@poncho-ai/cli 0.5.1 → 0.6.0

package/dist/chunk-AWYXKGGD.js

@@ -0,0 +1,4429 @@
+// src/index.ts
+import { spawn } from "child_process";
+import { access as access2, cp, mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
+import { existsSync } from "fs";
+import {
+  createServer
+} from "http";
+import { dirname as dirname3, relative, resolve as resolve3 } from "path";
+import { createRequire as createRequire2 } from "module";
+import { fileURLToPath } from "url";
+import {
+  AgentHarness,
+  LocalMcpBridge,
+  TelemetryEmitter,
+  createConversationStore,
+  loadPonchoConfig,
+  resolveStateConfig
+} from "@poncho-ai/harness";
+import { Command } from "commander";
+import dotenv from "dotenv";
+import YAML from "yaml";
+
+// src/web-ui.ts
+import { createHash, randomUUID, timingSafeEqual } from "crypto";
+import { mkdir, readFile, writeFile } from "fs/promises";
+import { readFileSync } from "fs";
+import { basename, dirname, resolve, join } from "path";
+import { homedir } from "os";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var markedPackagePath = require2.resolve("marked");
+var markedDir = dirname(markedPackagePath);
+var markedSource = readFileSync(join(markedDir, "marked.umd.js"), "utf-8");
+var DEFAULT_OWNER = "local-owner";
+var SessionStore = class {
+  sessions = /* @__PURE__ */ new Map();
+  ttlMs;
+  constructor(ttlMs = 1e3 * 60 * 60 * 8) {
+    this.ttlMs = ttlMs;
+  }
+  create(ownerId = DEFAULT_OWNER) {
+    const now = Date.now();
+    const session = {
+      sessionId: randomUUID(),
+      ownerId,
+      csrfToken: randomUUID(),
+      createdAt: now,
+      expiresAt: now + this.ttlMs,
+      lastSeenAt: now
+    };
+    this.sessions.set(session.sessionId, session);
+    return session;
+  }
+  get(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      return void 0;
+    }
+    if (Date.now() > session.expiresAt) {
+      this.sessions.delete(sessionId);
+      return void 0;
+    }
+    session.lastSeenAt = Date.now();
+    return session;
+  }
+  delete(sessionId) {
+    this.sessions.delete(sessionId);
+  }
+};
+var LoginRateLimiter = class {
+  constructor(maxAttempts = 5, windowMs = 1e3 * 60 * 5, lockoutMs = 1e3 * 60 * 10) {
+    this.maxAttempts = maxAttempts;
+    this.windowMs = windowMs;
+    this.lockoutMs = lockoutMs;
+  }
+  attempts = /* @__PURE__ */ new Map();
+  canAttempt(key) {
+    const current = this.attempts.get(key);
+    if (!current) {
+      return { allowed: true };
+    }
+    if (current.lockedUntil && Date.now() < current.lockedUntil) {
+      return {
+        allowed: false,
+        retryAfterSeconds: Math.ceil((current.lockedUntil - Date.now()) / 1e3)
+      };
+    }
+    return { allowed: true };
+  }
+  registerFailure(key) {
+    const now = Date.now();
+    const current = this.attempts.get(key);
+    if (!current || now - current.firstFailureAt > this.windowMs) {
+      this.attempts.set(key, { count: 1, firstFailureAt: now });
+      return { locked: false };
+    }
+    const count = current.count + 1;
+    const next = {
+      ...current,
+      count
+    };
+    if (count >= this.maxAttempts) {
+      next.lockedUntil = now + this.lockoutMs;
+      this.attempts.set(key, next);
+      return { locked: true, retryAfterSeconds: Math.ceil(this.lockoutMs / 1e3) };
+    }
+    this.attempts.set(key, next);
+    return { locked: false };
+  }
+  registerSuccess(key) {
+    this.attempts.delete(key);
+  }
+};
+var parseCookies = (request) => {
+  const cookieHeader = request.headers.cookie ?? "";
+  const pairs = cookieHeader.split(";").map((part) => part.trim()).filter(Boolean);
+  const cookies = {};
+  for (const pair of pairs) {
+    const index = pair.indexOf("=");
+    if (index <= 0) {
+      continue;
+    }
+    const key = pair.slice(0, index);
+    const value = pair.slice(index + 1);
+    try {
+      cookies[key] = decodeURIComponent(value);
+    } catch {
+      cookies[key] = value;
+    }
+  }
+  return cookies;
+};
+var setCookie = (response, name, value, options) => {
+  const segments = [`${name}=${encodeURIComponent(value)}`];
+  segments.push(`Path=${options.path ?? "/"}`);
+  if (typeof options.maxAge === "number") {
+    segments.push(`Max-Age=${Math.max(0, Math.floor(options.maxAge))}`);
+  }
+  if (options.httpOnly) {
+    segments.push("HttpOnly");
+  }
+  if (options.secure) {
+    segments.push("Secure");
+  }
+  if (options.sameSite) {
+    segments.push(`SameSite=${options.sameSite}`);
+  }
+  const previous = response.getHeader("Set-Cookie");
+  const serialized = segments.join("; ");
+  if (!previous) {
+    response.setHeader("Set-Cookie", serialized);
+    return;
+  }
+  if (Array.isArray(previous)) {
+    response.setHeader("Set-Cookie", [...previous, serialized]);
+    return;
+  }
+  response.setHeader("Set-Cookie", [String(previous), serialized]);
+};
+var verifyPassphrase = (provided, expected) => {
+  const providedBuffer = Buffer.from(provided);
+  const expectedBuffer = Buffer.from(expected);
+  if (providedBuffer.length !== expectedBuffer.length) {
+    const zero = Buffer.alloc(expectedBuffer.length);
+    return timingSafeEqual(expectedBuffer, zero) && false;
+  }
+  return timingSafeEqual(providedBuffer, expectedBuffer);
+};
+var getRequestIp = (request) => {
+  return request.socket.remoteAddress ?? "unknown";
+};
+var inferConversationTitle = (text) => {
+  const normalized = text.trim().replace(/\s+/g, " ");
+  if (!normalized) {
+    return "New conversation";
+  }
+  return normalized.length <= 48 ? normalized : `${normalized.slice(0, 48)}...`;
+};
+var renderManifest = (options) => {
+  const name = options?.agentName ?? "Agent";
+  return JSON.stringify({
+    name,
+    short_name: name,
+    description: `${name} \u2014 AI agent powered by Poncho`,
+    start_url: "/",
+    display: "standalone",
+    background_color: "#000000",
+    theme_color: "#000000",
+    icons: [
+      { src: "/icon.svg", sizes: "any", type: "image/svg+xml" },
+      { src: "/icon-192.png", sizes: "192x192", type: "image/png" },
+      { src: "/icon-512.png", sizes: "512x512", type: "image/png" }
+    ]
+  });
+};
+var renderIconSvg = (options) => {
+  const letter = (options?.agentName ?? "A").charAt(0).toUpperCase();
+  return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <rect width="512" height="512" rx="96" fill="#000"/>
+  <text x="256" y="256" dy=".35em" text-anchor="middle"
+        font-family="-apple-system,BlinkMacSystemFont,sans-serif"
+        font-size="280" font-weight="700" fill="#fff">${letter}</text>
+</svg>`;
+};
+var renderServiceWorker = () => `
+const CACHE_NAME = "poncho-shell-v1";
+const SHELL_URLS = ["/"];
+
+self.addEventListener("install", (event) => {
+  event.waitUntil(
+    caches.open(CACHE_NAME).then((cache) => cache.addAll(SHELL_URLS))
+  );
+  self.skipWaiting();
+});
+
+self.addEventListener("activate", (event) => {
+  event.waitUntil(
+    caches.keys().then((keys) =>
+      Promise.all(keys.filter((k) => k !== CACHE_NAME).map((k) => caches.delete(k)))
+    )
+  );
+  self.clients.claim();
+});
+
+self.addEventListener("fetch", (event) => {
+  const url = new URL(event.request.url);
+  // Only cache GET requests for the app shell; let API calls pass through
+  if (event.request.method !== "GET" || url.pathname.startsWith("/api/")) {
+    return;
+  }
+  event.respondWith(
+    fetch(event.request)
+      .then((response) => {
+        const clone = response.clone();
+        caches.open(CACHE_NAME).then((cache) => cache.put(event.request, clone));
+        return response;
+      })
+      .catch(() => caches.match(event.request))
+  );
+});
+`;
+var renderWebUiHtml = (options) => {
+  const agentInitial = (options?.agentName ?? "A").charAt(0).toUpperCase();
+  const agentName = options?.agentName ?? "Agent";
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">
+  <meta name="theme-color" content="#000000">
+  <meta name="apple-mobile-web-app-capable" content="yes">
+  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
+  <meta name="apple-mobile-web-app-title" content="${agentName}">
+  <link rel="manifest" href="/manifest.json">
+  <link rel="icon" href="/icon.svg" type="image/svg+xml">
+  <link rel="apple-touch-icon" href="/icon-192.png">
+  <title>${agentName}</title>
+  <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Inconsolata:400,700">
+  <style>
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+    html, body { height: 100vh; overflow: hidden; overscroll-behavior: none; touch-action: pan-y; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Roboto", "Helvetica Neue", sans-serif;
+      background: #000;
+      color: #ededed;
+      font-size: 14px;
+      line-height: 1.5;
+      -webkit-font-smoothing: antialiased;
+      -moz-osx-font-smoothing: grayscale;
+    }
+    button, input, textarea { font: inherit; color: inherit; }
+    .hidden { display: none !important; }
+    a { color: #ededed; }
+
+    /* Auth */
+    .auth {
+      min-height: 100vh;
+      display: grid;
+      place-items: center;
+      padding: 20px;
+      background: #000;
+    }
+    .auth-card {
+      width: min(400px, 90vw);
+    }
+    .auth-shell {
+      background: #0a0a0a;
+      border: 1px solid rgba(255,255,255,0.1);
+      border-radius: 9999px;
+      display: flex;
+      align-items: center;
+      padding: 4px 6px 4px 18px;
+      transition: border-color 0.15s;
+    }
+    .auth-shell:focus-within { border-color: rgba(255,255,255,0.2); }
+    .auth-input {
+      flex: 1;
+      background: transparent;
+      border: 0;
+      outline: none;
+      color: #ededed;
+      padding: 10px 0 8px;
+      font-size: 14px;
+      margin-top: -2px;
+    }
+    .auth-input::placeholder { color: #444; }
+    .auth-submit {
+      width: 32px;
+      height: 32px;
+      background: #ededed;
+      border: 0;
+      border-radius: 50%;
+      color: #000;
+      cursor: pointer;
+      display: grid;
+      place-items: center;
+      flex-shrink: 0;
+      margin-bottom: 2px;
+      transition: background 0.15s;
+    }
+    .auth-submit:hover { background: #fff; }
+    .error { color: #ff4444; font-size: 13px; min-height: 16px; }
+    .message-error {
+      background: rgba(255,68,68,0.08);
+      border: 1px solid rgba(255,68,68,0.25);
+      border-radius: 10px;
+      color: #ff6b6b;
+      padding: 12px 16px;
+      font-size: 13px;
+      line-height: 1.5;
+      max-width: 600px;
+    }
+    .message-error strong { color: #ff4444; }
+
+    /* Layout - use fixed positioning with explicit dimensions */
+    .shell { 
+      position: fixed; 
+      top: 0; 
+      left: 0;
+      width: 100vw;
+      height: 100vh;
+      height: 100dvh; /* Dynamic viewport height for normal browsers */
+      display: flex; 
+      overflow: hidden;
+    }
+    /* PWA standalone mode: use 100vh which works correctly */
+    @media (display-mode: standalone) {
+      .shell {
+        height: 100vh;
+      }
+    }
+    
+    /* Edge swipe blocker - invisible touch target to intercept right edge gestures */
+    .edge-blocker-right {
+      position: fixed;
+      top: 0;
+      bottom: 0;
+      right: 0;
+      width: 20px;
+      z-index: 9999;
+      touch-action: none;
+    }
+    .sidebar {
+      width: 260px;
+      background: #000;
+      border-right: 1px solid rgba(255,255,255,0.06);
+      display: flex;
+      flex-direction: column;
+      padding: 12px 8px;
+    }
+    .new-chat-btn {
+      background: transparent;
+      border: 0;
+      color: #888;
+      border-radius: 12px;
+      height: 36px;
+      padding: 0 10px;
+      display: flex;
+      align-items: center;
+      gap: 8px;
+      font-size: 13px;
+      cursor: pointer;
+      transition: background 0.15s, color 0.15s;
+    }
+    .new-chat-btn:hover { color: #ededed; }
+    .new-chat-btn svg { width: 16px; height: 16px; }
+    .conversation-list {
+      flex: 1;
+      overflow-y: auto;
+      margin-top: 12px;
+      display: flex;
+      flex-direction: column;
+      gap: 2px;
+    }
+    .conversation-item {
+      height: 36px;
+      min-height: 36px;
+      max-height: 36px;
+      flex-shrink: 0;
+      padding: 0 16px 0 10px;
+      border-radius: 12px;
+      cursor: pointer;
+      font-size: 13px;
+      line-height: 36px;
+      color: #555;
+      white-space: nowrap;
+      overflow: hidden;
+      text-overflow: ellipsis;
+      position: relative;
+      transition: color 0.15s;
+    }
+    .conversation-item:hover { color: #999; }
+    .conversation-item.active {
+      color: #ededed;
+    }
+    .conversation-item .delete-btn {
+      position: absolute;
+      right: 0;
+      top: 0;
+      bottom: 0;
+      opacity: 0;
+      background: #000;
+      border: 0;
+      color: #444;
+      padding: 0 8px;
+      border-radius: 0 4px 4px 0;
+      cursor: pointer;
+      font-size: 16px;
+      line-height: 1;
+      display: grid;
+      place-items: center;
+      transition: opacity 0.15s, color 0.15s;
+    }
+    .conversation-item:hover .delete-btn { opacity: 1; }
+    .conversation-item.active .delete-btn { background: rgba(0,0,0,1); }
+    .conversation-item .delete-btn::before {
+      content: "";
+      position: absolute;
+      right: 100%;
+      top: 0;
+      bottom: 0;
+      width: 24px;
+      background: linear-gradient(to right, transparent, #000);
+      pointer-events: none;
+    }
+    .conversation-item.active .delete-btn::before {
+      background: linear-gradient(to right, transparent, rgba(0,0,0,1));
+    }
+    .conversation-item .delete-btn:hover { color: #888; }
+    .conversation-item .delete-btn.confirming {
+      opacity: 1;
+      width: auto;
+      padding: 0 8px;
+      font-size: 11px;
+      color: #ff4444;
+      border-radius: 3px;
+    }
+    .conversation-item .delete-btn.confirming:hover {
+      color: #ff6666;
+    }
+    .sidebar-footer {
+      margin-top: auto;
+      padding-top: 8px;
+    }
+    .logout-btn {
+      background: transparent;
+      border: 0;
+      color: #555;
+      width: 100%;
+      padding: 8px 10px;
+      text-align: left;
+      border-radius: 6px;
+      cursor: pointer;
+      font-size: 13px;
+      transition: color 0.15s, background 0.15s;
+    }
+    .logout-btn:hover { color: #888; }
+
+    /* Main */
+    .main { flex: 1; display: flex; flex-direction: column; min-width: 0; max-width: 100%; background: #000; overflow: hidden; }
+    .topbar {
+      height: calc(52px + env(safe-area-inset-top, 0px));
+      padding-top: env(safe-area-inset-top, 0px);
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      font-size: 13px;
+      font-weight: 500;
+      color: #888;
+      border-bottom: 1px solid rgba(255,255,255,0.06);
+      position: relative;
+      flex-shrink: 0;
+    }
+    .topbar-title {
+      max-width: calc(100% - 100px);
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+      letter-spacing: -0.01em;
+      padding: 0 50px;
+    }
+    .sidebar-toggle {
+      display: none;
+      position: absolute;
+      left: 12px;
+      bottom: 4px; /* Position from bottom of topbar content area */
+      background: transparent;
+      border: 0;
+      color: #666;
+      width: 44px;
+      height: 44px;
+      border-radius: 6px;
+      cursor: pointer;
+      transition: color 0.15s, background 0.15s;
+      font-size: 18px;
+      z-index: 10;
+      -webkit-tap-highlight-color: transparent;
+    }
+    .sidebar-toggle:hover { color: #ededed; }
+    .topbar-new-chat {
+      display: none;
+      position: absolute;
+      right: 12px;
+      bottom: 4px;
+      background: transparent;
+      border: 0;
+      color: #666;
+      width: 44px;
+      height: 44px;
+      border-radius: 6px;
+      cursor: pointer;
+      transition: color 0.15s, background 0.15s;
+      z-index: 10;
+      -webkit-tap-highlight-color: transparent;
+    }
+    .topbar-new-chat:hover { color: #ededed; }
+    .topbar-new-chat svg { width: 16px; height: 16px; }
+
+    /* Messages */
+    .messages { flex: 1; overflow-y: auto; overflow-x: hidden; padding: 24px 24px; }
+    .messages-column { max-width: 680px; margin: 0 auto; }
+    .message-row { margin-bottom: 24px; display: flex; max-width: 100%; }
+    .message-row.user { justify-content: flex-end; }
+    .assistant-wrap { display: flex; gap: 12px; max-width: 100%; min-width: 0; }
+    .assistant-avatar {
+      width: 24px;
+      height: 24px;
+      background: #ededed;
+      color: #000;
+      border-radius: 6px;
+      display: grid;
+      place-items: center;
+      font-size: 11px;
+      font-weight: 600;
+      flex-shrink: 0;
+      margin-top: 2px;
+    }
+    .assistant-content {
+      line-height: 1.65;
+      color: #ededed;
+      font-size: 14px;
+      min-width: 0;
+      max-width: 100%;
+      overflow-wrap: break-word;
+      word-break: break-word;
+      margin-top: 2px;
+    }
+    .assistant-content p { margin: 0 0 12px; }
+    .assistant-content p:last-child { margin-bottom: 0; }
+    .assistant-content ul, .assistant-content ol { margin: 8px 0; padding-left: 20px; }
+    .assistant-content li { margin: 4px 0; }
+    .assistant-content strong { font-weight: 600; color: #fff; }
+    .assistant-content h2 {
+      font-size: 16px;
+      font-weight: 600;
+      letter-spacing: -0.02em;
+      margin: 20px 0 8px;
+      color: #fff;
+    }
+    .assistant-content h3 {
+      font-size: 14px;
+      font-weight: 600;
+      letter-spacing: -0.01em;
+      margin: 16px 0 6px;
+      color: #fff;
+    }
+    .assistant-content code {
+      background: rgba(255,255,255,0.06);
+      border: 1px solid rgba(255,255,255,0.06);
+      padding: 2px 5px;
+      border-radius: 4px;
+      font-family: ui-monospace, "SF Mono", "Fira Code", monospace;
+      font-size: 0.88em;
+    }
+    .assistant-content pre {
+      background: #0a0a0a;
+      border: 1px solid rgba(255,255,255,0.06);
+      padding: 14px 16px;
+      border-radius: 8px;
+      overflow-x: auto;
+      margin: 14px 0;
+    }
+    .assistant-content pre code {
+      background: none;
+      border: 0;
+      padding: 0;
+      font-size: 13px;
+      line-height: 1.5;
+    }
+    .tool-activity-inline {
+      margin: 8px 0;
+      font-size: 12px;
+      line-height: 1.45;
+      color: #8a8a8a;
+    }
+    .tool-activity-inline code {
+      font-family: ui-monospace, "SF Mono", "Fira Code", monospace;
+      background: rgba(255,255,255,0.04);
+      border: 1px solid rgba(255,255,255,0.08);
+      padding: 4px 8px;
+      border-radius: 6px;
+      color: #bcbcbc;
+      font-size: 11px;
+    }
+    .tool-status {
+      color: #8a8a8a;
+      font-style: italic;
+    }
+    .tool-done {
+      color: #6a9955;
+    }
+    .tool-error {
+      color: #f48771;
+    }
+    .assistant-content table {
+      border-collapse: collapse;
+      width: 100%;
+      margin: 14px 0;
+      font-size: 13px;
+      border: 1px solid rgba(255,255,255,0.08);
+      border-radius: 8px;
+      overflow: hidden;
+      display: block;
+      max-width: 100%;
+      overflow-x: auto;
+      white-space: nowrap;
+    }
+    .assistant-content th {
+      background: rgba(255,255,255,0.06);
+      padding: 10px 12px;
+      text-align: left;
+      font-weight: 600;
+      border-bottom: 1px solid rgba(255,255,255,0.12);
+      color: #fff;
+      min-width: 100px;
+    }
+    .assistant-content td {
+      padding: 10px 12px;
+      border-bottom: 1px solid rgba(255,255,255,0.06);
+      min-width: 100px;
+    }
+    .assistant-content tr:last-child td {
+      border-bottom: none;
+    }
+    .assistant-content tbody tr:hover {
+      background: rgba(255,255,255,0.02);
+    }
+    .assistant-content hr {
+      border: 0;
+      border-top: 1px solid rgba(255,255,255,0.1);
+      margin: 20px 0;
+    }
+    .tool-activity {
+      margin-top: 12px;
+      margin-bottom: 12px;
+      border: 1px solid rgba(255,255,255,0.08);
