@openpalm/ui 0.13.0-beta.7 → 0.13.0-beta.8

package/build/server/chunks/{IconStop-DKVpXPKq.js → IconStop-BxUfqTaV.js}

@@ -1,6 +1,24 @@
 import { p as derived, d as attr, e as attr_class, a9 as stringify } from './dev-D85DamNs.js';
-import { r as randomId } from './voice-state.svelte-CSmyLPRH.js';
+import { g as getConnectionStore, l as loadRuntimeConfig, s as setActiveConnection, i as isLoopbackHost, a as getTransport } from './voice-state.svelte-DU9g_xEh.js';
 
+//#region ../ui-kit/src/lib/components/icons/IconThemeSystem.svelte
+function IconThemeSystem($$renderer, $$props) {
+	let { size = 20, class: className = "" } = $$props;
+	$$renderer.push(`<svg xmlns="http://www.w3.org/2000/svg"${attr("width", size)}${attr("height", size)} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"${attr_class(`lucide lucide-sun-moon-icon lucide-sun-moon s-icon ${stringify(className)}`)}><path d="M12 2v2"></path><path d="M14.837 16.385a6 6 0 1 1-7.223-7.222c.624-.147.97.66.715 1.248a4 4 0 0 0 5.26 5.259c.589-.255 1.396.09 1.248.715"></path><path d="M16 12a4 4 0 0 0-4-4"></path><path d="m19 5-1.256 1.256"></path><path d="M20 12h2"></path></svg>`);
+}
+//#endregion
+//#region ../ui-kit/src/lib/components/icons/IconThemeLight.svelte
+function IconThemeLight($$renderer, $$props) {
+	let { size = 20, class: className = "" } = $$props;
+	$$renderer.push(`<svg aria-hidden="true"${attr("width", size)}${attr("height", size)} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"${attr_class(`s-icon ${stringify(className)}`)}><circle cx="12" cy="12" r="4"></circle><path d="M12 2.5v2.2M12 19.3v2.2M4.6 4.6l1.6 1.6M17.8 17.8l1.6 1.6M2.5 12h2.2M19.3 12h2.2M19.4 4.6l-1.6 1.6M6.2 17.8l-1.6 1.6"></path></svg>`);
+}
+//#endregion
+//#region ../ui-kit/src/lib/components/icons/IconThemeDark.svelte
+function IconThemeDark($$renderer, $$props) {
+	let { size = 20, class: className = "" } = $$props;
+	$$renderer.push(`<svg aria-hidden="true"${attr("width", size)}${attr("height", size)} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"${attr_class(`s-icon ${stringify(className)}`)}><path d="M21 12.8A9 9 0 1 1 11.2 3 7 7 0 0 0 21 12.8z"></path></svg>`);
+}
+//#endregion
 //#region src/lib/chat/tool-strip.ts
 function valueToText$1(value) {
 	if (typeof value === "string") return value;
@@ -340,832 +358,6 @@ function flattenSessionMessages(rows) {
 	return messages;
 }
 //#endregion
-//#region src/lib/connections/url-policy.ts
-/**
-* Browser-owned connection URL policy (Phase 3a — "One UI, delete the split").
-*
-* A leaf module with zero imports so both the direct transport
-* (`probeHealth()` short-circuit) and the connections form can consult it
-* without pulling in the IndexedDB store module. There is no guardian
-* `/oc`-appending helper — Guardian is a transparent OpenCode proxy now, so
-* the user provides the exact baseUrl and no path inference is performed.
-*
-* The ONLY refusal trigger: a plain-http, non-loopback connection URL is
-* refused iff the app itself runs on an https: origin. This is exactly the
-* platform mixed-content rule (an https origin cannot `fetch()` a plain-http
-* cross-origin target — the request would never leave the browser), not a
-* broader "https or non-loopback origin" check. Preserves:
-*   - loopback TARGETS from any origin (mixed-content loopback exemption —
-*     `http://127.0.0.1`/`localhost`/`::1` are "potentially trustworthy"),
-*   - plain-http LAN targets from a loopback-origin client (the zero-TLS
-*     desktop default — a `http://127.0.0.1` origin is a secure context),
-*   - plain-http LAN targets from a non-loopback http ORIGIN (the LAN-served
-*     tier: `rewriteLoopbackUrlForBrowserHost` in `./store.ts`).
-*/
-/** Canonical deep link to the TLS integration guide. Pinned by a test that
-* the path segment names a real file, so a docs rename breaks CI instead of
-* shipping a dead link. */
-var TLS_GUIDE_URL = "https://github.com/itlackey/openpalm/blob/main/docs/remote-access-tls.md";
-function isLoopbackHost(hostname) {
-	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
-}
-/** Remove legacy URL-embedded credentials before a URL reaches UI or storage. */
-function redactUrlUserinfo(rawUrl) {
-	try {
-		const url = new URL(rawUrl);
-		url.username = "";
-		url.password = "";
-		return url.toString().replace(/\/$/, url.pathname === "/" && !rawUrl.endsWith("/") ? "" : "/");
-	} catch {
-		return rawUrl;
-	}
-}
-/**
-* Refuse a plain-http non-loopback connection URL iff the app's own origin is
-* https: (mixed content — the request could never succeed, so refuse up front
-* with guidance instead of a generic fetch failure).
-*
-* `origin` defaults to `globalThis.location`; a null/undefined origin
-* (non-browser context — tests, SSR) always allows, since there is no browser
-* mixed-content policy to enforce there.
