@openscout/scout 0.2.57 → 0.2.60

package/dist/pair-supervisor.mjs

@@ -956,19 +956,58 @@ function findStoredCerts() {
     return null;
   }
 }
-function getTailscaleHostname() {
+function readTailscaleStatus() {
   try {
     const output = execSync("tailscale status --self=true --peers=false --json", {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 5000
     }).toString();
     const data = JSON.parse(output);
-    const dnsName = data?.Self?.DNSName ?? "";
-    return dnsName.replace(/\.$/, "") || null;
+    const dnsName = typeof data.Self?.DNSName === "string" ? data.Self.DNSName.replace(/\.$/, "") : "";
+    return {
+      backendState: typeof data.BackendState === "string" ? data.BackendState : null,
+      dnsName: dnsName || null,
+      online: data.Self?.Online !== false,
+      health: Array.isArray(data.Health) ? data.Health.filter((entry) => typeof entry === "string") : []
+    };
   } catch {
     return null;
   }
 }
+function resolveRelayEndpointForTailscaleStatus(port, tailscale) {
+  const backendState = tailscale?.backendState?.trim().toLowerCase() ?? "";
+  const hostname = tailscale?.dnsName ?? null;
+  const tailscaleRunning = backendState === "running" && tailscale?.online !== false && Boolean(hostname);
+  const tls = resolveTls(tailscaleRunning ? hostname : null);
+  if (tailscaleRunning && hostname && tls) {
+    return {
+      relayUrl: `wss://${hostname}:${port}`,
+      options: { tls }
+    };
+  }
+  if (tailscaleRunning && hostname) {
+    pairingLog.warn("relay", "tailscale is running without TLS; falling back to insecure websocket relay", {
+      hostname,
+      port
+    });
+    return {
+      relayUrl: `ws://${hostname}:${port}`,
+      options: {}
+    };
+  }
+  if (hostname && backendState && backendState !== "running") {
+    pairingLog.warn("relay", "tailscale hostname detected but tailscale is not running; using local-only relay endpoint", {
+      hostname,
+      backendState,
+      health: tailscale?.health ?? [],
+      port
+    });
+  }
+  return {
+    relayUrl: `ws://127.0.0.1:${port}`,
+    options: {}
+  };
+}
 function generateTailscaleCerts(hostname) {
   mkdirSync3(PAIRING_DIR, { recursive: true });
   const certPath = join(PAIRING_DIR, `${hostname}.crt`);
@@ -1014,28 +1053,7 @@ function resolveTls(hostname) {
   return generateTailscaleCerts(hostname);
 }
 function resolveRelayEndpoint(port) {
-  const hostname = getTailscaleHostname();
-  const tls = resolveTls(hostname);
-  if (hostname && tls) {
-    return {
-      relayUrl: `wss://${hostname}:${port}`,
-      options: { tls }
-    };
-  }
-  if (hostname) {
-    pairingLog.warn("relay", "tailscale hostname detected without TLS; falling back to insecure websocket relay", {
-      hostname,
-      port
-    });
-    return {
-      relayUrl: `ws://${hostname}:${port}`,
-      options: {}
-    };
-  }
-  return {
-    relayUrl: `ws://127.0.0.1:${port}`,
-    options: {}
-  };
+  return resolveRelayEndpointForTailscaleStatus(port, readTailscaleStatus());
 }
 function startManagedRelay(port = 7889) {
   const endpoint = resolveRelayEndpoint(port);
@@ -7869,7 +7887,73 @@ function resolveConfig() {
 // ../../apps/desktop/src/core/pairing/runtime/bridge/fileserver.ts
 import { isAbsolute } from "path";
 import { homedir as homedir9 } from "os";
+
+// ../../apps/desktop/src/core/pairing/runtime/bridge/web-handoff.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var SCOUT_WEB_HANDOFF_COOKIE = "scout_handoff";
+var WEB_HANDOFF_TTL_MS = 5 * 60 * 1000;
+var activeWebHandoffs = new Map;
+function pruneExpiredWebHandoffs(now = Date.now()) {
+  for (const [token, record] of activeWebHandoffs) {
+    if (record.expiresAt <= now) {
+      activeWebHandoffs.delete(token);
+    }
+  }
+}
+function scopesMatch(left, right) {
+  if (left.kind !== right.kind) {
+    return false;
+  }
+  if (left.sessionId !== right.sessionId) {
+    return false;
+  }
+  if (left.kind === "session") {
+    return true;
+  }
+  return left.turnId === right.turnId && left.blockId === right.blockId;
+}
+function pathForWebHandoffScope(scope) {
+  switch (scope.kind) {
+    case "session":
+      return `/handoff/session/${encodeURIComponent(scope.sessionId)}`;
+    case "file_change":
+      return `/handoff/file-change/${encodeURIComponent(scope.sessionId)}/${encodeURIComponent(scope.turnId)}/${encodeURIComponent(scope.blockId)}`;
+  }
+}
+function issueWebHandoff(scope, deviceId) {
+  pruneExpiredWebHandoffs();
+  const token = randomBytes2(24).toString("base64url");
+  const expiresAt = Date.now() + WEB_HANDOFF_TTL_MS;
+  activeWebHandoffs.set(token, {
+    token,
+    deviceId: deviceId?.trim() || null,
+    expiresAt,
+    scope
+  });
+  return { token, expiresAt, scope };
+}
+function readAuthorizedWebHandoff(token, scope) {
+  pruneExpiredWebHandoffs();
+  if (!token) {
+    return null;
+  }
+  const record = activeWebHandoffs.get(token);
+  if (!record) {
+    return null;
+  }
+  if (!scopesMatch(record.scope, scope)) {
+    return null;
+  }
+  return record;
+}
+
+// ../../apps/desktop/src/core/pairing/runtime/bridge/fileserver.ts
 var ALLOWED_ROOTS = [homedir9(), "/tmp"];
+var LOOPBACK_IPV4_HOST_PATTERN = /^127(?:\.\d{1,3}){3}$/;
+function isTrustedLoopbackHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::1" || LOOPBACK_IPV4_HOST_PATTERN.test(normalized);
+}
 function isAllowedPath(filePath) {
   if (!isAbsolute(filePath))
     return false;
@@ -7880,7 +7964,7 @@ function isAllowedPath(filePath) {
   return ALLOWED_ROOTS.some((root) => filePath.startsWith(root));
 }
 function startFileServer(options) {
-  const { port } = options;
+  const { port, bridge } = options;
   let server = null;
   function start() {
     try {
@@ -7888,7 +7972,7 @@ function startFileServer(options) {
         port,
         fetch(req) {
           try {
-            return route(new URL(req.url));
+            return route(req, new URL(req.url), bridge);
           } catch (err) {
             console.error(`[fileserver] ${req.url} \u2192`, err.message);
             return new Response("Internal error", { status: 500 });
@@ -7911,12 +7995,19 @@ function startFileServer(options) {
   start();
   return { port, stop, restart };
 }
-function route(url) {
+function route(req, url, bridge) {
   const path2 = url.pathname;
-  if (path2 === "/file")
+  if (path2 === "/file") {
+    if (!isTrustedLoopbackHostname(url.hostname)) {
+      return new Response("Forbidden", { status: 403 });
+    }
     return serveFile(url);
+  }
   if (path2 === "/health")
     return Response.json({ ok: true });
+  if (path2.startsWith("/handoff/")) {
+    return serveHandoffPage(req, url, bridge);
+  }
   return new Response("Pairing file server", { status: 200 });
 }
 function serveFile(url) {
@@ -7930,9 +8021,523 @@ function serveFile(url) {
     return new Response("Not found", { status: 404 });
   return new Response(file);
 }
+function serveHandoffPage(req, url, bridge) {
+  if (!bridge) {
+    return new Response("Secure handoff unavailable", { status: 503 });
+  }
+  const scope = parseHandoffScope(url);
+  if (!scope) {
+    return new Response("Not found", { status: 404 });
+  }
+  const token = readHandoffToken(req);
+  const authorized = readAuthorizedWebHandoff(token, scope);
+  if (!authorized) {
+    return unauthorizedHandoffResponse();
+  }
+  let html;
+  switch (scope.kind) {
+    case "session": {
+      const snapshot = bridge.getSessionSnapshot(scope.sessionId);
+      if (!snapshot) {
+        return new Response("Session handoff expired", { status: 404 });
+      }
+      html = renderSessionHandoffPage(snapshot);
+      break;
+    }
+    case "file_change": {
+      const snapshot = bridge.getSessionSnapshot(scope.sessionId);
+      if (!snapshot) {
+        return new Response("Session handoff expired", { status: 404 });
+      }
+      const target = findFileChangeBlock(snapshot, scope.turnId, scope.blockId);
+      if (!target) {
+        return new Response("File change handoff expired", { status: 404 });
+      }
+      html = renderFileChangeHandoffPage(snapshot, target.turn, target.block);
+      break;
+    }
+  }
+  const headers = new Headers({
+    "content-type": "text/html; charset=utf-8",
+    "cache-control": "no-store",
+    "x-content-type-options": "nosniff"
+  });
+  headers.set("set-cookie", `${SCOUT_WEB_HANDOFF_COOKIE}=${authorized.token}; Max-Age=300; Path=/handoff; HttpOnly; SameSite=Strict`);
+  return new Response(html, { status: 200, headers });
+}
+function unauthorizedHandoffResponse() {
+  return new Response("Secure handoff required", {
+    status: 401,
+    headers: {
+      "cache-control": "no-store",
+      "set-cookie": `${SCOUT_WEB_HANDOFF_COOKIE}=; Max-Age=0; Path=/handoff; HttpOnly; SameSite=Strict`
+    }
+  });
+}
+function parseHandoffScope(url) {
+  const parts = url.pathname.split("/").filter(Boolean).map((part) => decodeURIComponent(part));
+  if (parts[0] !== "handoff") {
+    return null;
+  }
+  if (parts[1] === "session" && parts[2]) {
+    return { kind: "session", sessionId: parts[2] };
+  }
+  if (parts[1] === "file-change" && parts[2] && parts[3] && parts[4]) {
+    return {
+      kind: "file_change",
+      sessionId: parts[2],
+      turnId: parts[3],
+      blockId: parts[4]
+    };
+  }
+  return null;
+}
+function readHandoffToken(req) {
+  const headerToken = req.headers.get("x-scout-handoff-token")?.trim();
+  if (headerToken) {
+    return headerToken;
+  }
+  const cookieHeader = req.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === SCOUT_WEB_HANDOFF_COOKIE) {
+      const value = rest.join("=").trim();
+      return value || null;
+    }
+  }
+  return null;
+}