+      background: rgba(255,255,255,0.03);
+      border-radius: 10px;
+      font-size: 12px;
+      line-height: 1.45;
+      color: #bcbcbc;
+      max-width: 300px;
+    }
+    .assistant-content > .tool-activity:first-child {
+      margin-top: 0;
+    }
+    .tool-activity-disclosure {
+      display: block;
+    }
+    .tool-activity-summary {
+      list-style: none;
+      display: flex;
+      align-items: center;
+      gap: 8px;
+      cursor: pointer;
+      padding: 10px 12px;
+      user-select: none;
+    }
+    .tool-activity-summary::-webkit-details-marker {
+      display: none;
+    }
+    .tool-activity-label {
+      font-size: 11px;
+      text-transform: uppercase;
+      letter-spacing: 0.06em;
+      color: #8a8a8a;
+      font-weight: 600;
+    }
+    .tool-activity-caret {
+      margin-left: auto;
+      color: #8a8a8a;
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      transition: transform 120ms ease;
+      transform: rotate(0deg);
+    }
+    .tool-activity-caret svg {
+      width: 14px;
+      height: 14px;
+      display: block;
+    }
+    .tool-activity-disclosure[open] .tool-activity-caret {
+      transform: rotate(90deg);
+    }
+    .tool-activity-list {
+      display: grid;
+      gap: 6px;
+      padding: 0 12px 10px;
+    }
+    .tool-activity-item {
+      font-family: ui-monospace, "SF Mono", "Fira Code", monospace;
+      background: rgba(255,255,255,0.04);
+      border-radius: 6px;
+      padding: 4px 7px;
+      color: #d6d6d6;
+    }
+    .approval-requests {
+      border-top: 1px solid rgba(255,255,255,0.08);
+      padding: 10px 12px 12px;
+      display: grid;
+      gap: 8px;
+      background: rgba(0,0,0,0.16);
+    }
+    .approval-requests-label {
+      font-size: 11px;
+      text-transform: uppercase;
+      letter-spacing: 0.06em;
+      color: #b0b0b0;
+      font-weight: 600;
+    }
+    .approval-request-item {
+      border: 1px solid rgba(255,255,255,0.1);
+      background: rgba(255,255,255,0.03);
+      border-radius: 8px;
+      padding: 8px;
+      display: grid;
+      gap: 6px;
+    }
+    .approval-request-tool {
+      font-size: 12px;
+      color: #fff;
+      font-weight: 600;
+      overflow-wrap: anywhere;
+    }
+    .approval-request-input {
+      font-family: ui-monospace, "SF Mono", "Fira Code", monospace;
+      font-size: 11px;
+      color: #cfcfcf;
+      background: rgba(0,0,0,0.25);
+      border-radius: 6px;
+      padding: 6px;
+      overflow-wrap: anywhere;
+      max-height: 80px;
+      overflow-y: auto;
+    }
+    .approval-request-actions {
+      display: flex;
+      gap: 6px;
+    }
+    .approval-action-btn {
+      border-radius: 6px;
+      border: 1px solid rgba(255,255,255,0.18);
+      background: rgba(255,255,255,0.06);
+      color: #f0f0f0;
+      font-size: 11px;
+      font-weight: 600;
+      padding: 4px 8px;
+      cursor: pointer;
+    }
+    .approval-action-btn:hover {
+      background: rgba(255,255,255,0.12);
+    }
+    .approval-action-btn.approve {
+      border-color: rgba(58, 208, 122, 0.45);
+      color: #78e7a6;
+    }
+    .approval-action-btn.deny {
+      border-color: rgba(224, 95, 95, 0.45);
+      color: #f59b9b;
+    }
+    .approval-action-btn[disabled] {
+      opacity: 0.55;
+      cursor: not-allowed;
+    }
+    .user-bubble {
+      background: #111;
+      border: 1px solid rgba(255,255,255,0.08);
+      padding: 10px 16px;
+      border-radius: 18px;
+      max-width: 70%;
+      font-size: 14px;
+      line-height: 1.5;
+      overflow-wrap: break-word;
+      word-break: break-word;
+    }
+    .empty-state {
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      justify-content: center;
+      height: 100%;
+      gap: 16px;
+      color: #555;
+    }
+    .empty-state .assistant-avatar {
+      width: 36px;
+      height: 36px;
+      font-size: 14px;
+      border-radius: 8px;
+    }
+    .empty-state-text {
+      font-size: 14px;
+      color: #555;
+    }
+    .thinking-indicator {
+      display: inline-block;
+      font-family: Inconsolata, monospace;
+      font-size: 20px;
+      line-height: 1;
+      vertical-align: middle;
+      color: #ededed;
+      opacity: 0.5;
+    }
+
+    /* Composer */
+    .composer {
+      padding: 12px 24px 24px;
+      position: relative;
+    }
+    /* PWA standalone mode - extra bottom padding */
+    @media (display-mode: standalone), (-webkit-touch-callout: none) {
+      .composer {
+        padding-bottom: 32px;
+      }
+    }
+    @supports (-webkit-touch-callout: none) {
+      /* iOS Safari standalone check via JS class */
+      .standalone .composer {
+        padding-bottom: 32px;
+      }
+    }
+    .composer::before {
+      content: "";
+      position: absolute;
+      left: 0;
+      right: 0;
+      bottom: 100%;
+      height: 48px;
+      background: linear-gradient(to top, #000 0%, transparent 100%);
+      pointer-events: none;
+    }
+    .composer-inner { max-width: 680px; margin: 0 auto; }
+    .composer-shell {
+      background: #0a0a0a;
+      border: 1px solid rgba(255,255,255,0.1);
+      border-radius: 9999px;
+      display: flex;
+      align-items: center;
+      padding: 4px 6px 4px 18px;
+      transition: border-color 0.15s;
+    }
+    .composer-shell:focus-within { border-color: rgba(255,255,255,0.2); }
+    .composer-input {
+      flex: 1;
+      background: transparent;
+      border: 0;
+      outline: none;
+      color: #ededed;
+      min-height: 40px;
+      max-height: 200px;
+      resize: none;
+      padding: 10px 0 8px;
+      font-size: 14px;
+      line-height: 1.5;
+      margin-top: -2px;
+    }
+    .composer-input::placeholder { color: #444; }
+    .send-btn {
+      width: 32px;
+      height: 32px;
+      background: #ededed;
+      border: 0;
+      border-radius: 50%;
+      color: #000;
+      cursor: pointer;
+      display: grid;
+      place-items: center;
+      flex-shrink: 0;
+      margin-bottom: 2px;
+      transition: background 0.15s, opacity 0.15s;
+    }
+    .send-btn:hover { background: #fff; }
+    .send-btn:disabled { opacity: 0.2; cursor: default; }
+    .send-btn:disabled:hover { background: #ededed; }
+    .disclaimer {
+      text-align: center;
+      color: #333;
+      font-size: 12px;
+      margin-top: 10px;
+    }
+
+    /* Scrollbar */
+    ::-webkit-scrollbar { width: 6px; }
+    ::-webkit-scrollbar-track { background: transparent; }
+    ::-webkit-scrollbar-thumb { background: rgba(255,255,255,0.1); border-radius: 3px; }
+    ::-webkit-scrollbar-thumb:hover { background: rgba(255,255,255,0.16); }
+
+    /* Mobile */
+    @media (max-width: 768px) {
+      .sidebar {
+        position: fixed;
+        inset: 0 auto 0 0;
+        z-index: 100;
+        transform: translateX(-100%);
+        padding-top: calc(env(safe-area-inset-top, 0px) + 12px);
+        will-change: transform;
+      }
+      .sidebar.dragging { transition: none; }
+      .sidebar:not(.dragging) { transition: transform 0.25s cubic-bezier(0.4, 0, 0.2, 1); }
+      .shell.sidebar-open .sidebar { transform: translateX(0); }
+      .sidebar-toggle { display: grid; place-items: center; }
+      .topbar-new-chat { display: grid; place-items: center; }
+      .sidebar-backdrop {
+        position: fixed;
+        inset: 0;
+        background: rgba(0,0,0,0.6);
+        z-index: 50;
+        backdrop-filter: blur(2px);
+        -webkit-backdrop-filter: blur(2px);
+        opacity: 0;
+        pointer-events: none;
+        will-change: opacity;
+      }
+      .sidebar-backdrop:not(.dragging) { transition: opacity 0.25s cubic-bezier(0.4, 0, 0.2, 1); }
+      .sidebar-backdrop.dragging { transition: none; }
+      .shell.sidebar-open .sidebar-backdrop { opacity: 1; pointer-events: auto; }
+      .messages { padding: 16px; }
+      .composer { padding: 8px 16px 16px; }
+      /* Always show delete button on mobile (no hover) */
+      .conversation-item .delete-btn { opacity: 1; }
+    }
+
+    /* Reduced motion */
+    @media (prefers-reduced-motion: reduce) {
+      *, *::before, *::after {
+        animation-duration: 0.01ms !important;
+        transition-duration: 0.01ms !important;
+      }
+    }
+  </style>
+</head>
+<body data-agent-initial="${agentInitial}" data-agent-name="${agentName}">
+  <div class="edge-blocker-right"></div>
+  <div id="auth" class="auth hidden">
+    <form id="login-form" class="auth-card">
+      <div class="auth-shell">
+        <input id="passphrase" class="auth-input" type="password" placeholder="Passphrase" required autofocus>
+        <button class="auth-submit" type="submit">
+          <svg width="16" height="16" viewBox="0 0 16 16" fill="none"><path d="M4 8h8M9 5l3 3-3 3" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg>
+        </button>
+      </div>
+      <div id="login-error" class="error"></div>
+    </form>
+  </div>
+
+  <div id="app" class="shell hidden">
+    <aside class="sidebar">
+      <button id="new-chat" class="new-chat-btn">
+        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 5v14M5 12h14"/></svg>
+      </button>
+      <div id="conversation-list" class="conversation-list"></div>
+      <div class="sidebar-footer">
+        <button id="logout" class="logout-btn">Log out</button>
+      </div>
+    </aside>
+    <div id="sidebar-backdrop" class="sidebar-backdrop"></div>
+    <main class="main">
+      <div class="topbar">
+        <button id="sidebar-toggle" class="sidebar-toggle">&#9776;</button>
+        <div id="chat-title" class="topbar-title"></div>
+        <button id="topbar-new-chat" class="topbar-new-chat">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 5v14M5 12h14"/></svg>
+        </button>
+      </div>
+      <div id="messages" class="messages">
+        <div class="empty-state">
+          <div class="assistant-avatar">${agentInitial}</div>
+          <div class="empty-state-text">How can I help you today?</div>
+        </div>
+      </div>
+      <form id="composer" class="composer">
+        <div class="composer-inner">
+          <div class="composer-shell">
+            <textarea id="prompt" class="composer-input" placeholder="Send a message..." rows="1"></textarea>
+            <button id="send" class="send-btn" type="submit">
+              <svg width="16" height="16" viewBox="0 0 16 16" fill="none"><path d="M8 12V4M4 7l4-4 4 4" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg>
+            </button>
+          </div>
+        </div>
+      </form>
+    </main>
+  </div>
+
+    <script>
+      // Marked library (inlined)
+      ${markedSource}
+
+      // Configure marked for GitHub Flavored Markdown (tables, etc.)
+      marked.setOptions({
+        gfm: true,
+        breaks: true
+      });
+
+      const state = {
+        csrfToken: "",
+        conversations: [],
+        activeConversationId: null,
+        activeMessages: [],
+        isStreaming: false,
+        confirmDeleteId: null,
+        approvalRequestsInFlight: {}
+      };
+
+      const agentInitial = document.body.dataset.agentInitial || "A";
+      const $ = (id) => document.getElementById(id);
+      const elements = {
+        auth: $("auth"),
+        app: $("app"),
+        loginForm: $("login-form"),
+        passphrase: $("passphrase"),
+        loginError: $("login-error"),
+        list: $("conversation-list"),
+        newChat: $("new-chat"),
+        topbarNewChat: $("topbar-new-chat"),
+        messages: $("messages"),
+        chatTitle: $("chat-title"),
+        logout: $("logout"),
+        composer: $("composer"),
+        prompt: $("prompt"),
+        send: $("send"),
+        shell: $("app"),
+        sidebarToggle: $("sidebar-toggle"),
+        sidebarBackdrop: $("sidebar-backdrop")
+      };
+
+      const pushConversationUrl = (conversationId) => {
+        const target = conversationId ? "/c/" + encodeURIComponent(conversationId) : "/";
+        if (window.location.pathname !== target) {
+          history.pushState({ conversationId: conversationId || null }, "", target);
+        }
+      };
+
+      const replaceConversationUrl = (conversationId) => {
+        const target = conversationId ? "/c/" + encodeURIComponent(conversationId) : "/";
+        if (window.location.pathname !== target) {
+          history.replaceState({ conversationId: conversationId || null }, "", target);
+        }
+      };
+
+      const getConversationIdFromUrl = () => {
+        const match = window.location.pathname.match(/^\\/c\\/([^\\/]+)/);
+        return match ? decodeURIComponent(match[1]) : null;
+      };
+
+      const mutatingMethods = new Set(["POST", "PATCH", "PUT", "DELETE"]);
+
+      const api = async (path, options = {}) => {
+        const method = (options.method || "GET").toUpperCase();
+        const headers = { ...(options.headers || {}) };
+        if (mutatingMethods.has(method) && state.csrfToken) {
+          headers["x-csrf-token"] = state.csrfToken;
+        }
+        if (options.body && !headers["Content-Type"]) {
+          headers["Content-Type"] = "application/json";
+        }
+        const response = await fetch(path, { credentials: "include", ...options, method, headers });
+        if (!response.ok) {
+          let payload = {};
+          try { payload = await response.json(); } catch {}
+          const error = new Error(payload.message || ("Request failed: " + response.status));
+          error.status = response.status;
+          error.payload = payload;
+          throw error;
+        }
+        const contentType = response.headers.get("content-type") || "";
+        if (contentType.includes("application/json")) {
+          return await response.json();
+        }
+        return await response.text();
+      };
+
+      const escapeHtml = (value) =>
+        String(value || "")
+          .replace(/&/g, "&amp;")
+          .replace(/</g, "&lt;")
+          .replace(/>/g, "&gt;")
+          .replace(/"/g, "&quot;")
+          .replace(/'/g, "&#39;");
+
+      const renderAssistantMarkdown = (value) => {
+        const source = String(value || "").trim();
+        if (!source) return "<p></p>";
+
+        try {
+          return marked.parse(source);
+        } catch (error) {
+          console.error("Markdown parsing error:", error);
+          // Fallback to escaped text
+          return "<p>" + escapeHtml(source) + "</p>";
+        }
+      };
+
+      const extractToolActivity = (value) => {
+        const source = String(value || "");
+        let markerIndex = source.lastIndexOf("\\n### Tool activity\\n");
+        if (markerIndex < 0 && source.startsWith("### Tool activity\\n")) {
+          markerIndex = 0;
+        }
+        if (markerIndex < 0) {
+          return { content: source, activities: [] };
+        }
+        const content = markerIndex === 0 ? "" : source.slice(0, markerIndex).trimEnd();
+        const rawSection = markerIndex === 0 ? source : source.slice(markerIndex + 1);
+        const afterHeading = rawSection.replace(/^### Tool activity\\s*\\n?/, "");
+        const activities = afterHeading
+          .split("\\n")
+          .map((line) => line.trim())
+          .filter((line) => line.startsWith("- "))
+          .map((line) => line.slice(2).trim())
+          .filter(Boolean);
+        return { content, activities };
+      };
+
+      const renderApprovalRequests = (requests) => {
+        if (!Array.isArray(requests) || requests.length === 0) {
+          return "";
+        }
+        const rows = requests
+          .map((req) => {
+            const approvalId = typeof req.approvalId === "string" ? req.approvalId : "";
+            const tool = typeof req.tool === "string" ? req.tool : "tool";
+            const inputPreview = typeof req.inputPreview === "string" ? req.inputPreview : "{}";
+            const submitting = req.state === "submitting";
+            const approveLabel = submitting && req.pendingDecision === "approve" ? "Approving..." : "Approve";
+            const denyLabel = submitting && req.pendingDecision === "deny" ? "Denying..." : "Deny";
+            return (
+              '<div class="approval-request-item">' +
+              '<div class="approval-request-tool">' +
+              escapeHtml(tool) +
+              "</div>" +
+              '<div class="approval-request-input">' +
+              escapeHtml(inputPreview) +
+              "</div>" +
+              '<div class="approval-request-actions">' +
+              '<button class="approval-action-btn approve" data-approval-id="' +
+              escapeHtml(approvalId) +
+              '" data-approval-decision="approve" ' +
+              (submitting ? "disabled" : "") +
+              ">" +
+              approveLabel +
+              "</button>" +
+              '<button class="approval-action-btn deny" data-approval-id="' +
+              escapeHtml(approvalId) +
+              '" data-approval-decision="deny" ' +
+              (submitting ? "disabled" : "") +
+              ">" +
+              denyLabel +
+              "</button>" +
+              "</div>" +
+              "</div>"
+            );
+          })
+          .join("");
+        return (
+          '<div class="approval-requests">' +
+          '<div class="approval-requests-label">Approval required</div>' +
+          rows +
+          "</div>"
+        );
+      };
+
+      const renderToolActivity = (items, approvalRequests = []) => {
+        const hasItems = Array.isArray(items) && items.length > 0;
+        const hasApprovals = Array.isArray(approvalRequests) && approvalRequests.length > 0;
+        if (!hasItems && !hasApprovals) {
+          return "";
+        }
+        const chips = hasItems
+          ? items
+              .map((item) => '<div class="tool-activity-item">' + escapeHtml(item) + "</div>")
+              .join("")
+          : "";
+        const disclosure = hasItems
+          ? (
+              '<details class="tool-activity-disclosure">' +
+              '<summary class="tool-activity-summary">' +
+              '<span class="tool-activity-label">Tool activity</span>' +
+              '<span class="tool-activity-caret" aria-hidden="true"><svg viewBox="0 0 12 12" fill="none"><path d="M4.5 2.75L8 6L4.5 9.25" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"></path></svg></span>' +
+              "</summary>" +
+              '<div class="tool-activity-list">' +
+              chips +
+              "</div>" +
+              "</details>"
+            )
+          : "";
+        return (
+          '<div class="tool-activity">' +
+          disclosure +
+          renderApprovalRequests(approvalRequests) +
+          "</div>"
+        );
+      };
+
+      const updatePendingApproval = (approvalId, updater) => {
+        if (!approvalId || typeof updater !== "function") {
+          return false;
+        }
+        const messages = state.activeMessages || [];
+        for (const message of messages) {
+          if (!message || !Array.isArray(message._pendingApprovals)) {
+            continue;
+          }
+          const idx = message._pendingApprovals.findIndex((req) => req.approvalId === approvalId);
+          if (idx < 0) {
+            continue;
+          }
+          const next = updater(message._pendingApprovals[idx], message._pendingApprovals);
+          if (next === null) {
+            message._pendingApprovals.splice(idx, 1);
+          } else if (next && typeof next === "object") {
+            message._pendingApprovals[idx] = next;
+          }
+          return true;
+        }
+        return false;
+      };
+
+      const formatDate = (epoch) => {
+        try {
+          const date = new Date(epoch);
+          const now = new Date();
+          const startOfToday = new Date(now.getFullYear(), now.getMonth(), now.getDate()).getTime();
+          const startOfDate = new Date(date.getFullYear(), date.getMonth(), date.getDate()).getTime();
