,t[25]=k):k=t[25],k},oe=new Set([`in_progress`,`pending`,`completed`,`cancelled`]),P=e=>e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`).replace(/"/g,`&quot;`).replace(/'/g,`&#39;`),F=e=>e?Object.entries(e).map(([e,t])=>t==null?``:`${e.startsWith(`--`)?e:e.replace(/[A-Z]/g,e=>`-${e.toLowerCase()}`)}:${typeof t==`number`?`${t}px`:t};`).join(``):``,I=(e,t,n)=>{let r=e.querySelector(`pre`);r&&(r.style.margin=`0`,r.style.background=`transparent`,r.style.whiteSpace=t?`pre-wrap`:`pre`,t&&(r.style.wordBreak=`break-word`,r.style.overflowWrap=`break-word`));let i=e.querySelector(`code`);if(i){let e=F(n);e&&i.setAttribute(`style`,`${i.getAttribute(`style`)??``}${e}`)}},L=e=>`<pre><code>${P(e)}</code></pre>`,R=e=>{let t=(0,x.c)(21),{code:n,language:r,className:i,style:a,codeStyle:s,wrap:l}=e,u=l!==void 0&&l,{currentTheme:d}=c(),f=b.useRef(null),p;t[0]===d?p=t[1]:(p=y(d),t[0]=d,t[1]=p);let m=p,h,g;t[2]!==n||t[3]!==s||t[4]!==u?(h=()=>{let e=f.current;e&&(e.innerHTML=L(n),I(e,u,s))},g=[n,u,s],t[2]=n,t[3]=s,t[4]=u,t[5]=h,t[6]=g):(h=t[5],g=t[6]),b.useLayoutEffect(h,g);let v,C;t[7]!==n||t[8]!==s||t[9]!==r||t[10]!==u?(v=()=>{let e=f.current;if(!e)return;let t=!0,i=new AbortController;return _(n,(r||`text`).toLowerCase(),{signal:i.signal,priority:`visible`}).then(n=>{!t||!e||!n||(e.innerHTML=n,I(e,u,s))}),()=>{t=!1,i.abort()}},C=[n,r,u,s],t[7]=n,t[8]=s,t[9]=r,t[10]=u,t[11]=v,t[12]=C):(v=t[11],C=t[12]),b.useEffect(v,C);let w;t[13]===i?w=t[14]:(w=o(`typography-code`,i),t[13]=i,t[14]=w);let T=m,E;t[15]!==a||t[16]!==T?(E={...T,...a},t[15]=a,t[16]=T,t[17]=E):E=t[17];let D;return t[18]!==w||t[19]!==E?(D=(0,S.jsx)(`div`,{ref:f,className:w,style:E}),t[18]=w,t[19]=E,t[20]=D):D=t[20],D},z=e=>{let t=e.replace(/^<file>\s*\n?/,``).replace(/\n?<\/file>\s*$/,``);return t=t.replace(/^\s*\d{5}\|\s?/gm,``),t.trim()},B=(e,t=``)=>{if(typeof e==`string`)return e;if(e==null)return t;if(typeof e==`number`||typeof e==`boolean`||typeof e==`bigint`)return String(e);try{return JSON.stringify(e)}catch{return t}},V=e=>e?e.includes(`<diagnostics`)||e.includes(`<file_diagnostics>`)||e.includes(`LSP errors detected`)||e.includes(`This file has errors`):!1,H=e=>e?e.replace(/\n{0,2}LSP errors detected[\s\S]*?<diagnostics[^>]*>[\s\S]*?<\/diagnostics>/g,``).replace(/\n{0,2}This file has errors[\s\S]*?<\/file_diagnostics>/g,``).replace(/<diagnostics[^>]*>[\s\S]*?<\/diagnostics>/g,``).replace(/<file_diagnostics>[\s\S]*?<\/file_diagnostics>/g,``).trim():``,U=(e,t)=>!e||typeof e!=`object`?String(e):g(e,t||``),W=e=>{if(typeof e==`string`){let t=e.trim();return t.length>0?t:void 0}if(e&&typeof e==`object`){let t=e.patch;if(typeof t==`string`){let e=t.trim();return e.length>0?e:void 0}}},G=e=>{if(!e||typeof e!=`object`)return;let t=W(e.patch)??W(e.diff);if(t)return t;let n=Array.isArray(e.files)?e.files:[];for(let e of n){if(!e||typeof e!=`object`)continue;let t=W(e.patch)??W(e.diff);if(t)return t}},K=e=>{if(!e||typeof e!=`string`)return{data:null,isJson:!1};let t=e.trim();if(!t.startsWith(`{`)&&!t.startsWith(`[`)||!t.endsWith(`}`)&&!t.endsWith(`]`)||t.length<2)return{data:null,isJson:!1};try{let e=JSON.parse(t);return typeof e==`object`&&e?{data:e,isJson:!0}:{data:null,isJson:!1}}catch{return{data:null,isJson:!1}}},q=(e,t,n)=>{let r=z(e);if((t===`edit`||t===`multiedit`||t===`write`||t===`apply_patch`)&&V(r)&&(r=H(r)),(t===`edit`||t===`multiedit`||t===`apply_patch`)&&r.trim().length===0){let e=G(n);if(e)return e}return r},se=e=>{let t=e.match(/<type>(file|directory)<\/type>/i)?.[1]?.toLowerCase()??`unknown`,n=(e.match(/<content>([\s\S]*?)<\/content>/i)?.[1]??e).replace(/\r\n/g,`
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{it as t,rt as n}from"./vendor-base-ui-CdzJ6My_.js";import{v as r}from"./useUIStore-CEqU9Ujv.js";import{n as i}from"./vendor-react-BP2cRVqX.js";import{f as a,r as o,t as s}from"./button--NSU9MZj.js";import{n as c}from"./useThemeSystem-8jhE4Zyk.js";import{n as l}from"./Icon-DJOJhmkK.js";import{i as u,n as d,t as f}from"./tooltip-CRvh1CJe.js";import{n as p}from"./MarkdownRenderer-CVFTXv6T.js";import{n as m,o as h,s as g,t as _}from"./markdown-worker-DFNZ3KJ_.js";import{t as v}from"./vendor-tanstack-react-virtual-B_EO--9t.js";import{n as y}from"./markdownTheme-BUfvCGAn.js";var b=e(t(),1),x=i(),S=n(),C=`w-[min(30rem,calc(100cqw-1rem))] min-w-[280px] max-w-full