+function findFileChangeBlock(snapshot, turnId, blockId) {
+  const turn = snapshot.turns.find((candidate) => candidate.id === turnId);
+  if (!turn) {
+    return null;
+  }
+  const blockState = turn.blocks.find((candidate) => candidate.block.id === blockId);
+  const block = blockState?.block;
+  if (!block || block.type !== "action" || block.action.kind !== "file_change") {
+    return null;
+  }
+  return { turn, block };
+}
+function renderPage(title, body) {
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${escapeHtml(title)}</title>
+    <style>
+      :root {
+        color-scheme: dark;
+        --bg: #0b0f14;
+        --panel: rgba(19, 27, 39, 0.92);
+        --panel-strong: rgba(12, 18, 28, 0.96);
+        --line: rgba(148, 163, 184, 0.16);
+        --line-strong: rgba(148, 163, 184, 0.24);
+        --text: #e5ecf5;
+        --muted: #90a0b4;
+        --accent: #63d0ff;
+        --green: #54d38a;
+        --amber: #f8c36a;
+        --red: #ff7b72;
+        --surface-add: rgba(84, 211, 138, 0.08);
+        --surface-del: rgba(255, 123, 114, 0.08);
+      }
+      * { box-sizing: border-box; }
+      body {
+        margin: 0;
+        background:
+          radial-gradient(circle at top left, rgba(99, 208, 255, 0.12), transparent 32%),
+          linear-gradient(180deg, #090d12 0%, #0b0f14 55%, #111723 100%);
+        color: var(--text);
+        font: 14px/1.5 ui-sans-serif, -apple-system, BlinkMacSystemFont, "SF Pro Text", sans-serif;
+      }
+      .wrap {
+        width: min(980px, calc(100vw - 24px));
+        margin: 0 auto;
+        padding: 20px 0 40px;
+      }
+      .hero, .panel {
+        background: var(--panel);
+        border: 1px solid var(--line);
+        border-radius: 18px;
+        backdrop-filter: blur(18px);
+        box-shadow: 0 24px 64px rgba(0, 0, 0, 0.28);
+      }
+      .hero {
+        padding: 18px 18px 16px;
+        margin-bottom: 14px;
+      }
+      .eyebrow {
+        display: inline-flex;
+        align-items: center;
+        gap: 8px;
+        color: var(--muted);
+        font-size: 11px;
+        letter-spacing: 0.14em;
+        text-transform: uppercase;
+      }
+      .dot {
+        width: 8px;
+        height: 8px;
+        border-radius: 999px;
+        background: var(--accent);
+        box-shadow: 0 0 14px rgba(99, 208, 255, 0.65);
+      }
+      h1 {
+        margin: 12px 0 10px;
+        font-size: 24px;
+        line-height: 1.15;
+      }
+      .meta, .stack {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 8px;
+      }
+      .pill {
+        display: inline-flex;
+        align-items: center;
+        gap: 6px;
+        padding: 5px 10px;
+        border-radius: 999px;
+        border: 1px solid var(--line-strong);
+        background: rgba(255, 255, 255, 0.03);
+        color: var(--muted);
+        font-size: 12px;
+      }
+      .pill strong {
+        color: var(--text);
+        font-weight: 600;
+      }
+      .stack { flex-direction: column; }
+      .panel {
+        margin-top: 12px;
+        overflow: hidden;
+      }
+      .panel-inner {
+        padding: 16px;
+      }
+      .turn {
+        border-top: 1px solid var(--line);
+      }
+      .turn:first-child {
+        border-top: none;
+      }
+      .turn-head {
+        padding: 14px 16px;
+        display: flex;
+        justify-content: space-between;
+        gap: 12px;
+        align-items: center;
+        background: rgba(255, 255, 255, 0.02);
+      }
+      .turn-title {
+        font-size: 13px;
+        font-weight: 600;
+        letter-spacing: 0.02em;
+      }
+      .turn-subtitle {
+        color: var(--muted);
+        font-size: 12px;
+        margin-top: 2px;
+      }
+      .blocks {
+        padding: 8px;
+      }
+      .block {
+        padding: 12px;
+        border-radius: 14px;
+        border: 1px solid var(--line);
+        background: var(--panel-strong);
+        margin: 8px;
+      }
+      .block-head {
+        display: flex;
+        justify-content: space-between;
+        align-items: center;
+        gap: 12px;
+        margin-bottom: 10px;
+      }
+      .block-type {
+        color: var(--muted);
+        text-transform: uppercase;
+        letter-spacing: 0.12em;
+        font-size: 11px;
+      }
+      .label {
+        color: var(--muted);
+        font-size: 12px;
+      }
+      .label strong {
+        color: var(--text);
+      }
+      pre {
+        margin: 0;
+        white-space: pre-wrap;
+        word-break: break-word;
+        overflow-wrap: anywhere;
+        font: 12.5px/1.6 ui-monospace, SFMono-Regular, Menlo, monospace;
+      }
+      .code {
+        padding: 12px;
+        border-radius: 12px;
+        border: 1px solid var(--line);
+        background: rgba(255, 255, 255, 0.02);
+      }
+      .diff-line-add { background: var(--surface-add); color: #8ef3b7; }
+      .diff-line-del { background: var(--surface-del); color: #ff9d96; }
+      .details {
+        margin-top: 10px;
+        border: 1px solid var(--line);
+        border-radius: 12px;
+        overflow: hidden;
+      }
+      details > summary {
+        list-style: none;
+        cursor: pointer;
+        padding: 10px 12px;
+        background: rgba(255, 255, 255, 0.03);
+        color: var(--muted);
+        font-size: 12px;
+        text-transform: uppercase;
+        letter-spacing: 0.1em;
+      }
+      details[open] > summary {
+        border-bottom: 1px solid var(--line);
+      }
+      .empty {
+        padding: 28px 18px;
+        color: var(--muted);
+      }
+      .grid {
+        display: grid;
+        gap: 10px;
+      }
+      .grid.two {
+        grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+      }
+      a.inline {
+        color: var(--accent);
+        text-decoration: none;
+      }
+      .status-streaming { color: var(--amber); }
+      .status-completed { color: var(--green); }
+      .status-failed, .status-error { color: var(--red); }
+    </style>
+  </head>
+  <body>
+    <main class="wrap">
+      ${body}
+    </main>
+  </body>
+</html>`;
+}
+function renderSessionHandoffPage(snapshot) {
+  const title = snapshot.session.name || snapshot.session.id;
+  const hero = `
+    <section class="hero">
+      <div class="eyebrow"><span class="dot"></span> Secure Proxy Session Handoff</div>
+      <h1>${escapeHtml(title)}</h1>
+      <div class="meta">
+        <span class="pill"><strong>ID</strong> ${escapeHtml(snapshot.session.id)}</span>
+        <span class="pill"><strong>Adapter</strong> ${escapeHtml(snapshot.session.adapterType)}</span>
+        <span class="pill"><strong>Status</strong> ${escapeHtml(snapshot.session.status)}</span>
+        ${snapshot.session.model ? `<span class="pill"><strong>Model</strong> ${escapeHtml(snapshot.session.model)}</span>` : ""}
+        ${snapshot.session.cwd ? `<span class="pill"><strong>Workspace</strong> ${escapeHtml(snapshot.session.cwd)}</span>` : ""}
+      </div>
+    </section>
+  `;
+  const turns = snapshot.turns.length > 0 ? snapshot.turns.map((turn) => {
+    const turnBody = turn.blocks.length > 0 ? turn.blocks.map(({ block }) => renderBlock(block)).join("") : `<div class="empty">No blocks were captured for this turn.</div>`;
+    return `
+        <section class="turn">
+          <div class="turn-head">
+            <div>
+              <div class="turn-title">${escapeHtml(turn.id)}</div>
+              <div class="turn-subtitle">${formatTimestamp(turn.startedAt)}${turn.endedAt ? ` to ${formatTimestamp(turn.endedAt)}` : ""}</div>
+            </div>
+            <span class="pill"><strong>Turn</strong> <span class="status-${escapeHtml(turn.status)}">${escapeHtml(turn.status)}</span></span>
+          </div>
+          <div class="blocks">${turnBody}</div>
+        </section>
+      `;
+  }).join("") : `<div class="empty">This session has not produced any turns yet.</div>`;
+  return renderPage(title, `${hero}<section class="panel">${turns}</section>`);
+}
+function renderFileChangeHandoffPage(snapshot, turn, block) {
+  const action = block.action;
+  const title = action.path || snapshot.session.name || snapshot.session.id;
+  const hero = `
+    <section class="hero">
+      <div class="eyebrow"><span class="dot"></span> Secure Proxy File Change</div>
+      <h1>${escapeHtml(title)}</h1>
+      <div class="meta">
+        <span class="pill"><strong>Session</strong> ${escapeHtml(snapshot.session.name || snapshot.session.id)}</span>
+        <span class="pill"><strong>Turn</strong> ${escapeHtml(turn.id)}</span>
+        <span class="pill"><strong>Status</strong> ${escapeHtml(action.status)}</span>
+      </div>
+    </section>
+  `;
+  const body = `
+    <section class="panel">
+      <div class="panel-inner stack">
+        <div class="grid two">
+          <div class="pill"><strong>Path</strong> ${escapeHtml(action.path)}</div>
+          <div class="pill"><strong>Block</strong> ${escapeHtml(block.id)}</div>
+        </div>
+        ${action.diff ? renderDetailsSection("Diff", renderDiff(action.diff), true) : `<div class="empty">No diff was recorded for this action.</div>`}
+        ${action.output ? renderDetailsSection("Output", `<div class="code"><pre>${escapeHtml(action.output)}</pre></div>`) : ""}
+      </div>
+    </section>
+  `;
+  return renderPage(title, `${hero}${body}`);
+}
+function renderBlock(block) {
+  switch (block.type) {
+    case "text":
+      return renderTextLikeBlock("Text", block.text);
+    case "reasoning":
+      return renderTextLikeBlock("Reasoning", block.text);
+    case "error":
+      return `
+        <article class="block">
+          <div class="block-head">
+            <div class="block-type">Error</div>