+          const dayDiff = Math.floor((startOfToday - startOfDate) / 86400000);
+          if (dayDiff === 0) {
+            return "Today";
+          }
+          if (dayDiff === 1) {
+            return "Yesterday";
+          }
+          if (dayDiff < 7 && dayDiff > 1) {
+            return date.toLocaleDateString(undefined, { weekday: "short" });
+          }
+          return date.toLocaleDateString(undefined, { month: "short", day: "numeric" });
+        } catch {
+          return "";
+        }
+      };
+
+      const isMobile = () => window.matchMedia("(max-width: 900px)").matches;
+
+      const setSidebarOpen = (open) => {
+        if (!isMobile()) {
+          elements.shell.classList.remove("sidebar-open");
+          return;
+        }
+        elements.shell.classList.toggle("sidebar-open", open);
+      };
+
+      const renderConversationList = () => {
+        elements.list.innerHTML = "";
+        for (const c of state.conversations) {
+          const item = document.createElement("div");
+          item.className = "conversation-item" + (c.conversationId === state.activeConversationId ? " active" : "");
+          item.textContent = c.title;
+
+          const isConfirming = state.confirmDeleteId === c.conversationId;
+          const deleteBtn = document.createElement("button");
+          deleteBtn.className = "delete-btn" + (isConfirming ? " confirming" : "");
+          deleteBtn.textContent = isConfirming ? "sure?" : "\\u00d7";
+          deleteBtn.onclick = async (e) => {
+            e.stopPropagation();
+            if (!isConfirming) {
+              state.confirmDeleteId = c.conversationId;
+              renderConversationList();
+              return;
+            }
+            await api("/api/conversations/" + c.conversationId, { method: "DELETE" });
+            if (state.activeConversationId === c.conversationId) {
+              state.activeConversationId = null;
+              state.activeMessages = [];
+              pushConversationUrl(null);
+              elements.chatTitle.textContent = "";
+              renderMessages([]);
+            }
+            state.confirmDeleteId = null;
+            await loadConversations();
+          };
+          item.appendChild(deleteBtn);
+
+          item.onclick = async () => {
+            // Clear any delete confirmation, but still navigate
+            if (state.confirmDeleteId) {
+              state.confirmDeleteId = null;
+            }
+            state.activeConversationId = c.conversationId;
+            pushConversationUrl(c.conversationId);
+            renderConversationList();
+            await loadConversation(c.conversationId);
+            if (isMobile()) setSidebarOpen(false);
+          };
+
+          elements.list.appendChild(item);
+        }
+      };
+
+      const renderMessages = (messages, isStreaming = false) => {
+        elements.messages.innerHTML = "";
+        if (!messages || !messages.length) {
+          elements.messages.innerHTML = '<div class="empty-state"><div class="assistant-avatar">' + agentInitial + '</div><div>How can I help you today?</div></div>';
+          return;
+        }
+        const col = document.createElement("div");
+        col.className = "messages-column";
+        messages.forEach((m, i) => {
+          const row = document.createElement("div");
+          row.className = "message-row " + m.role;
+          if (m.role === "assistant") {
+            const wrap = document.createElement("div");
+            wrap.className = "assistant-wrap";
+            wrap.innerHTML = '<div class="assistant-avatar">' + agentInitial + '</div>';
+            const content = document.createElement("div");
+            content.className = "assistant-content";
+            const text = String(m.content || "");
+
+            if (m._error) {
+              const errorEl = document.createElement("div");
+              errorEl.className = "message-error";
+              errorEl.innerHTML = "<strong>Error</strong><br>" + escapeHtml(m._error);
+              content.appendChild(errorEl);
+            } else if (isStreaming && i === messages.length - 1 && !text && (!m._chunks || m._chunks.length === 0)) {
+              const spinner = document.createElement("span");
+              spinner.className = "thinking-indicator";
+              const starFrames = ["\u2736","\u2738","\u2739","\u273A","\u2739","\u2737"];
+              let frame = 0;
+              spinner.textContent = starFrames[0];
+              spinner._interval = setInterval(() => { frame = (frame + 1) % starFrames.length; spinner.textContent = starFrames[frame]; }, 70);
+              content.appendChild(spinner);
+            } else {
+              // Check for sections in _sections (streaming) or metadata.sections (stored)
+              const sections = m._sections || (m.metadata && m.metadata.sections);
+
+              if (sections && sections.length > 0) {
+                // Render sections interleaved
+                sections.forEach(section => {
+                  if (section.type === "text") {
+                    const textDiv = document.createElement("div");
+                    textDiv.innerHTML = renderAssistantMarkdown(section.content);
+                    content.appendChild(textDiv);
+                  } else if (section.type === "tools") {
+                    content.insertAdjacentHTML("beforeend", renderToolActivity(section.content));
+                  }
+                });
+                // While streaming, show current tools if any
+                if (isStreaming && i === messages.length - 1 && m._currentTools && m._currentTools.length > 0) {
+                  content.insertAdjacentHTML(
+                    "beforeend",
+                    renderToolActivity(m._currentTools, m._pendingApprovals || []),
+                  );
+                }
+                // Show current text being typed
+                if (isStreaming && i === messages.length - 1 && m._currentText) {
+                  const textDiv = document.createElement("div");
+                  textDiv.innerHTML = renderAssistantMarkdown(m._currentText);
+                  content.appendChild(textDiv);
+                }
+              } else {
+                // Fallback: render text and tools the old way (for old messages without sections)
+                if (text) {
+                  const parsed = extractToolActivity(text);
+                  content.innerHTML = renderAssistantMarkdown(parsed.content);
+                }
+                const metadataToolActivity =
+                  m.metadata && Array.isArray(m.metadata.toolActivity)
+                    ? m.metadata.toolActivity
+                    : [];
+                if (metadataToolActivity.length > 0) {
+                  content.insertAdjacentHTML(
+                    "beforeend",
+                    renderToolActivity(
+                      metadataToolActivity,
+                      isStreaming && i === messages.length - 1 ? m._pendingApprovals || [] : [],
+                    ),
+                  );
+                }
+              }
+            }
+            wrap.appendChild(content);
+            row.appendChild(wrap);
+          } else {
+            row.innerHTML = '<div class="user-bubble">' + escapeHtml(m.content) + '</div>';
+          }
+          col.appendChild(row);
+        });
+        elements.messages.appendChild(col);
+        elements.messages.scrollTop = elements.messages.scrollHeight;
+      };
+
+      const loadConversations = async () => {
+        const payload = await api("/api/conversations");
+        state.conversations = payload.conversations || [];
+        renderConversationList();
+      };
+
+      const loadConversation = async (conversationId) => {
+        const payload = await api("/api/conversations/" + encodeURIComponent(conversationId));
+        elements.chatTitle.textContent = payload.conversation.title;
+        state.activeMessages = payload.conversation.messages || [];
+        renderMessages(state.activeMessages);
+        elements.prompt.focus();
+      };
+
+      const createConversation = async (title, options = {}) => {
+        const shouldLoadConversation = options.loadConversation !== false;
+        const payload = await api("/api/conversations", {
+          method: "POST",
+          body: JSON.stringify(title ? { title } : {})
+        });
+        state.activeConversationId = payload.conversation.conversationId;
+        state.confirmDeleteId = null;
+        pushConversationUrl(state.activeConversationId);
+        await loadConversations();
+        if (shouldLoadConversation) {
+          await loadConversation(state.activeConversationId);
+        } else {
+          elements.chatTitle.textContent = payload.conversation.title || "New conversation";
+        }
+        return state.activeConversationId;
+      };
+
+      const parseSseChunk = (buffer, onEvent) => {
+        let rest = buffer;
+        while (true) {
+          const index = rest.indexOf("\\n\\n");
+          if (index < 0) {
+            return rest;
+          }
+          const raw = rest.slice(0, index);
+          rest = rest.slice(index + 2);
+          const lines = raw.split("\\n");
+          let eventName = "message";
+          let data = "";
+          for (const line of lines) {
+            if (line.startsWith("event:")) {
+              eventName = line.slice(6).trim();
+            } else if (line.startsWith("data:")) {
+              data += line.slice(5).trim();
+            }
+          }
+          if (data) {
+            try {
+              onEvent(eventName, JSON.parse(data));
+            } catch {}
+          }
+        }
+      };
+
+      const setStreaming = (value) => {
+        state.isStreaming = value;
+        elements.send.disabled = value;
+      };
+
+      const pushToolActivity = (assistantMessage, line) => {
+        if (!line) {
+          return;
+        }
+        if (
+          !assistantMessage.metadata ||
+          !Array.isArray(assistantMessage.metadata.toolActivity)
+        ) {
+          assistantMessage.metadata = {
+            ...(assistantMessage.metadata || {}),
+            toolActivity: [],
+          };
+        }
+        assistantMessage.metadata.toolActivity.push(line);
+      };
+
+      const autoResizePrompt = () => {
+        const el = elements.prompt;
+        el.style.height = "auto";
+        const scrollHeight = el.scrollHeight;
+        const nextHeight = Math.min(scrollHeight, 200);
+        el.style.height = nextHeight + "px";
+        el.style.overflowY = scrollHeight > 200 ? "auto" : "hidden";
+      };
+
+      const sendMessage = async (text) => {
+        const messageText = (text || "").trim();
+        if (!messageText || state.isStreaming) {
+          return;
+        }
+        const localMessages = [...(state.activeMessages || []), { role: "user", content: messageText }];
+        let assistantMessage = {
+          role: "assistant",
+          content: "",
+          _sections: [], // Array of {type: 'text'|'tools', content: string|array}
+          _currentText: "",
+          _currentTools: [],
+          _pendingApprovals: [],
+          metadata: { toolActivity: [] }
+        };
+        localMessages.push(assistantMessage);
+        state.activeMessages = localMessages;
+        renderMessages(localMessages, true);
+        setStreaming(true);
+        let conversationId = state.activeConversationId;
+        try {
+          if (!conversationId) {
+            conversationId = await createConversation(messageText, { loadConversation: false });
+          }
+          const response = await fetch("/api/conversations/" + encodeURIComponent(conversationId) + "/messages", {
+            method: "POST",
+            credentials: "include",
+            headers: { "Content-Type": "application/json", "x-csrf-token": state.csrfToken },
+            body: JSON.stringify({ message: messageText })
+          });
+          if (!response.ok || !response.body) {
+            throw new Error("Failed to stream response");
+          }
+          const reader = response.body.getReader();
+          const decoder = new TextDecoder();
+          let buffer = "";
+          while (true) {
+            const { value, done } = await reader.read();
+            if (done) {
+              break;
+            }
+            buffer += decoder.decode(value, { stream: true });
+            buffer = parseSseChunk(buffer, (eventName, payload) => {
+              if (eventName === "model:chunk") {
+                const chunk = String(payload.content || "");
+                // If we have tools accumulated and text starts again, push tools as a section
+                if (assistantMessage._currentTools.length > 0 && chunk.length > 0) {
+                  assistantMessage._sections.push({ type: "tools", content: assistantMessage._currentTools });
+                  assistantMessage._currentTools = [];
+                }
+                assistantMessage.content += chunk;
+                assistantMessage._currentText += chunk;
+                renderMessages(localMessages, true);
+              }
+              if (eventName === "tool:started") {
+                const toolName = payload.tool || "tool";
+                // If we have text accumulated, push it as a text section
+                if (assistantMessage._currentText.length > 0) {
+                  assistantMessage._sections.push({ type: "text", content: assistantMessage._currentText });
+                  assistantMessage._currentText = "";
+                }
+                const toolText = "- start \\x60" + toolName + "\\x60";
+                assistantMessage._currentTools.push(toolText);
+                if (!assistantMessage.metadata) assistantMessage.metadata = {};
+                if (!assistantMessage.metadata.toolActivity) assistantMessage.metadata.toolActivity = [];
+                assistantMessage.metadata.toolActivity.push(toolText);
+                renderMessages(localMessages, true);
+              }
+              if (eventName === "tool:completed") {
+                const toolName = payload.tool || "tool";
+                const duration = typeof payload.duration === "number" ? payload.duration : null;
+                const toolText = "- done \\x60" + toolName + "\\x60" + (duration !== null ? " (" + duration + "ms)" : "");
+                assistantMessage._currentTools.push(toolText);
+                if (!assistantMessage.metadata) assistantMessage.metadata = {};
+                if (!assistantMessage.metadata.toolActivity) assistantMessage.metadata.toolActivity = [];
+                assistantMessage.metadata.toolActivity.push(toolText);
+                renderMessages(localMessages, true);
+              }
+              if (eventName === "tool:error") {
+                const toolName = payload.tool || "tool";
+                const errorMsg = payload.error || "unknown error";
+                const toolText = "- error \\x60" + toolName + "\\x60: " + errorMsg;
+                assistantMessage._currentTools.push(toolText);
+                if (!assistantMessage.metadata) assistantMessage.metadata = {};
+                if (!assistantMessage.metadata.toolActivity) assistantMessage.metadata.toolActivity = [];
+                assistantMessage.metadata.toolActivity.push(toolText);
+                renderMessages(localMessages, true);
+              }
+              if (eventName === "tool:approval:required") {
+                const toolName = payload.tool || "tool";
+                const toolText = "- approval required \\x60" + toolName + "\\x60";
+                assistantMessage._currentTools.push(toolText);
+                if (!assistantMessage.metadata) assistantMessage.metadata = {};
+                if (!assistantMessage.metadata.toolActivity) assistantMessage.metadata.toolActivity = [];
+                assistantMessage.metadata.toolActivity.push(toolText);
+                const approvalId =
+                  typeof payload.approvalId === "string" ? payload.approvalId : "";
+                if (approvalId) {
+                  const preview = JSON.stringify(payload.input ?? {});
+                  const inputPreview = preview.length > 600 ? preview.slice(0, 600) + "..." : preview;
+                  if (!Array.isArray(assistantMessage._pendingApprovals)) {
+                    assistantMessage._pendingApprovals = [];
+                  }
+                  const exists = assistantMessage._pendingApprovals.some(
+                    (req) => req.approvalId === approvalId,
+                  );
+                  if (!exists) {
+                    assistantMessage._pendingApprovals.push({
+                      approvalId,
+                      tool: toolName,
+                      inputPreview,
+                      state: "pending",
+                    });
+                  }
+                }
+                renderMessages(localMessages, true);
+              }
+              if (eventName === "tool:approval:granted") {
+                const toolText = "- approval granted";
+                assistantMessage._currentTools.push(toolText);
+                if (!assistantMessage.metadata) assistantMessage.metadata = {};
+                if (!assistantMessage.metadata.toolActivity) assistantMessage.metadata.toolActivity = [];
+                assistantMessage.metadata.toolActivity.push(toolText);
+                const approvalId =
+                  typeof payload.approvalId === "string" ? payload.approvalId : "";
+                if (approvalId && Array.isArray(assistantMessage._pendingApprovals)) {
+                  assistantMessage._pendingApprovals = assistantMessage._pendingApprovals.filter(
+                    (req) => req.approvalId !== approvalId,
+                  );
+                }
+                renderMessages(localMessages, true);
+              }
+              if (eventName === "tool:approval:denied") {
+                const toolText = "- approval denied";
+                assistantMessage._currentTools.push(toolText);
+                if (!assistantMessage.metadata) assistantMessage.metadata = {};
+                if (!assistantMessage.metadata.toolActivity) assistantMessage.metadata.toolActivity = [];
+                assistantMessage.metadata.toolActivity.push(toolText);
+                const approvalId =
+                  typeof payload.approvalId === "string" ? payload.approvalId : "";
+                if (approvalId && Array.isArray(assistantMessage._pendingApprovals)) {
+                  assistantMessage._pendingApprovals = assistantMessage._pendingApprovals.filter(
+                    (req) => req.approvalId !== approvalId,
+                  );
+                }
+                renderMessages(localMessages, true);
+              }
+              if (eventName === "run:completed") {
+                if (!assistantMessage.content || assistantMessage.content.length === 0) {
+                  assistantMessage.content = String(payload.result?.response || "");
+                }
+                // Finalize sections: push any remaining tools and text
+                if (assistantMessage._currentTools.length > 0) {
+                  assistantMessage._sections.push({ type: "tools", content: assistantMessage._currentTools });
+                  assistantMessage._currentTools = [];
+                }
+                if (assistantMessage._currentText.length > 0) {
+                  assistantMessage._sections.push({ type: "text", content: assistantMessage._currentText });
+                  assistantMessage._currentText = "";
+                }
+                renderMessages(localMessages, false);
+              }
+              if (eventName === "run:error") {
+                const errMsg = payload.error?.message || "Something went wrong";
+                assistantMessage.content = "";
