@prismshadow/penguin-server 0.2.2 → 0.2.3

package/dist/index.js

@@ -1,3 +1,18 @@
+import {
+  ADMIN_USER_ID,
+  AuthService,
+  AuthSessionsRepo,
+  HttpError,
+  MIN_PASSWORD_LENGTH,
+  UsersRepo,
+  errorBody,
+  handleError,
+  hashPassword,
+  isMissingCredential,
+  modelCredentialMissing,
+  openDatabase,
+  toUserInfo
+} from "./chunk-3QINBW3W.js";
 import {
   acquireServerLock,
   liveServerLock,
@@ -11,20 +26,26 @@ import {
 } from "./chunk-UUJCF46V.js";
 
 // src/index.ts
-import fs23 from "fs";
+import fs24 from "fs";
 import path19 from "path";
 import { config as loadDotenv } from "dotenv";
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import fs21 from "fs";
-import fsp from "fs/promises";
+import fs22 from "fs";
+import fsp2 from "fs/promises";
 import path17 from "path";
-import { Hono as Hono25 } from "hono";
+import { Hono as Hono26 } from "hono";
 import { bodyLimit } from "hono/body-limit";
 
 // src/net/proxy.ts
-import { Agent, EnvHttpProxyAgent, fetch as undiciFetch, setGlobalDispatcher } from "undici";
+import {
+  Agent,
+  EnvHttpProxyAgent,
+  ProxyAgent,
+  fetch as undiciFetch,
+  setGlobalDispatcher
+} from "undici";
 var LOOPBACK_NO_PROXY = ["localhost", "127.0.0.1", "::1"];
 function mergedNoProxy(env = process.env) {
   const raw = env.no_proxy ?? env.NO_PROXY ?? "";
@@ -45,12 +66,14 @@ function normalizeProxyUrl(raw) {
   } catch {
     return null;
   }
-  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-  if (url.hostname === "" || url.username !== "" || url.password !== "") return null;
-  if (url.pathname !== "/" && url.pathname !== "" || url.search !== "" || url.hash !== "") {
+  if (url.hostname === "") return null;
+  const normalized = url.pathname === "/" && url.search === "" && url.hash === "" ? url.href.slice(0, -1) : url.href;
+  try {
+    void new ProxyAgent({ uri: normalized }).close();
+  } catch {
     return null;
   }
-  return url.origin;
+  return normalized;
 }
 function envProxyAgentOptions(proxyUrl, env) {
   const noProxy = mergedNoProxy(env);
@@ -75,175 +98,6 @@ function applyProxySettings(settings) {
   if (installed) setGlobalDispatcher(buildProxyDispatcher(current));
 }
 
-// src/db/database.ts
-import { mkdirSync } from "fs";
-import path from "path";
-
-// src/db/schema.ts
-var SCHEMA_SQL = `
-CREATE TABLE IF NOT EXISTS users (
-  user_id             TEXT PRIMARY KEY,            -- semantic id doubles as login name: ^[a-z][a-z0-9_-]{1,31}$
-  password_hash       TEXT NOT NULL,               -- scrypt$N$r$p$salt$hash(base64)
-  is_admin            INTEGER NOT NULL DEFAULT 0,  -- 1 for the built-in admin (seeded at startup)
-  password_is_initial INTEGER NOT NULL DEFAULT 0,  -- 1=initial password (seeded/admin-set); cleared once the user changes it
-  created_at          TEXT NOT NULL
-);
-CREATE TABLE IF NOT EXISTS auth_sessions (
-  token_hash TEXT PRIMARY KEY,               -- sha256(token) hex; the cookie stores only the raw token
-  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
-  created_at TEXT NOT NULL,
-  expires_at TEXT NOT NULL,                  -- 7-day sliding renewal (topped up when <6 days remain)
-  via        TEXT                            -- 'password' | 'desktop'; NULL = legacy row (password)
-);
-CREATE TABLE IF NOT EXISTS projects (
-  project_id    TEXT PRIMARY KEY,            -- directory name doubles as id; display name lives in project_config.toml
-  owner_user_id TEXT NOT NULL REFERENCES users(user_id),
-  created_at    TEXT NOT NULL
-);
-CREATE TABLE IF NOT EXISTS project_members (  -- member grants only; owners are not stored here
-  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
-  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
-  created_at TEXT NOT NULL,
-  PRIMARY KEY (project_id, user_id)
-);
-CREATE TABLE IF NOT EXISTS agents (           -- index only; name/description live in system_config.yaml
-  project_id TEXT NOT NULL,
-  agent_id   TEXT NOT NULL,