overflow-hidden rounded-xl shadow-[inset_0_1px_0_0_rgba(255,255,255,0.8),inset_0_0_0_1px_rgba(0,0,0,0.04),0_0_0_1px_rgba(0,0,0,0.10),0_1px_2px_-0.5px_rgba(0,0,0,0.08),0_4px_8px_-2px_rgba(0,0,0,0.08),0_12px_20px_-4px_rgba(0,0,0,0.08)] dark:shadow-[inset_0_1px_0_0_rgba(255,255,255,0.12),inset_0_0_0_1px_rgba(255,255,255,0.08),0_0_0_1px_rgba(0,0,0,0.36),0_1px_1px_-0.5px_rgba(0,0,0,0.22),0_3px_3px_-1.5px_rgba(0,0,0,0.20),0_6px_6px_-3px_rgba(0,0,0,0.16)]`,w={maxWidth:`min(28rem, calc(100cqw - 4ch))`,backgroundColor:`var(--surface-elevated)`,color:`var(--surface-elevated-foreground)`},T=`flex items-center justify-between gap-3 border-b border-[var(--surface-subtle)] px-3 py-2.5`,E=`text-xs font-medium leading-4 text-foreground md:text-[0.8125rem] md:leading-5`,D=`text-xs tabular-nums leading-4 text-muted-foreground md:text-[0.8125rem] md:leading-5`,O=`m-0 list-none divide-y divide-[var(--surface-subtle)] p-0`,k=`${O} max-h-[min(22rem,50vh)] overflow-y-auto`,A=`${O} w-full`,ee={className:`p-0 rounded-none`,maxHeightClass:`max-h-[46vh]`,disableHorizontal:!0},j=`px-2.5 py-1.5 text-xs leading-4 md:py-2 md:text-[0.8125rem] md:leading-5`,M=`flex min-w-0 items-center gap-1 text-xs leading-4 text-muted-foreground md:gap-1.5 md:text-[0.8125rem] md:leading-5`,te=`min-w-0 truncate text-xs leading-4 text-foreground md:text-[0.8125rem] md:leading-5`,ne=`inline-flex shrink-0 items-center gap-1 text-xs leading-4 tabular-nums text-muted-foreground md:text-[0.8125rem] md:leading-5`,re=`h-3 w-3 shrink-0 md:h-3.5 md:w-3.5`,ie={in_progress:`text-foreground`,pending:`text-foreground`,completed:`text-muted-foreground line-through`,cancelled:`text-muted-foreground line-through`},ae={in_progress:`chat.statusRow.todo.status.inProgress`,pending:`chat.statusRow.todo.status.pending`,completed:`chat.statusRow.todo.status.completed`,cancelled:`chat.statusRow.todo.status.cancelled`},N=e=>{let t=(0,x.c)(26),{todo:n,isActive:r,activeRef:i}=e,{t:s}=a(),c=oe.has(n.status)?n.status:`pending`,p=ae[c],m;t[0]!==s||t[1]!==p?(m=s(p),t[0]=s,t[1]=p,t[2]=m):m=t[2];let h=m,g;t[3]===c?g=t[4]:(g=c===`in_progress`?(0,S.jsx)(l,{name:`record-circle`,className:`h-3.5 w-3.5 text-[var(--status-info)]`,"aria-hidden":`true`}):c===`completed`?(0,S.jsx)(l,{name:`checkbox-circle`,className:`h-3.5 w-3.5 text-[var(--status-success)]`,"aria-hidden":`true`}):(0,S.jsx)(l,{name:`time`,className:`h-3.5 w-3.5 text-muted-foreground`,"aria-hidden":`true`}),t[3]=c,t[4]=g);let _=g,v=r?`step`:void 0,y=r&&`bg-[var(--surface-muted)] before:absolute before:inset-y-2 before:left-0 before:w-0.5 before:rounded-full before:bg-[var(--status-info)]`,b;t[5]===y?b=t[6]:(b=o(`group relative grid min-w-0 grid-cols-[1rem_minmax(0,1fr)] items-start gap-2.5`,j,y),t[5]=y,t[6]=b);let C;t[7]!==_||t[8]!==h?(C=(0,S.jsx)(u,{asChild:!0,children:(0,S.jsx)(`span`,{className:`flex size-4 items-center justify-center`,"aria-label":h,children:_})}),t[7]=_,t[8]=h,t[9]=C):C=t[9];let w;t[10]===h?w=t[11]:(w=(0,S.jsx)(d,{side:`left`,sideOffset:6,children:h}),t[10]=h,t[11]=w);let T;t[12]!==C||t[13]!==w?(T=(0,S.jsxs)(f,{children:[C,w]}),t[12]=C,t[13]=w,t[14]=T):T=t[14];let E=ie[c],D;t[15]===E?D=t[16]:(D=o(`block whitespace-normal break-words`,E),t[15]=E,t[16]=D);let O;t[17]!==D||t[18]!==n.content?(O=(0,S.jsx)(`span`,{className:`min-w-0 flex-1`,children:(0,S.jsx)(`span`,{className:D,children:n.content})}),t[17]=D,t[18]=n.content,t[19]=O):O=t[19];let k;return t[20]!==i||t[21]!==O||t[22]!==v||t[23]!==b||t[24]!==T?(k=(0,S.jsxs)(`li`,{ref:i,"aria-current":v,className:b,children:[T,O]}),t[20]=i,t[21]=O,t[22]=v,t[23]=b,t[24]=T,t[25]=k):k=t[25],k},oe=new Set([`in_progress`,`pending`,`completed`,`cancelled`]),P=e=>e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`).replace(/"/g,`&quot;`).replace(/'/g,`&#39;`),F=e=>e?Object.entries(e).map(([e,t])=>t==null?``:`${e.startsWith(`--`)?e:e.replace(/[A-Z]/g,e=>`-${e.toLowerCase()}`)}:${typeof t==`number`?`${t}px`:t};`).join(``):``,I=(e,t,n)=>{let r=e.querySelector(`pre`);r&&(r.style.margin=`0`,r.style.background=`transparent`,r.style.whiteSpace=t?`pre-wrap`:`pre`,t&&(r.style.wordBreak=`break-word`,r.style.overflowWrap=`break-word`));let i=e.querySelector(`code`);if(i){let e=F(n);e&&i.setAttribute(`style`,`${i.getAttribute(`style`)??