+                assistantMessage._error = errMsg;
+                renderMessages(localMessages, false);
+              }
+            });
+          }
+          // Update the state with our local messages (don't reload and lose tool chips)
+          state.activeMessages = localMessages;
+          await loadConversations();
+          // Don't reload the conversation - we already have the latest state with tool chips
+        } finally {
+          setStreaming(false);
+          elements.prompt.focus();
+        }
+      };
+
+      const requireAuth = async () => {
+        try {
+          const session = await api("/api/auth/session");
+          if (!session.authenticated) {
+            elements.auth.classList.remove("hidden");
+            elements.app.classList.add("hidden");
+            return false;
+          }
+          state.csrfToken = session.csrfToken || "";
+          elements.auth.classList.add("hidden");
+          elements.app.classList.remove("hidden");
+          return true;
+        } catch {
+          elements.auth.classList.remove("hidden");
+          elements.app.classList.add("hidden");
+          return false;
+        }
+      };
+
+      elements.loginForm.addEventListener("submit", async (event) => {
+        event.preventDefault();
+        elements.loginError.textContent = "";
+        try {
+          const result = await api("/api/auth/login", {
+            method: "POST",
+            body: JSON.stringify({ passphrase: elements.passphrase.value || "" })
+          });
+          state.csrfToken = result.csrfToken || "";
+          elements.passphrase.value = "";
+          elements.auth.classList.add("hidden");
+          elements.app.classList.remove("hidden");
+          await loadConversations();
+          const urlConversationId = getConversationIdFromUrl();
+          if (urlConversationId) {
+            state.activeConversationId = urlConversationId;
+            renderConversationList();
+            try {
+              await loadConversation(urlConversationId);
+            } catch {
+              state.activeConversationId = null;
+              state.activeMessages = [];
+              replaceConversationUrl(null);
+              renderMessages([]);
+              renderConversationList();
+            }
+          }
+        } catch (error) {
+          elements.loginError.textContent = error.message || "Login failed";
+        }
+      });
+
+      const startNewChat = () => {
+        state.activeConversationId = null;
+        state.activeMessages = [];
+        state.confirmDeleteId = null;
+        pushConversationUrl(null);
+        elements.chatTitle.textContent = "";
+        renderMessages([]);
+        renderConversationList();
+        elements.prompt.focus();
+        if (isMobile()) {
+          setSidebarOpen(false);
+        }
+      };
+
+      elements.newChat.addEventListener("click", startNewChat);
+      elements.topbarNewChat.addEventListener("click", startNewChat);
+
+      elements.prompt.addEventListener("input", () => {
+        autoResizePrompt();
+      });
+
+      elements.prompt.addEventListener("keydown", (event) => {
+        if (event.key === "Enter" && !event.shiftKey) {
+          event.preventDefault();
+          elements.composer.requestSubmit();
+        }
+      });
+
+      elements.sidebarToggle.addEventListener("click", () => {
+        if (isMobile()) setSidebarOpen(!elements.shell.classList.contains("sidebar-open"));
+      });
+
+      elements.sidebarBackdrop.addEventListener("click", () => setSidebarOpen(false));
+
+      elements.logout.addEventListener("click", async () => {
+        await api("/api/auth/logout", { method: "POST" });
+        state.activeConversationId = null;
+        state.activeMessages = [];
+        state.confirmDeleteId = null;
+        state.conversations = [];
+        state.csrfToken = "";
+        await requireAuth();
+      });
+
+      elements.composer.addEventListener("submit", async (event) => {
+        event.preventDefault();
+        const value = elements.prompt.value;
+        elements.prompt.value = "";
+        autoResizePrompt();
+        await sendMessage(value);
+      });
+
+      elements.messages.addEventListener("click", async (event) => {
+        const target = event.target;
+        if (!(target instanceof Element)) {
+          return;
+        }
+        const button = target.closest(".approval-action-btn");
+        if (!button) {
+          return;
+        }
+        const approvalId = button.getAttribute("data-approval-id") || "";
+        const decision = button.getAttribute("data-approval-decision") || "";
+        if (!approvalId || (decision !== "approve" && decision !== "deny")) {
+          return;
+        }
+        if (state.approvalRequestsInFlight[approvalId]) {
+          return;
+        }
+        state.approvalRequestsInFlight[approvalId] = true;
+        updatePendingApproval(approvalId, (request) => ({
+          ...request,
+          state: "submitting",
+          pendingDecision: decision,
+        }));
+        renderMessages(state.activeMessages, state.isStreaming);
+        try {
+          await api("/api/approvals/" + encodeURIComponent(approvalId), {
+            method: "POST",
+            body: JSON.stringify({ approved: decision === "approve" }),
+          });
+        } catch (error) {
+          const errMsg = error instanceof Error ? error.message : String(error);
+          updatePendingApproval(approvalId, (request) => ({
+            ...request,
+            state: "pending",
+            pendingDecision: null,
+            inputPreview: String(request.inputPreview || "") + " (submit failed: " + errMsg + ")",
+          }));
+          renderMessages(state.activeMessages, state.isStreaming);
+        } finally {
+          delete state.approvalRequestsInFlight[approvalId];
+        }
+      });
+
+      document.addEventListener("click", (event) => {
+        if (!(event.target instanceof Node)) {
+          return;
+        }
+        if (!event.target.closest(".conversation-item") && state.confirmDeleteId) {
+          state.confirmDeleteId = null;
+          renderConversationList();
+        }
+      });
+
+      window.addEventListener("resize", () => {
+        setSidebarOpen(false);
+      });
+
+      const navigateToConversation = async (conversationId) => {
+        if (conversationId) {
+          state.activeConversationId = conversationId;
+          renderConversationList();
+          try {
+            await loadConversation(conversationId);
+          } catch {
+            // Conversation not found \u2013 fall back to empty state
+            state.activeConversationId = null;
+            state.activeMessages = [];
+            replaceConversationUrl(null);
+            elements.chatTitle.textContent = "";
+            renderMessages([]);
+            renderConversationList();
+          }
+        } else {
+          state.activeConversationId = null;
+          state.activeMessages = [];
+          elements.chatTitle.textContent = "";
+          renderMessages([]);
+          renderConversationList();
+        }
+      };
+
+      window.addEventListener("popstate", async () => {
+        if (state.isStreaming) return;
+        const conversationId = getConversationIdFromUrl();
+        await navigateToConversation(conversationId);
+      });
+
+      (async () => {
+        const authenticated = await requireAuth();
+        if (!authenticated) {
+          return;
+        }
+        await loadConversations();
+        const urlConversationId = getConversationIdFromUrl();
+        if (urlConversationId) {
+          state.activeConversationId = urlConversationId;
+          replaceConversationUrl(urlConversationId);
+          renderConversationList();
+          try {
+            await loadConversation(urlConversationId);
+          } catch {
+            // URL pointed to a conversation that no longer exists
+            state.activeConversationId = null;
+            state.activeMessages = [];
+            replaceConversationUrl(null);
+            elements.chatTitle.textContent = "";
+            renderMessages([]);
+            renderConversationList();
+            if (state.conversations.length === 0) {
+              await createConversation();
+            }
+          }
+        } else if (state.conversations.length === 0) {
+          await createConversation();
+        }
+        autoResizePrompt();
+        elements.prompt.focus();
+      })();
+
+      if ("serviceWorker" in navigator) {
+        navigator.serviceWorker.register("/sw.js").catch(() => {});
+      }
+
+      // Detect iOS standalone mode and add class for CSS targeting
+      if (window.navigator.standalone === true || window.matchMedia("(display-mode: standalone)").matches) {
+        document.documentElement.classList.add("standalone");
+      }
+
+      // iOS viewport and keyboard handling
+      (function() {
+        var shell = document.querySelector(".shell");
+        var pinScroll = function() { if (window.scrollY !== 0) window.scrollTo(0, 0); };
+        
+        // Track the "full" height when keyboard is not open
+        var fullHeight = window.innerHeight;
+        
+        // Resize shell when iOS keyboard opens/closes
+        var resizeForKeyboard = function() {
+          if (!shell || !window.visualViewport) return;
+          var vvHeight = window.visualViewport.height;
+          
+          // Update fullHeight if viewport grew (keyboard closed)
+          if (vvHeight > fullHeight) {
+            fullHeight = vvHeight;
+          }
+          
+          // Only apply height override if keyboard appears to be open
+          // (viewport significantly smaller than full height)
+          if (vvHeight < fullHeight - 100) {
+            shell.style.height = vvHeight + "px";
+          } else {
+            // Keyboard closed - remove override, let CSS handle it
+            shell.style.height = "";
+          }
+          pinScroll();
+        };
+        
+        if (window.visualViewport) {
+          window.visualViewport.addEventListener("scroll", pinScroll);
+          window.visualViewport.addEventListener("resize", resizeForKeyboard);
+        }
+        document.addEventListener("scroll", pinScroll);
+
+        // Draggable sidebar from left edge (mobile only)
+        (function() {
+          var sidebar = document.querySelector(".sidebar");
+          var backdrop = document.querySelector(".sidebar-backdrop");
+          var shell = document.querySelector(".shell");
+          if (!sidebar || !backdrop || !shell) return;
+          
+          var sidebarWidth = 260;
+          var edgeThreshold = 50; // px from left edge to start drag
+          var velocityThreshold = 0.3; // px/ms to trigger open/close
+          
+          var dragging = false;
+          var startX = 0;
+          var startY = 0;
+          var currentX = 0;
+          var startTime = 0;
+          var isOpen = false;
+          var directionLocked = false;
+          var isHorizontal = false;
+          
+          function getProgress() {
+            // Returns 0 (closed) to 1 (open)
+            if (isOpen) {
+              return Math.max(0, Math.min(1, 1 + currentX / sidebarWidth));
+            } else {
+              return Math.max(0, Math.min(1, currentX / sidebarWidth));
+            }
+          }
+          
+          function updatePosition(progress) {
+            var offset = (progress - 1) * sidebarWidth;
+            sidebar.style.transform = "translateX(" + offset + "px)";
+            backdrop.style.opacity = progress;
+            if (progress > 0) {
+              backdrop.style.pointerEvents = "auto";
+            } else {
+              backdrop.style.pointerEvents = "none";
+            }
+          }
+          
+          function onTouchStart(e) {
+            if (window.innerWidth > 768) return;
+            
+            // Don't intercept touches on interactive elements
+            var target = e.target;
+            if (target.closest("button") || target.closest("a") || target.closest("input") || target.closest("textarea")) {
+              return;
+            }
+            
+            var touch = e.touches[0];
+            isOpen = shell.classList.contains("sidebar-open");
+            
+            // When sidebar is closed: only respond to edge swipes
+            // When sidebar is open: only respond to backdrop touches (not sidebar content)
+            var fromEdge = touch.clientX < edgeThreshold;
+            var onBackdrop = e.target === backdrop;
+            
+            if (!isOpen && !fromEdge) return;
+            if (isOpen && !onBackdrop) return;
+            
+            // Prevent Safari back gesture when starting from edge
+            if (fromEdge) {
+              e.preventDefault();
+            }
+            
+            startX = touch.clientX;
+            startY = touch.clientY;
+            currentX = 0;
+            startTime = Date.now();
+            directionLocked = false;
+            isHorizontal = false;
+            dragging = true;
+            sidebar.classList.add("dragging");
+            backdrop.classList.add("dragging");
+          }
+          
+          function onTouchMove(e) {
+            if (!dragging) return;
+            var touch = e.touches[0];
+            var dx = touch.clientX - startX;
+            var dy = touch.clientY - startY;
+            
+            // Lock direction after some movement
+            if (!directionLocked && (Math.abs(dx) > 10 || Math.abs(dy) > 10)) {
+              directionLocked = true;
+              isHorizontal = Math.abs(dx) > Math.abs(dy);
+              if (!isHorizontal) {
+                // Vertical scroll, cancel drag
+                dragging = false;
+                sidebar.classList.remove("dragging");
+                backdrop.classList.remove("dragging");
+                return;
+              }
+            }
+            
+            if (!directionLocked) return;
+            
+            // Prevent scrolling while dragging sidebar
+            e.preventDefault();
+            
+            currentX = dx;
+            updatePosition(getProgress());
+          }
+          
+          function onTouchEnd(e) {
+            if (!dragging) return;
+            dragging = false;
+            sidebar.classList.remove("dragging");
+            backdrop.classList.remove("dragging");
+            
+            var touch = e.changedTouches[0];
+            var dx = touch.clientX - startX;
+            var dt = Date.now() - startTime;
+            var velocity = dx / dt; // px/ms
+            
+            var progress = getProgress();
+            var shouldOpen;
+            
+            // Use velocity if fast enough, otherwise use position threshold
+            if (Math.abs(velocity) > velocityThreshold) {
+              shouldOpen = velocity > 0;
+            } else {
+              shouldOpen = progress > 0.5;
+            }
+            
+            // Reset inline styles and let CSS handle the animation
+            sidebar.style.transform = "";
+            backdrop.style.opacity = "";
+            backdrop.style.pointerEvents = "";
+            
+            if (shouldOpen) {
+              shell.classList.add("sidebar-open");
+            } else {
+              shell.classList.remove("sidebar-open");
+            }
+          }
+          
+          document.addEventListener("touchstart", onTouchStart, { passive: false });
+          document.addEventListener("touchmove", onTouchMove, { passive: false });
+          document.addEventListener("touchend", onTouchEnd, { passive: true });
+          document.addEventListener("touchcancel", onTouchEnd, { passive: true });
+        })();
+
+        // Prevent Safari back/forward navigation by manipulating history
+        // This doesn't stop the gesture animation but prevents actual navigation
+        if (window.navigator.standalone || window.matchMedia("(display-mode: standalone)").matches) {
+          history.pushState(null, "", location.href);
+          window.addEventListener("popstate", function() {
+            history.pushState(null, "", location.href);
+          });
+        }
+        
+        // Right edge blocker - intercept touch events to prevent forward navigation
+        var rightBlocker = document.querySelector(".edge-blocker-right");
+        if (rightBlocker) {
+          rightBlocker.addEventListener("touchstart", function(e) {
+            e.preventDefault();
+          }, { passive: false });
+          rightBlocker.addEventListener("touchmove", function(e) {
+            e.preventDefault();
+          }, { passive: false });
+        }
+      })();
+
+    </script>
+  </body>
+</html>`;
+};
+
+// src/index.ts
+import { createInterface } from "readline/promises";
+
+// src/init-onboarding.ts
+import { stdin, stdout } from "process";
+import { input, password, select } from "@inquirer/prompts";
+import {
+  fieldsForScope
+} from "@poncho-ai/sdk";
+var C = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  cyan: "\x1B[36m"
+};
+var dim = (s) => `${C.dim}${s}${C.reset}`;
+var bold = (s) => `${C.bold}${s}${C.reset}`;
+var INPUT_CARET = "\xBB";
+var shouldAskField = (field, answers) => {
+  if (!field.dependsOn) {
+    return true;
+  }
+  const value = answers[field.dependsOn.fieldId];
+  if (typeof field.dependsOn.equals !== "undefined") {
+    return value === field.dependsOn.equals;
+  }
+  if (field.dependsOn.oneOf) {
+    return field.dependsOn.oneOf.includes(value);
+  }
+  return true;
+};
+var parsePromptValue = (field, answer) => {
+  if (field.kind === "boolean") {
+    const normalized = answer.trim().toLowerCase();
+    if (normalized === "y" || normalized === "yes" || normalized === "true") {
+      return true;
+    }
+    if (normalized === "n" || normalized === "no" || normalized === "false") {
+      return false;
+    }
+    return Boolean(field.defaultValue);
+  }
+  if (field.kind === "number") {
+    const parsed = Number.parseInt(answer.trim(), 10);
+    if (Number.isFinite(parsed)) {
+      return parsed;
+    }
+    return Number(field.defaultValue);
+  }
+  if (field.kind === "select") {
+    const trimmed2 = answer.trim();
+    if (field.options && field.options.some((option) => option.value === trimmed2)) {
+      return trimmed2;
+    }
+    const asNumber = Number.parseInt(trimmed2, 10);
+    if (Number.isFinite(asNumber) && field.options && asNumber >= 1 && asNumber <= field.options.length) {
+      return field.options[asNumber - 1]?.value ?? String(field.defaultValue);
+    }
+    return String(field.defaultValue);
+  }
+  const trimmed = answer.trim();
+  if (trimmed.length === 0) {
+    return String(field.defaultValue);
+  }
+  return trimmed;
+};
+var askSecret = async (field) => {
+  if (!stdin.isTTY) {
+    return void 0;
+  }
+  const hint = field.placeholder ? dim(` (${field.placeholder})`) : "";
+  const message = `${field.prompt}${hint}`;
+  const value = await password(
+    {
+      message,
+      // true invisible input while typing/pasting
+      mask: false,
+      theme: {
+        prefix: {
+          idle: dim(INPUT_CARET),
+          done: dim("\u2713")
+        },
+        style: {
+          help: () => ""
+        }
+      }
+    },
+    { input: stdin, output: stdout }
+  );
+  return value ?? "";
+};
+var askSelectWithArrowKeys = async (field) => {
+  if (!field.options || field.options.length === 0) {
+    return void 0;
+  }
+  if (!stdin.isTTY) {
+    return void 0;
+  }
+  const selected = await select(
+    {
+      message: field.prompt,
+      choices: field.options.map((option) => ({
+        name: option.label,
+        value: option.value
+      })),
+      default: String(field.defaultValue),
+      theme: {
+        prefix: {
+          idle: dim(INPUT_CARET),
