@openscout/scout 0.2.58 → 0.2.60

package/dist/pair-supervisor.mjs

@@ -956,19 +956,58 @@ function findStoredCerts() {
     return null;
   }
 }
-function getTailscaleHostname() {
+function readTailscaleStatus() {
   try {
     const output = execSync("tailscale status --self=true --peers=false --json", {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 5000
     }).toString();
     const data = JSON.parse(output);
-    const dnsName = data?.Self?.DNSName ?? "";
-    return dnsName.replace(/\.$/, "") || null;
+    const dnsName = typeof data.Self?.DNSName === "string" ? data.Self.DNSName.replace(/\.$/, "") : "";
+    return {
+      backendState: typeof data.BackendState === "string" ? data.BackendState : null,
+      dnsName: dnsName || null,
+      online: data.Self?.Online !== false,
+      health: Array.isArray(data.Health) ? data.Health.filter((entry) => typeof entry === "string") : []
+    };
   } catch {
     return null;
   }
 }
+function resolveRelayEndpointForTailscaleStatus(port, tailscale) {
+  const backendState = tailscale?.backendState?.trim().toLowerCase() ?? "";
+  const hostname = tailscale?.dnsName ?? null;
+  const tailscaleRunning = backendState === "running" && tailscale?.online !== false && Boolean(hostname);
+  const tls = resolveTls(tailscaleRunning ? hostname : null);
+  if (tailscaleRunning && hostname && tls) {
+    return {
+      relayUrl: `wss://${hostname}:${port}`,
+      options: { tls }
+    };
+  }
+  if (tailscaleRunning && hostname) {
+    pairingLog.warn("relay", "tailscale is running without TLS; falling back to insecure websocket relay", {
+      hostname,
+      port
+    });
+    return {
+      relayUrl: `ws://${hostname}:${port}`,
+      options: {}
+    };
+  }
+  if (hostname && backendState && backendState !== "running") {
+    pairingLog.warn("relay", "tailscale hostname detected but tailscale is not running; using local-only relay endpoint", {
+      hostname,
+      backendState,
+      health: tailscale?.health ?? [],
+      port
+    });
+  }
+  return {
+    relayUrl: `ws://127.0.0.1:${port}`,
+    options: {}
+  };
+}
 function generateTailscaleCerts(hostname) {
   mkdirSync3(PAIRING_DIR, { recursive: true });
   const certPath = join(PAIRING_DIR, `${hostname}.crt`);
@@ -1014,28 +1053,7 @@ function resolveTls(hostname) {
   return generateTailscaleCerts(hostname);
 }
 function resolveRelayEndpoint(port) {
-  const hostname = getTailscaleHostname();
-  const tls = resolveTls(hostname);
-  if (hostname && tls) {
-    return {
-      relayUrl: `wss://${hostname}:${port}`,
-      options: { tls }
-    };
-  }
-  if (hostname) {
-    pairingLog.warn("relay", "tailscale hostname detected without TLS; falling back to insecure websocket relay", {
-      hostname,
-      port
-    });
-    return {
-      relayUrl: `ws://${hostname}:${port}`,
-      options: {}
-    };
-  }
-  return {
-    relayUrl: `ws://127.0.0.1:${port}`,
-    options: {}
-  };
+  return resolveRelayEndpointForTailscaleStatus(port, readTailscaleStatus());
 }
 function startManagedRelay(port = 7889) {
   const endpoint = resolveRelayEndpoint(port);
@@ -7869,7 +7887,73 @@ function resolveConfig() {
 // ../../apps/desktop/src/core/pairing/runtime/bridge/fileserver.ts
 import { isAbsolute } from "path";
 import { homedir as homedir9 } from "os";
+
+// ../../apps/desktop/src/core/pairing/runtime/bridge/web-handoff.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var SCOUT_WEB_HANDOFF_COOKIE = "scout_handoff";
+var WEB_HANDOFF_TTL_MS = 5 * 60 * 1000;
+var activeWebHandoffs = new Map;
+function pruneExpiredWebHandoffs(now = Date.now()) {
+  for (const [token, record] of activeWebHandoffs) {
+    if (record.expiresAt <= now) {
+      activeWebHandoffs.delete(token);
+    }
+  }
+}
+function scopesMatch(left, right) {
+  if (left.kind !== right.kind) {
+    return false;
+  }
+  if (left.sessionId !== right.sessionId) {
+    return false;
+  }
+  if (left.kind === "session") {
+    return true;
+  }
+  return left.turnId === right.turnId && left.blockId === right.blockId;
+}
+function pathForWebHandoffScope(scope) {
+  switch (scope.kind) {
+    case "session":
+      return `/handoff/session/${encodeURIComponent(scope.sessionId)}`;
+    case "file_change":
+      return `/handoff/file-change/${encodeURIComponent(scope.sessionId)}/${encodeURIComponent(scope.turnId)}/${encodeURIComponent(scope.blockId)}`;
+  }
+}
+function issueWebHandoff(scope, deviceId) {
+  pruneExpiredWebHandoffs();
+  const token = randomBytes2(24).toString("base64url");
+  const expiresAt = Date.now() + WEB_HANDOFF_TTL_MS;
+  activeWebHandoffs.set(token, {
+    token,
+    deviceId: deviceId?.trim() || null,
+    expiresAt,
+    scope
+  });
+  return { token, expiresAt, scope };
+}
+function readAuthorizedWebHandoff(token, scope) {
+  pruneExpiredWebHandoffs();
+  if (!token) {
+    return null;
+  }
+  const record = activeWebHandoffs.get(token);
+  if (!record) {
+    return null;
+  }
+  if (!scopesMatch(record.scope, scope)) {
+    return null;
+  }
+  return record;
+}
+
+// ../../apps/desktop/src/core/pairing/runtime/bridge/fileserver.ts
 var ALLOWED_ROOTS = [homedir9(), "/tmp"];
+var LOOPBACK_IPV4_HOST_PATTERN = /^127(?:\.\d{1,3}){3}$/;
+function isTrustedLoopbackHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::1" || LOOPBACK_IPV4_HOST_PATTERN.test(normalized);
+}
 function isAllowedPath(filePath) {
   if (!isAbsolute(filePath))
     return false;
@@ -7880,7 +7964,7 @@ function isAllowedPath(filePath) {
   return ALLOWED_ROOTS.some((root) => filePath.startsWith(root));
 }
 function startFileServer(options) {
-  const { port } = options;
+  const { port, bridge } = options;
   let server = null;
   function start() {
     try {
@@ -7888,7 +7972,7 @@ function startFileServer(options) {
         port,
         fetch(req) {
           try {
-            return route(new URL(req.url));
+            return route(req, new URL(req.url), bridge);
           } catch (err) {
             console.error(`[fileserver] ${req.url} \u2192`, err.message);
             return new Response("Internal error", { status: 500 });
@@ -7911,12 +7995,19 @@ function startFileServer(options) {
   start();
   return { port, stop, restart };
 }
-function route(url) {
+function route(req, url, bridge) {
   const path2 = url.pathname;
-  if (path2 === "/file")
+  if (path2 === "/file") {
+    if (!isTrustedLoopbackHostname(url.hostname)) {
+      return new Response("Forbidden", { status: 403 });
+    }
     return serveFile(url);
+  }
   if (path2 === "/health")
     return Response.json({ ok: true });
+  if (path2.startsWith("/handoff/")) {
+    return serveHandoffPage(req, url, bridge);
+  }
   return new Response("Pairing file server", { status: 200 });
 }
 function serveFile(url) {
@@ -7930,6 +8021,520 @@ function serveFile(url) {
     return new Response("Not found", { status: 404 });
   return new Response(file);
 }
+function serveHandoffPage(req, url, bridge) {
+  if (!bridge) {