+            <span class="pill status-error">${escapeHtml(block.status)}</span>
+          </div>
+          <div class="code"><pre>${escapeHtml(block.message)}</pre></div>
+        </article>
+      `;
+    case "file":
+      return `
+        <article class="block">
+          <div class="block-head">
+            <div class="block-type">File</div>
+            <span class="pill">${escapeHtml(block.status)}</span>
+          </div>
+          <div class="grid">
+            ${block.name ? `<div class="label"><strong>Name</strong> ${escapeHtml(block.name)}</div>` : ""}
+            <div class="label"><strong>MIME</strong> ${escapeHtml(block.mimeType)}</div>
+          </div>
+        </article>
+      `;
+    case "question":
+      return renderQuestionBlock(block);
+    case "action":
+      return renderActionBlock(block);
+  }
+}
+function renderTextLikeBlock(label, text) {
+  return `
+    <article class="block">
+      <div class="block-head">
+        <div class="block-type">${escapeHtml(label)}</div>
+      </div>
+      <div class="code"><pre>${escapeHtml(text)}</pre></div>
+    </article>
+  `;
+}
+function renderQuestionBlock(block) {
+  const answer = block.answer?.length ? block.answer.join(", ") : "Awaiting answer";
+  const options = block.options?.length ? `<div class="label"><strong>Options</strong> ${escapeHtml(block.options.map((option) => option.label).join(", "))}</div>` : "";
+  return `
+    <article class="block">
+      <div class="block-head">
+        <div class="block-type">Question</div>
+        <span class="pill">${escapeHtml(block.questionStatus)}</span>
+      </div>
+      ${block.header ? `<div class="label"><strong>${escapeHtml(block.header)}</strong></div>` : ""}
+      <div class="code"><pre>${escapeHtml(block.question)}</pre></div>
+      <div class="stack" style="margin-top: 10px;">
+        ${options}
+        <div class="label"><strong>Answer</strong> ${escapeHtml(answer)}</div>
+      </div>
+    </article>
+  `;
+}
+function renderActionBlock(block) {
+  const action = block.action;
+  const parts = [];
+  switch (action.kind) {
+    case "file_change":
+      parts.push(`<div class="label"><strong>Path</strong> ${escapeHtml(action.path)}</div>`);
+      if (action.diff) {
+        parts.push(renderDetailsSection("Diff", renderDiff(action.diff)));
+      }
+      break;
+    case "command":
+      parts.push(`<div class="label"><strong>Command</strong></div><div class="code"><pre>${escapeHtml(action.command)}</pre></div>`);
+      if (typeof action.exitCode === "number") {
+        parts.push(`<div class="label"><strong>Exit Code</strong> ${escapeHtml(String(action.exitCode))}</div>`);
+      }
+      break;
+    case "tool_call":
+      parts.push(`<div class="label"><strong>Tool</strong> ${escapeHtml(action.toolName)}</div>`);
+      if (action.toolCallId) {
+        parts.push(`<div class="label"><strong>Call ID</strong> ${escapeHtml(action.toolCallId)}</div>`);
+      }
+      break;
+    case "subagent":
+      parts.push(`<div class="label"><strong>Agent</strong> ${escapeHtml(action.agentName || action.agentId)}</div>`);
+      if (action.prompt) {
+        parts.push(`<div class="code"><pre>${escapeHtml(action.prompt)}</pre></div>`);
+      }
+      break;
+  }
+  if (action.approval) {
+    parts.push(`<div class="label"><strong>Approval</strong> ${escapeHtml(action.approval.risk || "medium")} risk${action.approval.description ? ` - ${escapeHtml(action.approval.description)}` : ""}</div>`);
+  }
+  if (action.output) {
+    parts.push(renderDetailsSection("Output", `<div class="code"><pre>${escapeHtml(action.output)}</pre></div>`));
+  }
+  return `
+    <article class="block">
+      <div class="block-head">
+        <div class="block-type">${escapeHtml(action.kind.replace("_", " "))}</div>
+        <span class="pill">${escapeHtml(action.status)}</span>
+      </div>
+      <div class="stack">${parts.join("")}</div>
+    </article>
+  `;
+}
+function renderDetailsSection(title, innerHtml, open = false) {
+  return `
+    <details class="details"${open ? " open" : ""}>
+      <summary>${escapeHtml(title)}</summary>
+      <div class="panel-inner">${innerHtml}</div>
+    </details>
+  `;
+}
+function renderDiff(diff) {
+  const lines = diff.split(`
+`).map((line) => {
+    const className = line.startsWith("+") ? "diff-line-add" : line.startsWith("-") ? "diff-line-del" : "";
+    return `<div class="${className}"><pre>${escapeHtml(line || " ")}</pre></div>`;
+  }).join("");
+  return `<div class="code">${lines}</div>`;
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function formatTimestamp(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    return "Unknown time";
+  }
+  try {
+    return new Intl.DateTimeFormat("en-US", {
+      dateStyle: "medium",
+      timeStyle: "short"
+    }).format(value);
+  } catch {
+    return new Date(value).toISOString();
+  }
+}
 
 // ../../apps/desktop/src/core/pairing/runtime/bridge/server.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync8, realpathSync, statSync as statSync3 } from "fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync9, realpathSync, statSync as statSync3 } from "fs";
 import { execSync as execSync3 } from "child_process";
 import { basename as basename6, isAbsolute as isAbsolute3, join as join17, relative as relative2 } from "path";
 import { homedir as homedir15 } from "os";
@@ -8036,6 +8641,11 @@ var BUILT_IN_HARNESS_CATALOG = [
       loginCommand: "claude login",
       notReadyMessage: "Claude is installed but not authenticated yet."
     },
+    resume: {
+      command: "claude",
+      sessionFlag: "--resume",
+      cwdFlag: "--cwd"
+    },
     capabilities: ["chat", "invoke", "deliver", "summarize", "review"]
   },
   {
@@ -8067,6 +8677,11 @@ var BUILT_IN_HARNESS_CATALOG = [
       loginCommand: "codex login",
       notReadyMessage: "Codex is installed but not authenticated yet."
     },
+    resume: {
+      command: "codex",
+      sessionFlag: "--thread",
+      cwdFlag: "--cwd"
+    },
     capabilities: ["chat", "invoke", "deliver", "review", "execute"]
   }
 ];
@@ -8179,6 +8794,7 @@ function createBuiltInHarnessCatalog() {
       anyOf: entry.readiness.anyOf ? [...entry.readiness.anyOf] : undefined
     } : undefined,
     launch: entry.launch ? { ...entry.launch, args: [...entry.launch.args] } : undefined,
+    resume: entry.resume ? { ...entry.resume } : undefined,
     resolveEnv: entry.resolveEnv ? [...entry.resolveEnv] : undefined,
     capabilities: [...entry.capabilities],
     metadata: entry.metadata ? { ...entry.metadata } : undefined
@@ -8196,6 +8812,7 @@ function mergeHarnessCatalogEntries(baseEntries, overrides = {}) {
       install: mergeInstall(entry.install, override.install),
       readiness: mergeReadiness(entry.readiness, override.readiness),
       launch: mergeLaunch(entry.launch, override.launch),
+      resume: override.resume && entry.resume ? { ...entry.resume, ...override.resume } : entry.resume,
       tags: override.tags ? [...override.tags] : entry.tags,
       capabilities: override.capabilities ? [...override.capabilities] : entry.capabilities,
       resolveEnv: override.resolveEnv ? [...override.resolveEnv] : entry.resolveEnv,
@@ -8224,6 +8841,7 @@ function mergeHarnessCatalogEntries(baseEntries, overrides = {}) {
       install: mergeInstall(undefined, override.install),
       readiness: mergeReadiness(undefined, override.readiness),
       launch: mergeLaunch(undefined, override.launch),
+      resume: override.resume?.command && override.resume?.sessionFlag ? { command: override.resume.command, sessionFlag: override.resume.sessionFlag, cwdFlag: override.resume.cwdFlag } : undefined,
       resolveEnv: override.resolveEnv ? [...override.resolveEnv] : undefined,
       capabilities: [...override.capabilities],
       metadata: override.metadata ? { ...override.metadata } : undefined
@@ -11729,7 +12347,7 @@ async function ensureRelayAgentConfigured(value, options = {}) {
 
 // ../runtime/src/local-agents.ts
 import { execFileSync as execFileSync3, execSync as execSync2 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync8 } from "fs";
 import { mkdir as mkdir6, rm as rm5, stat as stat3, writeFile as writeFile6 } from "fs/promises";
 import { basename as basename4, dirname as dirname6, join as join15, resolve as resolve5 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
@@ -11737,7 +12355,8 @@ import { fileURLToPath as fileURLToPath5 } from "url";
 // ../runtime/src/claude-stream-json.ts
 import { randomUUID } from "crypto";
 import { spawn as spawn2 } from "child_process";
-import { appendFile as appendFile2, mkdir as mkdir4, readFile as readFile5, rm as rm3, writeFile as writeFile4 } from "fs/promises";
+import { appendFile as appendFile2, mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "fs/promises";
+import { existsSync as existsSync11, readFileSync as readFileSync6 } from "fs";
 import { join as join12 } from "path";
 
 // ../runtime/src/managed-agent-environment.ts
@@ -11778,18 +12397,58 @@ function sessionKey(options) {
 function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
-async function readOptionalFile2(filePath) {
+var SESSION_CATALOG_FILENAME = "session-catalog.json";
+var SESSION_CATALOG_MAX_ENTRIES = 64;
+function readSessionCatalogSync(runtimeDirectory) {
+  const catalogPath = join12(runtimeDirectory, SESSION_CATALOG_FILENAME);
   try {
-    const raw = await readFile5(filePath, "utf8");
-    const trimmed = raw.trim();
-    return trimmed || null;
+    if (!existsSync11(catalogPath)) {
+      const legacyPath = join12(runtimeDirectory, "claude-session-id.txt");
+      if (existsSync11(legacyPath)) {