+          done: dim("\u2713")
+        }
+      }
+    },
+    { input: stdin, output: stdout }
+  );
+  return selected;
+};
+var askBooleanWithArrowKeys = async (field) => {
+  if (!stdin.isTTY) {
+    return void 0;
+  }
+  const selected = await select(
+    {
+      message: field.prompt,
+      choices: [
+        { name: "Yes", value: "true" },
+        { name: "No", value: "false" }
+      ],
+      default: field.defaultValue ? "true" : "false",
+      theme: {
+        prefix: {
+          idle: dim(INPUT_CARET),
+          done: dim("\u2713")
+        }
+      }
+    },
+    { input: stdin, output: stdout }
+  );
+  return selected;
+};
+var askTextInput = async (field) => {
+  if (!stdin.isTTY) {
+    return void 0;
+  }
+  const answer = await input(
+    {
+      message: field.prompt,
+      default: String(field.defaultValue ?? ""),
+      theme: {
+        prefix: {
+          idle: dim(INPUT_CARET),
+          done: dim("\u2713")
+        }
+      }
+    },
+    { input: stdin, output: stdout }
+  );
+  return answer;
+};
+var buildDefaultAnswers = () => {
+  const answers = {};
+  for (const field of fieldsForScope("light")) {
+    answers[field.id] = field.defaultValue;
+  }
+  return answers;
+};
+var askOnboardingQuestions = async (options) => {
+  const answers = buildDefaultAnswers();
+  const interactive = options.yes === true ? false : options.interactive ?? (stdin.isTTY === true && stdout.isTTY === true);
+  if (!interactive) {
+    return answers;
+  }
+  stdout.write("\n");
+  stdout.write(`  ${bold("Poncho")} ${dim("\xB7 quick setup")}
+`);
+  stdout.write("\n");
+  const fields = fieldsForScope("light");
+  for (const field of fields) {
+    if (!shouldAskField(field, answers)) {
+      continue;
+    }
+    stdout.write("\n");
+    let value;
+    if (field.secret) {
+      value = await askSecret(field);
+    } else if (field.kind === "select") {
+      value = await askSelectWithArrowKeys(field);
+    } else if (field.kind === "boolean") {
+      value = await askBooleanWithArrowKeys(field);
+    } else {
+      value = await askTextInput(field);
+    }
+    if (!value || value.trim().length === 0) {
+      continue;
+    }
+    answers[field.id] = parsePromptValue(field, value);
+  }
+  return answers;
+};
+var getProviderModelName = (provider) => provider === "openai" ? "gpt-4.1" : "claude-opus-4-5";
+var maybeSet = (target, key, value) => {
+  if (typeof value === "string" && value.trim().length === 0) {
+    return;
+  }
+  if (typeof value === "undefined") {
+    return;
+  }
+  target[key] = value;
+};
+var buildConfigFromOnboardingAnswers = (answers) => {
+  const storageProvider = String(answers["storage.provider"] ?? "local");
+  const memoryEnabled = Boolean(answers["storage.memory.enabled"] ?? true);
+  const maxRecallConversations = Number(
+    answers["storage.memory.maxRecallConversations"] ?? 20
+  );
+  const storage = {
+    provider: storageProvider,
+    memory: {
+      enabled: memoryEnabled,
+      maxRecallConversations
+    }
+  };
+  maybeSet(storage, "url", answers["storage.url"]);
+  maybeSet(storage, "token", answers["storage.token"]);
+  maybeSet(storage, "table", answers["storage.table"]);
+  maybeSet(storage, "region", answers["storage.region"]);
+  const authRequired = Boolean(answers["auth.required"] ?? false);
+  const authType = answers["auth.type"] ?? "bearer";
+  const auth = {
+    required: authRequired,
+    type: authType
+  };
+  if (authType === "header") {
+    maybeSet(auth, "headerName", answers["auth.headerName"]);
+  }
+  const telemetryEnabled = Boolean(answers["telemetry.enabled"] ?? true);
+  const telemetry = {
+    enabled: telemetryEnabled
+  };
+  maybeSet(telemetry, "otlp", answers["telemetry.otlp"]);
+  return {
+    mcp: [],
+    auth,
+    storage,
+    telemetry
+  };
+};
+var collectEnvVars = (answers) => {
+  const envVars = /* @__PURE__ */ new Set();
+  const provider = String(answers["model.provider"] ?? "anthropic");
+  if (provider === "openai") {
+    envVars.add("OPENAI_API_KEY=sk-...");
+  } else {
+    envVars.add("ANTHROPIC_API_KEY=sk-ant-...");
+  }
+  const storageProvider = String(answers["storage.provider"] ?? "local");
+  if (storageProvider === "redis") {
+    envVars.add("REDIS_URL=redis://localhost:6379");
+  }
+  if (storageProvider === "upstash") {
+    envVars.add("UPSTASH_REDIS_REST_URL=https://...");
+    envVars.add("UPSTASH_REDIS_REST_TOKEN=...");
+  }
+  if (storageProvider === "dynamodb") {
+    envVars.add("PONCHO_DYNAMODB_TABLE=poncho-conversations");
+    envVars.add("AWS_REGION=us-east-1");
+  }
+  const authRequired = Boolean(answers["auth.required"] ?? false);
+  if (authRequired) {
+    envVars.add("PONCHO_AUTH_TOKEN=...");
+  }
+  return Array.from(envVars);
+};
+var collectEnvFileLines = (answers) => {
+  const lines = [
+    "# Poncho environment configuration",
+    "# Fill in empty values before running `poncho dev` or `poncho run --interactive`.",
+    "# Tip: keep secrets in `.env` only (never commit them).",
+    ""
+  ];
+  const modelProvider = String(answers["model.provider"] ?? "anthropic");
+  const modelEnvKey = modelProvider === "openai" ? "env.OPENAI_API_KEY" : "env.ANTHROPIC_API_KEY";
+  const modelEnvVar = modelProvider === "openai" ? "OPENAI_API_KEY" : "ANTHROPIC_API_KEY";
+  const modelEnvValue = String(answers[modelEnvKey] ?? "");
+  lines.push("# Model");
+  if (modelEnvValue.length === 0) {
+    lines.push(
+      modelProvider === "openai" ? "# OpenAI: create an API key at https://platform.openai.com/api-keys" : "# Anthropic: create an API key at https://console.anthropic.com/settings/keys"
+    );
+  }
+  lines.push(`${modelEnvVar}=${modelEnvValue}`);
+  lines.push("");
+  const authRequired = Boolean(answers["auth.required"] ?? false);
+  const authType = answers["auth.type"] ?? "bearer";
+  const authHeaderName = String(answers["auth.headerName"] ?? "x-poncho-key");
+  if (authRequired) {
+    lines.push("# Auth (protects both Web UI and API)");
+    lines.push("# Web UI: enter this token as the passphrase");
+    if (authType === "bearer") {
+      lines.push("# API: include Authorization: Bearer <token> header");
+    } else if (authType === "header") {
+      lines.push(`# API: include ${authHeaderName}: <token> header`);
+    } else {
+      lines.push("# Custom auth mode: read this token in your auth.validate function.");
+    }
+    lines.push("PONCHO_AUTH_TOKEN=");
+    lines.push("");
+  }
+  const storageProvider = String(answers["storage.provider"] ?? "local");
+  if (storageProvider === "redis") {
+    lines.push("# Storage (Redis)");
+    lines.push("# Run local Redis: docker run -p 6379:6379 redis:7");
+    lines.push("# Or use a managed Redis URL from your cloud provider.");
+    lines.push("REDIS_URL=");
+    lines.push("");
+  } else if (storageProvider === "upstash") {
+    lines.push("# Storage (Upstash)");
+    lines.push("# Create a Redis database at https://console.upstash.com/");
+    lines.push("# Copy REST URL + REST TOKEN from the Upstash dashboard.");
+    lines.push("UPSTASH_REDIS_REST_URL=");
+    lines.push("UPSTASH_REDIS_REST_TOKEN=");
+    lines.push("");
+  } else if (storageProvider === "dynamodb") {
+    lines.push("# Storage (DynamoDB)");
+    lines.push("# Create a DynamoDB table for Poncho conversation/state storage.");
+    lines.push("# Ensure AWS credentials are configured (AWS_PROFILE or access keys).");
+    lines.push("PONCHO_DYNAMODB_TABLE=");
+    lines.push("AWS_REGION=");
+    lines.push("");
+  } else if (storageProvider === "local" || storageProvider === "memory") {
+    lines.push(
+      storageProvider === "local" ? "# Storage (Local file): no extra env vars required." : "# Storage (In-memory): no extra env vars required, data resets on restart."
+    );
+    lines.push("");
+  }
+  const telemetryEnabled = Boolean(answers["telemetry.enabled"] ?? true);
+  if (telemetryEnabled) {
+    lines.push("# Telemetry (optional)");
+    lines.push("# Latitude telemetry setup: https://docs.latitude.so/");
+    lines.push("# If not using Latitude yet, you can leave these empty.");
+    lines.push("LATITUDE_API_KEY=");
+    lines.push("LATITUDE_PROJECT_ID=");
+    lines.push("LATITUDE_PATH=");
+    lines.push("");
+  }
+  while (lines.length > 0 && lines[lines.length - 1] === "") {
+    lines.pop();
+  }
+  return lines;
+};
+var runInitOnboarding = async (options) => {
+  const answers = await askOnboardingQuestions(options);
+  const provider = String(answers["model.provider"] ?? "anthropic");
+  const config = buildConfigFromOnboardingAnswers(answers);
+  const envExampleLines = collectEnvVars(answers);
+  const envFileLines = collectEnvFileLines(answers);
+  const envNeedsUserInput = envFileLines.some(
+    (line) => line.includes("=") && !line.startsWith("#") && line.endsWith("=")
+  );
+  return {
+    answers,
+    config,
+    envExample: `${envExampleLines.join("\n")}
+`,
+    envFile: envFileLines.length > 0 ? `${envFileLines.join("\n")}
+` : "",
+    envNeedsUserInput,
+    agentModel: {
+      provider: provider === "openai" ? "openai" : "anthropic",
+      name: getProviderModelName(provider)
+    }
+  };
+};
+
+// src/init-feature-context.ts
+import { createHash as createHash2 } from "crypto";
+import { access, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { basename as basename2, dirname as dirname2, resolve as resolve2 } from "path";
+import { homedir as homedir2 } from "os";
+var ONBOARDING_VERSION = 1;
+var getStateDirectory = () => {
+  const cwd = process.cwd();
+  const home = homedir2();
+  const isServerless = process.env.VERCEL === "1" || process.env.VERCEL_ENV !== void 0 || process.env.VERCEL_URL !== void 0 || process.env.AWS_LAMBDA_FUNCTION_NAME !== void 0 || process.env.AWS_EXECUTION_ENV?.includes("AWS_Lambda") === true || process.env.LAMBDA_TASK_ROOT !== void 0 || process.env.NOW_REGION !== void 0 || cwd.startsWith("/var/task") || home.startsWith("/var/task") || process.env.SERVERLESS === "1";
+  if (isServerless) {
+    return "/tmp/.poncho/state";
+  }
+  return resolve2(homedir2(), ".poncho", "state");
+};
+var summarizeConfig = (config) => {
+  const provider = config?.storage?.provider ?? config?.state?.provider ?? "local";
+  const memoryEnabled = config?.storage?.memory?.enabled ?? config?.memory?.enabled ?? false;
+  const authRequired = config?.auth?.required ?? false;
+  const telemetryEnabled = config?.telemetry?.enabled ?? true;
+  return [
+    `storage: ${provider}`,
+    `memory tools: ${memoryEnabled ? "enabled" : "disabled"}`,
+    `auth: ${authRequired ? "required" : "not required"}`,
+    `telemetry: ${telemetryEnabled ? "enabled" : "disabled"}`
+  ];
+};
+var getOnboardingMarkerPath = (workingDir) => resolve2(
+  getStateDirectory(),
+  `${basename2(workingDir).replace(/[^a-zA-Z0-9_-]+/g, "-") || "project"}-${createHash2("sha256").update(workingDir).digest("hex").slice(0, 12)}-onboarding.json`
+);
+var readMarker = async (workingDir) => {
+  const markerPath = getOnboardingMarkerPath(workingDir);
+  try {
+    await access(markerPath);
+  } catch {
+    return void 0;
+  }
+  try {
+    const raw = await readFile2(markerPath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+};
+var writeMarker = async (workingDir, state) => {
+  const markerPath = getOnboardingMarkerPath(workingDir);
+  await mkdir2(dirname2(markerPath), { recursive: true });
+  await writeFile2(markerPath, JSON.stringify(state, null, 2), "utf8");
+};
+var initializeOnboardingMarker = async (workingDir, options) => {
+  const current = await readMarker(workingDir);
+  if (current) {
+    return;
+  }
+  const allowIntro = options?.allowIntro ?? true;
+  await writeMarker(workingDir, {
+    introduced: allowIntro ? false : true,
+    allowIntro,
+    onboardingVersion: ONBOARDING_VERSION,
+    createdAt: Date.now()
+  });
+};
+var consumeFirstRunIntro = async (workingDir, input2) => {
+  const runtimeEnv = resolveHarnessEnvironment();
+  if (runtimeEnv === "production") {
+    return void 0;
+  }
+  const marker = await readMarker(workingDir);
+  if (marker?.allowIntro === false) {
+    return void 0;
+  }
+  const shouldShow = !marker || marker.introduced === false;
+  if (!shouldShow) {
+    return void 0;
+  }
+  await writeMarker(workingDir, {
+    introduced: true,
+    allowIntro: true,
+    onboardingVersion: ONBOARDING_VERSION,
+    createdAt: marker?.createdAt ?? Date.now(),
+    introducedAt: Date.now()
+  });
+  const summary = summarizeConfig(input2.config);
+  return [
+    `Hi! I'm **${input2.agentName}**. I can configure myself directly by chat.
+`,
+    `**Current config**`,
+    `  Model: ${input2.provider}/${input2.model}`,
+    `  \`\`\`${summary.join(" \xB7 ")}\`\`\``,
+    "",
+    "Feel free to ask me anything when you're ready. I can help you:",
+    "",
+    "- **Build skills**: Create custom tools and capabilities for this agent",
+    "- **Configure the model**: Switch providers (OpenAI, Anthropic, etc.) or models",
+    "- **Set up storage**: Use local files, Upstash, or other backends",
+    "- **Enable auth**: Add bearer tokens or custom authentication",
+    "- **Turn on telemetry**: Track usage with OpenTelemetry/OTLP",
+    "- **Add MCP servers**: Connect external tool servers",
+    "",
+    "Just let me know what you'd like to work on!\n"
+  ].join("\n");
+};
+
+// src/index.ts
+var __dirname = dirname3(fileURLToPath(import.meta.url));
+var require3 = createRequire2(import.meta.url);
+var writeJson = (response, statusCode, payload) => {
+  response.writeHead(statusCode, { "Content-Type": "application/json" });
+  response.end(JSON.stringify(payload));
+};
+var writeHtml = (response, statusCode, payload) => {
+  response.writeHead(statusCode, { "Content-Type": "text/html; charset=utf-8" });
+  response.end(payload);
+};
+var readRequestBody = async (request) => {
+  const chunks = [];
+  for await (const chunk of request) {
+    chunks.push(Buffer.from(chunk));
+  }
+  const body = Buffer.concat(chunks).toString("utf8");
+  return body.length > 0 ? JSON.parse(body) : {};
+};
+var resolveHarnessEnvironment = () => {
+  if (process.env.PONCHO_ENV) {
+    const value = process.env.PONCHO_ENV.toLowerCase();
+    if (value === "production" || value === "staging") {
+      return value;
+    }
+    return "development";
+  }
+  if (process.env.VERCEL_ENV) {
+    const vercelEnv = process.env.VERCEL_ENV.toLowerCase();
+    if (vercelEnv === "production") return "production";
+    if (vercelEnv === "preview") return "staging";
+    return "development";
+  }
+  if (process.env.RAILWAY_ENVIRONMENT) {
+    const railwayEnv = process.env.RAILWAY_ENVIRONMENT.toLowerCase();
+    if (railwayEnv === "production") return "production";
+    return "staging";
+  }
+  if (process.env.RENDER) {
+    if (process.env.IS_PULL_REQUEST === "true") return "staging";
+    return "production";
+  }
+  if (process.env.AWS_EXECUTION_ENV || process.env.AWS_LAMBDA_FUNCTION_NAME) {
+    return "production";
+  }
+  if (process.env.FLY_APP_NAME) {
+    return "production";
+  }
+  if (process.env.NODE_ENV) {
+    const value = process.env.NODE_ENV.toLowerCase();
+    if (value === "production" || value === "staging") {
+      return value;
+    }
+    return "development";
+  }
+  return "development";
+};
+var listenOnAvailablePort = async (server, preferredPort) => await new Promise((resolveListen, rejectListen) => {
+  let currentPort = preferredPort;
+  const tryListen = () => {
+    const onListening = () => {
+      server.off("error", onError);
+      const address = server.address();
+      if (address && typeof address === "object" && typeof address.port === "number") {
+        resolveListen(address.port);
+        return;
+      }
+      resolveListen(currentPort);
+    };
+    const onError = (error) => {
+      server.off("listening", onListening);
+      if (typeof error === "object" && error !== null && "code" in error && error.code === "EADDRINUSE") {
+        currentPort += 1;
+        if (currentPort > 65535) {
+          rejectListen(
+            new Error(
+              "No available ports found from the requested port up to 65535."
+            )
+          );
+          return;
+        }
+        setImmediate(tryListen);
+        return;
+      }
+      rejectListen(error);
+    };
+    server.once("listening", onListening);
+    server.once("error", onError);
+    server.listen(currentPort);
+  };
+  tryListen();
+});
+var parseParams = (values) => {
+  const params = {};
+  for (const value of values) {
+    const [key, ...rest] = value.split("=");
+    if (!key) {
+      continue;
+    }
+    params[key] = rest.join("=");
+  }
+  return params;
+};
+var AGENT_TEMPLATE = (name, options) => `---
+name: ${name}
+description: A helpful Poncho assistant
+model:
+  provider: ${options.modelProvider}
+  name: ${options.modelName}
+  temperature: 0.2
+limits:
+  maxSteps: 50
+  timeout: 300
+---
+
+# {{name}}
+
+You are **{{name}}**, a helpful assistant built with Poncho.
+
+Working directory: {{runtime.workingDir}}
+Environment: {{runtime.environment}}
+
+## Task Guidance
+
+- Use tools when needed
+- Explain your reasoning clearly
+- Ask clarifying questions when requirements are ambiguous
+- Never claim a file/tool change unless the corresponding tool call actually succeeded
+`;
+var resolveLocalPackagesRoot = () => {
+  const candidate = resolve3(__dirname, "..", "..", "harness", "package.json");
+  if (existsSync(candidate)) {
+    return resolve3(__dirname, "..", "..");
+  }
+  return null;
+};
+var resolveCoreDeps = (projectDir) => {
+  const packagesRoot = resolveLocalPackagesRoot();
+  if (packagesRoot) {
+    const harnessAbs = resolve3(packagesRoot, "harness");
+    const sdkAbs = resolve3(packagesRoot, "sdk");
+    return {
+      harness: `link:${relative(projectDir, harnessAbs)}`,
+      sdk: `link:${relative(projectDir, sdkAbs)}`
+    };
+  }
+  return { harness: "^0.1.0", sdk: "^0.1.0" };
+};
+var PACKAGE_TEMPLATE = (name, projectDir) => {
+  const deps = resolveCoreDeps(projectDir);
+  return JSON.stringify(
+    {
+      name,
+      private: true,
+      type: "module",
+      dependencies: {
+        "@poncho-ai/harness": deps.harness,
+        "@poncho-ai/sdk": deps.sdk
+      }
+    },
+    null,
+    2
+  );
+};
+var README_TEMPLATE = (name) => `# ${name}
+
+An AI agent built with [Poncho](https://github.com/cesr/poncho-ai).
+
+## Prerequisites
+
+- Node.js 20+
+- npm (or pnpm/yarn)
+- Anthropic or OpenAI API key
+
+## Quick Start
+
+\`\`\`bash
+npm install
+# If you didn't enter an API key during init:
+cp .env.example .env
+# Then edit .env and add your API key
+poncho dev
+\`\`\`
+
+Open \`http://localhost:3000\` for the web UI.
+
+On your first interactive session, the agent introduces its configurable capabilities.
+
+## Common Commands
+
+\`\`\`bash
+# Local web UI + API server
+poncho dev
+
+# Local interactive CLI
+poncho run --interactive
+
+# One-off run
+poncho run "Your task here"
+
+# Run tests
+poncho test
+
+# List available tools
+poncho tools
+\`\`\`
+
+## Add Skills
+
+Install skills from a local path or remote repository, then verify discovery:
+
+\`\`\`bash
+# Install skills into ./skills
+poncho add <repo-or-path>
+
+# Verify loaded tools
+poncho tools
+\`\`\`
+
+After adding skills, run \`poncho dev\` or \`poncho run --interactive\` and ask the agent to use them.
+
+## Configure MCP Servers (Remote)
+
+Connect remote MCP servers and expose their tools to the agent:
+
+\`\`\`bash
+# Add remote MCP server
+poncho mcp add --url https://mcp.example.com/github --name github --auth-bearer-env GITHUB_TOKEN
+
+# List configured servers
+poncho mcp list
+
+# Discover MCP tools and print frontmatter intent snippets
+poncho mcp tools list github
+poncho mcp tools select github
+
+# Remove a server
+poncho mcp remove github
+\`\`\`
+
+Set required secrets in \`.env\` (for example, \`GITHUB_TOKEN=...\`).