+    return new Response("Secure handoff unavailable", { status: 503 });
+  }
+  const scope = parseHandoffScope(url);
+  if (!scope) {
+    return new Response("Not found", { status: 404 });
+  }
+  const token = readHandoffToken(req);
+  const authorized = readAuthorizedWebHandoff(token, scope);
+  if (!authorized) {
+    return unauthorizedHandoffResponse();
+  }
+  let html;
+  switch (scope.kind) {
+    case "session": {
+      const snapshot = bridge.getSessionSnapshot(scope.sessionId);
+      if (!snapshot) {
+        return new Response("Session handoff expired", { status: 404 });
+      }
+      html = renderSessionHandoffPage(snapshot);
+      break;
+    }
+    case "file_change": {
+      const snapshot = bridge.getSessionSnapshot(scope.sessionId);
+      if (!snapshot) {
+        return new Response("Session handoff expired", { status: 404 });
+      }
+      const target = findFileChangeBlock(snapshot, scope.turnId, scope.blockId);
+      if (!target) {
+        return new Response("File change handoff expired", { status: 404 });
+      }
+      html = renderFileChangeHandoffPage(snapshot, target.turn, target.block);
+      break;
+    }
+  }
+  const headers = new Headers({
+    "content-type": "text/html; charset=utf-8",
+    "cache-control": "no-store",
+    "x-content-type-options": "nosniff"
+  });
+  headers.set("set-cookie", `${SCOUT_WEB_HANDOFF_COOKIE}=${authorized.token}; Max-Age=300; Path=/handoff; HttpOnly; SameSite=Strict`);
+  return new Response(html, { status: 200, headers });
+}
+function unauthorizedHandoffResponse() {
+  return new Response("Secure handoff required", {
+    status: 401,
+    headers: {
+      "cache-control": "no-store",
+      "set-cookie": `${SCOUT_WEB_HANDOFF_COOKIE}=; Max-Age=0; Path=/handoff; HttpOnly; SameSite=Strict`
+    }
+  });
+}
+function parseHandoffScope(url) {
+  const parts = url.pathname.split("/").filter(Boolean).map((part) => decodeURIComponent(part));
+  if (parts[0] !== "handoff") {
+    return null;
+  }
+  if (parts[1] === "session" && parts[2]) {
+    return { kind: "session", sessionId: parts[2] };
+  }
+  if (parts[1] === "file-change" && parts[2] && parts[3] && parts[4]) {
+    return {
+      kind: "file_change",
+      sessionId: parts[2],
+      turnId: parts[3],
+      blockId: parts[4]
+    };
+  }
+  return null;
+}
+function readHandoffToken(req) {
+  const headerToken = req.headers.get("x-scout-handoff-token")?.trim();
+  if (headerToken) {
+    return headerToken;
+  }
+  const cookieHeader = req.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === SCOUT_WEB_HANDOFF_COOKIE) {
+      const value = rest.join("=").trim();
+      return value || null;
+    }
+  }
+  return null;
+}
+function findFileChangeBlock(snapshot, turnId, blockId) {
+  const turn = snapshot.turns.find((candidate) => candidate.id === turnId);
+  if (!turn) {
+    return null;
+  }
+  const blockState = turn.blocks.find((candidate) => candidate.block.id === blockId);
+  const block = blockState?.block;
+  if (!block || block.type !== "action" || block.action.kind !== "file_change") {
+    return null;
+  }
+  return { turn, block };
+}
+function renderPage(title, body) {
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${escapeHtml(title)}</title>
+    <style>
+      :root {
+        color-scheme: dark;
+        --bg: #0b0f14;
+        --panel: rgba(19, 27, 39, 0.92);
+        --panel-strong: rgba(12, 18, 28, 0.96);
+        --line: rgba(148, 163, 184, 0.16);
+        --line-strong: rgba(148, 163, 184, 0.24);
+        --text: #e5ecf5;
+        --muted: #90a0b4;
+        --accent: #63d0ff;
+        --green: #54d38a;
+        --amber: #f8c36a;
+        --red: #ff7b72;
+        --surface-add: rgba(84, 211, 138, 0.08);
+        --surface-del: rgba(255, 123, 114, 0.08);
+      }
+      * { box-sizing: border-box; }
+      body {
+        margin: 0;
+        background:
+          radial-gradient(circle at top left, rgba(99, 208, 255, 0.12), transparent 32%),
+          linear-gradient(180deg, #090d12 0%, #0b0f14 55%, #111723 100%);
+        color: var(--text);
+        font: 14px/1.5 ui-sans-serif, -apple-system, BlinkMacSystemFont, "SF Pro Text", sans-serif;
+      }
+      .wrap {
+        width: min(980px, calc(100vw - 24px));
+        margin: 0 auto;
+        padding: 20px 0 40px;
+      }
+      .hero, .panel {
+        background: var(--panel);
+        border: 1px solid var(--line);
+        border-radius: 18px;
+        backdrop-filter: blur(18px);
+        box-shadow: 0 24px 64px rgba(0, 0, 0, 0.28);
+      }
+      .hero {
+        padding: 18px 18px 16px;
+        margin-bottom: 14px;
+      }
+      .eyebrow {
+        display: inline-flex;
+        align-items: center;
+        gap: 8px;
+        color: var(--muted);
+        font-size: 11px;
+        letter-spacing: 0.14em;
+        text-transform: uppercase;
+      }
+      .dot {
+        width: 8px;
+        height: 8px;
+        border-radius: 999px;
+        background: var(--accent);
+        box-shadow: 0 0 14px rgba(99, 208, 255, 0.65);
+      }
+      h1 {
+        margin: 12px 0 10px;
+        font-size: 24px;
+        line-height: 1.15;
+      }
+      .meta, .stack {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 8px;
+      }
+      .pill {
+        display: inline-flex;
+        align-items: center;
+        gap: 6px;
+        padding: 5px 10px;
+        border-radius: 999px;
+        border: 1px solid var(--line-strong);
+        background: rgba(255, 255, 255, 0.03);
+        color: var(--muted);
+        font-size: 12px;
+      }
+      .pill strong {
+        color: var(--text);
+        font-weight: 600;
+      }
+      .stack { flex-direction: column; }
+      .panel {
+        margin-top: 12px;
+        overflow: hidden;
+      }
+      .panel-inner {
+        padding: 16px;
+      }
+      .turn {
+        border-top: 1px solid var(--line);
+      }
+      .turn:first-child {
+        border-top: none;
+      }
+      .turn-head {
+        padding: 14px 16px;
+        display: flex;
+        justify-content: space-between;
+        gap: 12px;
+        align-items: center;
+        background: rgba(255, 255, 255, 0.02);
+      }
+      .turn-title {
+        font-size: 13px;
+        font-weight: 600;
+        letter-spacing: 0.02em;
+      }
+      .turn-subtitle {
+        color: var(--muted);
+        font-size: 12px;
+        margin-top: 2px;
+      }
+      .blocks {
+        padding: 8px;
+      }
+      .block {
+        padding: 12px;
+        border-radius: 14px;
+        border: 1px solid var(--line);
+        background: var(--panel-strong);
+        margin: 8px;
+      }
+      .block-head {
+        display: flex;
+        justify-content: space-between;
+        align-items: center;
+        gap: 12px;
+        margin-bottom: 10px;
+      }
+      .block-type {
+        color: var(--muted);
+        text-transform: uppercase;
+        letter-spacing: 0.12em;
+        font-size: 11px;
+      }
+      .label {