-*/
-function validateConnectionUrl(rawUrl, origin = globalThis.location ?? null) {
-	let url;
-	try {
-		url = new URL(rawUrl);
-	} catch {
-		return {
-			ok: false,
-			reason: "invalid-url",
-			message: "Enter a valid URL."
-		};
-	}
-	if (url.protocol !== "http:" && url.protocol !== "https:") return {
-		ok: false,
-		reason: "invalid-url",
-		message: "The URL must use http:// or https://."
-	};
-	if (url.username || url.password) return {
-		ok: false,
-		reason: "userinfo-not-allowed",
-		message: "Do not put credentials in the URL. Use the Authentication fields instead."
-	};
-	if (url.protocol === "https:") return { ok: true };
-	if (isLoopbackHost(url.hostname)) return { ok: true };
-	if (origin?.protocol !== "https:") return { ok: true };
-	return {
-		ok: false,
-		reason: "insecure-remote",
-		message: "This app runs on a secure (https) origin, so browsers block plain-HTTP connections to remote servers. Use an https:// URL — see the TLS setup guide.",
-		guideUrl: TLS_GUIDE_URL
-	};
-}
-//#endregion
-//#region src/lib/connections/store.ts
-/**
-* Browser-owned connection store (Phase 3a — "One UI, delete the split").
-*
-* Connection records persist behind a storage abstraction so the same store
-* logic runs over IndexedDB in the browser (offline-readable) and over an
-* in-memory backend in tests. The store API is async throughout (IndexedDB is
-* async) and keeps NO state in store-instance fields — a page reload
-* constructs a new store over the same backend and must see identical state.
-*
-* Locked/default entries are seeded from a runtime-config.json fetched from
-* the app's own origin at boot. Absent file = no default connection.
-*
-* The Connection shape is `{ id, label, baseUrl, auth }` with auth narrowed to
-* none | basic (Guardian is a transparent OpenCode proxy — Basic is the only
-* connection credential model).
-*/
-function rewriteLoopbackUrlForBrowserHost(rawUrl) {
-	const locationLike = globalThis.location;
-	const redactedUrl = redactUrlUserinfo(rawUrl);
-	if (!locationLike || isLoopbackHost(locationLike.hostname)) return redactedUrl;
-	try {
-		const url = new URL(redactedUrl);
-		if (!isLoopbackHost(url.hostname)) return redactedUrl;
-		url.hostname = locationLike.hostname;
-		return url.toString();
-	} catch {
-		return redactedUrl;
-	}
-}
-function redactEntryUrl(entry) {
-	const baseUrl = redactUrlUserinfo(entry.baseUrl);
-	return baseUrl === entry.baseUrl ? entry : {
-		...entry,
-		baseUrl
-	};
-}
-function assertUrlHasNoUserinfo(rawUrl) {
-	let url;
-	try {
-		url = new URL(rawUrl);
-	} catch {
-		return;
-	}
-	if (url.username || url.password) throw new Error("Credentials must use the Authentication fields, not the connection URL.");
-}
-function adaptRuntimeConfigForBrowser(config) {
-	return { connections: config.connections.map((entry) => ({
-		...redactEntryUrl(entry),
-		baseUrl: entry.locked ? rewriteLoopbackUrlForBrowserHost(entry.baseUrl) : redactUrlUserinfo(entry.baseUrl)
-	})) };
-}
-var ACTIVE_ID_KEY = "activeId";
-function clone(value) {
-	return structuredClone(value);
-}
-/** In-memory storage backend — same semantics as the IndexedDB one. */
-function createMemoryStorage() {
-	const entries = /* @__PURE__ */ new Map();
-	const meta = /* @__PURE__ */ new Map();
-	let cryptoKey = null;
-	return {
-		async getAll() {
-			return [...entries.values()].map(clone);
-		},
-		async get(id) {
-			const entry = entries.get(id);
-			return entry ? clone(entry) : null;
-		},
-		async put(entry) {
-			entries.set(entry.id, clone(redactEntryUrl(entry)));
-		},
-		async delete(id) {
-			entries.delete(id);
-		},
-		async getMeta(key) {
-			return meta.get(key) ?? null;
-		},
-		async setMeta(key, value) {
-			if (value === null) meta.delete(key);
-			else meta.set(key, value);
-		},
-		async getCryptoKey() {
-			return cryptoKey;
-		},
-		async setCryptoKey(key) {
-			cryptoKey = key;
-		}
-	};
-}
-var IDB_NAME = "openpalm-ui-connections";
-var IDB_VERSION = 1;
-var STORE_CONNECTIONS = "connections";
-var STORE_META = "meta";
-var STORE_KEYS = "keys";
-var CRYPTO_KEY_ID = "secret-store-aes-gcm-key";
-function idbRequest(request) {
-	return new Promise((resolve, reject) => {
-		request.onsuccess = () => resolve(request.result);
-		request.onerror = () => reject(request.error ?? /* @__PURE__ */ new Error("IndexedDB request failed"));
-	});
-}
-/**
-* F11 hardening: an IDB version bump with no `onblocked` handler and no
-* `versionchange` listener can leave a boot hung forever with no error
-* surfaced anywhere. `onblocked` rejects the open promise; `onVersionChange`
-* is invoked once a successfully-opened connection later receives its OWN
-* `versionchange` event (some other tab needs an upgrade): the connection
-* closes itself immediately so it can't go on to block that upgrade in turn,
-* and the caller uses the callback to drop its cached db promise so the NEXT
-* storage operation reopens fresh.