+
+## Tool Intent and Approvals in Frontmatter
+
+Declare tool intent directly in \`AGENT.md\` and \`SKILL.md\` frontmatter:
+
+\`\`\`yaml
+allowed-tools:
+  - mcp:github/list_issues
+  - mcp:github/*
+approval-required:
+  - mcp:github/create_issue
+  - ./scripts/deploy.ts
+\`\`\`
+
+How it works:
+
+- \`AGENT.md\` provides fallback MCP intent when no skill is active.
+- \`SKILL.md\` intent applies when you activate that skill (\`activate_skill\`).
+- Scripts in a sibling \`scripts/\` directory are available by convention.
+- For non-standard script folders (for example \`tools/\`), add explicit relative entries in \`allowed-tools\`.
+- Use \`approval-required\` to require human approval for specific MCP calls or script files.
+- Deactivating a skill (\`deactivate_skill\`) removes its MCP tools from runtime registration.
+
+Pattern format is strict slash-only:
+
+- MCP: \`server/tool\`, \`server/*\`
+- Scripts: relative paths such as \`./scripts/file.ts\`, \`./scripts/*\`, \`./tools/deploy.ts\`
+
+## Configuration
+
+Core files:
+
+- \`AGENT.md\`: behavior, model selection, runtime guidance
+- \`poncho.config.js\`: runtime config (storage, auth, telemetry, MCP, tools)
+- \`.env\`: secrets and environment variables
+
+Example \`poncho.config.js\`:
+
+\`\`\`javascript
+export default {
+  storage: {
+    provider: "local", // local | memory | redis | upstash | dynamodb
+    memory: {
+      enabled: true,
+      maxRecallConversations: 20,
+    },
+  },
+  auth: {
+    required: false,
+  },
+  telemetry: {
+    enabled: true,
+  },
+  mcp: [
+    {
+      name: "github",
+      url: "https://mcp.example.com/github",
+      auth: { type: "bearer", tokenEnv: "GITHUB_TOKEN" },
+    },
+  ],
+  tools: {
+    defaults: {
+      list_directory: true,
+      read_file: true,
+      write_file: true, // still gated by environment/policy
+    },
+    byEnvironment: {
+      production: {
+        read_file: false, // example override
+      },
+    },
+  },
+};
+\`\`\`
+
+## Project Structure
+
+\`\`\`
+${name}/
+\u251C\u2500\u2500 AGENT.md           # Agent definition and system prompt
+\u251C\u2500\u2500 poncho.config.js   # Configuration (MCP servers, auth, etc.)
+\u251C\u2500\u2500 package.json       # Dependencies
+\u251C\u2500\u2500 .env.example       # Environment variables template
+\u251C\u2500\u2500 tests/
+\u2502   \u2514\u2500\u2500 basic.yaml     # Test suite
+\u2514\u2500\u2500 skills/
+    \u2514\u2500\u2500 starter/
+        \u251C\u2500\u2500 SKILL.md
+        \u2514\u2500\u2500 scripts/
+            \u2514\u2500\u2500 starter-echo.ts
+\`\`\`
+
+## Deployment
+
+\`\`\`bash
+# Build for Vercel
+poncho build vercel
+cd .poncho-build/vercel && vercel deploy --prod
+
+# Build for Docker
+poncho build docker
+docker build -t ${name} .
+\`\`\`
+
+For full reference:
+https://github.com/cesr/poncho-ai
+`;
+var ENV_TEMPLATE = "ANTHROPIC_API_KEY=sk-ant-...\n";
+var GITIGNORE_TEMPLATE = ".env\nnode_modules\ndist\n.poncho-build\n.poncho/\ninteractive-session.json\n";
+var VERCEL_RUNTIME_DEPENDENCIES = {
+  "@anthropic-ai/sdk": "^0.74.0",
+  "@aws-sdk/client-dynamodb": "^3.988.0",
+  "@latitude-data/telemetry": "^2.0.2",
+  commander: "^12.0.0",
+  dotenv: "^16.4.0",
+  jiti: "^2.6.1",
+  mustache: "^4.2.0",
+  openai: "^6.3.0",
+  redis: "^5.10.0",
+  yaml: "^2.8.1"
+};
+var TEST_TEMPLATE = `tests:
+  - name: "Basic sanity"
+    task: "What is 2 + 2?"
+    expect:
+      contains: "4"
+`;
+var SKILL_TEMPLATE = `---
+name: starter-skill
+description: Starter local skill template
+---
+
+# Starter Skill
+
+This is a starter local skill created by \`poncho init\`.
+
+## Authoring Notes
+
+- Put executable JavaScript/TypeScript files in \`scripts/\`.
+- Ask the agent to call \`run_skill_script\` with \`skill\`, \`script\`, and optional \`input\`.
+`;
+var SKILL_TOOL_TEMPLATE = `export default async function run(input) {
+  const message = typeof input?.message === "string" ? input.message : "";
+  return { echoed: message };
+}
+`;
+var ensureFile = async (path, content) => {
+  await mkdir3(dirname3(path), { recursive: true });
+  await writeFile3(path, content, { encoding: "utf8", flag: "wx" });
+};
+var copyIfExists = async (sourcePath, destinationPath) => {
+  try {
+    await access2(sourcePath);
+  } catch {
+    return;
+  }
+  await mkdir3(dirname3(destinationPath), { recursive: true });
+  await cp(sourcePath, destinationPath, { recursive: true });
+};
+var resolveCliEntrypoint = async () => {
+  const sourceEntrypoint = resolve3(packageRoot, "src", "index.ts");
+  try {
+    await access2(sourceEntrypoint);
+    return sourceEntrypoint;
+  } catch {
+    return resolve3(packageRoot, "dist", "index.js");
+  }
+};
+var buildVercelHandlerBundle = async (outDir) => {
+  const { build: esbuild } = await import("esbuild");
+  const cliEntrypoint = await resolveCliEntrypoint();
+  const tempEntry = resolve3(outDir, "api", "_entry.js");
+  await writeFile3(
+    tempEntry,
+    `import { createRequestHandler } from ${JSON.stringify(cliEntrypoint)};
+let handlerPromise;
+export default async function handler(req, res) {
+  try {
+    if (!handlerPromise) {
+      handlerPromise = createRequestHandler({ workingDir: process.cwd() });
+    }
+    const requestHandler = await handlerPromise;
+    await requestHandler(req, res);
+  } catch (error) {
+    console.error("Handler error:", error);
+    if (!res.headersSent) {
+      res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Internal server error", message: error?.message || "Unknown error" }));
+    }
+  }
+}
+`,
+    "utf8"
+  );
+  await esbuild({
+    entryPoints: [tempEntry],
+    bundle: true,
+    platform: "node",
+    format: "esm",
+    target: "node20",
+    outfile: resolve3(outDir, "api", "index.js"),
+    sourcemap: false,
+    legalComments: "none",
+    external: [
+      ...Object.keys(VERCEL_RUNTIME_DEPENDENCIES),
+      "@anthropic-ai/sdk/*",
+      "child_process",
+      "fs",
+      "fs/promises",
+      "http",
+      "https",
+      "path",
+      "module",
+      "url",
+      "readline",
+      "readline/promises",
+      "crypto",
+      "stream",
+      "events",
+      "util",
+      "os",
+      "zlib",
+      "net",
+      "tls",
+      "dns",
+      "assert",
+      "buffer",
+      "timers",
+      "timers/promises",
+      "node:child_process",
+      "node:fs",
+      "node:fs/promises",
+      "node:http",
+      "node:https",
+      "node:path",
+      "node:module",
+      "node:url",
+      "node:readline",
+      "node:readline/promises",
+      "node:crypto",
+      "node:stream",
+      "node:events",
+      "node:util",
+      "node:os",
+      "node:zlib",
+      "node:net",
+      "node:tls",
+      "node:dns",
+      "node:assert",
+      "node:buffer",
+      "node:timers",
+      "node:timers/promises"
+    ]
+  });
+};
+var renderConfigFile = (config) => `export default ${JSON.stringify(config, null, 2)}
+`;
+var writeConfigFile = async (workingDir, config) => {
+  const serialized = renderConfigFile(config);
+  await writeFile3(resolve3(workingDir, "poncho.config.js"), serialized, "utf8");
+};
+var ensureEnvPlaceholder = async (filePath, key) => {
+  const normalizedKey = key.trim();
+  if (!normalizedKey) {
+    return false;
+  }
+  let content = "";
+  try {
+    content = await readFile3(filePath, "utf8");
+  } catch {
+    await writeFile3(filePath, `${normalizedKey}=
+`, "utf8");
+    return true;
+  }
+  const present = content.split(/\r?\n/).some((line) => line.trimStart().startsWith(`${normalizedKey}=`));
+  if (present) {
+    return false;
+  }
+  const withTrailingNewline = content.length === 0 || content.endsWith("\n") ? content : `${content}
+`;
+  await writeFile3(filePath, `${withTrailingNewline}${normalizedKey}=
+`, "utf8");
+  return true;
+};
+var removeEnvPlaceholder = async (filePath, key) => {
+  const normalizedKey = key.trim();
+  if (!normalizedKey) {
+    return false;
+  }
+  let content = "";
+  try {
+    content = await readFile3(filePath, "utf8");
+  } catch {
+    return false;
+  }
+  const lines = content.split(/\r?\n/);
+  const filtered = lines.filter((line) => !line.trimStart().startsWith(`${normalizedKey}=`));
+  if (filtered.length === lines.length) {
+    return false;
+  }
+  const nextContent = filtered.join("\n").replace(/\n+$/, "");
+  await writeFile3(filePath, nextContent.length > 0 ? `${nextContent}
+` : "", "utf8");
+  return true;
+};
+var gitInit = (cwd) => new Promise((resolve4) => {
+  const child = spawn("git", ["init"], { cwd, stdio: "ignore" });
+  child.on("error", () => resolve4(false));
+  child.on("close", (code) => resolve4(code === 0));
+});
+var initProject = async (projectName, options) => {
+  const baseDir = options?.workingDir ?? process.cwd();
+  const projectDir = resolve3(baseDir, projectName);
+  await mkdir3(projectDir, { recursive: true });
+  const onboardingOptions = options?.onboarding ?? {
+    yes: true,
+    interactive: false
+  };
+  const onboarding = await runInitOnboarding(onboardingOptions);
+  const G = "\x1B[32m";
+  const D = "\x1B[2m";
+  const B = "\x1B[1m";
+  const CY = "\x1B[36m";
+  const YW = "\x1B[33m";
+  const R = "\x1B[0m";
+  process.stdout.write("\n");
+  const scaffoldFiles = [
+    { path: "AGENT.md", content: AGENT_TEMPLATE(projectName, { modelProvider: onboarding.agentModel.provider, modelName: onboarding.agentModel.name }) },
+    { path: "poncho.config.js", content: renderConfigFile(onboarding.config) },
+    { path: "package.json", content: PACKAGE_TEMPLATE(projectName, projectDir) },
+    { path: "README.md", content: README_TEMPLATE(projectName) },
+    { path: ".env.example", content: options?.envExampleOverride ?? onboarding.envExample ?? ENV_TEMPLATE },
+    { path: ".gitignore", content: GITIGNORE_TEMPLATE },
+    { path: "tests/basic.yaml", content: TEST_TEMPLATE },
+    { path: "skills/starter/SKILL.md", content: SKILL_TEMPLATE },
+    { path: "skills/starter/scripts/starter-echo.ts", content: SKILL_TOOL_TEMPLATE }
+  ];
+  if (onboarding.envFile) {
+    scaffoldFiles.push({ path: ".env", content: onboarding.envFile });
+  }
+  for (const file of scaffoldFiles) {
+    await ensureFile(resolve3(projectDir, file.path), file.content);
+    process.stdout.write(`  ${D}+${R} ${D}${file.path}${R}
+`);
+  }
+  await initializeOnboardingMarker(projectDir, {
+    allowIntro: !(onboardingOptions.yes ?? false)
+  });
+  process.stdout.write("\n");
+  try {
+    await runPnpmInstall(projectDir);
+    process.stdout.write(`  ${G}\u2713${R} ${D}Installed dependencies${R}
+`);
+  } catch {
+    process.stdout.write(
+      `  ${YW}!${R} Could not install dependencies \u2014 run ${D}pnpm install${R} manually
+`
+    );
+  }
+  const gitOk = await gitInit(projectDir);
+  if (gitOk) {
+    process.stdout.write(`  ${G}\u2713${R} ${D}Initialized git${R}
+`);
+  }
+  process.stdout.write(`  ${G}\u2713${R} ${B}${projectName}${R} is ready
+`);
+  process.stdout.write("\n");
+  process.stdout.write(`  ${B}Get started${R}
+`);
+  process.stdout.write("\n");
+  process.stdout.write(`    ${D}$${R} cd ${projectName}
+`);
+  process.stdout.write("\n");
+  process.stdout.write(`    ${CY}Web UI${R}          ${D}$${R} poncho dev
+`);
+  process.stdout.write(`    ${CY}CLI interactive${R}  ${D}$${R} poncho run --interactive
+`);
+  process.stdout.write("\n");
+  if (onboarding.envNeedsUserInput) {
+    process.stdout.write(
+      `  ${YW}!${R} Make sure you add your keys to the ${B}.env${R} file.
+`
+    );
+  }
+  process.stdout.write(`  ${D}The agent will introduce itself on your first session.${R}
+`);
+  process.stdout.write("\n");
+};
+var updateAgentGuidance = async (workingDir) => {
+  const agentPath = resolve3(workingDir, "AGENT.md");
+  const content = await readFile3(agentPath, "utf8");
+  const guidanceSectionPattern = /\n## Configuration Assistant Context[\s\S]*?(?=\n## |\n# |$)|\n## Skill Authoring Guidance[\s\S]*?(?=\n## |\n# |$)/g;
+  const normalized = content.replace(/\s+$/g, "");
+  const updated = normalized.replace(guidanceSectionPattern, "").replace(/\n{3,}/g, "\n\n");
+  if (updated === normalized) {
+    process.stdout.write("AGENT.md does not contain deprecated embedded local guidance.\n");
+    return false;
+  }
+  await writeFile3(agentPath, `${updated}
+`, "utf8");
+  process.stdout.write("Removed deprecated embedded local guidance from AGENT.md.\n");
+  return true;
+};
+var formatSseEvent = (event) => `event: ${event.type}
+data: ${JSON.stringify(event)}
+
+`;
+var createRequestHandler = async (options) => {
+  const workingDir = options?.workingDir ?? process.cwd();
+  dotenv.config({ path: resolve3(workingDir, ".env") });
+  const config = await loadPonchoConfig(workingDir);
+  let agentName = "Agent";
+  let agentModelProvider = "anthropic";
+  let agentModelName = "claude-opus-4-5";
+  try {
+    const agentMd = await readFile3(resolve3(workingDir, "AGENT.md"), "utf8");
+    const nameMatch = agentMd.match(/^name:\s*(.+)$/m);
+    const providerMatch = agentMd.match(/^\s{2}provider:\s*(.+)$/m);
+    const modelMatch = agentMd.match(/^\s{2}name:\s*(.+)$/m);
+    if (nameMatch?.[1]) {
+      agentName = nameMatch[1].trim().replace(/^["']|["']$/g, "");
+    }
+    if (providerMatch?.[1]) {
+      agentModelProvider = providerMatch[1].trim().replace(/^["']|["']$/g, "");
+    }
+    if (modelMatch?.[1]) {
+      agentModelName = modelMatch[1].trim().replace(/^["']|["']$/g, "");
+    }
+  } catch {
+  }
+  const runOwners = /* @__PURE__ */ new Map();
+  const pendingApprovals = /* @__PURE__ */ new Map();
+  const harness = new AgentHarness({
+    workingDir,
+    environment: resolveHarnessEnvironment(),
+    approvalHandler: async (request) => new Promise((resolveApproval) => {
+      const ownerIdForRun = runOwners.get(request.runId) ?? "local-owner";
+      pendingApprovals.set(request.approvalId, {
+        ownerId: ownerIdForRun,
+        resolve: resolveApproval
+      });
+    })
+  });
+  await harness.initialize();
+  const telemetry = new TelemetryEmitter(config?.telemetry);
+  const conversationStore = createConversationStore(resolveStateConfig(config), { workingDir });
+  const sessionStore = new SessionStore();
+  const loginRateLimiter = new LoginRateLimiter();
+  const authToken = process.env.PONCHO_AUTH_TOKEN ?? "";
+  const authRequired = config?.auth?.required ?? false;
+  const requireAuth = authRequired && authToken.length > 0;
+  const isProduction = resolveHarnessEnvironment() === "production";
+  const secureCookies = isProduction;
+  const validateBearerToken = (authHeader) => {
+    if (!requireAuth || !authToken) {
+      return true;
+    }
+    if (!authHeader || typeof authHeader !== "string") {
+      return false;
+    }
+    const match = authHeader.match(/^Bearer\s+(.+)$/i);
+    if (!match || !match[1]) {
+      return false;
+    }
+    return verifyPassphrase(match[1], authToken);
+  };
+  return async (request, response) => {
+    if (!request.url || !request.method) {
+      writeJson(response, 404, { error: "Not found" });
+      return;
+    }
+    const [pathname] = request.url.split("?");
+    if (request.method === "GET" && (pathname === "/" || pathname.startsWith("/c/"))) {
+      writeHtml(response, 200, renderWebUiHtml({ agentName }));
+      return;
+    }
+    if (pathname === "/manifest.json" && request.method === "GET") {
+      response.writeHead(200, { "Content-Type": "application/manifest+json" });
+      response.end(renderManifest({ agentName }));
+      return;
+    }
+    if (pathname === "/sw.js" && request.method === "GET") {
+      response.writeHead(200, {
+        "Content-Type": "application/javascript",
+        "Service-Worker-Allowed": "/"
+      });
+      response.end(renderServiceWorker());
+      return;
+    }
+    if (pathname === "/icon.svg" && request.method === "GET") {
+      response.writeHead(200, { "Content-Type": "image/svg+xml" });
+      response.end(renderIconSvg({ agentName }));
+      return;
+    }
+    if ((pathname === "/icon-192.png" || pathname === "/icon-512.png") && request.method === "GET") {
+      response.writeHead(302, { Location: "/icon.svg" });
+      response.end();
+      return;
+    }
+    if (pathname === "/health" && request.method === "GET") {
+      writeJson(response, 200, { status: "ok" });
+      return;
+    }
+    const cookies = parseCookies(request);
+    const sessionId = cookies.poncho_session;
+    const session = sessionId ? sessionStore.get(sessionId) : void 0;
+    const ownerId = session?.ownerId ?? "local-owner";
+    const requiresCsrfValidation = request.method !== "GET" && request.method !== "HEAD" && request.method !== "OPTIONS";
+    if (pathname === "/api/auth/session" && request.method === "GET") {
+      if (!requireAuth) {
+        writeJson(response, 200, { authenticated: true, csrfToken: "" });
+        return;
+      }
+      if (!session) {
+        writeJson(response, 200, { authenticated: false });
+        return;
+      }
+      writeJson(response, 200, {
+        authenticated: true,
+        sessionId: session.sessionId,
+        ownerId: session.ownerId,
+        csrfToken: session.csrfToken
+      });
+      return;
+    }
+    if (pathname === "/api/auth/login" && request.method === "POST") {
+      if (!requireAuth) {
+        writeJson(response, 200, { authenticated: true, csrfToken: "" });
+        return;
+      }
+      const ip = getRequestIp(request);
+      const canAttempt = loginRateLimiter.canAttempt(ip);
+      if (!canAttempt.allowed) {
+        writeJson(response, 429, {
+          code: "AUTH_RATE_LIMIT",
+          message: "Too many failed login attempts. Try again later.",
+          retryAfterSeconds: canAttempt.retryAfterSeconds
+        });
+        return;
+      }
+      const body = await readRequestBody(request);
+      const provided = body.passphrase ?? "";
+      if (!verifyPassphrase(provided, authToken)) {
+        const failure = loginRateLimiter.registerFailure(ip);
+        writeJson(response, 401, {
+          code: "AUTH_ERROR",
+          message: "Invalid passphrase",
+          retryAfterSeconds: failure.retryAfterSeconds
+        });
+        return;
+      }
+      loginRateLimiter.registerSuccess(ip);
+      const createdSession = sessionStore.create(ownerId);
+      setCookie(response, "poncho_session", createdSession.sessionId, {
+        httpOnly: true,
+        secure: secureCookies,
+        sameSite: "Lax",
+        path: "/",
+        maxAge: 60 * 60 * 8
+      });