+        color: var(--muted);
+        font-size: 12px;
+      }
+      .label strong {
+        color: var(--text);
+      }
+      pre {
+        margin: 0;
+        white-space: pre-wrap;
+        word-break: break-word;
+        overflow-wrap: anywhere;
+        font: 12.5px/1.6 ui-monospace, SFMono-Regular, Menlo, monospace;
+      }
+      .code {
+        padding: 12px;
+        border-radius: 12px;
+        border: 1px solid var(--line);
+        background: rgba(255, 255, 255, 0.02);
+      }
+      .diff-line-add { background: var(--surface-add); color: #8ef3b7; }
+      .diff-line-del { background: var(--surface-del); color: #ff9d96; }
+      .details {
+        margin-top: 10px;
+        border: 1px solid var(--line);
+        border-radius: 12px;
+        overflow: hidden;
+      }
+      details > summary {
+        list-style: none;
+        cursor: pointer;
+        padding: 10px 12px;
+        background: rgba(255, 255, 255, 0.03);
+        color: var(--muted);
+        font-size: 12px;
+        text-transform: uppercase;
+        letter-spacing: 0.1em;
+      }
+      details[open] > summary {
+        border-bottom: 1px solid var(--line);
+      }
+      .empty {
+        padding: 28px 18px;
+        color: var(--muted);
+      }
+      .grid {
+        display: grid;
+        gap: 10px;
+      }
+      .grid.two {
+        grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+      }
+      a.inline {
+        color: var(--accent);
+        text-decoration: none;
+      }
+      .status-streaming { color: var(--amber); }
+      .status-completed { color: var(--green); }
+      .status-failed, .status-error { color: var(--red); }
+    </style>
+  </head>
+  <body>
+    <main class="wrap">
+      ${body}
+    </main>
+  </body>
+</html>`;
+}
+function renderSessionHandoffPage(snapshot) {
+  const title = snapshot.session.name || snapshot.session.id;
+  const hero = `
+    <section class="hero">
+      <div class="eyebrow"><span class="dot"></span> Secure Proxy Session Handoff</div>
+      <h1>${escapeHtml(title)}</h1>
+      <div class="meta">
+        <span class="pill"><strong>ID</strong> ${escapeHtml(snapshot.session.id)}</span>
+        <span class="pill"><strong>Adapter</strong> ${escapeHtml(snapshot.session.adapterType)}</span>
+        <span class="pill"><strong>Status</strong> ${escapeHtml(snapshot.session.status)}</span>
+        ${snapshot.session.model ? `<span class="pill"><strong>Model</strong> ${escapeHtml(snapshot.session.model)}</span>` : ""}
+        ${snapshot.session.cwd ? `<span class="pill"><strong>Workspace</strong> ${escapeHtml(snapshot.session.cwd)}</span>` : ""}
+      </div>
+    </section>
+  `;
+  const turns = snapshot.turns.length > 0 ? snapshot.turns.map((turn) => {
+    const turnBody = turn.blocks.length > 0 ? turn.blocks.map(({ block }) => renderBlock(block)).join("") : `<div class="empty">No blocks were captured for this turn.</div>`;
+    return `
+        <section class="turn">
+          <div class="turn-head">
+            <div>
+              <div class="turn-title">${escapeHtml(turn.id)}</div>
+              <div class="turn-subtitle">${formatTimestamp(turn.startedAt)}${turn.endedAt ? ` to ${formatTimestamp(turn.endedAt)}` : ""}</div>
+            </div>
+            <span class="pill"><strong>Turn</strong> <span class="status-${escapeHtml(turn.status)}">${escapeHtml(turn.status)}</span></span>
+          </div>
+          <div class="blocks">${turnBody}</div>
+        </section>
+      `;
+  }).join("") : `<div class="empty">This session has not produced any turns yet.</div>`;
+  return renderPage(title, `${hero}<section class="panel">${turns}</section>`);
+}
+function renderFileChangeHandoffPage(snapshot, turn, block) {
+  const action = block.action;
+  const title = action.path || snapshot.session.name || snapshot.session.id;
+  const hero = `
+    <section class="hero">
+      <div class="eyebrow"><span class="dot"></span> Secure Proxy File Change</div>
+      <h1>${escapeHtml(title)}</h1>
+      <div class="meta">
+        <span class="pill"><strong>Session</strong> ${escapeHtml(snapshot.session.name || snapshot.session.id)}</span>
+        <span class="pill"><strong>Turn</strong> ${escapeHtml(turn.id)}</span>
+        <span class="pill"><strong>Status</strong> ${escapeHtml(action.status)}</span>
+      </div>
+    </section>
+  `;
+  const body = `
+    <section class="panel">
+      <div class="panel-inner stack">
+        <div class="grid two">
+          <div class="pill"><strong>Path</strong> ${escapeHtml(action.path)}</div>
+          <div class="pill"><strong>Block</strong> ${escapeHtml(block.id)}</div>
+        </div>
+        ${action.diff ? renderDetailsSection("Diff", renderDiff(action.diff), true) : `<div class="empty">No diff was recorded for this action.</div>`}
+        ${action.output ? renderDetailsSection("Output", `<div class="code"><pre>${escapeHtml(action.output)}</pre></div>`) : ""}
+      </div>
+    </section>
+  `;
+  return renderPage(title, `${hero}${body}`);
+}
+function renderBlock(block) {
+  switch (block.type) {
+    case "text":
+      return renderTextLikeBlock("Text", block.text);
+    case "reasoning":
+      return renderTextLikeBlock("Reasoning", block.text);
+    case "error":
+      return `
+        <article class="block">
+          <div class="block-head">
+            <div class="block-type">Error</div>
+            <span class="pill status-error">${escapeHtml(block.status)}</span>
+          </div>
+          <div class="code"><pre>${escapeHtml(block.message)}</pre></div>
+        </article>
+      `;
+    case "file":
+      return `
+        <article class="block">
+          <div class="block-head">
+            <div class="block-type">File</div>
+            <span class="pill">${escapeHtml(block.status)}</span>
+          </div>
+          <div class="grid">
+            ${block.name ? `<div class="label"><strong>Name</strong> ${escapeHtml(block.name)}</div>` : ""}
+            <div class="label"><strong>MIME</strong> ${escapeHtml(block.mimeType)}</div>
+          </div>
+        </article>
+      `;
+    case "question":
+      return renderQuestionBlock(block);
+    case "action":
+      return renderActionBlock(block);
+  }
+}
+function renderTextLikeBlock(label, text) {
+  return `
+    <article class="block">
+      <div class="block-head">
+        <div class="block-type">${escapeHtml(label)}</div>
+      </div>
+      <div class="code"><pre>${escapeHtml(text)}</pre></div>
+    </article>
+  `;
+}
+function renderQuestionBlock(block) {
+  const answer = block.answer?.length ? block.answer.join(", ") : "Awaiting answer";
+  const options = block.options?.length ? `<div class="label"><strong>Options</strong> ${escapeHtml(block.options.map((option) => option.label).join(", "))}</div>` : "";
+  return `
+    <article class="block">
+      <div class="block-head">
+        <div class="block-type">Question</div>