-*/
-function openDatabase(onVersionChange) {
-	return new Promise((resolve, reject) => {
-		const request = indexedDB.open(IDB_NAME, IDB_VERSION);
-		request.onupgradeneeded = () => {
-			const db = request.result;
-			if (!db.objectStoreNames.contains(STORE_CONNECTIONS)) db.createObjectStore(STORE_CONNECTIONS, { keyPath: "id" });
-			if (!db.objectStoreNames.contains(STORE_META)) db.createObjectStore(STORE_META);
-			if (!db.objectStoreNames.contains(STORE_KEYS)) db.createObjectStore(STORE_KEYS);
-		};
-		request.onsuccess = () => {
-			const db = request.result;
-			db.onversionchange = () => {
-				db.close();
-				onVersionChange();
-			};
-			resolve(db);
-		};
-		request.onerror = () => reject(request.error ?? /* @__PURE__ */ new Error("IndexedDB open failed"));
-		request.onblocked = () => reject(/* @__PURE__ */ new Error("IndexedDB upgrade blocked by another open connection (close other tabs of this app and retry)"));
-	});
-}
-/**
-* IndexedDB storage backend (raw IDB API, no deps). Lazily opens the database
-* on first use; each operation runs in its own short transaction.
-*/
-function createIndexedDbStorage() {
-	let db = null;
-	const invalidate = () => {
-		db = null;
-	};
-	const database = () => {
-		db ??= openDatabase(invalidate);
-		return db;
-	};
-	const store = async (name, mode) => (await database()).transaction(name, mode).objectStore(name);
-	return {
-		async getAll() {
-			return idbRequest((await store(STORE_CONNECTIONS, "readonly")).getAll());
-		},
-		async get(id) {
-			return await idbRequest((await store(STORE_CONNECTIONS, "readonly")).get(id)) ?? null;
-		},
-		async put(entry) {
-			await idbRequest((await store(STORE_CONNECTIONS, "readwrite")).put(redactEntryUrl(entry)));
-		},
-		async delete(id) {
-			await idbRequest((await store(STORE_CONNECTIONS, "readwrite")).delete(id));
-		},
-		async getMeta(key) {
-			return await idbRequest((await store(STORE_META, "readonly")).get(key)) ?? null;
-		},
-		async setMeta(key, value) {
-			const metaStore = await store(STORE_META, "readwrite");
-			if (value === null) await idbRequest(metaStore.delete(key));
-			else await idbRequest(metaStore.put(value, key));
-		},
-		async getCryptoKey() {
-			return await idbRequest((await store(STORE_KEYS, "readonly")).get(CRYPTO_KEY_ID)) ?? null;
-		},
-		async setCryptoKey(key) {
-			await idbRequest((await store(STORE_KEYS, "readwrite")).put(key, CRYPTO_KEY_ID));
-		}
-	};
-}
-function createConnectionStore(options) {
-	const { storage } = options;
-	async function readEntry(id) {
-		const stored = await storage.get(id);
-		if (!stored) return null;
-		const entry = redactEntryUrl(stored);
-		if (entry.baseUrl !== stored.baseUrl) await storage.put(entry);
-		return entry;
-	}
-	async function requireEntry(id) {
-		const entry = await readEntry(id);
-		if (!entry) throw new Error(`Unknown connection: ${id}`);
-		return entry;
-	}
-	return {
-		async list() {
-			const stored = await storage.getAll();
-			const entries = stored.map(redactEntryUrl);
-			await Promise.all(entries.map((entry, index) => entry.baseUrl === stored[index]?.baseUrl ? Promise.resolve() : storage.put(entry)));
-			return entries;
-		},
-		get(id) {
-			return readEntry(id);
-		},
-		async add(input) {
-			assertUrlHasNoUserinfo(input.baseUrl);
-			const id = input.id ?? randomId();
-			if (await readEntry(id)) throw new Error(`Connection already exists: ${id}`);
-			const entry = {
-				...input,
-				id
-			};
-			await storage.put(entry);
-			return clone(entry);
-		},
-		async update(id, patch) {
-			if (patch.baseUrl !== void 0) assertUrlHasNoUserinfo(patch.baseUrl);
-			const entry = await requireEntry(id);
-			if (entry.locked) throw new Error(`Connection is locked (config-owned): ${id}`);
-			const updated = {
-				...entry,
-				...patch,
-				id
-			};
-			await storage.put(updated);
-			return clone(updated);
-		},
-		async remove(id) {
-			if ((await requireEntry(id)).locked) throw new Error(`Connection is locked (config-owned): ${id}`);
-			await storage.delete(id);
-			if (await storage.getMeta(ACTIVE_ID_KEY) === id) await storage.setMeta(ACTIVE_ID_KEY, null);
-		},
-		async setSecretRef(id, auth) {
-			const updated = {
-				...await requireEntry(id),
-				auth,
-				id
-			};
-			await storage.put(updated);
-			return clone(updated);
-		},
-		getActiveId() {
-			return storage.getMeta(ACTIVE_ID_KEY);
-		},
-		async getActive() {
-			const id = await storage.getMeta(ACTIVE_ID_KEY);
-			return id === null ? null : readEntry(id);
-		},
-		async setActive(id) {
-			await requireEntry(id);
-			await storage.setMeta(ACTIVE_ID_KEY, id);
-		},
-		async clearActive() {
-			await storage.setMeta(ACTIVE_ID_KEY, null);
-		},
-		async seedFromRuntimeConfig(config) {
-			if (!config) return;
-			const activeId = await storage.getMeta(ACTIVE_ID_KEY);
-			const configIds = new Set(config.connections.map((entry) => entry.id));
-			for (const existing of await storage.getAll()) {
-				if (!existing.locked || configIds.has(existing.id)) continue;
-				await storage.delete(existing.id);
-				if (activeId === existing.id) await storage.setMeta(ACTIVE_ID_KEY, null);
-			}
-			for (const entry of config.connections) {
-				const seededEntry = redactEntryUrl(entry);
-				const existing = await readEntry(entry.id);
-				if (!existing) await storage.put(clone(seededEntry));
-				else if (existing.locked) {
-					const seeded = clone(seededEntry);
-					const preserveAuth = existing.auth && existing.auth.mode !== "none";
-					await storage.put(preserveAuth ? {
-						...seeded,
-						auth: existing.auth
-					} : seeded);
-				}
-			}
-			if (await storage.getMeta(ACTIVE_ID_KEY) !== null) return;
-			const fallback = config.connections.find((entry) => entry.isDefault);
-			if (fallback && await storage.get(fallback.id)) await storage.setMeta(ACTIVE_ID_KEY, fallback.id);
-		}
-	};
-}
-/**
-* Fetch '/runtime-config.json' from the app's OWN origin (relative URL — the
-* static server ships the file beside the build; the app holds no other
-* trusted origin at boot). Absent (404), unreachable (offline), or malformed
-* -> null; never throws, so an offline PWA boot still reaches the stored
-* connection list.