``}${e}`)}},L=e=>`<pre><code>${P(e)}</code></pre>`,R=e=>{let t=(0,x.c)(21),{code:n,language:r,className:i,style:a,codeStyle:s,wrap:l}=e,u=l!==void 0&&l,{currentTheme:d}=c(),f=b.useRef(null),p;t[0]===d?p=t[1]:(p=y(d),t[0]=d,t[1]=p);let m=p,h,g;t[2]!==n||t[3]!==s||t[4]!==u?(h=()=>{let e=f.current;e&&(e.innerHTML=L(n),I(e,u,s))},g=[n,u,s],t[2]=n,t[3]=s,t[4]=u,t[5]=h,t[6]=g):(h=t[5],g=t[6]),b.useLayoutEffect(h,g);let v,C;t[7]!==n||t[8]!==s||t[9]!==r||t[10]!==u?(v=()=>{let e=f.current;if(!e)return;let t=!0,i=new AbortController;return _(n,(r||`text`).toLowerCase(),{signal:i.signal,priority:`visible`}).then(n=>{!t||!e||!n||(e.innerHTML=n,I(e,u,s))}),()=>{t=!1,i.abort()}},C=[n,r,u,s],t[7]=n,t[8]=s,t[9]=r,t[10]=u,t[11]=v,t[12]=C):(v=t[11],C=t[12]),b.useEffect(v,C);let w;t[13]===i?w=t[14]:(w=o(`typography-code`,i),t[13]=i,t[14]=w);let T=m,E;t[15]!==a||t[16]!==T?(E={...T,...a},t[15]=a,t[16]=T,t[17]=E):E=t[17];let D;return t[18]!==w||t[19]!==E?(D=(0,S.jsx)(`div`,{ref:f,className:w,style:E}),t[18]=w,t[19]=E,t[20]=D):D=t[20],D},z=e=>{let t=e.replace(/^<file>\s*\n?/,``).replace(/\n?<\/file>\s*$/,``);return t=t.replace(/^\s*\d{5}\|\s?/gm,``),t.trim()},B=(e,t=``)=>{if(typeof e==`string`)return e;if(e==null)return t;if(typeof e==`number`||typeof e==`boolean`||typeof e==`bigint`)return String(e);try{return JSON.stringify(e)}catch{return t}},V=e=>e?e.includes(`<diagnostics`)||e.includes(`<file_diagnostics>`)||e.includes(`LSP errors detected`)||e.includes(`This file has errors`):!1,H=e=>e?e.replace(/\n{0,2}LSP errors detected[\s\S]*?<diagnostics[^>]*>[\s\S]*?<\/diagnostics>/g,``).replace(/\n{0,2}This file has errors[\s\S]*?<\/file_diagnostics>/g,``).replace(/<diagnostics[^>]*>[\s\S]*?<\/diagnostics>/g,``).replace(/<file_diagnostics>[\s\S]*?<\/file_diagnostics>/g,``).trim():``,U=(e,t)=>!e||typeof e!=`object`?String(e):g(e,t||``),W=e=>{if(typeof e==`string`){let t=e.trim();return t.length>0?t:void 0}if(e&&typeof e==`object`){let t=e.patch;if(typeof t==`string`){let e=t.trim();return e.length>0?e:void 0}}},G=e=>{if(!e||typeof e!=`object`)return;let t=W(e.patch)??W(e.diff);if(t)return t;let n=Array.isArray(e.files)?e.files:[];for(let e of n){if(!e||typeof e!=`object`)continue;let t=W(e.patch)??W(e.diff);if(t)return t}},K=e=>{if(!e||typeof e!=`string`)return{data:null,isJson:!1};let t=e.trim();if(!t.startsWith(`{`)&&!t.startsWith(`[`)||!t.endsWith(`}`)&&!t.endsWith(`]`)||t.length<2)return{data:null,isJson:!1};try{let e=JSON.parse(t);return typeof e==`object`&&e?{data:e,isJson:!0}:{data:null,isJson:!1}}catch{return{data:null,isJson:!1}}},q=(e,t,n)=>{let r=z(e);if((t===`edit`||t===`multiedit`||t===`write`||t===`apply_patch`)&&V(r)&&(r=H(r)),(t===`edit`||t===`multiedit`||t===`apply_patch`)&&r.trim().length===0){let e=G(n);if(e)return e}return r},se=e=>{let t=e.match(/<type>(file|directory)<\/type>/i)?.[1]?.toLowerCase()??`unknown`,n=(e.match(/<content>([\s\S]*?)<\/content>/i)?.[1]??e).replace(/\r\n/g,`
 `).split(`
 `),r=e=>/\(\s*File has more lines\..*offset.*\)/i.test(e.trim());return{type:t,lines:n.map(e=>{let n=e.trim(),i=n.startsWith(`(`)&&n.endsWith(`)`)||r(n);if(t!==`directory`){let t=e.match(/^(\d+):\s?(.*)$/);if(t){let e=t[2],n=e.trim(),i=n.startsWith(`(`)&&n.endsWith(`)`)||r(n);return{lineNumber:i?null:Number(t[1]),text:e,isInfo:i}}}return{lineNumber:null,text:e,isInfo:i}}).filter((e,t,n)=>{if(e.text.trim().length>0)return!0;let r=n[t-1],i=n[t+1],a=!!(r?.isInfo||i?.isInfo),o=e.lineNumber!==null;return!(a&&o)})}},ce=(e,t)=>{try{let n=e.trim().split(`
 `).filter(Boolean);if(n.length===0)return null;let i=[];return n.forEach(e=>{let t=e.match(/^(\s*)(.+)$/);if(t){let[,e,n]=t,r=Math.floor(e.length/2),a=!n.endsWith(`/`);i.push({name:n.replace(/\/$/,``),depth:r,isFile:a})}}),(0,S.jsx)(`div`,{className:o(`w-full min-w-0 font-mono space-y-0.5`,t?.unstyled?null:`p-3 bg-muted/20 rounded-xl border border-border/30`),style:r.tool.popup,children:i.map((e,t)=>(0,S.jsx)(`div`,{className:`min-w-0`,style:{paddingLeft:`${e.depth*20}px`},children:e.isFile?(0,S.jsx)(`span`,{className:`text-foreground/90 block truncate`,children:e.name}):(0,S.jsxs)(`span`,{className:`font-semibold text-foreground block truncate`,children:[e.name,`/`]})},t))})}catch{return null}},le={backgroundColor:`var(--status-info)`,opacity:.6},ue=(e,t,n)=>{try{let i=e.trim().split(`