+        <span class="pill">${escapeHtml(block.questionStatus)}</span>
+      </div>
+      ${block.header ? `<div class="label"><strong>${escapeHtml(block.header)}</strong></div>` : ""}
+      <div class="code"><pre>${escapeHtml(block.question)}</pre></div>
+      <div class="stack" style="margin-top: 10px;">
+        ${options}
+        <div class="label"><strong>Answer</strong> ${escapeHtml(answer)}</div>
+      </div>
+    </article>
+  `;
+}
+function renderActionBlock(block) {
+  const action = block.action;
+  const parts = [];
+  switch (action.kind) {
+    case "file_change":
+      parts.push(`<div class="label"><strong>Path</strong> ${escapeHtml(action.path)}</div>`);
+      if (action.diff) {
+        parts.push(renderDetailsSection("Diff", renderDiff(action.diff)));
+      }
+      break;
+    case "command":
+      parts.push(`<div class="label"><strong>Command</strong></div><div class="code"><pre>${escapeHtml(action.command)}</pre></div>`);
+      if (typeof action.exitCode === "number") {
+        parts.push(`<div class="label"><strong>Exit Code</strong> ${escapeHtml(String(action.exitCode))}</div>`);
+      }
+      break;
+    case "tool_call":
+      parts.push(`<div class="label"><strong>Tool</strong> ${escapeHtml(action.toolName)}</div>`);
+      if (action.toolCallId) {
+        parts.push(`<div class="label"><strong>Call ID</strong> ${escapeHtml(action.toolCallId)}</div>`);
+      }
+      break;
+    case "subagent":
+      parts.push(`<div class="label"><strong>Agent</strong> ${escapeHtml(action.agentName || action.agentId)}</div>`);
+      if (action.prompt) {
+        parts.push(`<div class="code"><pre>${escapeHtml(action.prompt)}</pre></div>`);
+      }
+      break;
+  }
+  if (action.approval) {
+    parts.push(`<div class="label"><strong>Approval</strong> ${escapeHtml(action.approval.risk || "medium")} risk${action.approval.description ? ` - ${escapeHtml(action.approval.description)}` : ""}</div>`);
+  }
+  if (action.output) {
+    parts.push(renderDetailsSection("Output", `<div class="code"><pre>${escapeHtml(action.output)}</pre></div>`));
+  }
+  return `
+    <article class="block">
+      <div class="block-head">
+        <div class="block-type">${escapeHtml(action.kind.replace("_", " "))}</div>
+        <span class="pill">${escapeHtml(action.status)}</span>
+      </div>
+      <div class="stack">${parts.join("")}</div>
+    </article>
+  `;
+}
+function renderDetailsSection(title, innerHtml, open = false) {
+  return `
+    <details class="details"${open ? " open" : ""}>
+      <summary>${escapeHtml(title)}</summary>
+      <div class="panel-inner">${innerHtml}</div>
+    </details>
+  `;
+}
+function renderDiff(diff) {
+  const lines = diff.split(`
+`).map((line) => {
+    const className = line.startsWith("+") ? "diff-line-add" : line.startsWith("-") ? "diff-line-del" : "";
+    return `<div class="${className}"><pre>${escapeHtml(line || " ")}</pre></div>`;
+  }).join("");
+  return `<div class="code">${lines}</div>`;
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function formatTimestamp(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    return "Unknown time";
+  }
+  try {
+    return new Intl.DateTimeFormat("en-US", {
+      dateStyle: "medium",
+      timeStyle: "short"
+    }).format(value);
+  } catch {
+    return new Date(value).toISOString();
+  }
+}
 
 // ../../apps/desktop/src/core/pairing/runtime/bridge/server.ts
 import { readdirSync as readdirSync3, readFileSync as readFileSync9, realpathSync, statSync as statSync3 } from "fs";
@@ -12151,8 +12756,107 @@ async function shutdownClaudeStreamJsonAgent(options, shutdownOptions = {}) {
 
 // ../runtime/src/codex-app-server.ts
 import { spawn as spawn3 } from "child_process";
-import { access as access3, appendFile as appendFile3, constants as constants3, mkdir as mkdir5, readFile as readFile6, rm as rm4, writeFile as writeFile5 } from "fs/promises";
+import { constants as constants3 } from "fs";
+import { access as access3, appendFile as appendFile3, mkdir as mkdir5, readFile as readFile6, rm as rm4, writeFile as writeFile5 } from "fs/promises";
 import { delimiter as delimiter3, join as join13 } from "path";
+function normalizeCodexModelValue(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+function encodeCodexModelConfig(model) {
+  return `model=${JSON.stringify(model)}`;
+}
+function parseCodexModelConfig(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    return null;
+  }
+  const separatorIndex = trimmed.indexOf("=");
+  if (separatorIndex <= 0) {
+    return null;
+  }
+  const key = trimmed.slice(0, separatorIndex).trim();
+  if (key !== "model") {
+    return null;
+  }
+  const rawValue = trimmed.slice(separatorIndex + 1).trim();
+  if (!rawValue) {
+    return null;
+  }
+  if (rawValue.startsWith('"') && rawValue.endsWith('"') || rawValue.startsWith("'") && rawValue.endsWith("'")) {
+    return rawValue.slice(1, -1) || null;
+  }
+  return rawValue;
+}
+function normalizeCodexAppServerLaunchArgs(launchArgs) {
+  const args = Array.isArray(launchArgs) ? launchArgs.map((entry) => String(entry).trim()).filter(Boolean) : [];
+  const normalized = [];
+  for (let index = 0;index < args.length; index += 1) {
+    const current = args[index] ?? "";
+    if (current === "--model" || current === "-m") {
+      const model = normalizeCodexModelValue(args[index + 1]);
+      if (model) {
+        normalized.push("-c", encodeCodexModelConfig(model));
+        index += 1;
+        continue;
+      }
+      normalized.push(current);
+      continue;
+    }
+    if (current.startsWith("--model=")) {
+      const model = normalizeCodexModelValue(current.slice("--model=".length));
+      if (model) {
+        normalized.push("-c", encodeCodexModelConfig(model));
+        continue;
+      }
+    }
+    if (current.startsWith("-m=")) {
+      const model = normalizeCodexModelValue(current.slice(3));
+      if (model) {
+        normalized.push("-c", encodeCodexModelConfig(model));
+        continue;
+      }
+    }
+    if (current === "-c" || current === "--config") {
+      const next = args[index + 1];
+      if (typeof next === "string") {
+        const model = parseCodexModelConfig(next);
+        normalized.push(current === "--config" ? "--config" : "-c", model ? encodeCodexModelConfig(model) : next);
+        index += 1;
+        continue;
+      }
+    }
+    if (current.startsWith("--config=")) {
+      const value = current.slice("--config=".length);
+      const model = parseCodexModelConfig(value);
+      normalized.push(model ? `--config=${encodeCodexModelConfig(model)}` : current);
+      continue;
+    }
+    normalized.push(current);
+  }
+  return normalized;
+}
+function readCodexAppServerModelFromLaunchArgs(launchArgs) {
+  const normalized = normalizeCodexAppServerLaunchArgs(launchArgs);
+  for (let index = 0;index < normalized.length; index += 1) {
+    const current = normalized[index] ?? "";
+    if (current === "-c" || current === "--config") {