-*/
-async function loadRuntimeConfig(fetchImpl = globalThis.fetch) {
-	try {
-		const response = await fetchImpl("/runtime-config.json", {
-			method: "GET",
-			headers: { accept: "application/json" },
-			credentials: "omit"
-		});
-		if (!response.ok) return null;
-		const parsed = await response.json();
-		if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.connections)) return null;
-		return adaptRuntimeConfigForBrowser(parsed);
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/lib/connections/secrets.ts
-var META_PREFIX = "secret:";
-var ENCRYPTED_MARKER = 2;
-var AES_GCM_LENGTH = 256;
-var IV_BYTES = 12;
-/**
-* WebCrypto's `SubtleCrypto` is secure-context-only: on a plain-http LAN origin
-* (the LAN-served tier) `crypto.subtle` is undefined, so encryption is simply
-* not available there. Callers degrade to the legacy plaintext record shape —
-* which `readMaterial` already reads — rather than throwing and blocking the
-* user from saving a credential at all.
-*/
-function subtleAvailable() {
-	return typeof crypto !== "undefined" && !!crypto.subtle;
-}
-function isEncryptedRecord(value) {
-	return !!value && typeof value === "object" && value.v === ENCRYPTED_MARKER && typeof value.iv === "string" && typeof value.ciphertext === "string";
-}
-function bytesToBase64(bytes) {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary);
-}
-function base64ToBytes(b64) {
-	const binary = atob(b64);
-	const bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return bytes;
-}
-var pendingKeys = /* @__PURE__ */ new WeakMap();
-/** Generate-once, reuse-forever non-extractable AES-GCM key for this storage backend. */
-async function getOrCreateKey(storage) {
-	const existing = await storage.getCryptoKey();
-	if (existing) return existing;
-	let pending = pendingKeys.get(storage);
-	if (!pending) {
-		pending = (async () => {
-			const key = await crypto.subtle.generateKey({
-				name: "AES-GCM",
-				length: AES_GCM_LENGTH
-			}, false, ["encrypt", "decrypt"]);
-			await storage.setCryptoKey(key);
-			return key;
-		})();
-		pendingKeys.set(storage, pending);
-		pending.catch(() => {
-			pendingKeys.delete(storage);
-		});
-	}
-	return pending;
-}
-async function encryptMaterial(key, material) {
-	const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
-	const plaintext = new TextEncoder().encode(JSON.stringify(material));
-	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv
-	}, key, plaintext));
-	return {
-		v: ENCRYPTED_MARKER,
-		iv: bytesToBase64(iv),
-		ciphertext: bytesToBase64(ciphertext)
-	};
-}
-async function decryptRecord(key, record) {
-	const iv = base64ToBytes(record.iv);
-	const ciphertext = base64ToBytes(record.ciphertext);
-	const plaintext = await crypto.subtle.decrypt({
-		name: "AES-GCM",
-		iv
-	}, key, ciphertext);
-	return JSON.parse(new TextDecoder().decode(plaintext));
-}
-async function writeMaterial(storage, ref, material) {
-	if (!subtleAvailable()) {
-		await storage.setMeta(META_PREFIX + ref, JSON.stringify(material));
-		return;
-	}
-	const record = await encryptMaterial(await getOrCreateKey(storage), material);
-	await storage.setMeta(META_PREFIX + ref, JSON.stringify(record));
-}
-/**
-* Read+decrypt a stored secret. Transparently migrates a legacy plaintext
-* record by re-encrypting it in place before returning. Returns null for a
-* missing ref or anything that can't be parsed/decrypted — the caller degrades
-* gracefully rather than throwing.