+        const legacyId = readFileSync6(legacyPath, "utf8").trim();
+        if (legacyId) {
+          return {
+            activeSessionId: legacyId,
+            sessions: [{ id: legacyId, startedAt: Date.now(), cwd: "" }]
+          };
+        }
+      }
+      return { activeSessionId: null, sessions: [] };
+    }
+    const raw = readFileSync6(catalogPath, "utf8").trim();
+    if (!raw)
+      return { activeSessionId: null, sessions: [] };
+    const parsed = JSON.parse(raw);
+    return {
+      activeSessionId: parsed.activeSessionId ?? null,
+      sessions: Array.isArray(parsed.sessions) ? parsed.sessions : []
+    };
   } catch {
-    return null;
+    return { activeSessionId: null, sessions: [] };
+  }
+}
+async function readSessionCatalog(runtimeDirectory) {
+  return readSessionCatalogSync(runtimeDirectory);
+}
+async function writeSessionCatalog(runtimeDirectory, catalog) {
+  const catalogPath = join12(runtimeDirectory, SESSION_CATALOG_FILENAME);
+  await writeFile4(catalogPath, JSON.stringify(catalog, null, 2) + `
+`);
+}
+function catalogRecordSession(catalog, sessionId, cwd) {
+  const now = Date.now();
+  const sessions = catalog.sessions.map((s) => s.id === catalog.activeSessionId && !s.endedAt ? { ...s, endedAt: now } : s);
+  if (!sessions.some((s) => s.id === sessionId)) {
+    sessions.push({ id: sessionId, startedAt: now, cwd });
+  }
+  while (sessions.length > SESSION_CATALOG_MAX_ENTRIES) {
+    sessions.shift();
   }
+  return { activeSessionId: sessionId, sessions };
 }
 class ClaudeStreamJsonSession {
   options;
-  sessionStatePath;
+  catalogDirectory;
   stdoutLogPath;
   stderrLogPath;
   process = null;
@@ -11800,7 +12459,7 @@ class ClaudeStreamJsonSession {
   lastConfigSignature;
   constructor(options) {
     this.options = options;
-    this.sessionStatePath = join12(options.runtimeDirectory, "claude-session-id.txt");
+    this.catalogDirectory = options.runtimeDirectory;
     this.stdoutLogPath = join12(options.logsDirectory, "stdout.log");
     this.stderrLogPath = join12(options.logsDirectory, "stderr.log");
     this.lastConfigSignature = this.configSignature(options);
@@ -11906,7 +12565,9 @@ class ClaudeStreamJsonSession {
     }
     if (options.resetSession) {
       this.claudeSessionId = null;
-      await rm3(this.sessionStatePath, { force: true });
+      const catalog = await readSessionCatalog(this.catalogDirectory);
+      catalog.activeSessionId = null;
+      await writeSessionCatalog(this.catalogDirectory, catalog);
     }
   }
   configSignature(options) {
@@ -11935,7 +12596,8 @@ class ClaudeStreamJsonSession {
     await mkdir4(this.options.runtimeDirectory, { recursive: true });
     await mkdir4(this.options.logsDirectory, { recursive: true });
     await writeFile4(join12(this.options.runtimeDirectory, "prompt.txt"), this.options.systemPrompt);
-    this.claudeSessionId = await readOptionalFile2(this.sessionStatePath);
+    const catalog = await readSessionCatalog(this.catalogDirectory);
+    this.claudeSessionId = catalog.activeSessionId;
     const args = [
       "--verbose",
       "--print",
@@ -12014,8 +12676,11 @@ class ClaudeStreamJsonSession {
       const nextSessionId = event.session_id ?? event.sessionId ?? null;
       if (nextSessionId && nextSessionId !== this.claudeSessionId) {
         this.claudeSessionId = nextSessionId;
-        writeFile4(this.sessionStatePath, `${nextSessionId}
-`);
+        (async () => {
+          const catalog = await readSessionCatalog(this.catalogDirectory);
+          const updated = catalogRecordSession(catalog, nextSessionId, this.options.cwd);
+          await writeSessionCatalog(this.catalogDirectory, updated);
+        })();
       }
       return;
     }
@@ -12079,7 +12744,9 @@ async function shutdownClaudeStreamJsonAgent(options, shutdownOptions = {}) {
   const session = sessions.get(key);
   if (!session) {
     if (shutdownOptions.resetSession) {
-      await rm3(join12(options.runtimeDirectory, "claude-session-id.txt"), { force: true });
+      const catalog = await readSessionCatalog(options.runtimeDirectory);
+      catalog.activeSessionId = null;
+      await writeSessionCatalog(options.runtimeDirectory, catalog);
     }
     return;
   }
@@ -12089,8 +12756,107 @@ async function shutdownClaudeStreamJsonAgent(options, shutdownOptions = {}) {
 
 // ../runtime/src/codex-app-server.ts
 import { spawn as spawn3 } from "child_process";
-import { access as access3, appendFile as appendFile3, constants as constants3, mkdir as mkdir5, readFile as readFile6, rm as rm4, writeFile as writeFile5 } from "fs/promises";
+import { constants as constants3 } from "fs";
+import { access as access3, appendFile as appendFile3, mkdir as mkdir5, readFile as readFile6, rm as rm4, writeFile as writeFile5 } from "fs/promises";
 import { delimiter as delimiter3, join as join13 } from "path";
+function normalizeCodexModelValue(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+function encodeCodexModelConfig(model) {
+  return `model=${JSON.stringify(model)}`;
+}
+function parseCodexModelConfig(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    return null;
+  }
+  const separatorIndex = trimmed.indexOf("=");
+  if (separatorIndex <= 0) {
+    return null;
+  }
+  const key = trimmed.slice(0, separatorIndex).trim();
+  if (key !== "model") {
+    return null;
+  }
+  const rawValue = trimmed.slice(separatorIndex + 1).trim();
+  if (!rawValue) {
+    return null;
+  }
+  if (rawValue.startsWith('"') && rawValue.endsWith('"') || rawValue.startsWith("'") && rawValue.endsWith("'")) {
+    return rawValue.slice(1, -1) || null;
+  }
+  return rawValue;
+}
+function normalizeCodexAppServerLaunchArgs(launchArgs) {
+  const args = Array.isArray(launchArgs) ? launchArgs.map((entry) => String(entry).trim()).filter(Boolean) : [];
+  const normalized = [];
+  for (let index = 0;index < args.length; index += 1) {
+    const current = args[index] ?? "";
+    if (current === "--model" || current === "-m") {
+      const model = normalizeCodexModelValue(args[index + 1]);
+      if (model) {
+        normalized.push("-c", encodeCodexModelConfig(model));
+        index += 1;
+        continue;
+      }
+      normalized.push(current);
+      continue;
+    }
+    if (current.startsWith("--model=")) {
+      const model = normalizeCodexModelValue(current.slice("--model=".length));
+      if (model) {
+        normalized.push("-c", encodeCodexModelConfig(model));
+        continue;
+      }
+    }
+    if (current.startsWith("-m=")) {
+      const model = normalizeCodexModelValue(current.slice(3));
+      if (model) {
+        normalized.push("-c", encodeCodexModelConfig(model));
+        continue;
+      }
+    }
+    if (current === "-c" || current === "--config") {
+      const next = args[index + 1];
+      if (typeof next === "string") {
+        const model = parseCodexModelConfig(next);
+        normalized.push(current === "--config" ? "--config" : "-c", model ? encodeCodexModelConfig(model) : next);
+        index += 1;
+        continue;
+      }
+    }
+    if (current.startsWith("--config=")) {
+      const value = current.slice("--config=".length);
+      const model = parseCodexModelConfig(value);
+      normalized.push(model ? `--config=${encodeCodexModelConfig(model)}` : current);
+      continue;
+    }
+    normalized.push(current);
+  }
+  return normalized;
+}
+function readCodexAppServerModelFromLaunchArgs(launchArgs) {
+  const normalized = normalizeCodexAppServerLaunchArgs(launchArgs);
+  for (let index = 0;index < normalized.length; index += 1) {
+    const current = normalized[index] ?? "";
+    if (current === "-c" || current === "--config") {
+      const model = parseCodexModelConfig(normalized[index + 1]);
+      if (model) {
+        return model;
+      }
+      index += 1;
+      continue;
+    }
+    if (current.startsWith("--config=")) {
+      const model = parseCodexModelConfig(current.slice("--config=".length));
+      if (model) {
+        return model;
+      }
+    }
+  }
+  return null;
+}
 function sessionKey2(options) {
   return `${options.agentName}:${options.sessionId}`;
 }
@@ -12186,7 +12952,7 @@ function isServerRequest2(message) {
 function isNotification2(message) {
   return Boolean(message && typeof message === "object" && "method" in message && !("id" in message));
 }
-async function readOptionalFile3(filePath) {
+async function readOptionalFile2(filePath) {
   try {
     const raw = await readFile6(filePath, "utf8");
     const trimmed = raw.trim();
@@ -12199,6 +12965,13 @@ function isMissingCodexRolloutError2(error) {
   const message = errorMessage3(error).toLowerCase();
   return message.includes("no rollout found for thread id");
 }
+function resolveCodexCompletionGraceMs() {
+  const parsed = Number.parseInt(process.env.OPENSCOUT_CODEX_COMPLETION_GRACE_MS ?? "", 10);
+  if (Number.isFinite(parsed) && parsed >= 0) {
+    return parsed;
+  }
+  return 60000;
+}
 
 class CodexAppServerSession {
   options;
@@ -12388,7 +13161,7 @@ class CodexAppServerSession {
       systemPrompt: options.systemPrompt,
       threadId: options.threadId ?? null,
       requireExistingThread: options.requireExistingThread === true,
-      launchArgs: Array.isArray(options.launchArgs) ? options.launchArgs : []
+      launchArgs: normalizeCodexAppServerLaunchArgs(options.launchArgs)
     });
   }
   async ensureStarted() {
@@ -12410,6 +13183,7 @@ class CodexAppServerSession {
     await mkdir5(this.options.logsDirectory, { recursive: true });
     await writeFile5(join13(this.options.runtimeDirectory, "prompt.txt"), this.options.systemPrompt);
     const codexExecutable = await resolveCodexExecutable2();