+      const model = parseCodexModelConfig(normalized[index + 1]);
+      if (model) {
+        return model;
+      }
+      index += 1;
+      continue;
+    }
+    if (current.startsWith("--config=")) {
+      const model = parseCodexModelConfig(current.slice("--config=".length));
+      if (model) {
+        return model;
+      }
+    }
+  }
+  return null;
+}
 function sessionKey2(options) {
   return `${options.agentName}:${options.sessionId}`;
 }
@@ -12261,6 +12965,13 @@ function isMissingCodexRolloutError2(error) {
   const message = errorMessage3(error).toLowerCase();
   return message.includes("no rollout found for thread id");
 }
+function resolveCodexCompletionGraceMs() {
+  const parsed = Number.parseInt(process.env.OPENSCOUT_CODEX_COMPLETION_GRACE_MS ?? "", 10);
+  if (Number.isFinite(parsed) && parsed >= 0) {
+    return parsed;
+  }
+  return 60000;
+}
 
 class CodexAppServerSession {
   options;
@@ -12450,7 +13161,7 @@ class CodexAppServerSession {
       systemPrompt: options.systemPrompt,
       threadId: options.threadId ?? null,
       requireExistingThread: options.requireExistingThread === true,
-      launchArgs: Array.isArray(options.launchArgs) ? options.launchArgs : []
+      launchArgs: normalizeCodexAppServerLaunchArgs(options.launchArgs)
     });
   }
   async ensureStarted() {
@@ -12472,6 +13183,7 @@ class CodexAppServerSession {
     await mkdir5(this.options.logsDirectory, { recursive: true });
     await writeFile5(join13(this.options.runtimeDirectory, "prompt.txt"), this.options.systemPrompt);
     const codexExecutable = await resolveCodexExecutable2();
+    const launchArgs = normalizeCodexAppServerLaunchArgs(this.options.launchArgs);
     const env = buildManagedAgentEnvironment({
       agentName: this.options.agentName,
       currentDirectory: this.options.cwd,
@@ -12482,7 +13194,8 @@ class CodexAppServerSession {
       ...buildScoutMcpCodexLaunchArgs({
         currentDirectory: this.options.cwd,
         env
-      })
+      }),
+      ...launchArgs
     ], {
       cwd: this.options.cwd,
       env,
@@ -12580,6 +13293,8 @@ class CodexAppServerSession {
       turnId: "",
       startedAt: Date.now(),
       timer: null,
+      graceTimer: null,
+      timedOutAt: null,
       messageOrder: [],
       messageByItemId: new Map,
       resolve: resolve4,
@@ -12587,20 +13302,43 @@ class CodexAppServerSession {
       watchers: []
     };
     turn.timer = setTimeout(() => {
-      this.interrupt().catch(() => {
-        return;
-      });
-      if (this.activeTurn === turn) {
-        this.activeTurn = null;
-      }
-      for (const watcher of this.drainTurnWatchers(turn)) {
-        watcher.reject(new Error(`Timed out after ${timeoutMs}ms waiting for ${this.options.agentName}.`));
-      }
-      reject(new Error(`Timed out after ${timeoutMs}ms waiting for ${this.options.agentName}.`));
+      this.scheduleTurnTimeout(turn, timeoutMs);
     }, timeoutMs);
     this.activeTurn = turn;
     return turn;
   }
+  buildTurnTimeoutError(timeoutMs) {
+    return new Error(`Timed out after ${timeoutMs}ms waiting for ${this.options.agentName}.`);
+  }
+  scheduleTurnTimeout(turn, timeoutMs) {
+    if (turn.timedOutAt !== null) {
+      return;
+    }
+    turn.timedOutAt = Date.now();
+    this.interrupt().catch(() => {
+      return;
+    });
+    const graceMs = resolveCodexCompletionGraceMs();
+    if (graceMs <= 0) {
+      this.rejectTimedOutTurn(turn, timeoutMs);
+      return;
+    }
+    turn.graceTimer = setTimeout(() => {
+      this.rejectTimedOutTurn(turn, timeoutMs);
+    }, graceMs);
+  }
+  rejectTimedOutTurn(turn, timeoutMs) {
+    if (this.activeTurn !== turn) {
+      this.clearActiveTurn(turn);
+      return;
+    }
+    this.clearActiveTurn(turn);
+    const error = this.buildTurnTimeoutError(timeoutMs);
+    for (const watcher of this.drainTurnWatchers(turn)) {
+      watcher.reject(error);
+    }
+    turn.reject(error);
+  }
   addTurnWatcher(turn, resolve4, reject, timeoutMs) {
     const watcher = {
       resolve: resolve4,
@@ -12634,6 +13372,9 @@ class CodexAppServerSession {
     if (turn.timer) {
       clearTimeout(turn.timer);
     }
+    if (turn.graceTimer) {
+      clearTimeout(turn.graceTimer);
+    }
     if (this.activeTurn === turn) {
       this.activeTurn = null;
     }
@@ -13833,6 +14574,128 @@ function normalizeLocalAgentCapabilities(value) {
 function normalizeLocalAgentLaunchArgs(value) {
   return Array.isArray(value) ? value.map((entry) => String(entry).trim()).filter(Boolean) : [];
 }
+function normalizeRequestedModel(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function readClaudeLaunchModel(launchArgs) {
+  for (let index = 0;index < launchArgs.length; index += 1) {
+    const current = launchArgs[index] ?? "";
+    if (current === "--model") {
+      const next = launchArgs[index + 1]?.trim();
+      return next || undefined;
+    }
+    if (current.startsWith("--model=")) {
+      const next = current.slice("--model=".length).trim();
+      return next || undefined;
+    }
+  }
+  return;
+}
+function normalizeLaunchArgsForHarness(harness, value) {
+  const normalized = normalizeLocalAgentLaunchArgs(value);
+  if (harness === "codex") {
+    return normalizeCodexAppServerLaunchArgs(normalized);
+  }
+  return normalized;
+}
+function readLaunchModelForHarness(harness, launchArgs) {
+  if (harness === "codex") {
+    return readCodexAppServerModelFromLaunchArgs(launchArgs) ?? undefined;
+  }
+  if (harness === "claude") {
+    return readClaudeLaunchModel(launchArgs ?? []);
+  }
+  return;
+}
+function stripLaunchModelForHarness(harness, launchArgs) {
+  if (harness === "codex") {
+    const next = [];
+    const normalized = normalizeCodexAppServerLaunchArgs(launchArgs);
+    for (let index = 0;index < normalized.length; index += 1) {
+      const current = normalized[index] ?? "";
+      if (current === "-c" || current === "--config") {
+        const value = normalized[index + 1];
+        if (readCodexAppServerModelFromLaunchArgs(value ? [current, value] : [current])) {
+          index += 1;
+          continue;
+        }
+        next.push(current);
+        if (value) {
+          next.push(value);
+          index += 1;
+        }
+        continue;
+      }
+      if (current.startsWith("--config=")) {
+        if (readCodexAppServerModelFromLaunchArgs([current])) {
+          continue;
+        }
+      }
+      next.push(current);
+    }
+    return next;
+  }
+  if (harness === "claude") {
+    const next = [];
+    const normalized = normalizeLocalAgentLaunchArgs(launchArgs);
+    for (let index = 0;index < normalized.length; index += 1) {
+      const current = normalized[index] ?? "";
+      if (current === "--model") {
+        index += 1;
+        continue;
+      }
+      if (current.startsWith("--model=")) {
+        continue;
+      }
+      next.push(current);
+    }
+    return next;
+  }
+  return normalizeLocalAgentLaunchArgs(launchArgs);
+}