-*/
-async function readMaterial(storage, ref) {
-	const raw = await storage.getMeta(META_PREFIX + ref);
-	if (raw === null) return null;
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch {
-		return null;
-	}
-	if (isEncryptedRecord(parsed)) try {
-		return await decryptRecord(await getOrCreateKey(storage), parsed);
-	} catch {
-		return null;
-	}
-	const material = parsed;
-	if (subtleAvailable()) try {
-		await writeMaterial(storage, ref, material);
-	} catch {}
-	return material;
-}
-function createSecretStore(storage) {
-	return {
-		async set(ref, material) {
-			await writeMaterial(storage, ref, material);
-		},
-		async delete(ref) {
-			await storage.setMeta(META_PREFIX + ref, null);
-		},
-		async resolveAuth(entry) {
-			if (entry.auth.mode !== "basic" || !entry.auth.secretRef) return { mode: "none" };
-			const material = await readMaterial(storage, entry.auth.secretRef);
-			if (!material || typeof material.password !== "string") return { mode: "none" };
-			const username = entry.auth.username || material.username;
-			return username ? {
-				mode: "basic",
-				username,
-				password: material.password
-			} : {
-				mode: "basic",
-				password: material.password
-			};
-		},
-		async updateUsername(ref, username) {
-			const material = await readMaterial(storage, ref);
-			if (!material) return;
-			const updated = { ...material };
-			if (username === void 0) delete updated.username;
-			else updated.username = username;
-			await writeMaterial(storage, ref, updated);
-		}
-	};
-}
-//#endregion
-//#region src/lib/chat/session-events.ts
-/**
-* SSE consumer for OpenCode's `/event` stream.
-*
-* Phase 3b ("One UI, delete the split"): the underlying stream is now opened by
-* the browser-owned direct transport (`$lib/connections/boot.getTransport()`
-* → `subscribeEvents(onFrame, signal)`), which talks to the active connection's
-* OpenCode/Guardian base URL directly (no host proxy, no admin cookie) and
-* REUSES this module's `parseFrame`. Reconnect/backoff, session-scoped dispatch,
-* and abort semantics stay here — the chat layer's concern, not the transport's.
-*
-* Phase D of docs/technical/multi-endpoint-session-ux.md.
-*/
-var INITIAL_BACKOFF_MS = 1e3;
-var MAX_BACKOFF_MS = 3e4;
-/**
-* Parse one `\n\n`-delimited SSE frame. Multi-line `data:` fields are
-* concatenated with `\n` per the SSE spec. Reused by the direct transport.
-*/
-function parseFrame(chunk) {
-	const frame = {};
-	const dataLines = [];
-	for (const rawLine of chunk.split("\n")) {
-		if (!rawLine || rawLine.startsWith(":")) continue;
-		if (rawLine.startsWith("data:")) dataLines.push(rawLine.replace(/^data:\s?/, ""));
-		else if (rawLine.startsWith("event:")) frame.event = rawLine.replace(/^event:\s?/, "");
-		else if (rawLine.startsWith("id:")) frame.id = rawLine.replace(/^id:\s?/, "");
-	}
-	if (dataLines.length > 0) frame.data = dataLines.join("\n");
-	return frame;
-}
-function dispatch(handlers, payload) {
-	const info = payload.properties?.info;
-	const id = info?.id ?? payload.sessionID;
-	if (!id) return;
-	switch (payload.type) {
-		case "session.created":
-			handlers.onCreated(id);
-			return;
-		case "session.updated":
-			handlers.onUpdated(id, {
-				title: info?.title,
-				updatedAt: info?.time?.updated
-			});
-			return;
-		case "session.deleted":
-			handlers.onDeleted(id);
-			return;
-		default: return;
-	}
-}
-/**
-* Open the active connection's `/event` SSE stream (via the direct transport)
-* and dispatch session-scoped events. Returns an unsubscribe function that
-* aborts the stream and prevents reconnection.
-*
-* `onConnect` fires on the first frame of each (re)connected stream — the point
-* at which live updates are demonstrably flowing. The transport owns the fetch;
-* this loop owns exponential-backoff reconnect and abort.
-*/
-function subscribeSessionEvents(handlers) {
-	let stopped = false;
-	let controller = new AbortController();
-	const sleep = (ms) => new Promise((resolve) => {
-		const timer = setTimeout(resolve, ms);
-		controller.signal.addEventListener("abort", () => {
-			clearTimeout(timer);
-			resolve();
-		}, { once: true });
-	});
-	async function readStream() {
-		let connected = false;
-		await getTransport().subscribeEvents((event) => {
-			if (!connected) {
-				connected = true;
-				handlers.onConnect?.();
-			}
-			const payload = event;
-			handlers.onEvent?.(payload);
-			dispatch(handlers, payload);
-		}, controller.signal);
-	}
-	(async () => {
-		let attempt = 0;
-		while (!stopped) try {
-			attempt++;
-			await readStream();
-			attempt = 0;
-			if (!stopped) await sleep(500);
-		} catch (err) {
-			if (stopped) return;
-			const error = err instanceof Error ? err : new Error(String(err));
-			if (error.name !== "AbortError") {
-				console.warn("[session-events] SSE error, reconnecting", error);
-				handlers.onDisconnect?.(error);
-			}
-			await sleep(Math.min(INITIAL_BACKOFF_MS * 2 ** Math.max(0, attempt - 1), MAX_BACKOFF_MS));
-			if (controller.signal.aborted && !stopped) controller = new AbortController();
-		}
-	})();
-	return () => {
-		stopped = true;
-		try {
-			controller.abort();
-		} catch {}
-	};
-}
-//#endregion
-//#region src/lib/transport/direct.ts
-/**
-* Minimal browser-owned direct transport (Phase 3a — "One UI, delete the
-* split").
-*
-* Talks to a connection's OpenCode/Guardian base URL directly from the
-* browser — no proxy, NO COOKIES (`credentials: 'omit'`). This is deliberately
-* small: it exposes only the calls the ui chat layer needs and REUSES ui's
-* existing SSE frame parser (`$lib/chat/session-events.ts` `parseFrame`) and
-* event envelope type (`$lib/chat/oc-events.ts` `RawEvent`) rather than
-* re-implementing them. Reconnect/backoff and session-scoped filtering are the
-* chat layer's concern, not this transport's.