-  created_at TEXT NOT NULL,
-  PRIMARY KEY (project_id, agent_id)
-);
-CREATE TABLE IF NOT EXISTS sessions (
-  session_id    TEXT PRIMARY KEY,
-  project_id    TEXT NOT NULL,
-  agent_id      TEXT NOT NULL,
-  provider      TEXT NOT NULL,                     -- provider group of the session model (paired with model_id as a model reference)
-  model_id      TEXT NOT NULL,                     -- upstream model id (sent to AgentHub as-is; never concatenate <provider>/<id>)
-  workspace     TEXT NOT NULL,
-  approval_mode TEXT NOT NULL DEFAULT 'allow-all',   -- allow-all|deny-all|read-only|always-ask
-  title         TEXT,                                -- auto-generated by the model after the first exchange; NULL=not yet (frontend shows "New chat")
-  archived_at   TEXT,                                -- archive time; NULL=not archived (shown by default; archived ones move under "Archived")
-  client        TEXT,                                -- creating client: 'web' (created via the Web App) | 'cli' (adopted from a CLI Trace); NULL = legacy row, treated as web
-  has_trace     INTEGER NOT NULL DEFAULT 0,          -- cache: a Trace record exists (set at task start / adoption / subagent registration; lazily backfilled by list hydration)
-  created_at    TEXT NOT NULL
-);                                            -- the schedule/subagent SOURCE is NOT stored: session_meta in the Trace is the single source of truth (see runtime/session-sources.ts); "client" is a different, DB-only axis (who created the row)
-CREATE INDEX IF NOT EXISTS idx_sessions_agent_created ON sessions(project_id, agent_id, created_at DESC);
-CREATE TABLE IF NOT EXISTS usage_records (
-  id                INTEGER PRIMARY KEY AUTOINCREMENT,
-  ts                TEXT NOT NULL,
-  date              TEXT NOT NULL,            -- local date yyyy-mm-dd (aggregation key; same convention as Trace date directories)
-  project_id        TEXT NOT NULL,
-  agent_id          TEXT NOT NULL,
-  session_id        TEXT NOT NULL,            -- top-level Session (child-session usage counts toward its main Session)
-  origin_session_id TEXT,                     -- immediate source child Session (last of the origin chain); NULL=main session
-  provider          TEXT NOT NULL,            -- provider group: paired with model_id as the attribution key; always GROUP BY provider, model_id
-  model_id          TEXT NOT NULL,            -- upstream model id (paired with provider; same model_id across providers aggregates separately)
-  cache_read        INTEGER NOT NULL,
-  cache_write       INTEGER NOT NULL,
-  output            INTEGER NOT NULL,
-  total             INTEGER NOT NULL,         -- from token_usage.request (one row per Request)
-  status            TEXT NOT NULL DEFAULT 'completed'  -- request outcome: completed=success (with tokens); others=failure (0 tokens, for success rate)
-);                                            -- cost is not stored: computed at query time from current pricing
-CREATE INDEX IF NOT EXISTS idx_usage_project_date ON usage_records(project_id, date);
-CREATE INDEX IF NOT EXISTS idx_usage_session ON usage_records(session_id);
-CREATE TABLE IF NOT EXISTS error_records (     -- server-side error capture (the Costs page's "Errors" tab)
-  id         INTEGER PRIMARY KEY AUTOINCREMENT,
-  ts         TEXT NOT NULL,
-  date       TEXT NOT NULL,            -- local date yyyy-mm-dd (same convention as usage_records)
-  project_id TEXT,                     -- nullable: sign-in/registration and process-level errors have no Project context
-  agent_id   TEXT,
-  session_id TEXT,
-  source     TEXT NOT NULL,            -- http | session | usage | title | subagent | process | llm | environment | compaction | schedule
-  kind       TEXT NOT NULL,            -- expected (HttpError, business 4xx) | unexpected (500/runtime)
-  code       TEXT NOT NULL,            -- HttpError.code / internal / session_run_failed / ...