+function buildLaunchArgsForRequestedModel(harness, model) {
+  if (harness === "codex") {
+    return normalizeCodexAppServerLaunchArgs(["--model", model]);
+  }
+  if (harness === "claude") {
+    return ["--model", model];
+  }
+  return [];
+}
+function applyRequestedModelToLaunchArgs(harness, launchArgs, model) {
+  const normalized = normalizeLaunchArgsForHarness(harness, launchArgs);
+  const requestedModel = normalizeRequestedModel(model);
+  if (!requestedModel) {
+    return normalized;
+  }
+  return [
+    ...stripLaunchModelForHarness(harness, normalized),
+    ...buildLaunchArgsForRequestedModel(harness, requestedModel)
+  ];
+}
+function defaultHarnessForOverride(override, fallback = "claude") {
+  return normalizeManagedHarness2(override.defaultHarness ?? override.runtime?.harness, fallback);
+}
+function launchArgsForOverrideHarness(override, harness) {
+  const profileLaunchArgs = override.harnessProfiles?.[harness]?.launchArgs;
+  if (profileLaunchArgs) {
+    return normalizeLaunchArgsForHarness(harness, profileLaunchArgs);
+  }
+  if (harness === defaultHarnessForOverride(override, harness)) {
+    return normalizeLaunchArgsForHarness(harness, override.launchArgs);
+  }
+  return [];
+}
+function overrideHarnessProfile(override, harness) {
+  const profile = override.harnessProfiles?.[harness];
+  return {
+    cwd: normalizeProjectPath(profile?.cwd || override.runtime?.cwd || override.projectRoot || process.cwd()),
+    transport: normalizeLocalAgentTransport(profile?.transport ?? override.runtime?.transport, harness),
+    sessionId: normalizeTmuxSessionName2(profile?.sessionId, `${override.agentId}-${harness}`),
+    launchArgs: launchArgsForOverrideHarness(override, harness)
+  };
+}
 function normalizeManagedHarness2(value, fallback) {
   return value === "codex" ? "codex" : value === "claude" ? "claude" : fallback;
 }
@@ -13848,7 +14711,7 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(profile.cwd || record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(profile.transport, harness),
       sessionId: normalizeTmuxSessionName2(profile.sessionId, `${agentId}-${harness}`),
-      launchArgs: normalizeLocalAgentLaunchArgs(profile.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(harness, profile.launchArgs)
     };
   }
   const runtimeHarness = normalizeManagedHarness2(record.harness, defaultHarness);
@@ -13857,7 +14720,7 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(record.transport, runtimeHarness),
       sessionId: normalizeTmuxSessionName2(record.tmuxSession, `${agentId}-${runtimeHarness}`),
-      launchArgs: normalizeLocalAgentLaunchArgs(record.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(runtimeHarness, record.launchArgs)
     };
   }
   if (!nextProfiles[defaultHarness]) {
@@ -13865,7 +14728,7 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(record.transport, defaultHarness),
       sessionId: normalizeTmuxSessionName2(record.tmuxSession, `${agentId}-${defaultHarness}`),
-      launchArgs: normalizeLocalAgentLaunchArgs(record.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(defaultHarness, record.launchArgs)
     };
   }
   for (const harness of ["claude", "codex"]) {
@@ -13877,7 +14740,7 @@ function normalizeLocalHarnessProfiles(agentId, record) {
       cwd: normalizeProjectPath(profile.cwd || record.cwd || process.cwd()),
       transport: normalizeLocalAgentTransport(profile.transport, harness),
       sessionId: normalizeTmuxSessionName2(profile.sessionId, `${agentId}-${harness}`),
-      launchArgs: normalizeLocalAgentLaunchArgs(profile.launchArgs)
+      launchArgs: normalizeLaunchArgsForHarness(harness, profile.launchArgs)
     };
   }
   return nextProfiles;
@@ -13901,14 +14764,14 @@ function recordForHarness(record, harnessOverride) {
       tmuxSession: fallbackSessionId,
       cwd: fallbackCwd,
       transport: fallbackTransport,
-      launchArgs: normalizeLocalAgentLaunchArgs(normalized.launchArgs),
+      launchArgs: normalizeLaunchArgsForHarness(selectedHarness, normalized.launchArgs),
       harnessProfiles: {
         ...normalized.harnessProfiles,
         [selectedHarness]: {
           cwd: fallbackCwd,
           transport: fallbackTransport,
           sessionId: fallbackSessionId,
-          launchArgs: normalizeLocalAgentLaunchArgs(normalized.launchArgs)
+          launchArgs: normalizeLaunchArgsForHarness(selectedHarness, normalized.launchArgs)
         }
       }
     };
@@ -13950,7 +14813,7 @@ function normalizeLocalAgentRecord(agentId, record) {
     harnessProfiles,
     transport: activeProfile?.transport ?? normalizeLocalAgentTransport(record.transport, harness),
     capabilities: normalizeLocalAgentCapabilities(record.capabilities),
-    launchArgs: activeProfile?.launchArgs ?? normalizeLocalAgentLaunchArgs(record.launchArgs)
+    launchArgs: activeProfile?.launchArgs ?? normalizeLaunchArgsForHarness(harness, record.launchArgs)
   };
 }
 function localAgentStatusFromRecord(agentId, record, source) {
@@ -14019,7 +14882,7 @@ function relayAgentOverrideFromLocalAgentRecord(agentId, record, existing) {
     source: existing?.source && existing.source !== "inferred" ? existing.source : "manual",
     startedAt: normalizedRecord.startedAt,
     systemPrompt: normalizedRecord.systemPrompt,
-    launchArgs: normalizeLocalAgentLaunchArgs(normalizedRecord.launchArgs),
+    launchArgs: normalizeLaunchArgsForHarness(normalizeLocalAgentHarness(normalizedRecord.harness), normalizedRecord.launchArgs),
     capabilities: normalizeLocalAgentCapabilities(normalizedRecord.capabilities),
     defaultHarness: normalizeManagedHarness2(normalizedRecord.defaultHarness, "claude"),
     harnessProfiles: normalizedRecord.harnessProfiles,
@@ -14040,7 +14903,7 @@ function buildCodexAgentSessionOptions(agentName, record, systemPrompt) {
     systemPrompt: systemPrompt ?? buildLocalAgentSystemPrompt(agentName, record.project, record.cwd, { transport: "codex_app_server" }),
     runtimeDirectory: relayAgentRuntimeDirectory(agentName),
     logsDirectory: relayAgentLogsDirectory(agentName),
-    launchArgs: normalizeLocalAgentLaunchArgs(record.launchArgs)
+    launchArgs: normalizeLaunchArgsForHarness("codex", record.launchArgs)
   };
 }
 function buildClaudeAgentSessionOptions(agentName, record, systemPrompt) {
@@ -14051,7 +14914,7 @@ function buildClaudeAgentSessionOptions(agentName, record, systemPrompt) {
     systemPrompt: systemPrompt ?? buildLocalAgentSystemPrompt(agentName, record.project, record.cwd, { transport: "claude_stream_json" }),
     runtimeDirectory: relayAgentRuntimeDirectory(agentName),
     logsDirectory: relayAgentLogsDirectory(agentName),
-    launchArgs: normalizeLocalAgentLaunchArgs(record.launchArgs)
+    launchArgs: normalizeLaunchArgsForHarness("claude", record.launchArgs)
   };
 }
 function isLocalAgentRecordOnline(agentName, record) {
@@ -14085,7 +14948,7 @@ function buildLocalAgentBootstrapPrompt(_harness, _systemPrompt, initialMessage)
   return initialMessage;