-*/
-var PROBE_TIMEOUT_MS = 5e3;
-/**
-* UTF-8-encode before base64ing: `btoa()` alone only accepts Latin-1 code
-* points and throws a synchronous `InvalidCharacterError` for any password
-* containing e.g. Cyrillic/CJK/emoji characters, before any network I/O.
-*/
-function base64Utf8(value) {
-	const bytes = new TextEncoder().encode(value);
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary);
-}
-/**
-* Build the `Authorization` header value for a resolved auth, or null for
-* `{ mode: 'none' }`. Basic username defaults to `'opencode'` (OpenCode's own
-* server default and what the host app sends).
-*/
-function authorizationHeader(auth) {
-	if (auth.mode === "basic") return `Basic ${base64Utf8(`${auth.username ?? "opencode"}:${auth.password}`)}`;
-	return null;
-}
-function createDirectTransport(getConnection, resolveAuth, fetchImpl = globalThis.fetch) {
-	function requireConnection() {
-		const connection = getConnection();
-		if (!connection) throw new Error("No active connection");
-		return connection;
-	}
-	/** Trailing-slash and path-prefix safe: reverse-proxied instances keep their prefix. */
-	function baseFor(connection) {
-		return connection.baseUrl.replace(/\/+$/, "");
-	}
-	async function authHeaders(connection) {
-		const { authorization } = await resolveAuth(connection);
-		return authorization ? { authorization } : {};
-	}
-	return {
-		async request(method, path, body) {
-			const connection = requireConnection();
-			const init = {
-				method,
-				headers: {
-					...body === void 0 ? {} : { "content-type": "application/json" },
-					...await authHeaders(connection)
-				},
-				credentials: "omit"
-			};
-			if (body !== void 0) init.body = JSON.stringify(body);
-			const response = await fetchImpl(`${baseFor(connection)}${path}`, init);
-			if (!response.ok) throw Object.assign(/* @__PURE__ */ new Error(`HTTP ${response.status}`), { status: response.status });
-			return response;
-		},
-		async subscribeEvents(onFrame, signal) {
-			const connection = requireConnection();
-			const response = await fetchImpl(`${baseFor(connection)}/event`, {
-				method: "GET",
-				headers: {
-					accept: "text/event-stream",
-					...await authHeaders(connection)
-				},
-				credentials: "omit",
-				signal
-			});
-			if (!response.ok || !response.body) throw Object.assign(/* @__PURE__ */ new Error(`SSE stream failed: HTTP ${response.status}`), { status: response.status });
-			const reader = response.body.getReader();
-			const decoder = new TextDecoder();
-			let buffer = "";
-			try {
-				while (true) {
-					const { done, value } = await reader.read();
-					if (done) break;
-					buffer += decoder.decode(value, { stream: true });
-					const chunks = buffer.split("\n\n");
-					buffer = chunks.pop() ?? "";
-					for (const chunk of chunks) {
-						if (!chunk) continue;
-						const frame = parseFrame(chunk);
-						if (!frame.data) continue;
-						let event;
-						try {
-							event = JSON.parse(frame.data);
-						} catch {
-							continue;
-						}
-						onFrame(event);
-					}
-				}
-			} finally {
-				try {
-					reader.releaseLock();
-				} catch {}
-			}
-		},
-		async probeHealth() {
-			const connection = getConnection();
-			if (!connection) return { status: "unreachable" };
-			const base = baseFor(connection);
-			const verdict = validateConnectionUrl(base);
-			if (!verdict.ok && verdict.reason === "insecure-remote") return { status: "insecure" };
-			try {
-				const response = await fetchImpl(`${base}/`, {
-					method: "GET",
-					headers: await authHeaders(connection),
-					credentials: "omit",
-					cache: "no-store",
-					signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
-				});
-				if (response.status === 401 || response.status === 403) return { status: "unauthorized" };
-				if (response.ok || response.status >= 300 && response.status < 400) return { status: "accessible" };
-				return { status: "unreachable" };
-			} catch {
-				return { status: "unreachable" };
-			}
-		}
-	};
-}
-//#endregion
-//#region src/lib/connections/boot.ts
-/**
-* Browser connection boot (Phase 3b — "One UI, delete the split").
-*
-* One storage backend + one ConnectionStore + one SecretStore + one direct
-* transport per browsing session, created lazily on first access. The chat
-* layer (`$lib/api/chat.ts`, `$lib/chat/session-events.ts`) and the connection
-* switcher (`$lib/endpoints-state.svelte.ts`) all share these singletons so the
-* browser owns connections and talks to OpenCode/Guardian DIRECTLY — no host
-* proxy, no admin cookie.
-*
-* The transport reads the active connection SYNCHRONOUSLY from a snapshot the
-* connection store owner (`endpoints-state`) keeps in sync via
-* `setActiveConnection()`. The store's own `getActive()` is async (IndexedDB),
-* so it can't back the transport's synchronous `getConnection` directly.
-*
-* IndexedDB is the persistent backend; private-browsing modes that refuse it
-* degrade to an in-memory backend (session-only) rather than a blank page —
-* mirroring the client's `pickStorage`.
-*/
-var store = null;
-var secrets = null;
-var transport = null;
-/** Synchronous snapshot of the active connection for the transport. */
-var activeConnection = null;
-/**
-* Some private-browsing modes refuse IndexedDB entirely; degrade to a
-* session-only in-memory backend rather than a blank page (mirrors the
-* client's pickStorage).