-  status     INTEGER,                  -- HTTP status code; NULL for non-HTTP sources
-  message    TEXT NOT NULL             -- truncated to 500 chars (no stack stored: stacks go to logs only)
-);
-CREATE INDEX IF NOT EXISTS idx_error_project_date ON error_records(project_id, date);
-CREATE TABLE IF NOT EXISTS schedule_state (    -- schedule runtime state (files are declarative intent; the system never writes back)
-  project_id      TEXT NOT NULL,
-  agent_id        TEXT NOT NULL,
-  name            TEXT NOT NULL,               -- file name (without .toml) doubles as the identifier
-  creator_user_id TEXT,                        -- creator (recorded on API create; hand-edited file reconciliation falls back to the Project owner)
-  start_at_ms     INTEGER NOT NULL,            -- defines identity: a start_at change counts as a new task instance, resetting fire state
-  def_hash        TEXT NOT NULL,               -- file content fingerprint: any change clears the invalid flag (the file takes effect again after edits)
-  last_slot_ms    INTEGER,                     -- latest due slot already consumed (advances on fire or skip; no re-fire across restarts)
-  last_fired_at   TEXT,                        -- last actual fire time (for display)
-  fired_once      INTEGER NOT NULL DEFAULT 0,  -- one-shot task has fired
-  missed          INTEGER NOT NULL DEFAULT 0,  -- one-shot task was missed (flagged by startup/registration reconciliation; not backfilled)
-  invalid_reason  TEXT,                        -- invalidation reason (e.g. the bound Session was deleted); NULL=healthy
-  PRIMARY KEY (project_id, agent_id, name)
-);
-CREATE TABLE IF NOT EXISTS goal_state (        -- goal-mode runtime state (GOAL.yaml on disk is the model-facing protocol; this row is what the UI reads)
-  id          INTEGER PRIMARY KEY AUTOINCREMENT,  -- one row per goal run; a Session may run goals repeatedly, latest row wins for display
-  session_id  TEXT NOT NULL,
-  project_id  TEXT NOT NULL,
-  agent_id    TEXT NOT NULL,
-  objective   TEXT NOT NULL,
-  status      TEXT NOT NULL,               -- active | complete | blocked | budget_limited | aborted (aborted is server-side only; on-disk status stays active)
-  budget      INTEGER NOT NULL,            -- token budget; -1 = unlimited
-  used        INTEGER NOT NULL DEFAULT 0,  -- uncached input + output, refreshed per round (mirrors the runner's accounting)
-  rounds      INTEGER NOT NULL DEFAULT 0,
-  created_at  TEXT NOT NULL,
-  updated_at  TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_goal_session ON goal_state(session_id);
-CREATE TABLE IF NOT EXISTS ui_prefs (
-  user_id    TEXT PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,
-  prefs_json TEXT NOT NULL                    -- {theme?, lastProjectId?, ...} free-form JSON
-);
-CREATE TABLE IF NOT EXISTS server_settings (   -- admin-level server-global settings (GET/PUT /api/admin/settings)
-  key   TEXT PRIMARY KEY,                     -- setting name, e.g. 'proxy_for_app'
-  value TEXT NOT NULL                         -- JSON-encoded value; an absent row means the setting's built-in default
-);
-CREATE TABLE IF NOT EXISTS trace_files (       -- DERIVED CACHE of the on-disk Trace tree (services/trace-index.ts): the directories stay the single source of truth, every row is rebuildable from disk, and a row is never authority for absence \u2014 consumers reconcile + retry on a miss, so a stale index costs one extra scan, never a false 404
-  project_id TEXT NOT NULL,
-  agent_id   TEXT NOT NULL,
-  session_id TEXT NOT NULL,
-  file_index INTEGER NOT NULL,               -- shard index NNN of <session_id>_NNN.jsonl (name/path are reconstructed from the row, never stored: the data root may move)
-  date       TEXT NOT NULL,                  -- date directory name (local yyyy-mm-dd)
-  size_bytes INTEGER NOT NULL,               -- last observed size (listings stat-refresh the returned page and write back; an actively-appended shard may lag in between)
-  page_stats TEXT,                           -- cached message-window scan state at this shard's END (services/message-window.ts ShardPrefixRecord JSON); immutable shards only, NULL = not yet computed, nulled whenever size_bytes changes