 }
 function buildLocalAgentLaunchCommand(agentName, record, projectPath, promptFile, workerScript) {
-  const extraArgs = shellQuoteArguments(normalizeLocalAgentLaunchArgs(record.launchArgs));
+  const extraArgs = shellQuoteArguments(normalizeLaunchArgsForHarness(normalizeLocalAgentHarness(record.harness), record.launchArgs));
   if (normalizeLocalAgentHarness(record.harness) === "codex") {
     return `exec bash ${JSON.stringify(workerScript ?? join15(relayAgentRuntimeDirectory(agentName), "codex-worker.sh"))}`;
   }
@@ -14351,6 +15214,7 @@ async function startLocalAgent(input) {
     const effectiveHarness = normalizeManagedHarness2(preferredHarness ?? configDefaultHarness, "claude");
     const transport = normalizeLocalAgentTransport(undefined, effectiveHarness);
     const sessionId = normalizeTmuxSessionName2(undefined, `${instance.id}-${effectiveHarness}`);
+    const launchArgs = applyRequestedModelToLaunchArgs(effectiveHarness, [], input.model);
     const existingForInstance = overrides[instance.id];
     if (existingForInstance && normalizeProjectPath(existingForInstance.projectRoot) !== projectRoot) {
       throw new Error(`Another agent is already registered as ${instance.id} at ${existingForInstance.projectRoot}. ` + `Two clones of the same project on the same branch cannot both register here; ` + `rename one of the checkouts or switch its branch before running scout up.`);
@@ -14364,13 +15228,14 @@ async function startLocalAgent(input) {
       projectConfigPath: coldProjectConfigPath,
       source: "manual",
       startedAt: nowSeconds2(),
+      launchArgs,
       defaultHarness: effectiveHarness,
       harnessProfiles: {
         [effectiveHarness]: {
           cwd: effectiveCwd ?? projectRoot,
           transport,
           sessionId,
-          launchArgs: []
+          launchArgs
         }
       },
       runtime: {
@@ -14391,6 +15256,9 @@ async function startLocalAgent(input) {
       throw new Error(`Another agent is already registered as ${instance.id} at ${existingForInstance.projectRoot}. ` + `Two clones of the same project on the same branch cannot both register here; ` + `rename one of the checkouts or switch its branch before running scout up.`);
     }
     const resolvedHarness = preferredHarness ?? matchingOverride.runtime?.harness;
+    const nextHarness = normalizeManagedHarness2(resolvedHarness, "claude");
+    const nextDefaultHarness = preferredHarness ? normalizeManagedHarness2(preferredHarness, "claude") : defaultHarnessForOverride(matchingOverride, "claude");
+    const nextLaunchArgs = applyRequestedModelToLaunchArgs(nextHarness, launchArgsForOverrideHarness(matchingOverride, nextHarness), input.model);
     overrides[instance.id] = {
       agentId: instance.id,
       definitionId: requestedDefinitionId,
@@ -14401,10 +15269,16 @@ async function startLocalAgent(input) {
       source: "manual",
       startedAt: matchingOverride.startedAt ?? nowSeconds2(),
       systemPrompt: matchingOverride.systemPrompt,
-      launchArgs: matchingOverride.launchArgs,
+      launchArgs: nextHarness === nextDefaultHarness ? nextLaunchArgs : matchingOverride.launchArgs,
       capabilities: matchingOverride.capabilities,
-      defaultHarness: normalizeManagedHarness2(preferredHarness ?? matchingOverride.defaultHarness, "claude"),
-      harnessProfiles: matchingOverride.harnessProfiles,
+      defaultHarness: nextDefaultHarness,
+      harnessProfiles: {
+        ...matchingOverride.harnessProfiles ?? {},
+        [nextHarness]: {
+          ...overrideHarnessProfile(matchingOverride, nextHarness),
+          launchArgs: nextLaunchArgs
+        }
+      },
       runtime: {
         cwd: effectiveCwd ?? matchingOverride.runtime?.cwd ?? matchingProjectRoot,
         harness: resolvedHarness,
@@ -14416,6 +15290,22 @@ async function startLocalAgent(input) {
     await writeRelayAgentOverrides(overrides);
     targetAgentId = instance.id;
   } else {
+    if (input.model) {
+      const existingHarness = normalizeManagedHarness2(preferredHarness ?? matchingOverride.defaultHarness ?? matchingOverride.runtime?.harness, "claude");
+      const nextLaunchArgs = applyRequestedModelToLaunchArgs(existingHarness, launchArgsForOverrideHarness(matchingOverride, existingHarness), input.model);
+      overrides[matchingAgentId] = {
+        ...matchingOverride,
+        launchArgs: existingHarness === defaultHarnessForOverride(matchingOverride, existingHarness) ? nextLaunchArgs : matchingOverride.launchArgs,
+        harnessProfiles: {
+          ...matchingOverride.harnessProfiles ?? {},
+          [existingHarness]: {
+            ...overrideHarnessProfile(matchingOverride, existingHarness),
+            launchArgs: nextLaunchArgs
+          }
+        }
+      };
+      await writeRelayAgentOverrides(overrides);
+    }
     targetAgentId = matchingAgentId;
   }
   await ensureLocalAgentBindingOnline(targetAgentId, process.env.OPENSCOUT_NODE_ID ?? "local", {
@@ -14511,6 +15401,7 @@ function readPersistedClaudeSessionId(agentName) {
 }
 function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
   const normalizedRecord = normalizeLocalAgentRecord(agentId, record);
+  const configuredModel = readLaunchModelForHarness(normalizeLocalAgentHarness(normalizedRecord.harness), normalizedRecord.launchArgs);
   const definitionId = normalizedRecord.definitionId ?? agentId;
   const displayName = titleCaseLocalAgentName(definitionId);
   const projectRoot = normalizedRecord.projectRoot ?? normalizedRecord.cwd;
@@ -14535,7 +15426,8 @@ function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
         defaultSelector: instance.defaultSelector,
         nodeQualifier: instance.nodeQualifier,
         workspaceQualifier: instance.workspaceQualifier,
-        branch: instance.branch
+        branch: instance.branch,
+        ...configuredModel ? { model: configuredModel } : {}
       }
     },
     agent: {
@@ -14562,7 +15454,8 @@ function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
         defaultSelector: instance.defaultSelector,
         nodeQualifier: instance.nodeQualifier,
         workspaceQualifier: instance.workspaceQualifier,
-        branch: instance.branch
+        branch: instance.branch,
+        ...configuredModel ? { model: configuredModel } : {}
       },
       agentClass: "general",
       capabilities: normalizeLocalAgentCapabilities(normalizedRecord.capabilities),
@@ -14595,6 +15488,7 @@ function buildLocalAgentBinding(agentId, record, alive, nodeId, source) {
         nodeQualifier: instance.nodeQualifier,
         workspaceQualifier: instance.workspaceQualifier,
         branch: instance.branch,
+        ...configuredModel ? { model: configuredModel } : {},
         ...externalSessionId ? { externalSessionId } : {}
       }
     }
@@ -15971,6 +16865,20 @@ function readSyncStatus(bridge, sessionId) {
     oldestBufferedSeq: bridge.oldestBufferedSeq(sessionId)
   };
 }
+function resolveSyncSessionId(bridge, preferredSessionId) {