package/dist/index.html

@@ -552,28 +552,31 @@
         opacity: 0.72;
       }
     </style>
-    <script type="module" crossorigin src="/assets/main-BnRW5v-z.js"></script>
+    <script type="module" crossorigin src="/assets/main-2yJj_50W.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-auth-BpCQ-dPr.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-switch-CMiMO5Yj.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtime-fetch-WgH0pROs.js">
+    <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
+    <link rel="modulepreload" crossorigin href="/assets/queryRuntime-DRiRiAgZ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CdzJ6My_.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-o69pgTEK.js">
     <link rel="modulepreload" crossorigin href="/assets/useUIStore-CEqU9Ujv.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-BP2cRVqX.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
-    <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-BKszKaoQ.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-C0e7Nes2.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-DckkHKsi.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-CAKBi4bp.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-C4ejHJ9p.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-UTCV51RC.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-client-MF2GBrFx.js">
+    <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-react-query-CdqCAt40.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-xol_6BsB.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-QykS5eAQ.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BeYpC7rG.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-file-resource-WtDqIbiH.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-jaHE0AyQ.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-CK8s1iYr.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-file-download-CzOWaZO_.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-KNLHDj7G.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-D0fGrt74.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-Doy5O-1o.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-WZniSuc4.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-DvTg6DjE.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <!-- Keep the startup layer outside #root. React replaces every child of

package/dist/mini-chat.html

@@ -74,28 +74,31 @@
       }
     </style>
 
-    <script type="module" crossorigin src="/assets/miniChat-DGxEvelP.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-QLQvDR18.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-auth-BpCQ-dPr.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-switch-CMiMO5Yj.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtime-fetch-WgH0pROs.js">
+    <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
+    <link rel="modulepreload" crossorigin href="/assets/queryRuntime-DRiRiAgZ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CdzJ6My_.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-o69pgTEK.js">
     <link rel="modulepreload" crossorigin href="/assets/useUIStore-CEqU9Ujv.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-BP2cRVqX.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
-    <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-BKszKaoQ.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-C0e7Nes2.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-DckkHKsi.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-CAKBi4bp.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-C4ejHJ9p.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-UTCV51RC.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-client-MF2GBrFx.js">
+    <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-react-query-CdqCAt40.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-xol_6BsB.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-QykS5eAQ.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BeYpC7rG.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-file-resource-WtDqIbiH.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-jaHE0AyQ.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-CK8s1iYr.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-file-download-CzOWaZO_.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-KNLHDj7G.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-D0fGrt74.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-Doy5O-1o.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-WZniSuc4.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-DvTg6DjE.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full">