-  PRIMARY KEY (project_id, agent_id, session_id, file_index)
-);
-CREATE INDEX IF NOT EXISTS idx_trace_files_agent_date ON trace_files(project_id, agent_id, date);
-CREATE INDEX IF NOT EXISTS idx_trace_files_session ON trace_files(session_id);
-CREATE TABLE IF NOT EXISTS trace_sessions (    -- per-session facts read ONCE at registration from the earliest shard's head (same derived-cache rules as trace_files; listing needs zero head-reads)
-  session_id TEXT PRIMARY KEY,
-  project_id TEXT NOT NULL,
-  agent_id   TEXT NOT NULL,
-  source     TEXT,                           -- session_meta origin: 'subagent' | 'schedule' | NULL = user-created (or head not yet readable)
-  workspace  TEXT NOT NULL DEFAULT '',
-  title      TEXT,                           -- first-prompt fallback title (sessions.title always wins when present)
-  provider   TEXT,                           -- model reference from session_meta (CLI adoption reads it from here; NULL = meta unreadable / legacy without provider)
-  model_id   TEXT,
-  first_ts   TEXT,                           -- first record's timestamp (adoption's createdAt fallback when the id embeds no time)
-  meta_read  INTEGER NOT NULL DEFAULT 0      -- 1 once the head parsed; 0 = facts unknown, retried by the next reconcile that touches the session
-);
-CREATE INDEX IF NOT EXISTS idx_trace_sessions_agent ON trace_sessions(project_id, agent_id);
-`;
-
-// src/db/database.ts
-var sqlite = process.getBuiltinModule("node:sqlite");
-function openDatabase(dbPath) {
-  if (dbPath !== ":memory:") {
-    mkdirSync(path.dirname(dbPath), { recursive: true });
-  }
-  const db = new sqlite.DatabaseSync(dbPath);
-  db.exec("PRAGMA journal_mode = WAL;");
-  db.exec("PRAGMA foreign_keys = ON;");
-  db.exec(SCHEMA_SQL);
-  ensureColumn(db, "sessions", "client", "TEXT");
-  ensureColumn(db, "sessions", "has_trace", "INTEGER NOT NULL DEFAULT 0");
-  ensureColumn(db, "auth_sessions", "via", "TEXT");
-  ensureColumn(db, "trace_files", "page_stats", "TEXT");
-  return db;
-}
-function ensureColumn(db, table, column, ddl) {
-  const cols = db.prepare(`PRAGMA table_info(${table})`).all();
-  if (cols.some((c) => c.name === column)) return;
-  db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);
-}
-
 // src/db/repos/agents.ts
 var AgentsRepo = class {
   constructor(db) {
@@ -274,45 +128,6 @@ var AgentsRepo = class {
   }
 };
 
-// src/db/repos/auth-sessions.ts
-var AuthSessionsRepo = class {
-  constructor(db) {
-    this.db = db;
-  }
-  db;
-  insert(row) {
-    this.db.prepare(
-      "INSERT INTO auth_sessions (token_hash, user_id, created_at, expires_at, via) VALUES (?, ?, ?, ?, ?)"
-    ).run(row.tokenHash, row.userId, row.createdAt, row.expiresAt, row.via);
-  }
-  findByTokenHash(tokenHash) {
-    const r = this.db.prepare("SELECT * FROM auth_sessions WHERE token_hash = ?").get(tokenHash);
-    if (!r) return null;
-    return {
-      tokenHash: r.token_hash,
-      userId: r.user_id,
-      createdAt: r.created_at,
-      expiresAt: r.expires_at,
-      via: r.via ?? null
-    };
-  }
-  /** Sliding renewal: update the expiration time. */
-  touch(tokenHash, expiresAt) {
-    this.db.prepare("UPDATE auth_sessions SET expires_at = ? WHERE token_hash = ?").run(expiresAt, tokenHash);
-  }
-  delete(tokenHash) {
-    this.db.prepare("DELETE FROM auth_sessions WHERE token_hash = ?").run(tokenHash);
-  }
-  /** Opportunistically clean up expired sessions (called during login/validation). */
-  deleteExpired(nowIso) {
-    this.db.prepare("DELETE FROM auth_sessions WHERE expires_at < ?").run(nowIso);
-  }
-  /** Clear all sessions for a user (forces re-login after an admin resets the password). */
-  deleteByUser(userId) {
-    this.db.prepare("DELETE FROM auth_sessions WHERE user_id = ?").run(userId);
-  }
-};
-
 // src/db/repos/errors.ts
 var MAX_ROWS = 2e4;
 var PRUNE_EVERY = 200;
@@ -712,11 +527,41 @@ var SchedulesRepo = class {
   }
 };
 
+// src/services/attachment-limits.ts
+var MB = 1024 * 1024;
+var DEFAULT_ATTACHMENT_MAX_MB = 100;
+var DEFAULT_ATTACHMENT_TOTAL_MB = 120;
+var MIN_ATTACHMENT_MB = 1;
+var MAX_ATTACHMENT_MB = 200;