+      writeJson(response, 200, {
+        authenticated: true,
+        csrfToken: createdSession.csrfToken
+      });
+      return;
+    }
+    if (pathname === "/api/auth/logout" && request.method === "POST") {
+      if (session?.sessionId) {
+        sessionStore.delete(session.sessionId);
+      }
+      setCookie(response, "poncho_session", "", {
+        httpOnly: true,
+        secure: secureCookies,
+        sameSite: "Lax",
+        path: "/",
+        maxAge: 0
+      });
+      writeJson(response, 200, { ok: true });
+      return;
+    }
+    if (pathname.startsWith("/api/")) {
+      const hasBearerToken = request.headers.authorization?.startsWith("Bearer ");
+      const isAuthenticated = !requireAuth || session || validateBearerToken(request.headers.authorization);
+      if (!isAuthenticated) {
+        writeJson(response, 401, {
+          code: "AUTH_ERROR",
+          message: "Authentication required"
+        });
+        return;
+      }
+      if (requireAuth && session && !hasBearerToken && requiresCsrfValidation && pathname !== "/api/auth/login" && request.headers["x-csrf-token"] !== session?.csrfToken) {
+        writeJson(response, 403, {
+          code: "CSRF_ERROR",
+          message: "Invalid CSRF token"
+        });
+        return;
+      }
+    }
+    if (pathname === "/api/conversations" && request.method === "GET") {
+      const conversations = await conversationStore.list(ownerId);
+      writeJson(response, 200, {
+        conversations: conversations.map((conversation) => ({
+          conversationId: conversation.conversationId,
+          title: conversation.title,
+          runtimeRunId: conversation.runtimeRunId,
+          ownerId: conversation.ownerId,
+          tenantId: conversation.tenantId,
+          createdAt: conversation.createdAt,
+          updatedAt: conversation.updatedAt,
+          messageCount: conversation.messages.length
+        }))
+      });
+      return;
+    }
+    if (pathname === "/api/conversations" && request.method === "POST") {
+      const body = await readRequestBody(request);
+      const conversation = await conversationStore.create(ownerId, body.title);
+      const introMessage = await consumeFirstRunIntro(workingDir, {
+        agentName,
+        provider: agentModelProvider,
+        model: agentModelName,
+        config
+      });
+      if (introMessage) {
+        conversation.messages = [{ role: "assistant", content: introMessage }];
+        await conversationStore.update(conversation);
+      }
+      writeJson(response, 201, { conversation });
+      return;
+    }
+    const approvalMatch = pathname.match(/^\/api\/approvals\/([^/]+)$/);
+    if (approvalMatch && request.method === "POST") {
+      const approvalId = decodeURIComponent(approvalMatch[1] ?? "");
+      const pending = pendingApprovals.get(approvalId);
+      if (!pending || pending.ownerId !== ownerId) {
+        writeJson(response, 404, {
+          code: "APPROVAL_NOT_FOUND",
+          message: "Approval request not found"
+        });
+        return;
+      }
+      const body = await readRequestBody(request);
+      const approved = body.approved === true;
+      pendingApprovals.delete(approvalId);
+      pending.resolve(approved);
+      writeJson(response, 200, { ok: true, approvalId, approved });
+      return;
+    }
+    const conversationPathMatch = pathname.match(/^\/api\/conversations\/([^/]+)$/);
+    if (conversationPathMatch) {
+      const conversationId = decodeURIComponent(conversationPathMatch[1] ?? "");
+      const conversation = await conversationStore.get(conversationId);
+      if (!conversation || conversation.ownerId !== ownerId) {
+        writeJson(response, 404, {
+          code: "CONVERSATION_NOT_FOUND",
+          message: "Conversation not found"
+        });
+        return;
+      }
+      if (request.method === "GET") {
+        writeJson(response, 200, { conversation });
+        return;
+      }
+      if (request.method === "PATCH") {
+        const body = await readRequestBody(request);
+        if (!body.title || body.title.trim().length === 0) {
+          writeJson(response, 400, {
+            code: "VALIDATION_ERROR",
+            message: "title is required"
+          });
+          return;
+        }
+        const updated = await conversationStore.rename(conversationId, body.title);
+        writeJson(response, 200, { conversation: updated });
+        return;
+      }
+      if (request.method === "DELETE") {
+        await conversationStore.delete(conversationId);
+        writeJson(response, 200, { ok: true });
+        return;
+      }
+    }
+    const conversationMessageMatch = pathname.match(/^\/api\/conversations\/([^/]+)\/messages$/);
+    if (conversationMessageMatch && request.method === "POST") {
+      const conversationId = decodeURIComponent(conversationMessageMatch[1] ?? "");
+      const conversation = await conversationStore.get(conversationId);
+      if (!conversation || conversation.ownerId !== ownerId) {
+        writeJson(response, 404, {
+          code: "CONVERSATION_NOT_FOUND",
+          message: "Conversation not found"
+        });
+        return;
+      }
+      const body = await readRequestBody(request);
+      const messageText = body.message?.trim() ?? "";
+      if (!messageText) {
+        writeJson(response, 400, {
+          code: "VALIDATION_ERROR",
+          message: "message is required"
+        });
+        return;
+      }
+      if (conversation.messages.length === 0 && (conversation.title === "New conversation" || conversation.title.trim().length === 0)) {
+        conversation.title = inferConversationTitle(messageText);
+      }
+      response.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        Connection: "keep-alive"
+      });
+      let latestRunId = conversation.runtimeRunId ?? "";
+      let assistantResponse = "";
+      const toolTimeline = [];
+      const sections = [];
+      let currentText = "";
+      let currentTools = [];
+      try {
+        const recallCorpus = (await conversationStore.list(ownerId)).filter((item) => item.conversationId !== conversationId).slice(0, 20).map((item) => ({
+          conversationId: item.conversationId,
+          title: item.title,
+          updatedAt: item.updatedAt,
+          content: item.messages.slice(-6).map((message) => `${message.role}: ${message.content}`).join("\n").slice(0, 2e3)
+        })).filter((item) => item.content.length > 0);
+        for await (const event of harness.runWithTelemetry({
+          task: messageText,
+          parameters: {
+            ...body.parameters ?? {},
+            __conversationRecallCorpus: recallCorpus,
+            __activeConversationId: conversationId
+          },
+          messages: conversation.messages
+        })) {
+          if (event.type === "run:started") {
+            latestRunId = event.runId;
+            runOwners.set(event.runId, ownerId);
+          }
+          if (event.type === "model:chunk") {
+            if (currentTools.length > 0) {
+              sections.push({ type: "tools", content: currentTools });
+              currentTools = [];
+            }
+            assistantResponse += event.content;
+            currentText += event.content;
+          }
+          if (event.type === "tool:started") {
+            if (currentText.length > 0) {
+              sections.push({ type: "text", content: currentText });
+              currentText = "";
+            }
+            const toolText = `- start \`${event.tool}\``;
+            toolTimeline.push(toolText);
+            currentTools.push(toolText);
+          }
+          if (event.type === "tool:completed") {
+            const toolText = `- done \`${event.tool}\` (${event.duration}ms)`;
+            toolTimeline.push(toolText);
+            currentTools.push(toolText);
+          }
+          if (event.type === "tool:error") {
+            const toolText = `- error \`${event.tool}\`: ${event.error}`;
+            toolTimeline.push(toolText);
+            currentTools.push(toolText);
+          }
+          if (event.type === "tool:approval:required") {
+            const toolText = `- approval required \`${event.tool}\``;
+            toolTimeline.push(toolText);
+            currentTools.push(toolText);
+          }
+          if (event.type === "tool:approval:granted") {
+            const toolText = `- approval granted (${event.approvalId})`;
+            toolTimeline.push(toolText);
+            currentTools.push(toolText);
+          }
+          if (event.type === "tool:approval:denied") {
+            const toolText = `- approval denied (${event.approvalId})`;
+            toolTimeline.push(toolText);
+            currentTools.push(toolText);
+          }
+          if (event.type === "run:completed" && assistantResponse.length === 0 && event.result.response) {
+            assistantResponse = event.result.response;
+          }
+          await telemetry.emit(event);
+          response.write(formatSseEvent(event));
+        }
+        if (currentTools.length > 0) {
+          sections.push({ type: "tools", content: currentTools });
+        }
+        if (currentText.length > 0) {
+          sections.push({ type: "text", content: currentText });
+        }
+        conversation.messages = [
+          ...conversation.messages,
+          { role: "user", content: messageText },
+          {
+            role: "assistant",
+            content: assistantResponse,
+            metadata: toolTimeline.length > 0 || sections.length > 0 ? {
+              toolActivity: toolTimeline,
+              sections: sections.length > 0 ? sections : void 0
+            } : void 0
+          }
+        ];
+        conversation.runtimeRunId = latestRunId || conversation.runtimeRunId;
+        conversation.updatedAt = Date.now();
+        await conversationStore.update(conversation);
+      } catch (error) {
+        response.write(
+          formatSseEvent({
+            type: "run:error",
+            runId: latestRunId || "run_unknown",
+            error: {
+              code: "RUN_ERROR",
+              message: error instanceof Error ? error.message : "Unknown error"
+            }
+          })
+        );
+      } finally {
+        if (latestRunId) {
+          runOwners.delete(latestRunId);
+        }
+        response.end();
+      }
+      return;
+    }
+    writeJson(response, 404, { error: "Not found" });
+  };
+};
+var startDevServer = async (port, options) => {
+  const handler = await createRequestHandler(options);
+  const server = createServer(handler);
+  const actualPort = await listenOnAvailablePort(server, port);
+  if (actualPort !== port) {
+    process.stdout.write(`Port ${port} is in use, switched to ${actualPort}.
+`);
+  }
+  process.stdout.write(`Poncho dev server running at http://localhost:${actualPort}
+`);
+  const shutdown = () => {
+    server.close();
+    server.closeAllConnections?.();
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  return server;
+};
+var runOnce = async (task, options) => {
+  const workingDir = options.workingDir ?? process.cwd();
+  dotenv.config({ path: resolve3(workingDir, ".env") });
+  const config = await loadPonchoConfig(workingDir);
+  const harness = new AgentHarness({ workingDir });
+  const telemetry = new TelemetryEmitter(config?.telemetry);
+  await harness.initialize();
+  const fileBlobs = await Promise.all(
+    options.filePaths.map(async (path) => {
+      const content = await readFile3(resolve3(workingDir, path), "utf8");
+      return `# File: ${path}
+${content}`;
+    })
+  );
+  const input2 = {
+    task: fileBlobs.length > 0 ? `${task}
+
+${fileBlobs.join("\n\n")}` : task,
+    parameters: options.params
+  };
+  if (options.json) {
+    const output = await harness.runToCompletion(input2);
+    for (const event of output.events) {
+      await telemetry.emit(event);
+    }
+    process.stdout.write(`${JSON.stringify(output, null, 2)}
+`);
+    return;
+  }
+  for await (const event of harness.runWithTelemetry(input2)) {
+    await telemetry.emit(event);
+    if (event.type === "model:chunk") {
+      process.stdout.write(event.content);
+    }
+    if (event.type === "run:error") {
+      process.stderr.write(`
+Error: ${event.error.message}
+`);
+    }
+    if (event.type === "run:completed") {
+      process.stdout.write("\n");
+    }
+  }
+};
+var runInteractive = async (workingDir, params) => {
+  dotenv.config({ path: resolve3(workingDir, ".env") });
+  const config = await loadPonchoConfig(workingDir);
+  let pendingApproval = null;
+  let onApprovalRequest = null;
+  const approvalHandler = async (request) => {
+    return new Promise((resolveApproval) => {
+      const req = {
+        tool: request.tool,
+        input: request.input,
+        approvalId: request.approvalId,
+        resolve: resolveApproval
+      };
+      pendingApproval = req;
+      if (onApprovalRequest) {
+        onApprovalRequest(req);
+      }
+    });
+  };
+  const harness = new AgentHarness({
+    workingDir,
+    environment: resolveHarnessEnvironment(),
+    approvalHandler
+  });
+  await harness.initialize();
+  try {
+    const { runInteractiveInk } = await import("./run-interactive-ink-JDTNFRN2.js");
+    await runInteractiveInk({
+      harness,
+      params,
+      workingDir,
+      config,
+      conversationStore: createConversationStore(resolveStateConfig(config), { workingDir }),
+      onSetApprovalCallback: (cb) => {
+        onApprovalRequest = cb;
+        if (pendingApproval) {
+          cb(pendingApproval);
+        }
+      }
+    });
+  } finally {
+    await harness.shutdown();
+  }
+};
+var listTools = async (workingDir) => {
+  dotenv.config({ path: resolve3(workingDir, ".env") });
+  const harness = new AgentHarness({ workingDir });
+  await harness.initialize();
+  const tools = harness.listTools();
+  if (tools.length === 0) {
+    process.stdout.write("No tools registered.\n");
+    return;
+  }
+  process.stdout.write("Available tools:\n");
+  for (const tool of tools) {
+    process.stdout.write(`- ${tool.name}: ${tool.description}
+`);
+  }
+};
+var runPnpmInstall = async (workingDir) => await new Promise((resolveInstall, rejectInstall) => {
+  const child = spawn("pnpm", ["install"], {
+    cwd: workingDir,
+    stdio: "inherit",
+    env: process.env
+  });
+  child.on("exit", (code) => {
+    if (code === 0) {
+      resolveInstall();
+      return;
+    }
+    rejectInstall(new Error(`pnpm install failed with exit code ${code ?? -1}`));
+  });
+});
+var runInstallCommand = async (workingDir, packageNameOrPath) => await new Promise((resolveInstall, rejectInstall) => {
+  const child = spawn("pnpm", ["add", packageNameOrPath], {
+    cwd: workingDir,
+    stdio: "inherit",
+    env: process.env
+  });
+  child.on("exit", (code) => {
+    if (code === 0) {
+      resolveInstall();
+      return;
+    }
+    rejectInstall(new Error(`pnpm add failed with exit code ${code ?? -1}`));
+  });
+});
+var resolveInstalledPackageName = (packageNameOrPath) => {
+  if (packageNameOrPath.startsWith(".") || packageNameOrPath.startsWith("/")) {
+    return null;
+  }
+  if (packageNameOrPath.startsWith("@")) {
+    return packageNameOrPath;
+  }
+  if (packageNameOrPath.includes("/")) {
+    return packageNameOrPath.split("/").pop() ?? packageNameOrPath;
+  }
+  return packageNameOrPath;
+};
+var resolveSkillRoot = (workingDir, packageNameOrPath) => {
+  if (packageNameOrPath.startsWith(".") || packageNameOrPath.startsWith("/")) {
+    return resolve3(workingDir, packageNameOrPath);
+  }
+  const moduleName = resolveInstalledPackageName(packageNameOrPath) ?? packageNameOrPath;
+  try {
+    const packageJsonPath = require3.resolve(`${moduleName}/package.json`, {
+      paths: [workingDir]
+    });
+    return resolve3(packageJsonPath, "..");
+  } catch {
+    const candidate = resolve3(workingDir, "node_modules", moduleName);
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+    throw new Error(
+      `Could not locate installed package "${moduleName}" in ${workingDir}`
+    );
+  }
+};
+var findSkillManifest = async (dir, depth = 2) => {
+  try {
+    await access2(resolve3(dir, "SKILL.md"));
+    return true;
+  } catch {
+  }
+  if (depth <= 0) return false;
+  try {
+    const { readdir } = await import("fs/promises");
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules") {
+        const found = await findSkillManifest(resolve3(dir, entry.name), depth - 1);
+        if (found) return true;
+      }
+    }
+  } catch {
+  }
+  return false;
+};
+var validateSkillPackage = async (workingDir, packageNameOrPath) => {
+  const skillRoot = resolveSkillRoot(workingDir, packageNameOrPath);
+  const hasSkill = await findSkillManifest(skillRoot);
+  if (!hasSkill) {
+    throw new Error(`Skill validation failed: no SKILL.md found in ${skillRoot}`);
+  }
+};
+var addSkill = async (workingDir, packageNameOrPath) => {
+  await runInstallCommand(workingDir, packageNameOrPath);
+  await validateSkillPackage(workingDir, packageNameOrPath);
+  process.stdout.write(`Added skill: ${packageNameOrPath}
+`);
+};
+var runTests = async (workingDir, filePath) => {
+  dotenv.config({ path: resolve3(workingDir, ".env") });
+  const testFilePath = filePath ?? resolve3(workingDir, "tests", "basic.yaml");
+  const content = await readFile3(testFilePath, "utf8");
+  const parsed = YAML.parse(content);
+  const tests = parsed.tests ?? [];
+  const harness = new AgentHarness({ workingDir });
+  await harness.initialize();
+  let passed = 0;
+  let failed = 0;
+  for (const testCase of tests) {
+    try {
+      const output = await harness.runToCompletion({ task: testCase.task });
+      const response = output.result.response ?? "";
+      const events = output.events;
+      const expectation = testCase.expect ?? {};
+      const checks = [];
+      if (expectation.contains) {
+        checks.push(response.includes(expectation.contains));
+      }
+      if (typeof expectation.maxSteps === "number") {
+        checks.push(output.result.steps <= expectation.maxSteps);
+      }
+      if (typeof expectation.maxTokens === "number") {
+        checks.push(
+          output.result.tokens.input + output.result.tokens.output <= expectation.maxTokens
+        );
+      }
+      if (expectation.refusal) {
+        checks.push(
+          response.toLowerCase().includes("can't") || response.toLowerCase().includes("cannot")
+        );
+      }