-*/
-function pickStorage() {
-	try {
-		if (typeof indexedDB !== "undefined") return createIndexedDbStorage();
-	} catch {}
-	return createMemoryStorage();
-}
-function ensure() {
-	if (store && secrets && transport) return;
-	const storage = pickStorage();
-	const connectionStore = createConnectionStore({ storage });
-	const secretStore = createSecretStore(storage);
-	const directTransport = createDirectTransport(() => activeConnection, async (connection) => {
-		return { authorization: authorizationHeader(await secretStore.resolveAuth(connection)) ?? void 0 };
-	});
-	store = connectionStore;
-	secrets = secretStore;
-	transport = directTransport;
-}
-function getConnectionStore() {
-	ensure();
-	return store;
-}
-function getTransport() {
-	ensure();
-	return transport;
-}
-/**
-* Point the direct transport at `connection` (or clear it). Called by the
-* connection-store owner (`endpoints-state`) on load/activate — a plain
-* function, no `$effect`, so the transport's synchronous `getConnection`
-* always sees the current active connection.
-*/
-function setActiveConnection(connection) {
-	activeConnection = connection;
-}
-//#endregion
 //#region src/lib/api/chat.ts
 /** Create a new session on the active connection's OpenCode instance. */
 async function createSession() {
@@ -1231,24 +423,6 @@ async function rejectChatQuestion(requestId) {
 	await (await getTransport().request("POST", `/question/${encodeURIComponent(requestId)}/reject`, {})).text().catch(() => "");
 }
 //#endregion
-//#region ../ui-kit/src/lib/components/icons/IconThemeSystem.svelte
-function IconThemeSystem($$renderer, $$props) {
-	let { size = 20, class: className = "" } = $$props;
-	$$renderer.push(`<svg xmlns="http://www.w3.org/2000/svg"${attr("width", size)}${attr("height", size)} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"${attr_class(`lucide lucide-sun-moon-icon lucide-sun-moon s-icon ${stringify(className)}`)}><path d="M12 2v2"></path><path d="M14.837 16.385a6 6 0 1 1-7.223-7.222c.624-.147.97.66.715 1.248a4 4 0 0 0 5.26 5.259c.589-.255 1.396.09 1.248.715"></path><path d="M16 12a4 4 0 0 0-4-4"></path><path d="m19 5-1.256 1.256"></path><path d="M20 12h2"></path></svg>`);
-}
-//#endregion
-//#region ../ui-kit/src/lib/components/icons/IconThemeLight.svelte
-function IconThemeLight($$renderer, $$props) {
-	let { size = 20, class: className = "" } = $$props;
-	$$renderer.push(`<svg aria-hidden="true"${attr("width", size)}${attr("height", size)} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"${attr_class(`s-icon ${stringify(className)}`)}><circle cx="12" cy="12" r="4"></circle><path d="M12 2.5v2.2M12 19.3v2.2M4.6 4.6l1.6 1.6M17.8 17.8l1.6 1.6M2.5 12h2.2M19.3 12h2.2M19.4 4.6l-1.6 1.6M6.2 17.8l-1.6 1.6"></path></svg>`);
-}
-//#endregion
-//#region ../ui-kit/src/lib/components/icons/IconThemeDark.svelte
-function IconThemeDark($$renderer, $$props) {
-	let { size = 20, class: className = "" } = $$props;
-	$$renderer.push(`<svg aria-hidden="true"${attr("width", size)}${attr("height", size)} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"${attr_class(`s-icon ${stringify(className)}`)}><path d="M21 12.8A9 9 0 1 1 11.2 3 7 7 0 0 0 21 12.8z"></path></svg>`);
-}
-//#endregion
 //#region src/lib/chat/oc-events.ts
 function propStr(props, key) {
 	const value = props?.[key];
@@ -1465,6 +639,76 @@ async function emitConnectionActivated(connectionId) {
 	for (const listener of listeners) await listener(connectionId);
 }
 //#endregion
+//#region src/lib/connections/discovery.ts
+/** Probed in order; the first reachable candidate is added. Ports are the
+* stack defaults (`STACK_DEFAULTS.ports.assistant`, guardian direct port). */
+var LOCAL_DISCOVERY_CANDIDATES = [{
+	baseUrl: "http://127.0.0.1:3800",
+	label: "Local assistant"
+}, {
+	baseUrl: "http://127.0.0.1:3830/oc",
+	label: "Local assistant (guardian)"
+}];
+var DISMISSED_STORAGE_KEY = "openpalm.connections.local-discovery-dismissed";
+var PROBE_TIMEOUT_MS = 1500;
+function safeLocalStorage() {
+	try {
+		return globalThis.localStorage ?? null;
+	} catch {
+		return null;
+	}
+}
+function isLocalDiscoveryDismissed() {
+	return safeLocalStorage()?.getItem(DISMISSED_STORAGE_KEY) === "1";
+}
+async function probe(baseUrl, fetchImpl) {
+	try {
+		const response = await fetchImpl(`${baseUrl}/`, {
+			method: "GET",
+			credentials: "omit",
+			cache: "no-store",
+			signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
+		});
+		if (response.status === 401 || response.status === 403) return true;
+		return response.ok || response.status >= 300 && response.status < 400;
+	} catch {
+		return false;
+	}
+}
+/**
+* Probe the well-known local endpoints and add the first reachable one to
+* `store` as an unlocked connection — unless the list already contains a
+* local (loopback) connection, or the user previously removed a discovered
+* entry. Returns the added connection, or null when nothing was added.