+  if (preferredSessionId) {
+    return preferredSessionId;
+  }
+  let latestSessionId = null;
+  let latestActivityAt = Number.NEGATIVE_INFINITY;
+  for (const session of bridge.getSessionSummaries()) {
+    if (session.lastActivityAt > latestActivityAt) {
+      latestActivityAt = session.lastActivityAt;
+      latestSessionId = session.sessionId;
+    }
+  }
+  return latestSessionId;
+}
 function sessionRegistryErrorResponse(reqId, error) {
   if (!isSessionRegistryError(error)) {
     return null;
@@ -16040,23 +16948,36 @@ async function handleRPCInner(bridge, req, deviceId) {
         return { id: req.id, result: { ok: true } };
       }
       case "sync/replay": {
-        const p = req.params;
-        if (!p.sessionId) {
-          return { id: req.id, error: { code: -32602, message: "sessionId is required" } };
+        const p = req.params ?? {};
+        if (typeof p.lastSeq !== "number") {
+          return { id: req.id, error: { code: -32602, message: "lastSeq is required" } };
+        }
+        const sessionId = resolveSyncSessionId(bridge, p.sessionId);
+        if (!sessionId) {
+          return { id: req.id, result: { events: [] } };
         }
-        const events2 = replaySyncEvents(bridge, p.sessionId, p.lastSeq);
+        const events2 = replaySyncEvents(bridge, sessionId, p.lastSeq);
         return { id: req.id, result: { events: events2 } };
       }
       case "sync/status": {
         const p = req.params ?? {};
-        if (!p.sessionId) {
-          return { id: req.id, error: { code: -32602, message: "sessionId is required" } };
+        const sessionCount = bridge.listSessions().length;
+        const sessionId = resolveSyncSessionId(bridge, p.sessionId);
+        if (!sessionId) {
+          return {
+            id: req.id,
+            result: {
+              currentSeq: 0,
+              oldestBufferedSeq: 0,
+              sessionCount
+            }
+          };
         }
         return {
           id: req.id,
           result: {
-            ...readSyncStatus(bridge, p.sessionId),
-            sessionCount: bridge.listSessions().length
+            ...readSyncStatus(bridge, sessionId),
+            sessionCount
           }
         };
       }
@@ -34044,6 +34965,64 @@ var mobileRouter = t.router({
       limit: typeof input.limit === "number" ? input.limit : null
     }, resolveMobileCurrentDirectory2());
   }),
+  webHandoff: procedure.input(exports_external.object({
+    kind: exports_external.enum(["session", "file_change"]),
+    sessionId: exports_external.string(),
+    turnId: exports_external.string().optional(),
+    blockId: exports_external.string().optional()
+  })).mutation(({ input, ctx }) => {
+    if (!ctx.deviceId) {
+      throw new TRPCError({
+        code: "UNAUTHORIZED",
+        message: "Secure web handoff requires a paired mobile device"
+      });
+    }
+    const snapshot = ctx.bridge.getSessionSnapshot(input.sessionId);
+    if (!snapshot) {
+      throw new TRPCError({
+        code: "NOT_FOUND",
+        message: `No session: ${input.sessionId}`
+      });
+    }
+    let scope;
+    let title = snapshot.session.name || snapshot.session.id;
+    if (input.kind === "file_change") {
+      if (!input.turnId || !input.blockId) {
+        throw new TRPCError({
+          code: "BAD_REQUEST",
+          message: "turnId and blockId are required for file_change handoffs"
+        });
+      }
+      const turn = snapshot.turns.find((candidate) => candidate.id === input.turnId);
+      const block = turn?.blocks.find((candidate) => candidate.block.id === input.blockId)?.block;
+      if (!turn || !block || block.type !== "action" || block.action.kind !== "file_change") {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "File change block not found"
+        });
+      }
+      scope = {
+        kind: "file_change",
+        sessionId: input.sessionId,
+        turnId: input.turnId,
+        blockId: input.blockId
+      };
+      title = block.action.path || title;
+    } else {
+      scope = {
+        kind: "session",
+        sessionId: input.sessionId
+      };
+    }
+    const issued = issueWebHandoff(scope, ctx.deviceId);
+    return {
+      kind: input.kind,
+      path: pathForWebHandoffScope(scope),
+      token: issued.token,
+      expiresAt: issued.expiresAt,
+      title
+    };
+  }),
   createSession: procedure.input(exports_external.object({
     workspaceId: exports_external.string(),
     harness: exports_external.string().optional(),
@@ -34257,15 +35236,42 @@ function readSyncStatus2(bridge, sessionId) {
     oldestBufferedSeq: bridge.oldestBufferedSeq(sessionId)
   };
 }
+function resolveSyncSessionId2(bridge, preferredSessionId) {
+  if (preferredSessionId) {
+    return preferredSessionId;
+  }
+  let latestSessionId = null;
+  let latestActivityAt = Number.NEGATIVE_INFINITY;
+  for (const session of bridge.getSessionSummaries()) {
+    if (session.lastActivityAt > latestActivityAt) {
+      latestActivityAt = session.lastActivityAt;
+      latestSessionId = session.sessionId;
+    }
+  }
+  return latestSessionId;
+}
 var syncRouter = t.router({
-  replay: procedure.input(exports_external.object({ lastSeq: exports_external.number(), sessionId: exports_external.string() })).query(({ input, ctx }) => {
-    const events2 = replaySyncEvents2(ctx.bridge, input.sessionId, input.lastSeq);
+  replay: procedure.input(exports_external.object({ lastSeq: exports_external.number(), sessionId: exports_external.string().optional() })).query(({ input, ctx }) => {
+    const sessionId = resolveSyncSessionId2(ctx.bridge, input.sessionId);
+    if (!sessionId) {
+      return { events: [] };
+    }
+    const events2 = replaySyncEvents2(ctx.bridge, sessionId, input.lastSeq);
     return { events: events2 };
   }),
-  status: procedure.input(exports_external.object({ sessionId: exports_external.string() })).query(({ input, ctx }) => {
+  status: procedure.input(exports_external.object({ sessionId: exports_external.string().optional() }).optional()).query(({ input, ctx }) => {
+    const sessionCount = ctx.bridge.listSessions().length;
+    const sessionId = resolveSyncSessionId2(ctx.bridge, input?.sessionId);
+    if (!sessionId) {
+      return {
+        currentSeq: 0,
+        oldestBufferedSeq: 0,
+        sessionCount
+      };
+    }
     return {
-      ...readSyncStatus2(ctx.bridge, input.sessionId),
-      sessionCount: ctx.bridge.listSessions().length
+      ...readSyncStatus2(ctx.bridge, sessionId),
+      sessionCount
     };
   })
 });
@@ -38767,7 +39773,7 @@ async function startPairingRuntime(options) {
     secure: config2.secure,
     identity: config2.secure ? identity2 : undefined
   });
-  const fileServer = startFileServer({ port: config2.port + 2 });
+  const fileServer = startFileServer({ port: config2.port + 2, bridge });
   const relayUrl = options?.relayUrl?.trim() || config2.relay || null;
   if (!relayUrl) {
     fileServer.stop();