+    const launchArgs = normalizeCodexAppServerLaunchArgs(this.options.launchArgs);
     const env = buildManagedAgentEnvironment({
       agentName: this.options.agentName,
       currentDirectory: this.options.cwd,
@@ -12420,7 +13194,8 @@ class CodexAppServerSession {
       ...buildScoutMcpCodexLaunchArgs({
         currentDirectory: this.options.cwd,
         env
-      })
+      }),
+      ...launchArgs
     ], {
       cwd: this.options.cwd,
       env,
@@ -12463,7 +13238,7 @@ class CodexAppServerSession {
   }
   async resumeOrStartThread() {
     const requestedThreadId = this.options.threadId?.trim() || null;
-    const storedThreadId = requestedThreadId ?? await readOptionalFile3(this.threadIdPath);
+    const storedThreadId = requestedThreadId ?? await readOptionalFile2(this.threadIdPath);
     if (storedThreadId) {
       try {
         const resumed = await this.request("thread/resume", {
@@ -12518,6 +13293,8 @@ class CodexAppServerSession {
       turnId: "",
       startedAt: Date.now(),
       timer: null,
+      graceTimer: null,
+      timedOutAt: null,
       messageOrder: [],
       messageByItemId: new Map,
       resolve: resolve4,
@@ -12525,20 +13302,43 @@ class CodexAppServerSession {
       watchers: []
     };
     turn.timer = setTimeout(() => {
-      this.interrupt().catch(() => {
-        return;
-      });
-      if (this.activeTurn === turn) {
-        this.activeTurn = null;
-      }
-      for (const watcher of this.drainTurnWatchers(turn)) {
-        watcher.reject(new Error(`Timed out after ${timeoutMs}ms waiting for ${this.options.agentName}.`));
-      }
-      reject(new Error(`Timed out after ${timeoutMs}ms waiting for ${this.options.agentName}.`));
+      this.scheduleTurnTimeout(turn, timeoutMs);
     }, timeoutMs);
     this.activeTurn = turn;
     return turn;
   }
+  buildTurnTimeoutError(timeoutMs) {
+    return new Error(`Timed out after ${timeoutMs}ms waiting for ${this.options.agentName}.`);
+  }
+  scheduleTurnTimeout(turn, timeoutMs) {
+    if (turn.timedOutAt !== null) {
+      return;
+    }
+    turn.timedOutAt = Date.now();
+    this.interrupt().catch(() => {
+      return;
+    });
+    const graceMs = resolveCodexCompletionGraceMs();
+    if (graceMs <= 0) {
+      this.rejectTimedOutTurn(turn, timeoutMs);
+      return;
+    }
+    turn.graceTimer = setTimeout(() => {
+      this.rejectTimedOutTurn(turn, timeoutMs);
+    }, graceMs);
+  }
+  rejectTimedOutTurn(turn, timeoutMs) {
+    if (this.activeTurn !== turn) {
+      this.clearActiveTurn(turn);
+      return;
+    }
+    this.clearActiveTurn(turn);
+    const error = this.buildTurnTimeoutError(timeoutMs);
+    for (const watcher of this.drainTurnWatchers(turn)) {
+      watcher.reject(error);
+    }
+    turn.reject(error);
+  }
   addTurnWatcher(turn, resolve4, reject, timeoutMs) {
     const watcher = {
       resolve: resolve4,
@@ -12572,6 +13372,9 @@ class CodexAppServerSession {
     if (turn.timer) {
       clearTimeout(turn.timer);
     }
+    if (turn.graceTimer) {
+      clearTimeout(turn.graceTimer);
+    }
     if (this.activeTurn === turn) {
       this.activeTurn = null;
     }
@@ -12890,7 +13693,7 @@ function buildCollaborationContractPrompt(agentId) {
 
 // ../runtime/src/broker-service.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync6, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir13 } from "os";
 import { basename as basename3, dirname as dirname5, join as join14, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
@@ -12936,7 +13739,7 @@ function runtimePackageDir() {
   return resolve4(moduleDir, "..");
 }
 function isInstalledRuntimePackageDir(candidate) {
-  return existsSync11(join14(candidate, "package.json")) && existsSync11(join14(candidate, "bin", "openscout-runtime.mjs"));
+  return existsSync12(join14(candidate, "package.json")) && existsSync12(join14(candidate, "bin", "openscout-runtime.mjs"));
 }
 function findGlobalRuntimeDir() {
   const candidates = [
@@ -12967,7 +13770,7 @@ function findWorkspaceRuntimeDir(startDir) {
   let current = resolve4(startDir);
   while (true) {
     const candidate = join14(current, "packages", "runtime");
-    if (existsSync11(join14(candidate, "package.json")) && existsSync11(join14(candidate, "src"))) {
+    if (existsSync12(join14(candidate, "package.json")) && existsSync12(join14(candidate, "src"))) {
       return candidate;
     }
     const parent = dirname5(current);
@@ -12981,18 +13784,18 @@ function resolveBunExecutable2() {
   if (explicit && explicit.trim().length > 0) {
     return explicit;
   }
-  if (basename3(process.execPath).startsWith("bun") && existsSync11(process.execPath)) {
+  if (basename3(process.execPath).startsWith("bun") && existsSync12(process.execPath)) {
     return process.execPath;
   }
   const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
   for (const entry of pathEntries) {
     const candidate = join14(entry, "bun");
-    if (existsSync11(candidate)) {
+    if (existsSync12(candidate)) {
       return candidate;
     }
   }
   const homeBun = join14(homedir13(), ".bun", "bin", "bun");
-  if (existsSync11(homeBun)) {
+  if (existsSync12(homeBun)) {
     return homeBun;
   }
   return "bun";
@@ -13182,10 +13985,10 @@ function launchctlPath() {
   return "/bin/launchctl";
 }
 function readLogLines(path2) {
-  if (!existsSync11(path2)) {
+  if (!existsSync12(path2)) {
     return [];
   }
-  return readFileSync6(path2, "utf8").split(`
+  return readFileSync7(path2, "utf8").split(`
 `).map((line) => line.trim()).filter(Boolean);
 }
 function isPackageScriptBanner(line) {
@@ -13282,7 +14085,7 @@ async function brokerServiceStatus(config = resolveBrokerServiceConfig()) {
   ensureServiceDirectories(config);
   const launchctl = inspectLaunchctl(config);
   const health = await fetchHealthSnapshot(config);
-  const installed = existsSync11(config.launchAgentPath);
+  const installed = existsSync12(config.launchAgentPath);
   const lastLogLine = health.reachable ? readLastLogLine([config.stdoutLogPath, config.stderrLogPath]) : readLastLogLine([config.stderrLogPath, config.stdoutLogPath]);
   return {
     label: config.label,
@@ -13344,7 +14147,7 @@ async function restartBrokerService(config = resolveBrokerServiceConfig()) {
 }
 async function uninstallBrokerService(config = resolveBrokerServiceConfig()) {
   await stopBrokerService(config);
-  if (existsSync11(config.launchAgentPath)) {
+  if (existsSync12(config.launchAgentPath)) {
     rmSync2(config.launchAgentPath, { force: true });
   }
   return brokerServiceStatus(config);
@@ -13427,10 +14230,10 @@ function resolveProjectsRoot(projectPath) {
   }
   try {
     const supportPaths = resolveOpenScoutSupportPaths();
-    if (!existsSync12(supportPaths.settingsPath)) {
+    if (!existsSync13(supportPaths.settingsPath)) {
       return dirname6(projectPath);
     }
-    const raw = JSON.parse(readFileSync7(supportPaths.settingsPath, "utf8"));
+    const raw = JSON.parse(readFileSync8(supportPaths.settingsPath, "utf8"));
     const workspaceRoot = raw.discovery?.workspaceRoots?.find((entry) => typeof entry === "string" && entry.trim().length > 0);
     return workspaceRoot ? resolve5(workspaceRoot) : dirname6(projectPath);
   } catch {
@@ -13443,8 +14246,14 @@ function resolveBrokerUrl() {
 function nowSeconds2() {
   return Math.floor(Date.now() / 1000);
 }
+function scoutCliPath() {
+  return join15(OPENSCOUT_REPO_ROOT, "packages", "cli", "bin", "scout.mjs");
+}
+function legacyNodeBrokerRelayCommand() {
+  return `node ${JSON.stringify(scoutCliPath())}`;
+}
 function brokerRelayCommand() {
-  return `node ${JSON.stringify(join15(OPENSCOUT_REPO_ROOT, "packages", "cli", "bin", "scout.mjs"))}`;
+  return `bun ${JSON.stringify(scoutCliPath())}`;
 }
 function titleCaseLocalAgentName(value) {
   return value.split(/[-_.\s]+/).filter(Boolean).map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1)).join(" ");
@@ -13457,7 +14266,7 @@ function resolveScoutSkillPath() {
     join15(process.env.HOME ?? "", ".agents", "skills", "relay-agent-comms", "SKILL.md")
   ];
   for (const path2 of candidatePaths) {
-    if (existsSync12(path2)) {
+    if (existsSync13(path2)) {
       return path2;
     }
   }
@@ -13653,7 +14462,7 @@ function buildLegacyBrokerBackedRelayPrompt(agentId, projectName, projectPath, r
 function legacyLocalAgentSystemPromptCandidates(agentId, projectName, projectPath) {
   const relayHub = resolveRelayHub();
   const brokerUrl = resolveBrokerUrl();
-  const relayCommandBases = ["openscout relay", brokerRelayCommand()];
+  const relayCommandBases = ["openscout relay", brokerRelayCommand(), legacyNodeBrokerRelayCommand()];
   const projectPathCandidates = projectPath.endsWith("/") ? [projectPath, projectPath.slice(0, -1)] : [projectPath, `${projectPath}/`];
   const candidates = new Set;
   for (const pathCandidate of projectPathCandidates) {
@@ -13664,12 +14473,28 @@ function legacyLocalAgentSystemPromptCandidates(agentId, projectName, projectPat
   }
   return Array.from(candidates);
 }
+function generatedLocalAgentSystemPromptCandidates(agentId, projectName, projectPath) {
+  const baseContext = buildLocalAgentTemplateContext(agentId, projectName, projectPath);
+  const relayCommands = [brokerRelayCommand(), legacyNodeBrokerRelayCommand()];
+  const transportModes = [undefined, "codex_app_server", "claude_stream_json"];
+  const candidates = new Set;
+  for (const relayCommand of relayCommands) {
+    const context = {
+      ...baseContext,
+      relayCommand
+    };
+    for (const transport of transportModes) {
+      candidates.add(renderLocalAgentSystemPromptTemplate(buildLocalAgentSystemPromptTemplate(), context, transport ? { transport } : {}));