+      if (expectation.toolCalled) {
+        checks.push(
+          events.some(
+            (event) => event.type === "tool:started" && event.tool === expectation.toolCalled
+          )
+        );
+      }
+      const ok = checks.length === 0 ? output.result.status === "completed" : checks.every(Boolean);
+      if (ok) {
+        passed += 1;
+        process.stdout.write(`PASS ${testCase.name}
+`);
+      } else {
+        failed += 1;
+        process.stdout.write(`FAIL ${testCase.name}
+`);
+      }
+    } catch (error) {
+      failed += 1;
+      process.stdout.write(
+        `FAIL ${testCase.name} (${error instanceof Error ? error.message : "Unknown test error"})
+`
+      );
+    }
+  }
+  process.stdout.write(`
+Test summary: ${passed} passed, ${failed} failed
+`);
+  return { passed, failed };
+};
+var buildTarget = async (workingDir, target) => {
+  const outDir = resolve3(workingDir, ".poncho-build", target);
+  await mkdir3(outDir, { recursive: true });
+  const serverEntrypoint = `import { startDevServer } from "@poncho-ai/cli";
+
+const port = Number.parseInt(process.env.PORT ?? "3000", 10);
+await startDevServer(Number.isNaN(port) ? 3000 : port, { workingDir: process.cwd() });
+`;
+  const runtimePackageJson = JSON.stringify(
+    {
+      name: "poncho-runtime-bundle",
+      private: true,
+      type: "module",
+      scripts: {
+        start: "node server.js"
+      },
+      dependencies: {
+        "@poncho-ai/cli": "^0.1.0"
+      }
+    },
+    null,
+    2
+  );
+  if (target === "vercel") {
+    await mkdir3(resolve3(outDir, "api"), { recursive: true });
+    await copyIfExists(resolve3(workingDir, "AGENT.md"), resolve3(outDir, "AGENT.md"));
+    await copyIfExists(
+      resolve3(workingDir, "poncho.config.js"),
+      resolve3(outDir, "poncho.config.js")
+    );
+    await copyIfExists(resolve3(workingDir, "skills"), resolve3(outDir, "skills"));
+    await copyIfExists(resolve3(workingDir, "tests"), resolve3(outDir, "tests"));
+    await writeFile3(
+      resolve3(outDir, "vercel.json"),
+      JSON.stringify(
+        {
+          version: 2,
+          functions: {
+            "api/index.js": {
+              includeFiles: "{AGENT.md,poncho.config.js,skills/**,tests/**}"
+            }
+          },
+          routes: [{ src: "/(.*)", dest: "/api/index.js" }]
+        },
+        null,
+        2
+      ),
+      "utf8"
+    );
+    await buildVercelHandlerBundle(outDir);
+    await writeFile3(
+      resolve3(outDir, "package.json"),
+      JSON.stringify(
+        {
+          private: true,
+          type: "module",
+          engines: {
+            node: "20.x"
+          },
+          dependencies: VERCEL_RUNTIME_DEPENDENCIES
+        },
+        null,
+        2
+      ),
+      "utf8"
+    );
+  } else if (target === "docker") {
+    await writeFile3(
+      resolve3(outDir, "Dockerfile"),
+      `FROM node:20-slim
+WORKDIR /app
+COPY package.json package.json
+COPY AGENT.md AGENT.md
+COPY poncho.config.js poncho.config.js
+COPY skills skills
+COPY tests tests
+COPY .env.example .env.example
+RUN corepack enable && npm install -g @poncho-ai/cli
+COPY server.js server.js
+EXPOSE 3000
+CMD ["node","server.js"]
+`,
+      "utf8"
+    );
+    await writeFile3(resolve3(outDir, "server.js"), serverEntrypoint, "utf8");
+    await writeFile3(resolve3(outDir, "package.json"), runtimePackageJson, "utf8");
+  } else if (target === "lambda") {
+    await writeFile3(
+      resolve3(outDir, "lambda-handler.js"),
+      `import { startDevServer } from "@poncho-ai/cli";
+let serverPromise;
+export const handler = async (event = {}) => {
+  if (!serverPromise) {
+    serverPromise = startDevServer(0, { workingDir: process.cwd() });
+  }
+  const body = JSON.stringify({
+    status: "ready",
+    route: event.rawPath ?? event.path ?? "/",
+  });
+  return { statusCode: 200, headers: { "content-type": "application/json" }, body };
+};
+`,
+      "utf8"
+    );
+    await writeFile3(resolve3(outDir, "package.json"), runtimePackageJson, "utf8");
+  } else if (target === "fly") {
+    await writeFile3(
+      resolve3(outDir, "fly.toml"),
+      `app = "poncho-app"
+[env]
+  PORT = "3000"
+[http_service]
+  internal_port = 3000
+  force_https = true
+  auto_start_machines = true
+  auto_stop_machines = "stop"
+  min_machines_running = 0
+`,
+      "utf8"
+    );
+    await writeFile3(
+      resolve3(outDir, "Dockerfile"),
+      `FROM node:20-slim
+WORKDIR /app
+COPY package.json package.json
+COPY AGENT.md AGENT.md
+COPY poncho.config.js poncho.config.js
+COPY skills skills
+COPY tests tests
+RUN npm install -g @poncho-ai/cli
+COPY server.js server.js
+EXPOSE 3000
+CMD ["node","server.js"]
+`,
+      "utf8"
+    );
+    await writeFile3(resolve3(outDir, "server.js"), serverEntrypoint, "utf8");
+    await writeFile3(resolve3(outDir, "package.json"), runtimePackageJson, "utf8");
+  } else {
+    throw new Error(`Unsupported build target: ${target}`);
+  }
+  process.stdout.write(`Build artifacts generated at ${outDir}
+`);
+};
+var normalizeMcpName = (entry) => entry.name ?? entry.url ?? `mcp_${Date.now()}`;
+var mcpAdd = async (workingDir, options) => {
+  const config = await loadPonchoConfig(workingDir) ?? { mcp: [] };
+  const mcp = [...config.mcp ?? []];
+  if (!options.url) {
+    throw new Error("Remote MCP only: provide --url for a remote MCP server.");
+  }
+  if (options.url.startsWith("ws://") || options.url.startsWith("wss://")) {
+    throw new Error("WebSocket MCP URLs are no longer supported. Use an HTTP MCP endpoint.");
+  }
+  if (!options.url.startsWith("http://") && !options.url.startsWith("https://")) {
+    throw new Error("Invalid MCP URL. Expected http:// or https://.");
+  }
+  const serverName = options.name ?? normalizeMcpName({ url: options.url });
+  mcp.push({
+    name: serverName,
+    url: options.url,
+    env: options.envVars ?? [],
+    auth: options.authBearerEnv ? {
+      type: "bearer",
+      tokenEnv: options.authBearerEnv
+    } : void 0
+  });
+  await writeConfigFile(workingDir, { ...config, mcp });
+  let envSeedMessage;
+  if (options.authBearerEnv) {
+    const envPath = resolve3(workingDir, ".env");
+    const envExamplePath = resolve3(workingDir, ".env.example");
+    const addedEnv = await ensureEnvPlaceholder(envPath, options.authBearerEnv);
+    const addedEnvExample = await ensureEnvPlaceholder(envExamplePath, options.authBearerEnv);
+    if (addedEnv || addedEnvExample) {
+      envSeedMessage = `Added ${options.authBearerEnv}= to ${addedEnv ? ".env" : ""}${addedEnv && addedEnvExample ? " and " : ""}${addedEnvExample ? ".env.example" : ""}.`;
+    }
+  }
+  const nextSteps = [];
+  let step = 1;
+  if (options.authBearerEnv) {
+    nextSteps.push(`  ${step}) Set token in .env: ${options.authBearerEnv}=...`);
+    step += 1;
+  }
+  nextSteps.push(`  ${step}) Discover tools: poncho mcp tools list ${serverName}`);
+  step += 1;
+  nextSteps.push(`  ${step}) Select tools:   poncho mcp tools select ${serverName}`);
+  step += 1;
+  nextSteps.push(`  ${step}) Verify config:  poncho mcp list`);
+  process.stdout.write(
+    [
+      `MCP server added: ${serverName}`,
+      ...envSeedMessage ? [envSeedMessage] : [],
+      "Next steps:",
+      ...nextSteps,
+      ""
+    ].join("\n")
+  );
+};
+var mcpList = async (workingDir) => {
+  const config = await loadPonchoConfig(workingDir);
+  const mcp = config?.mcp ?? [];
+  if (mcp.length === 0) {
+    process.stdout.write("No MCP servers configured.\n");
+    return;
+  }
+  process.stdout.write("Configured MCP servers:\n");
+  for (const entry of mcp) {
+    const auth = entry.auth?.type === "bearer" ? `auth=bearer:${entry.auth.tokenEnv}` : "auth=none";
+    process.stdout.write(
+      `- ${entry.name ?? entry.url} (remote: ${entry.url}, ${auth})
+`
+    );
+  }
+};
+var mcpRemove = async (workingDir, name) => {
+  const config = await loadPonchoConfig(workingDir) ?? { mcp: [] };
+  const before = config.mcp ?? [];
+  const removed = before.filter((entry) => normalizeMcpName(entry) === name);
+  const filtered = before.filter((entry) => normalizeMcpName(entry) !== name);
+  await writeConfigFile(workingDir, { ...config, mcp: filtered });
+  const removedTokenEnvNames = new Set(
+    removed.map(
+      (entry) => entry.auth?.type === "bearer" ? entry.auth.tokenEnv?.trim() ?? "" : ""
+    ).filter((value) => value.length > 0)
+  );
+  const stillUsedTokenEnvNames = new Set(
+    filtered.map(
+      (entry) => entry.auth?.type === "bearer" ? entry.auth.tokenEnv?.trim() ?? "" : ""
+    ).filter((value) => value.length > 0)
+  );
+  const removedFromExample = [];
+  for (const tokenEnv of removedTokenEnvNames) {
+    if (stillUsedTokenEnvNames.has(tokenEnv)) {
+      continue;
+    }
+    const changed = await removeEnvPlaceholder(resolve3(workingDir, ".env.example"), tokenEnv);
+    if (changed) {
+      removedFromExample.push(tokenEnv);
+    }
+  }
+  process.stdout.write(`Removed MCP server: ${name}
+`);
+  if (removedFromExample.length > 0) {
+    process.stdout.write(
+      `Removed unused token placeholder(s) from .env.example: ${removedFromExample.join(", ")}
+`
+    );
+  }
+};
+var resolveMcpEntry = async (workingDir, serverName) => {
+  const config = await loadPonchoConfig(workingDir) ?? { mcp: [] };
+  const entries = config.mcp ?? [];
+  const index = entries.findIndex((entry) => normalizeMcpName(entry) === serverName);
+  if (index < 0) {
+    throw new Error(`MCP server "${serverName}" is not configured.`);
+  }
+  return { config, index };
+};
+var discoverMcpTools = async (workingDir, serverName) => {
+  dotenv.config({ path: resolve3(workingDir, ".env") });
+  const { config, index } = await resolveMcpEntry(workingDir, serverName);
+  const entry = (config.mcp ?? [])[index];
+  const bridge = new LocalMcpBridge({ mcp: [entry] });
+  try {
+    await bridge.startLocalServers();
+    await bridge.discoverTools();
+    return bridge.listDiscoveredTools(normalizeMcpName(entry));
+  } finally {
+    await bridge.stopLocalServers();
+  }
+};
+var mcpToolsList = async (workingDir, serverName) => {
+  const discovered = await discoverMcpTools(workingDir, serverName);
+  if (discovered.length === 0) {
+    process.stdout.write(`No tools discovered for MCP server "${serverName}".
+`);
+    return;
+  }
+  process.stdout.write(`Discovered tools for "${serverName}":
+`);
+  for (const tool of discovered) {
+    process.stdout.write(`- ${tool}
+`);
+  }
+};
+var mcpToolsSelect = async (workingDir, serverName, options) => {
+  const discovered = await discoverMcpTools(workingDir, serverName);
+  if (discovered.length === 0) {
+    process.stdout.write(`No tools discovered for MCP server "${serverName}".
+`);
+    return;
+  }
+  let selected = [];
+  if (options.all) {
+    selected = [...discovered];
+  } else if (options.toolsCsv && options.toolsCsv.trim().length > 0) {
+    const requested = options.toolsCsv.split(",").map((part) => part.trim()).filter((part) => part.length > 0);
+    selected = discovered.filter((tool) => requested.includes(tool));
+  } else {
+    process.stdout.write(`Discovered tools for "${serverName}":
+`);
+    discovered.forEach((tool, idx) => {
+      process.stdout.write(`${idx + 1}. ${tool}
+`);
+    });
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await rl.question(
+      "Enter comma-separated tool numbers/names to allow (or * for all): "
+    );
+    rl.close();
+    const raw = answer.trim();
+    if (raw === "*") {
+      selected = [...discovered];
+    } else {
+      const tokens = raw.split(",").map((part) => part.trim()).filter((part) => part.length > 0);
+      const fromIndex = tokens.map((token) => Number.parseInt(token, 10)).filter((value) => !Number.isNaN(value)).map((index) => discovered[index - 1]).filter((value) => typeof value === "string");
+      const byName = discovered.filter((tool) => tokens.includes(tool));
+      selected = [.../* @__PURE__ */ new Set([...fromIndex, ...byName])];
+    }
+  }
+  if (selected.length === 0) {
+    throw new Error("No valid tools selected.");
+  }
+  const includePatterns = selected.length === discovered.length ? [`${serverName}/*`] : selected.sort();
+  process.stdout.write(`Selected MCP tools: ${includePatterns.join(", ")}
+`);
+  process.stdout.write(
+    "\nRequired next step: add MCP intent in AGENT.md or SKILL.md allowed-tools. Without this, these MCP tools will not be registered for the model.\n"
+  );
+  process.stdout.write(
+    "\nOption A: AGENT.md (global fallback intent)\nPaste this into AGENT.md frontmatter:\n---\nallowed-tools:\n" + includePatterns.map((tool) => `  - mcp:${tool}`).join("\n") + "\n---\n"
+  );
+  process.stdout.write(
+    "\nOption B: SKILL.md (only when that skill is activated)\nPaste this into SKILL.md frontmatter:\n---\nallowed-tools:\n" + includePatterns.map((tool) => `  - mcp:${tool}`).join("\n") + "\napproval-required:\n" + includePatterns.map((tool) => `  - mcp:${tool}`).join("\n") + "\n---\n"
+  );
+};
+var buildCli = () => {
+  const program = new Command();
+  program.name("poncho").description("CLI for building and running Poncho agents").version("0.1.0");
+  program.command("init").argument("<name>", "project name").option("--yes", "accept defaults and skip prompts", false).description("Scaffold a new Poncho project").action(async (name, options) => {
+    await initProject(name, {
+      onboarding: {
+        yes: options.yes,
+        interactive: !options.yes && process.stdin.isTTY === true && process.stdout.isTTY === true
+      }
+    });
+  });
+  program.command("dev").description("Run local development server").option("--port <port>", "server port", "3000").action(async (options) => {
+    const port = Number.parseInt(options.port, 10);
+    await startDevServer(Number.isNaN(port) ? 3e3 : port);
+  });
+  program.command("run").argument("[task]", "task to run").description("Execute the agent once").option("--param <keyValue>", "parameter key=value", (value, all) => {
+    all.push(value);
+    return all;
+  }, []).option("--file <path>", "include file contents", (value, all) => {
+    all.push(value);
+    return all;
+  }, []).option("--json", "output json", false).option("--interactive", "run in interactive mode", false).action(
+    async (task, options) => {
+      const params = parseParams(options.param);
+      if (options.interactive) {
+        await runInteractive(process.cwd(), params);
+        return;
+      }
+      if (!task) {
+        throw new Error("Task is required unless --interactive is used.");
+      }
+      await runOnce(task, {
+        params,
+        json: options.json,
+        filePaths: options.file
+      });
+    }
+  );
+  program.command("tools").description("List all tools available to the agent").action(async () => {
+    await listTools(process.cwd());
+  });
+  program.command("add").argument("<packageOrPath>", "skill package name/path").description("Add a skill package and validate SKILL.md").action(async (packageOrPath) => {
+    await addSkill(process.cwd(), packageOrPath);
+  });
+  program.command("update-agent").description("Remove deprecated embedded local guidance from AGENT.md").action(async () => {
+    await updateAgentGuidance(process.cwd());
+  });
+  program.command("test").argument("[file]", "test file path (yaml)").description("Run yaml-defined agent tests").action(async (file) => {
+    const testFile = file ? resolve3(process.cwd(), file) : void 0;
+    const result = await runTests(process.cwd(), testFile);
+    if (result.failed > 0) {
+      process.exitCode = 1;
+    }
+  });
+  program.command("build").argument("<target>", "vercel|docker|lambda|fly").description("Generate build artifacts for deployment target").action(async (target) => {
+    await buildTarget(process.cwd(), target);
+  });
+  const mcpCommand = program.command("mcp").description("Manage MCP servers");
+  mcpCommand.command("add").requiredOption("--url <url>", "remote MCP url").option("--name <name>", "server name").option(
+    "--auth-bearer-env <name>",
+    "env var name containing bearer token for this MCP server"
+  ).option("--env <name>", "env variable (repeatable)", (value, all) => {
+    all.push(value);
+    return all;
+  }, []).action(
+    async (options) => {
+      await mcpAdd(process.cwd(), {
+        url: options.url,
+        name: options.name,
+        envVars: options.env,
+        authBearerEnv: options.authBearerEnv
+      });
+    }
+  );
+  mcpCommand.command("list").description("List configured MCP servers").action(async () => {
+    await mcpList(process.cwd());
+  });
+  mcpCommand.command("remove").argument("<name>", "server name").description("Remove an MCP server by name").action(async (name) => {
+    await mcpRemove(process.cwd(), name);
+  });
+  const mcpToolsCommand = mcpCommand.command("tools").description("Discover and curate tools for a configured MCP server");
+  mcpToolsCommand.command("list").argument("<name>", "server name").description("Discover and list tools from a configured MCP server").action(async (name) => {
+    await mcpToolsList(process.cwd(), name);
+  });
+  mcpToolsCommand.command("select").argument("<name>", "server name").description("Select MCP tools and print frontmatter allowed-tools entries").option("--all", "select all discovered tools", false).option("--tools <csv>", "comma-separated discovered tool names").action(
+    async (name, options) => {
+      await mcpToolsSelect(process.cwd(), name, {
+        all: options.all,
+        toolsCsv: options.tools
+      });
+    }
+  );
+  return program;
+};
+var main = async (argv = process.argv) => {
+  try {
+    await buildCli().parseAsync(argv);
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "EADDRINUSE") {
+      const message = "Port is already in use. Try `poncho dev --port 3001` or stop the process using port 3000.";
+      process.stderr.write(`${message}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    process.stderr.write(`${error instanceof Error ? error.message : "Unknown CLI error"}
+`);
+    process.exitCode = 1;
+  }
+};
+var packageRoot = resolve3(__dirname, "..");
+
+export {
+  inferConversationTitle,
+  consumeFirstRunIntro,
+  resolveHarnessEnvironment,
+  initProject,
+  updateAgentGuidance,
+  createRequestHandler,
+  startDevServer,
+  runOnce,
+  runInteractive,
+  listTools,
+  addSkill,
+  runTests,
+  buildTarget,
+  mcpAdd,
+  mcpList,
+  mcpRemove,
+  mcpToolsList,
+  mcpToolsSelect,
+  buildCli,
+  main,
+  packageRoot
+};