package/dist/mobile.html

@@ -63,28 +63,31 @@
       })();
     </script>
 
-    <script type="module" crossorigin src="/assets/mobile-eGR6pZsC.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-D2W9Os9Y.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-auth-BpCQ-dPr.js">
     <link rel="modulepreload" crossorigin href="/assets/runtime-switch-CMiMO5Yj.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtime-fetch-WgH0pROs.js">
+    <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
+    <link rel="modulepreload" crossorigin href="/assets/queryRuntime-DRiRiAgZ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CdzJ6My_.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-o69pgTEK.js">
     <link rel="modulepreload" crossorigin href="/assets/useUIStore-CEqU9Ujv.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-BP2cRVqX.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
-    <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-BKszKaoQ.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-C0e7Nes2.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-DckkHKsi.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-CAKBi4bp.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-C4ejHJ9p.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-UTCV51RC.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-client-MF2GBrFx.js">
+    <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-react-query-CdqCAt40.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-xol_6BsB.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-QykS5eAQ.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-BeYpC7rG.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-file-resource-WtDqIbiH.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-jaHE0AyQ.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-CK8s1iYr.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-file-download-CzOWaZO_.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-KNLHDj7G.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-D0fGrt74.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-Doy5O-1o.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-WZniSuc4.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-DvTg6DjE.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/web",
-  "version": "2.1.10-beta.10",
+  "version": "2.1.10-beta.12",
   "private": false,
   "type": "module",
   "main": "./server/index.js",

package/server/lib/fs/DOCUMENTATION.md

@@ -13,7 +13,7 @@ Own filesystem API behavior for the web server runtime, including file operation
     - `GET /api/fs/home`
     - `POST /api/fs/mkdir`
     - `GET /api/fs/read`
-    - `GET /api/fs/stat` (includes an `isBinary` classification from an 8 KiB file sample)
+    - `GET /api/fs/stat` (includes an `isBinary` classification from an 8 KiB file sample). Opt-in `fingerprint=true` returns content `sha256` for files up to 32 MiB, after the existing read policy and realpath checks. `image-fingerprint.js` owns a bounded 128-path memo keyed by device/inode/size/mtimeNs/ctimeNs; hashing uses serialized 256 KiB reads and rejects mutation during the read. Same-size writes restoring mtime still change ctime. Responses are `no-store`; callers must authorize/stat again before using durable bytes. Hashing is local filesystem work, not a second network body download. VS Code reuses this helper after its own path authorization.
     - `GET /api/fs/raw`
     - `GET /api/fs/serve/:path(*)`
     - `POST /api/fs/write`
@@ -35,6 +35,9 @@ Own filesystem API behavior for the web server runtime, including file operation
 - `index.js` no longer owns FS route handlers or FS exec job state.
 
 ## Notes for contributors
+- Stat includes `mimeType` and `filename`; opt-in SHA-256 is omitted above 32 MiB rather than rejecting otherwise valid files. Empty files can be fingerprinted.
+- `/api/fs/serve` retains its original URL/body/MIME and relative-resource behavior. After existing authorization it emits `Cache-Control: private, no-cache`, `Vary: Authorization, Cookie`, and a weak size/mtime/ctime ETag; `sendFile` streams the body and handles conditional requests. This is browser-private revalidation, not a durable-cache guarantee. Tests cover relative CSS/JS, 304, updates and deletion.
+- `/api/fs/raw` also streams non-video bodies above 32 MiB. Client complete-body persistence is bounded independently; cold Range responses are not published as complete entries.
 - `/api/fs/raw` serves video MIME types (MP4/M4V/MOV/WebM/OGV) using Express's
   streamed `sendFile` after the existing path authorization/realpath checks.
   Explicit Range requests and HEAD use the same path: 206/Content-Range,

package/server/lib/fs/image-fingerprint.d.ts

@@ -0,0 +1,2 @@
+import type * as fs from 'node:fs/promises';
+export function createImageFingerprintReader(filesystem: Pick<typeof fs, 'stat' | 'open'>): (path: string) => Promise<string>;