+    }
+  }
+  return Array.from(candidates);
+}
 function normalizeLocalAgentSystemPrompt(agentId, projectName, projectPath, systemPrompt) {
   const trimmed = systemPrompt?.trim();
   if (!trimmed) {
     return;
   }
-  if (legacyLocalAgentSystemPromptCandidates(agentId, projectName, projectPath).includes(trimmed)) {
+  if (legacyLocalAgentSystemPromptCandidates(agentId, projectName, projectPath).includes(trimmed) || generatedLocalAgentSystemPromptCandidates(agentId, projectName, projectPath).includes(trimmed)) {
     return;
   }
   return trimmed;
@@ -13749,6 +14574,128 @@ function normalizeLocalAgentCapabilities(value) {
 function normalizeLocalAgentLaunchArgs(value) {
   return Array.isArray(value) ? value.map((entry) => String(entry).trim()).filter(Boolean) : [];
 }
+function normalizeRequestedModel(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function readClaudeLaunchModel(launchArgs) {
+  for (let index = 0;index < launchArgs.length; index += 1) {
+    const current = launchArgs[index] ?? "";
+    if (current === "--model") {
+      const next = launchArgs[index + 1]?.trim();
+      return next || undefined;
+    }
+    if (current.startsWith("--model=")) {
+      const next = current.slice("--model=".length).trim();
+      return next || undefined;
+    }
+  }
+  return;
+}
+function normalizeLaunchArgsForHarness(harness, value) {
+  const normalized = normalizeLocalAgentLaunchArgs(value);
+  if (harness === "codex") {
+    return normalizeCodexAppServerLaunchArgs(normalized);
+  }
+  return normalized;
+}
+function readLaunchModelForHarness(harness, launchArgs) {
+  if (harness === "codex") {
+    return readCodexAppServerModelFromLaunchArgs(launchArgs) ?? undefined;
+  }
+  if (harness === "claude") {
+    return readClaudeLaunchModel(launchArgs ?? []);
+  }
+  return;
+}
+function stripLaunchModelForHarness(harness, launchArgs) {
+  if (harness === "codex") {
+    const next = [];
+    const normalized = normalizeCodexAppServerLaunchArgs(launchArgs);
+    for (let index = 0;index < normalized.length; index += 1) {
+      const current = normalized[index] ?? "";
+      if (current === "-c" || current === "--config") {
+        const value = normalized[index + 1];
+        if (readCodexAppServerModelFromLaunchArgs(value ? [current, value] : [current])) {
+          index += 1;
+          continue;
+        }
+        next.push(current);
+        if (value) {
+          next.push(value);
+          index += 1;
+        }
+        continue;
+      }
+      if (current.startsWith("--config=")) {
+        if (readCodexAppServerModelFromLaunchArgs([current])) {
+          continue;
+        }
+      }
+      next.push(current);
+    }
+    return next;
+  }
+  if (harness === "claude") {
+    const next = [];
+    const normalized = normalizeLocalAgentLaunchArgs(launchArgs);
+    for (let index = 0;index < normalized.length; index += 1) {
+      const current = normalized[index] ?? "";
+      if (current === "--model") {
+        index += 1;
+        continue;
+      }
+      if (current.startsWith("--model=")) {
+        continue;
+      }
+      next.push(current);
+    }
+    return next;
+  }
+  return normalizeLocalAgentLaunchArgs(launchArgs);
+}
+function buildLaunchArgsForRequestedModel(harness, model) {
+  if (harness === "codex") {
+    return normalizeCodexAppServerLaunchArgs(["--model", model]);
+  }
+  if (harness === "claude") {
+    return ["--model", model];
+  }
+  return [];
+}
+function applyRequestedModelToLaunchArgs(harness, launchArgs, model) {
+  const normalized = normalizeLaunchArgsForHarness(harness, launchArgs);
+  const requestedModel = normalizeRequestedModel(model);
+  if (!requestedModel) {
+    return normalized;
+  }
+  return [
+    ...stripLaunchModelForHarness(harness, normalized),
+    ...buildLaunchArgsForRequestedModel(harness, requestedModel)
+  ];
+}
+function defaultHarnessForOverride(override, fallback = "claude") {
+  return normalizeManagedHarness2(override.defaultHarness ?? override.runtime?.harness, fallback);
+}
+function launchArgsForOverrideHarness(override, harness) {
+  const profileLaunchArgs = override.harnessProfiles?.[harness]?.launchArgs;
+  if (profileLaunchArgs) {
+    return normalizeLaunchArgsForHarness(harness, profileLaunchArgs);
+  }
+  if (harness === defaultHarnessForOverride(override, harness)) {
+    return normalizeLaunchArgsForHarness(harness, override.launchArgs);
+  }
+  return [];
+}
+function overrideHarnessProfile(override, harness) {
+  const profile = override.harnessProfiles?.[harness];
+  return {
+    cwd: normalizeProjectPath(profile?.cwd || override.runtime?.cwd || override.projectRoot || process.cwd()),
+    transport: normalizeLocalAgentTransport(profile?.transport ?? override.runtime?.transport, harness),
+    sessionId: normalizeTmuxSessionName2(profile?.sessionId, `${override.agentId}-${harness}`),
+    launchArgs: launchArgsForOverrideHarness(override, harness)
+  };
+}
 function normalizeManagedHarness2(value, fallback) {
   return value === "codex" ? "codex" : value === "claude" ? "claude" : fallback;
 }
@@ -13764,7 +14711,7 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(profile.cwd || record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(profile.transport, harness),
       sessionId: normalizeTmuxSessionName2(profile.sessionId, `${agentId}-${harness}`),
-      launchArgs: normalizeLocalAgentLaunchArgs(profile.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(harness, profile.launchArgs)
     };
   }
   const runtimeHarness = normalizeManagedHarness2(record.harness, defaultHarness);
@@ -13773,7 +14720,7 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(record.transport, runtimeHarness),
       sessionId: normalizeTmuxSessionName2(record.tmuxSession, `${agentId}-${runtimeHarness}`),
-      launchArgs: normalizeLocalAgentLaunchArgs(record.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(runtimeHarness, record.launchArgs)
     };
   }
   if (!nextProfiles[defaultHarness]) {
@@ -13781,7 +14728,7 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(record.transport, defaultHarness),
       sessionId: normalizeTmuxSessionName2(record.tmuxSession, `${agentId}-${defaultHarness}`),
-      launchArgs: normalizeLocalAgentLaunchArgs(record.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(defaultHarness, record.launchArgs)
     };
   }
   for (const harness of ["claude", "codex"]) {
@@ -13793,7 +14740,7 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(profile.cwd || record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(profile.transport, harness),
       sessionId: normalizeTmuxSessionName2(profile.sessionId, `${agentId}-${harness}`),
-      launchArgs: normalizeLocalAgentLaunchArgs(profile.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(harness, profile.launchArgs)
     };
   }
   return nextProfiles;
@@ -13817,14 +14764,14 @@ function recordForHarness(record, harnessOverride) {
       tmuxSession: fallbackSessionId,
       cwd: fallbackCwd,
       transport: fallbackTransport,
-      launchArgs: normalizeLocalAgentLaunchArgs(normalized.launchArgs),
+      launchArgs: normalizeLaunchArgsForHarness(selectedHarness, normalized.launchArgs),
       harnessProfiles: {
         ...normalized.harnessProfiles,
         [selectedHarness]: {
           cwd: fallbackCwd,
           transport: fallbackTransport,
           sessionId: fallbackSessionId,
-          launchArgs: normalizeLocalAgentLaunchArgs(normalized.launchArgs)
+          launchArgs: normalizeLaunchArgsForHarness(selectedHarness, normalized.launchArgs)
         }
       }
     };
@@ -13866,7 +14813,7 @@ function normalizeLocalAgentRecord(agentId, record) {
     harnessProfiles,
     transport: activeProfile?.transport ?? normalizeLocalAgentTransport(record.transport, harness),
     capabilities: normalizeLocalAgentCapabilities(record.capabilities),
-    launchArgs: activeProfile?.launchArgs ?? normalizeLocalAgentLaunchArgs(record.launchArgs)
+    launchArgs: activeProfile?.launchArgs ?? normalizeLaunchArgsForHarness(harness, record.launchArgs)
   };
 }
 function localAgentStatusFromRecord(agentId, record, source) {
@@ -13935,7 +14882,7 @@ function relayAgentOverrideFromLocalAgentRecord(agentId, record, existing) {
     source: existing?.source && existing.source !== "inferred" ? existing.source : "manual",
     startedAt: normalizedRecord.startedAt,
     systemPrompt: normalizedRecord.systemPrompt,
-    launchArgs: normalizeLocalAgentLaunchArgs(normalizedRecord.launchArgs),
+    launchArgs: normalizeLaunchArgsForHarness(normalizeLocalAgentHarness(normalizedRecord.harness), normalizedRecord.launchArgs),
     capabilities: normalizeLocalAgentCapabilities(normalizedRecord.capabilities),
     defaultHarness: normalizeManagedHarness2(normalizedRecord.defaultHarness, "claude"),
     harnessProfiles: normalizedRecord.harnessProfiles,
@@ -13956,7 +14903,7 @@ function buildCodexAgentSessionOptions(agentName, record, systemPrompt) {
     systemPrompt: systemPrompt ?? buildLocalAgentSystemPrompt(agentName, record.project, record.cwd, { transport: "codex_app_server" }),
     runtimeDirectory: relayAgentRuntimeDirectory(agentName),
     logsDirectory: relayAgentLogsDirectory(agentName),
-    launchArgs: normalizeLocalAgentLaunchArgs(record.launchArgs)
+    launchArgs: normalizeLaunchArgsForHarness("codex", record.launchArgs)
   };
 }
 function buildClaudeAgentSessionOptions(agentName, record, systemPrompt) {
@@ -13967,7 +14914,7 @@ function buildClaudeAgentSessionOptions(agentName, record, systemPrompt) {
     systemPrompt: systemPrompt ?? buildLocalAgentSystemPrompt(agentName, record.project, record.cwd, { transport: "claude_stream_json" }),