+* Never throws: discovery is strictly best-effort.
+*/
+async function discoverLocalAssistant(store, fetchImpl = globalThis.fetch) {
+	try {
+		if (typeof fetchImpl !== "function") return null;
+		if (isLocalDiscoveryDismissed()) return null;
+		const hasLocal = async () => (await store.list()).some((c) => {
+			try {
+				return isLoopbackHost(new URL(c.baseUrl).hostname);
+			} catch {
+				return false;
+			}
+		});
+		if (await hasLocal()) return null;
+		for (const candidate of LOCAL_DISCOVERY_CANDIDATES) {
+			if (!await probe(candidate.baseUrl, fetchImpl)) continue;
+			if (await hasLocal()) return null;
+			return await store.add({
+				label: candidate.label,
+				baseUrl: candidate.baseUrl,
+				auth: { mode: "none" }
+			});
+		}
+		return null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/lib/endpoints-state.svelte.ts
 function toView(c) {
 	return {
@@ -1505,6 +749,10 @@ var ConnectionsService = class {
 			this.activeId = storedActiveId ?? this.endpoints[0]?.id ?? "";
 			setActiveConnection(connections.find((c) => c.id === this.activeId) ?? null);
 			this.loaded = true;
+			if (!this.discoveryStarted) {
+				this.discoveryStarted = true;
+				this.discoverLocal();
+			}
 		} catch (e) {
 			const err = e;
 			this.error = err.message ?? "Failed to load connections";
@@ -1512,6 +760,25 @@ var ConnectionsService = class {
 			this.loading = false;
 		}
 	}
+	/** Localhost auto-discovery runs at most once per browsing session. */
+	discoveryStarted = false;
+	/**
+	* Probe the well-known local assistant endpoints and, when one is
+	* reachable and not yet listed, add it and refresh the view. Best-effort:
+	* failures are swallowed (discovery must never break boot).
+	*/
+	async discoverLocal() {
+		try {
+			const store = getConnectionStore();
+			const added = await discoverLocalAssistant(store);
+			if (!added) return;
+			const [connections, storedActiveId] = await Promise.all([store.list(), store.getActiveId()]);
+			this.endpoints = connections.map(toView);
+			this.activeId = storedActiveId ?? this.endpoints[0]?.id ?? "";
+			setActiveConnection(connections.find((c) => c.id === this.activeId) ?? null);
+			if (this.activeId === added.id && !activationBlockReason()) await emitConnectionActivated(added.id);
+		} catch {}
+	}
 	/** Monotonic activation counter: a failed activation may only roll state
 	*  back if no NEWER activation has started since (otherwise a slow failure
 	*  would clobber the selection a later, successful switch just persisted). */
@@ -1644,5 +911,5 @@ function IconStop($$renderer, $$props) {
 	$$renderer.push(`<svg aria-hidden="true"${attr("width", size)}${attr("height", size)} viewBox="0 0 24 24"${attr_class(`s-icon ${stringify(className)}`)}><rect fill="currentColor" stroke="none" x="7" y="7" width="10" height="10" rx="1.4"></rect></svg>`);
 }
 
-export { notifyAssistantError as A, notifyAssistantReply as B, onConnectionActivated as C, partSnapshotType as D, registerActivationGuard as E, rejectChatQuestion as F, relativeTimeLabel as G, replyChatPermission as H, IconClose as I, replyChatQuestion as J, sendChatMessage as K, startChatMessageTurn as L, subscribeSessionEvents as M, timelineTitle as N, toolAriaLabel as O, toolDetailRows as P, toolIconType as Q, toolStatusLabel as R, SvelteMap as S, IconStop as a, IconThemeDark as b, IconThemeLight as c, IconThemeSystem as d, SvelteSet as e, abortChatTurn as f, createSession as g, displayTitle as h, endpointsService as i, extractPermissionAsk as j, extractQuestionAsk as k, extractStepUpdate as l, extractTextDelta as m, extractToolUpdate as n, formatBytes as o, formatDate as p, formatDateTime as q, formatRelativeTime as r, formatTime as s, getSessionMessages as t, getTransport as u, isLoopbackHost as v, isSessionError as w, isTurnEnd as x, isUserFacingTool as y, listSessions as z };
-//# sourceMappingURL=IconStop-DKVpXPKq.js.map
+export { onConnectionActivated as A, partSnapshotType as B, registerActivationGuard as C, rejectChatQuestion as D, relativeTimeLabel as E, replyChatPermission as F, replyChatQuestion as G, sendChatMessage as H, IconClose as I, startChatMessageTurn as J, timelineTitle as K, toolAriaLabel as L, toolDetailRows as M, toolIconType as N, toolStatusLabel as O, SvelteMap as S, IconStop as a, IconThemeDark as b, IconThemeLight as c, IconThemeSystem as d, SvelteSet as e, abortChatTurn as f, createSession as g, displayTitle as h, endpointsService as i, extractPermissionAsk as j, extractQuestionAsk as k, extractStepUpdate as l, extractTextDelta as m, extractToolUpdate as n, formatBytes as o, formatDate as p, formatDateTime as q, formatRelativeTime as r, formatTime as s, getSessionMessages as t, isSessionError as u, isTurnEnd as v, isUserFacingTool as w, listSessions as x, notifyAssistantError as y, notifyAssistantReply as z };
+//# sourceMappingURL=IconStop-BxUfqTaV.js.map