package/server/lib/fs/image-fingerprint.js

@@ -0,0 +1,43 @@
+import { createHash } from 'node:crypto';
+
+const MAX_BYTES = 32 * 1024 * 1024;
+const versionOf = (stat) => [stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs].join(':');
+
+/** Called only after the owning route has authorized and canonicalized the path. */
+export const createImageFingerprintReader = (fs) => {
+  const entries = new Map();
+  let tail = Promise.resolve();
+  return async (file) => {
+    const before = await fs.stat(file, { bigint: true });
+    if (!before.isFile() || before.size < 0 || before.size > MAX_BYTES) throw new Error('Invalid file fingerprint size');
+    const version = versionOf(before);
+    const previous = entries.get(file);
+    if (previous?.version === version) return previous.promise;
+    const promise = tail.then(async () => {
+      const handle = await fs.open(file, 'r');
+      try {
+        if (versionOf(await handle.stat({ bigint: true })) !== version) throw new Error('Image changed during fingerprint read');
+        const hash = createHash('sha256');
+        const buffer = Buffer.allocUnsafe(256 * 1024);
+        let total = 0;
+        for (;;) {
+          const { bytesRead } = await handle.read(buffer, 0, buffer.length, null);
+          if (!bytesRead) break;
+          total += bytesRead;
+          if (total > MAX_BYTES) throw new Error('Image exceeds fingerprint limit');
+          hash.update(buffer.subarray(0, bytesRead));
+        }
+        const after = await fs.stat(file, { bigint: true });
+        if (versionOf(after) !== version || total !== Number(before.size)) throw new Error('Image changed during fingerprint read');
+        return hash.digest('hex');
+      } finally { await handle.close(); }
+    });
+    tail = promise.then(() => undefined, () => undefined);
+    const entry = { version, promise };
+    entries.delete(file);
+    entries.set(file, entry);
+    while (entries.size > 128) entries.delete(entries.keys().next().value);
+    try { return await promise; }
+    catch (error) { if (entries.get(file) === entry) entries.delete(file); throw error; }
+  };
+};

package/server/lib/fs/image-fingerprint.test.js

@@ -0,0 +1,54 @@
+import { afterEach, expect, test } from 'vitest';
+import * as fs from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import os from 'node:os';
+import express from 'express';
+import { registerFsRoutes } from './routes.js';
+import { createImageFingerprintReader } from './image-fingerprint.js';
+
+const cleanups = [];
+afterEach(async () => { for (const cleanup of cleanups.splice(0).reverse()) await cleanup(); });
+const fixture = async () => {
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-image-fingerprint-'));
+  cleanups.push(() => fs.rm(directory, { recursive: true, force: true }));
+  const file = path.join(directory, 'a.png');
+  await fs.writeFile(file, 'first');
+  return { directory, file };
+};
+
+test('fingerprints are content hashes; unchanged files avoid rehash; same-size preserved-mtime writes invalidate', async () => {
+  const { file, directory } = await fixture();
+  let reads = 0;
+  const reader = createImageFingerprintReader({ ...fs, open: (...args) => { reads++; return fs.open(...args); } });
+  const first = await reader(file);
+  expect(first).toBe(createHash('sha256').update('first').digest('hex'));
+  expect(await reader(file)).toBe(first);
+  expect(reads).toBe(1);
+  const duplicate = path.join(directory, 'copy.png');
+  await fs.copyFile(file, duplicate);
+  expect(await reader(duplicate)).toBe(first);
+  const stat = await fs.stat(file);
+  await fs.writeFile(file, 'other');
+  await fs.utimes(file, stat.atime, stat.mtime);
+  expect(await reader(file)).toBe(createHash('sha256').update('other').digest('hex'));
+});
+
+test('real stat route returns authorized opt-in SHA-256 metadata without image body', async () => {
+  const { file, directory } = await fixture();
+  const app = express();
+  registerFsRoutes({ get: (route, handler) => { if (route === '/api/fs/stat') app.get(route, handler); }, post() {}, put() {} }, {
+    os, path, fsPromises: fs, spawn() {}, crypto: globalThis.crypto,
+    normalizeDirectoryPath: value => value, resolveProjectDirectory: async () => ({ directory }),
+    buildAugmentedPath: () => '', resolveGitBinaryForSpawn: () => 'git', openchamberUserConfigRoot: directory,
+  });
+  const server = app.listen(0, '127.0.0.1');
+  await new Promise(resolve => server.once('listening', resolve));
+  cleanups.push(() => new Promise(resolve => { server.close(resolve); server.closeAllConnections(); }));
+  const url = `http://127.0.0.1:${server.address().port}/api/fs/stat?path=${encodeURIComponent(file)}`;
+  expect((await (await fetch(url)).json()).sha256).toBeUndefined();
+  const response = await fetch(`${url}&fingerprint=true`);
+  expect(response.headers.get('cache-control')).toBe('no-store');
+  expect((await response.json()).sha256).toBe(createHash('sha256').update('first').digest('hex'));
+  expect((await fetch(`${url}-missing&fingerprint=true`)).status).toBe(404);
+});

package/server/lib/fs/raw-video.test.js

@@ -8,6 +8,40 @@ import { registerFsRoutes } from './routes.js';
 const cleanups = [];
 afterEach(async () => { for (const cleanup of cleanups.splice(0).reverse()) await cleanup(); });
 