     runtimeDirectory: relayAgentRuntimeDirectory(agentName),
     logsDirectory: relayAgentLogsDirectory(agentName),
-    launchArgs: normalizeLocalAgentLaunchArgs(record.launchArgs)
+    launchArgs: normalizeLaunchArgsForHarness("claude", record.launchArgs)
   };
 }
 function isLocalAgentRecordOnline(agentName, record) {
@@ -14001,7 +14948,7 @@ function buildLocalAgentBootstrapPrompt(_harness, _systemPrompt, initialMessage)
   return initialMessage;
 }
 function buildLocalAgentLaunchCommand(agentName, record, projectPath, promptFile, workerScript) {
-  const extraArgs = shellQuoteArguments(normalizeLocalAgentLaunchArgs(record.launchArgs));
+  const extraArgs = shellQuoteArguments(normalizeLaunchArgsForHarness(normalizeLocalAgentHarness(record.harness), record.launchArgs));
   if (normalizeLocalAgentHarness(record.harness) === "codex") {
     return `exec bash ${JSON.stringify(workerScript ?? join15(relayAgentRuntimeDirectory(agentName), "codex-worker.sh"))}`;
   }
@@ -14157,7 +15104,7 @@ async function ensureLocalAgentOnline(agentName, record) {
     await new Promise((resolve6) => setTimeout(resolve6, 100));
   }
   if (!isLocalAgentSessionAlive(normalizedRecord.tmuxSession)) {
-    const stderrTail = existsSync12(stderrLogFile) ? readFileSync7(stderrLogFile, "utf8").trim().split(/\r?\n/).slice(-10).join(`
+    const stderrTail = existsSync13(stderrLogFile) ? readFileSync8(stderrLogFile, "utf8").trim().split(/\r?\n/).slice(-10).join(`
 `).trim() : "";
     throw new Error(stderrTail ? `Relay agent ${agentName} failed to stay online:
 ${stderrTail}` : `Relay agent ${agentName} failed to stay online.`);
@@ -14267,6 +15214,7 @@ async function startLocalAgent(input) {
     const effectiveHarness = normalizeManagedHarness2(preferredHarness ?? configDefaultHarness, "claude");
     const transport = normalizeLocalAgentTransport(undefined, effectiveHarness);
     const sessionId = normalizeTmuxSessionName2(undefined, `${instance.id}-${effectiveHarness}`);
+    const launchArgs = applyRequestedModelToLaunchArgs(effectiveHarness, [], input.model);
     const existingForInstance = overrides[instance.id];
     if (existingForInstance && normalizeProjectPath(existingForInstance.projectRoot) !== projectRoot) {
       throw new Error(`Another agent is already registered as ${instance.id} at ${existingForInstance.projectRoot}. ` + `Two clones of the same project on the same branch cannot both register here; ` + `rename one of the checkouts or switch its branch before running scout up.`);
@@ -14280,13 +15228,14 @@ async function startLocalAgent(input) {
       projectConfigPath: coldProjectConfigPath,
       source: "manual",
       startedAt: nowSeconds2(),
+      launchArgs,
       defaultHarness: effectiveHarness,
       harnessProfiles: {
         [effectiveHarness]: {
           cwd: effectiveCwd ?? projectRoot,
           transport,
           sessionId,
-          launchArgs: []
+          launchArgs
         }
       },
       runtime: {
@@ -14307,6 +15256,9 @@ async function startLocalAgent(input) {
       throw new Error(`Another agent is already registered as ${instance.id} at ${existingForInstance.projectRoot}. ` + `Two clones of the same project on the same branch cannot both register here; ` + `rename one of the checkouts or switch its branch before running scout up.`);
     }
     const resolvedHarness = preferredHarness ?? matchingOverride.runtime?.harness;
+    const nextHarness = normalizeManagedHarness2(resolvedHarness, "claude");
+    const nextDefaultHarness = preferredHarness ? normalizeManagedHarness2(preferredHarness, "claude") : defaultHarnessForOverride(matchingOverride, "claude");
+    const nextLaunchArgs = applyRequestedModelToLaunchArgs(nextHarness, launchArgsForOverrideHarness(matchingOverride, nextHarness), input.model);
     overrides[instance.id] = {
       agentId: instance.id,
       definitionId: requestedDefinitionId,
@@ -14317,10 +15269,16 @@ async function startLocalAgent(input) {
       source: "manual",
       startedAt: matchingOverride.startedAt ?? nowSeconds2(),
       systemPrompt: matchingOverride.systemPrompt,
-      launchArgs: matchingOverride.launchArgs,
+      launchArgs: nextHarness === nextDefaultHarness ? nextLaunchArgs : matchingOverride.launchArgs,
       capabilities: matchingOverride.capabilities,
-      defaultHarness: normalizeManagedHarness2(preferredHarness ?? matchingOverride.defaultHarness, "claude"),
-      harnessProfiles: matchingOverride.harnessProfiles,
+      defaultHarness: nextDefaultHarness,
+      harnessProfiles: {
+        ...matchingOverride.harnessProfiles ?? {},
+        [nextHarness]: {
+          ...overrideHarnessProfile(matchingOverride, nextHarness),
+          launchArgs: nextLaunchArgs
+        }
+      },
       runtime: {
         cwd: effectiveCwd ?? matchingOverride.runtime?.cwd ?? matchingProjectRoot,
         harness: resolvedHarness,
@@ -14332,6 +15290,22 @@ async function startLocalAgent(input) {
     await writeRelayAgentOverrides(overrides);
     targetAgentId = instance.id;
   } else {
+    if (input.model) {
+      const existingHarness = normalizeManagedHarness2(preferredHarness ?? matchingOverride.defaultHarness ?? matchingOverride.runtime?.harness, "claude");
+      const nextLaunchArgs = applyRequestedModelToLaunchArgs(existingHarness, launchArgsForOverrideHarness(matchingOverride, existingHarness), input.model);
+      overrides[matchingAgentId] = {
+        ...matchingOverride,
+        launchArgs: existingHarness === defaultHarnessForOverride(matchingOverride, existingHarness) ? nextLaunchArgs : matchingOverride.launchArgs,
+        harnessProfiles: {
+          ...matchingOverride.harnessProfiles ?? {},
+          [existingHarness]: {
+            ...overrideHarnessProfile(matchingOverride, existingHarness),
+            launchArgs: nextLaunchArgs
+          }
+        }
+      };
+      await writeRelayAgentOverrides(overrides);
+    }
     targetAgentId = matchingAgentId;
   }
   await ensureLocalAgentBindingOnline(targetAgentId, process.env.OPENSCOUT_NODE_ID ?? "local", {
@@ -14402,13 +15376,38 @@ async function interruptLocalAgent(agentId) {
     return { ok: false, agentId };
   }
 }
+function readPersistedClaudeSessionId(agentName) {
+  try {
+    const runtimeDir = relayAgentRuntimeDirectory(agentName);
+    const catalogPath = join15(runtimeDir, "session-catalog.json");
+    if (existsSync13(catalogPath)) {
+      const raw = readFileSync8(catalogPath, "utf8").trim();
+      if (raw) {
+        const catalog = JSON.parse(raw);
+        if (typeof catalog.activeSessionId === "string" && catalog.activeSessionId.trim()) {
+          return catalog.activeSessionId.trim();
+        }
+      }
+    }
+    const legacyPath = join15(runtimeDir, "claude-session-id.txt");
+    if (existsSync13(legacyPath)) {
+      const value = readFileSync8(legacyPath, "utf8").trim();
+      return value || null;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
 function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
   const normalizedRecord = normalizeLocalAgentRecord(agentId, record);
+  const configuredModel = readLaunchModelForHarness(normalizeLocalAgentHarness(normalizedRecord.harness), normalizedRecord.launchArgs);
   const definitionId = normalizedRecord.definitionId ?? agentId;
   const displayName = titleCaseLocalAgentName(definitionId);
   const projectRoot = normalizedRecord.projectRoot ?? normalizedRecord.cwd;
   const instance = buildRelayAgentInstance(definitionId, projectRoot);
   const actorId = instance.id;
+  const externalSessionId = normalizedRecord.transport === "claude_stream_json" ? readPersistedClaudeSessionId(definitionId) : null;
   return {
     actor: {
       id: actorId,
@@ -14427,7 +15426,8 @@ function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
         defaultSelector: instance.defaultSelector,
         nodeQualifier: instance.nodeQualifier,
         workspaceQualifier: instance.workspaceQualifier,
-        branch: instance.branch
+        branch: instance.branch,
+        ...configuredModel ? { model: configuredModel } : {}
       }
     },
     agent: {
@@ -14454,7 +15454,8 @@ function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
         defaultSelector: instance.defaultSelector,
         nodeQualifier: instance.nodeQualifier,
         workspaceQualifier: instance.workspaceQualifier,
-        branch: instance.branch
+        branch: instance.branch,
+        ...configuredModel ? { model: configuredModel } : {}
       },
       agentClass: "general",
       capabilities: normalizeLocalAgentCapabilities(normalizedRecord.capabilities),
@@ -14486,7 +15487,9 @@ function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
         selector: instance.selector,
         nodeQualifier: instance.nodeQualifier,
         workspaceQualifier: instance.workspaceQualifier,
-        branch: instance.branch
+        branch: instance.branch,
+        ...configuredModel ? { model: configuredModel } : {},
+        ...externalSessionId ? { externalSessionId } : {}
       }
     }
   };
@@ -15811,7 +16814,7 @@ async function deriveNewAgentName(projectName, branch, harness) {
 async function createGitWorktree(projectRoot, agentName) {
   const { execSync: execSync3 } = await import("child_process");
   const { join: join17 } = await import("path");
-  const { mkdirSync: mkdirSync9, existsSync: existsSync13 } = await import("fs");
+  const { mkdirSync: mkdirSync9, existsSync: existsSync14 } = await import("fs");
   try {
     execSync3("git rev-parse --git-dir", { cwd: projectRoot, stdio: "pipe" });
   } catch {
@@ -15820,7 +16823,7 @@ async function createGitWorktree(projectRoot, agentName) {