+test('HTML and relative assets retain URLs and privately revalidate after file authorization', async () => {
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-html-revalidate-'));
+  cleanups.push(() => fs.rm(directory, { recursive: true, force: true }));
+  const html = '<!doctype html><link rel="stylesheet" href="style.css"><script src="app.js"></script><p>original</p>';
+  await fs.writeFile(path.join(directory, 'index.html'), html);
+  await fs.writeFile(path.join(directory, 'style.css'), 'p { color: red }');
+  await fs.writeFile(path.join(directory, 'app.js'), 'window.relativeScriptLoaded = true');
+  const app = express();
+  registerFsRoutes({ get(route, handler) { if (route instanceof RegExp) app.get(route, handler); }, post() {}, put() {} }, {
+    os, path, fsPromises: fs, spawn() {}, crypto: globalThis.crypto,
+    normalizeDirectoryPath: value => value, resolveProjectDirectory: async () => ({ directory }),
+    buildAugmentedPath: () => '', resolveGitBinaryForSpawn: () => 'git', openchamberUserConfigRoot: directory,
+  });
+  const server = app.listen(0, '127.0.0.1');
+  await new Promise(resolve => server.once('listening', resolve));
+  cleanups.push(() => new Promise(resolve => { server.close(resolve); server.closeAllConnections(); }));
+  const url = `http://127.0.0.1:${server.address().port}/api/fs/serve${directory}/index.html`;
+  const first = await fetch(url);
+  expect(first.headers.get('cache-control')).toBe('private, no-cache');
+  expect(first.headers.get('vary')).toContain('Authorization');
+  expect(first.headers.get('vary')).toContain('Cookie');
+  expect(await first.text()).toBe(html);
+  const etag = first.headers.get('etag');
+  const hit = await fetch(url, { headers: { 'If-None-Match': etag, 'Cache-Control': 'max-age=0' } });
+  expect(hit.status).toBe(304);
+  expect(await hit.text()).toBe('');
+  expect(await (await fetch(new URL('style.css', url))).text()).toBe('p { color: red }');
+  expect(await (await fetch(new URL('app.js', url))).text()).toContain('relativeScriptLoaded');
+  await fs.writeFile(path.join(directory, 'index.html'), html.replace('original', 'modified'));
+  expect((await fetch(url, { headers: { 'If-None-Match': etag } })).status).toBe(200);
+  await fs.unlink(path.join(directory, 'index.html'));
+  expect((await fetch(url, { headers: { 'If-None-Match': etag } })).status).toBe(404);
+});
+
 test('raw video supports first-byte probing, tail seeking, HEAD and unsatisfiable ranges', async () => {
   const directory = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-video-range-'));
   cleanups.push(() => fs.rm(directory, { recursive: true, force: true }));

package/server/lib/fs/routes.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { createImageFingerprintReader } from './image-fingerprint.js';
 import { createRealpathCache } from '../path-realpath-cache.js';
 import nodeFsPromises from 'node:fs/promises';
 import nodePath from 'node:path';
@@ -17,6 +18,7 @@ const EXEC_JOB_TTL_MS = 30 * 60 * 1000;
 const OUTSIDE_FILE_GRANT_TTL_MS = 10 * 60 * 1000;
 
 const outsideFileGrants = new Map();
+const readImageFingerprint = createImageFingerprintReader(nodeFsPromises);
 
 const pruneOutsideFileGrants = () => {
   const now = Date.now();
@@ -745,7 +747,11 @@ export const registerFsRoutes = (app, dependencies) => {
       }
 
       const isBinary = await isBinaryFile(canonicalPath, fsPromises);
-      return res.json({ path: canonicalPath, isFile: true, size: stats.size, mtimeMs: stats.mtimeMs, isBinary });
+      const sha256 = req.query.fingerprint === 'true' && stats.size <= 32 * 1024 * 1024 ? await readImageFingerprint(canonicalPath) : undefined;
+      res.setHeader('Cache-Control', 'no-store');
+      return res.json({ path: canonicalPath, isFile: true, size: stats.size, mtimeMs: stats.mtimeMs, isBinary,
+        mimeType: FILE_MIME_MAP[path.extname(canonicalPath).toLowerCase()] || 'application/octet-stream', filename: path.basename(canonicalPath),
+        ...(sha256 ? { sha256 } : {}) });
     } catch (error) {
       const err = error;
       if (err && typeof err === 'object' && err.code === 'ENOENT') {
@@ -895,7 +901,7 @@ export const registerFsRoutes = (app, dependencies) => {
         '.webm': 'video/webm',
         '.ogv': 'video/ogg',
       };
-      const mimeType = mimeMap[ext] || 'application/octet-stream';
+      const mimeType = mimeMap[ext] || FILE_MIME_MAP[ext] || 'application/octet-stream';
 
       const download = req.query.download === 'true';
       if (download) {
@@ -913,7 +919,7 @@ export const registerFsRoutes = (app, dependencies) => {
       if (resolved.granted) {
         res.setHeader('Referrer-Policy', 'no-referrer');
       }
-      if (mimeType.startsWith('video/') || req.headers?.range || req.method === 'HEAD') {
+      if (stats.size > 32 * 1024 * 1024 || mimeType.startsWith('video/') || req.headers?.range || req.method === 'HEAD') {
         // Path authorization above remains authoritative; Express owns range parsing,
         // 206/416, stream backpressure and cancellation when the player seeks away.
         return res.type(mimeType).sendFile(canonicalPath, { acceptRanges: true, dotfiles: 'allow', cacheControl: false });
@@ -977,10 +983,14 @@ export const registerFsRoutes = (app, dependencies) => {
 