   const branchName = `scout/${agentName}`;
   const worktreeDir = join17(projectRoot, ".scout-worktrees");
   const worktreePath = join17(worktreeDir, agentName);
-  if (existsSync13(worktreePath)) {
+  if (existsSync14(worktreePath)) {
     return { path: worktreePath, branch: branchName };
   }
   mkdirSync9(worktreeDir, { recursive: true });
@@ -15862,6 +16865,20 @@ function readSyncStatus(bridge, sessionId) {
     oldestBufferedSeq: bridge.oldestBufferedSeq(sessionId)
   };
 }
+function resolveSyncSessionId(bridge, preferredSessionId) {
+  if (preferredSessionId) {
+    return preferredSessionId;
+  }
+  let latestSessionId = null;
+  let latestActivityAt = Number.NEGATIVE_INFINITY;
+  for (const session of bridge.getSessionSummaries()) {
+    if (session.lastActivityAt > latestActivityAt) {
+      latestActivityAt = session.lastActivityAt;
+      latestSessionId = session.sessionId;
+    }
+  }
+  return latestSessionId;
+}
 function sessionRegistryErrorResponse(reqId, error) {
   if (!isSessionRegistryError(error)) {
     return null;
@@ -15931,23 +16948,36 @@ async function handleRPCInner(bridge, req, deviceId) {
         return { id: req.id, result: { ok: true } };
       }
       case "sync/replay": {
-        const p = req.params;
-        if (!p.sessionId) {
-          return { id: req.id, error: { code: -32602, message: "sessionId is required" } };
+        const p = req.params ?? {};
+        if (typeof p.lastSeq !== "number") {
+          return { id: req.id, error: { code: -32602, message: "lastSeq is required" } };
         }
-        const events2 = replaySyncEvents(bridge, p.sessionId, p.lastSeq);
+        const sessionId = resolveSyncSessionId(bridge, p.sessionId);
+        if (!sessionId) {
+          return { id: req.id, result: { events: [] } };
+        }
+        const events2 = replaySyncEvents(bridge, sessionId, p.lastSeq);
         return { id: req.id, result: { events: events2 } };
       }
       case "sync/status": {
         const p = req.params ?? {};
-        if (!p.sessionId) {
-          return { id: req.id, error: { code: -32602, message: "sessionId is required" } };
+        const sessionCount = bridge.listSessions().length;
+        const sessionId = resolveSyncSessionId(bridge, p.sessionId);
+        if (!sessionId) {
+          return {
+            id: req.id,
+            result: {
+              currentSeq: 0,
+              oldestBufferedSeq: 0,
+              sessionCount
+            }
+          };
         }
         return {
           id: req.id,
           result: {
-            ...readSyncStatus(bridge, p.sessionId),
-            sessionCount: bridge.listSessions().length
+            ...readSyncStatus(bridge, sessionId),
+            sessionCount
           }
         };
       }
@@ -16188,7 +17218,7 @@ async function handleRPCInner(bridge, req, deviceId) {
           return { id: req.id, error: { code: -32000, message: "Only .jsonl files can be read" } };
         }
         try {
-          const content = readFileSync8(p.path, "utf-8");
+          const content = readFileSync9(p.path, "utf-8");
           const lines = content.split(`
 `).filter((l) => l.trim().length > 0);
           const trimmed = lines.length > 500 ? lines.slice(-500) : lines;
@@ -33081,7 +34111,7 @@ class ThreadEventPlane {
 }
 // ../runtime/src/mobile-push.ts
 import { Database as Database2 } from "bun:sqlite";
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync9 } from "fs";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync10 } from "fs";
 import { connect as connectHttp2 } from "http2";
 import { createPrivateKey, sign as signWithKey } from "crypto";
 import { dirname as dirname7, join as join18 } from "path";
@@ -33278,7 +34308,7 @@ function loadApnsCredentials() {
     privateKeyPem = Buffer.from(inlineBase64, "base64").toString("utf8");
   }
   if (!privateKeyPem && path2) {
-    privateKeyPem = readFileSync9(path2, "utf8");
+    privateKeyPem = readFileSync10(path2, "utf8");
   }
   if (!teamId || !keyId || !privateKeyPem) {
     return null;
@@ -33452,7 +34482,7 @@ async function broadcastApnsAlertToActiveMobileDevices(alert) {
   };
 }
 // ../../apps/desktop/src/core/pairing/runtime/bridge/router.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync4, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync11, readdirSync as readdirSync4, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
 import { execSync as execSync4 } from "child_process";
 import { basename as basename7, isAbsolute as isAbsolute4, join as join19, relative as relative3 } from "path";
 import { homedir as homedir16 } from "os";
@@ -33935,6 +34965,64 @@ var mobileRouter = t.router({
       limit: typeof input.limit === "number" ? input.limit : null
     }, resolveMobileCurrentDirectory2());
   }),
+  webHandoff: procedure.input(exports_external.object({
+    kind: exports_external.enum(["session", "file_change"]),
+    sessionId: exports_external.string(),
+    turnId: exports_external.string().optional(),
+    blockId: exports_external.string().optional()
+  })).mutation(({ input, ctx }) => {
+    if (!ctx.deviceId) {
+      throw new TRPCError({
+        code: "UNAUTHORIZED",
+        message: "Secure web handoff requires a paired mobile device"
+      });
+    }
+    const snapshot = ctx.bridge.getSessionSnapshot(input.sessionId);
+    if (!snapshot) {
+      throw new TRPCError({
+        code: "NOT_FOUND",
+        message: `No session: ${input.sessionId}`
+      });
+    }
+    let scope;
+    let title = snapshot.session.name || snapshot.session.id;
+    if (input.kind === "file_change") {
+      if (!input.turnId || !input.blockId) {
+        throw new TRPCError({
+          code: "BAD_REQUEST",
+          message: "turnId and blockId are required for file_change handoffs"
+        });
+      }
+      const turn = snapshot.turns.find((candidate) => candidate.id === input.turnId);
+      const block = turn?.blocks.find((candidate) => candidate.block.id === input.blockId)?.block;
+      if (!turn || !block || block.type !== "action" || block.action.kind !== "file_change") {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "File change block not found"
+        });
+      }
+      scope = {
+        kind: "file_change",
+        sessionId: input.sessionId,
+        turnId: input.turnId,
+        blockId: input.blockId
+      };
+      title = block.action.path || title;
+    } else {
+      scope = {
+        kind: "session",
+        sessionId: input.sessionId
+      };
+    }
+    const issued = issueWebHandoff(scope, ctx.deviceId);
+    return {
+      kind: input.kind,
+      path: pathForWebHandoffScope(scope),
+      token: issued.token,
+      expiresAt: issued.expiresAt,
+      title
+    };
+  }),
   createSession: procedure.input(exports_external.object({
     workspaceId: exports_external.string(),
     harness: exports_external.string().optional(),
@@ -34110,7 +35198,7 @@ var historyRouter = t.router({
       });
     }
     try {
-      const content = readFileSync10(input.path, "utf-8");
+      const content = readFileSync11(input.path, "utf-8");
       const lines = content.split(`
 `).filter((l) => l.trim().length > 0);
       const trimmed = lines.length > 500 ? lines.slice(-500) : lines;
@@ -34148,15 +35236,42 @@ function readSyncStatus2(bridge, sessionId) {
     oldestBufferedSeq: bridge.oldestBufferedSeq(sessionId)
   };
 }
+function resolveSyncSessionId2(bridge, preferredSessionId) {
+  if (preferredSessionId) {
+    return preferredSessionId;
+  }
+  let latestSessionId = null;
+  let latestActivityAt = Number.NEGATIVE_INFINITY;
+  for (const session of bridge.getSessionSummaries()) {
+    if (session.lastActivityAt > latestActivityAt) {
+      latestActivityAt = session.lastActivityAt;
+      latestSessionId = session.sessionId;
+    }
+  }
+  return latestSessionId;
+}
 var syncRouter = t.router({
-  replay: procedure.input(exports_external.object({ lastSeq: exports_external.number(), sessionId: exports_external.string() })).query(({ input, ctx }) => {
-    const events2 = replaySyncEvents2(ctx.bridge, input.sessionId, input.lastSeq);
+  replay: procedure.input(exports_external.object({ lastSeq: exports_external.number(), sessionId: exports_external.string().optional() })).query(({ input, ctx }) => {
+    const sessionId = resolveSyncSessionId2(ctx.bridge, input.sessionId);
+    if (!sessionId) {
+      return { events: [] };
+    }
+    const events2 = replaySyncEvents2(ctx.bridge, sessionId, input.lastSeq);
     return { events: events2 };
   }),
-  status: procedure.input(exports_external.object({ sessionId: exports_external.string() })).query(({ input, ctx }) => {
+  status: procedure.input(exports_external.object({ sessionId: exports_external.string().optional() }).optional()).query(({ input, ctx }) => {
+    const sessionCount = ctx.bridge.listSessions().length;
+    const sessionId = resolveSyncSessionId2(ctx.bridge, input?.sessionId);
+    if (!sessionId) {
+      return {
+        currentSeq: 0,
+        oldestBufferedSeq: 0,
+        sessionCount
+      };
+    }
     return {
-      ...readSyncStatus2(ctx.bridge, input.sessionId),
-      sessionCount: ctx.bridge.listSessions().length
+      ...readSyncStatus2(ctx.bridge, sessionId),
+      sessionCount
     };
   })
 });
@@ -38658,7 +39773,7 @@ async function startPairingRuntime(options) {
     secure: config2.secure,
     identity: config2.secure ? identity2 : undefined
   });
-  const fileServer = startFileServer({ port: config2.port + 2 });
+  const fileServer = startFileServer({ port: config2.port + 2, bridge });
   const relayUrl = options?.relayUrl?.trim() || config2.relay || null;
   if (!relayUrl) {
     fileServer.stop();