       const ext = path.extname(canonicalPath).toLowerCase();
       const mimeType = FILE_MIME_MAP[ext] || 'application/octet-stream';
-      const content = await fsPromises.readFile(canonicalPath);
-      res.setHeader('Cache-Control', 'no-store');
+      // Revalidate after the read policy above, including cookie/bearer changes.
+      // This is browser-private HTTP reuse, not the client's durable file store.
+      res.setHeader('Cache-Control', 'private, no-cache');
+      res.vary('Authorization');
+      res.vary('Cookie');
+      res.setHeader('ETag', `W/"${stats.size}-${stats.mtimeMs}-${stats.ctimeMs}"`);
       res.setHeader('X-Content-Type-Options', 'nosniff');
-      return res.type(mimeType).send(content);
+      return res.type(mimeType).sendFile(canonicalPath, { acceptRanges: true, dotfiles: 'allow', cacheControl: false });
     } catch (error) {
       const err = error;
       if (err && typeof err === 'object' && err.code === 'ENOENT') {

package/server/lib/quota/DOCUMENTATION.md

@@ -70,6 +70,8 @@ Each upstream provider gets a namespaced `magpie:<source>:<provider>` result, in
 `usage.accounts` retains separate account windows, errors and reading timestamps. `usage.windows`
 is the account-keyed projection for existing header/mobile/tray consumers. Compact surfaces display
 `window.label` rather than the account-bearing key; account detail remains on the full Usage page.
+The known ZCode gift-plan sign-in hint is retained only in account details: upstream serializes
+it as a zero-usage window without its internal `Aside` marker, but it is not a quota metric.
 Opening a usage menu checks the full refresh timestamp, not whether any results exist: a discovered
 Magpie snapshot must not suppress the initial built-in provider fetch. Percentages, balance
 labels, unlimited windows and absolute reset timestamps are preserved. Window duration remains unknown

package/server/lib/quota/magpie.js

@@ -49,6 +49,9 @@ export function projectMagpieQuotas(payload, source, now = Date.now()) {
         label: w.name, disablePace: true,
       };
       account.windows[`${i}:${w.name}`] = window;
+      // Magpie serializes this informational window as used: 0 without its
+      // internal Aside flag. Keep it in details, not the compact quota projection.
+      if (q.provider === 'zcode' && w.name === "ZCode gift plans (-Trial models) need ZCode's sign-in") continue;
       const label = `${account.name} · ${w.name}`;
       const key = Object.hasOwn(result.usage.windows, label) ? `${label} (${result.usage.accounts.length + 1}.${i + 1})` : label;
       result.usage.windows[key] = window;

package/server/lib/quota/magpie.test.js

@@ -54,6 +54,20 @@ describe('Magpie discovery and quota adapter', () => {
     expect(Object.values(results[1].usage.windows)[0]).toMatchObject({ valueLabel: '$12.34', usedPercent: null });
   });
 
+  it('keeps the ZCode sign-in hint in account details instead of compact quota metrics', () => {
+    const hint = { name: "ZCode gift plans (-Trial models) need ZCode's sign-in", used: 0,
+      display: 'not read with an API key: add the account with a ZCode sign-in' };
+    const [result] = projectMagpieQuotas({ object: 'list', data: [{
+      provider: 'zcode', name: 'ZCode', kind: 'subscription', windows: [
+        { name: '5 hours', used: 0 },
+        { name: 'MCP · Month', used: 0, display: '0 / 1000', limit: 1000 }, hint,
+      ],
+    }] }, source);
+    expect(Object.values(result.usage.windows).map((window) => window.label)).toEqual(['5 hours', 'MCP · Month']);
+    expect(Object.values(result.usage.accounts[0].windows).at(-1).valueLabel).toBe(hint.display);
+    expect(result.ok).toBe(true);
+  });
+
   it('isolates account errors and distinguishes unlimited, stale and malformed data', () => {
     const data = structuredClone(report);
     data.data[1].error = 'sensitive upstream response';

package/server/lib/relay/relay-server.e2e.test.ts

@@ -25,6 +25,7 @@ import { configureRuntimeUrlResolver, getRuntimeUrlResolver, setRuntimeUrlResolv
 import { setRuntimeBearerToken } from '../../../../ui/src/lib/runtime-auth.ts';
 import { adoptRelayTunnel, deactivateRelayTunnel } from '../../../../ui/src/lib/relay/runtime-tunnel.ts';
 import { acquireRuntimeImage } from '../../../../ui/src/lib/runtime-image-cache.ts';
+import { materializeImageBlob } from '../../../../ui/src/components/chat/imageSave.ts';
 import { NATIVE_RELAY_ASSET_BRIDGE_KEY } from '../../../../ui/src/lib/relay/native-asset-bridge.ts';
 import { readRelayImageDisplayBlob, resetRelayImageStreamForTests } from '../../../../ui/src/lib/relay/relay-image-stream.ts';
 import { registerFsRoutes } from '../fs/routes.js';
@@ -634,6 +635,13 @@ describe('private relay compiled-process boundary', () => {
         expect(response.headers.get('content-type')).toBe('video/mp4');
         expect(await response.text()).toBe(bytes);
       }
+      const downloadProgress: Array<number | null> = [];
+      const savedVideo = await materializeImageBlob({ kind: 'video', sourceUrl: `file://${origin.videoPath}` }, undefined, percent => downloadProgress.push(percent));
+      expect(await savedVideo.blob.text()).toBe('0123456789');
+      expect(downloadProgress[0]).toBe(0);
+      expect(downloadProgress).toContain(99);
+      expect(downloadProgress.at(-1)).toBe(100);
+      expect(downloadProgress).not.toContain(null);
     } finally {
       resetRelayImageStreamForTests();
       Reflect.deleteProperty(globalThis, NATIVE_RELAY_ASSET_BRIDGE_KEY);