+var MAX_ATTACHMENT_COUNT = 20;
+var INLINE_IMAGE_MAX_MB = 20;
+function base64Length(bytes) {
+  return Math.ceil(bytes / 3) * 4;
+}
+var BODY_HEADROOM_BYTES = base64Length(INLINE_IMAGE_MAX_MB * MB) + 4 * MB;
+function toAttachmentLimits(mb) {
+  return {
+    maxBytes: mb.attachmentMaxMb * MB,
+    totalBytes: mb.attachmentTotalMb * MB,
+    maxCount: MAX_ATTACHMENT_COUNT
+  };
+}
+var INLINE_IMAGE_MAX_BYTES = INLINE_IMAGE_MAX_MB * MB;
+function bodyLimitBytes(mb) {
+  return base64Length(mb.attachmentTotalMb * MB) + BODY_HEADROOM_BYTES;
+}
+function clampAttachmentMb(value, fallback) {
+  if (!Number.isFinite(value) || !Number.isInteger(value)) return fallback;
+  return Math.min(MAX_ATTACHMENT_MB, Math.max(MIN_ATTACHMENT_MB, value));
+}
+
 // src/db/repos/server-settings.ts
 var PROXY_FOR_APP_KEY = "proxy_for_app";
 var PROXY_FOR_AGENT_KEY = "proxy_for_agent";
 var LEGACY_USE_SYSTEM_PROXY_KEY = "use_system_proxy";
 var PROXY_URL_KEY = "proxy_url";
+var ATTACHMENT_MAX_MB_KEY = "attachment_max_mb";
+var ATTACHMENT_TOTAL_MB_KEY = "attachment_total_mb";
 var ServerSettingsRepo = class {
   constructor(db) {
     this.db = db;
@@ -771,6 +616,48 @@ var ServerSettingsRepo = class {
   setProxyUrl(value) {
     this.set(PROXY_URL_KEY, JSON.stringify(value));
   }
+  /**
+   * Shared read for the two attachment limits: the stored whole-MB number, clamped back into the
+   * legal range, or the built-in default when the row is absent or unreadable. Values only ever
+   * enter through the validated PUT, so the clamp is for a database that predates a change to the
+   * bounds (or was hand-edited) — using the nearest legal number is a better answer there than
+   * refusing to serve uploads at all.
+   */
+  getAttachmentMb(key, fallback) {
+    const raw = this.get(key);
+    if (raw === null) return fallback;
+    try {
+      const value = JSON.parse(raw);
+      return typeof value === "number" ? clampAttachmentMb(value, fallback) : fallback;
+    } catch {
+      return fallback;
+    }
+  }
+  /** Per-file composer attachment cap, in whole MB. */
+  getAttachmentMaxMb() {
+    return this.getAttachmentMb(ATTACHMENT_MAX_MB_KEY, DEFAULT_ATTACHMENT_MAX_MB);
+  }
+  setAttachmentMaxMb(value) {
+    this.set(ATTACHMENT_MAX_MB_KEY, JSON.stringify(value));
+  }
+  /** Per-message total attachment cap (decoded bytes), in whole MB. */
+  getAttachmentTotalMb() {
+    return this.getAttachmentMb(ATTACHMENT_TOTAL_MB_KEY, DEFAULT_ATTACHMENT_TOTAL_MB);
+  }
+  setAttachmentTotalMb(value) {
+    this.set(ATTACHMENT_TOTAL_MB_KEY, JSON.stringify(value));
+  }
+  /**
+   * The pair as one value — what the validators, the body cap and `/api/me` all read. Kept here
+   * so no caller has to remember that the two numbers are only meaningful together (the total is
+   * never below the per-file cap; the PUT enforces that against the effective post-write pair).
+   */
+  getAttachmentLimitsMb() {
+    return {
+      attachmentMaxMb: this.getAttachmentMaxMb(),
+      attachmentTotalMb: this.getAttachmentTotalMb()
+    };
+  }
 };
 
 // src/db/repos/sessions.ts
@@ -783,10 +670,14 @@ function mapRow4(r) {
     modelId: r.model_id,
     workspace: r.workspace,
     approvalMode: r.approval_mode,
+    thinkingLevel: r.thinking_level ?? null,
     title: r.title ?? null,
     archivedAt: r.archived_at ?? null,
     client: r.client ?? null,
     hasTrace: r.has_trace === 1,
+    // The open-time backfill leaves no NULLs; the coalesce only hardens against a row
+    // somehow inserted as NULL (degrades to createdAt instead of surfacing undefined).
+    lastActiveAt: r.last_active_at ?? r.created_at,
     createdAt: r.created_at
   };
 }
@@ -796,28 +687,47 @@ var SessionsRepo = class {
   }
   db;
   insert(row) {
-    this.db.prepare(
-      `INSERT INTO sessions (session_id, project_id, agent_id, provider, model_id, workspace, approval_mode, title, client, has_trace, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-    ).run(
-      row.sessionId,
-      row.projectId,
-      row.agentId,
-      row.provider,
-      row.modelId,
-      row.workspace,
-      row.approvalMode,
-      row.title,
-      row.client ?? null,
-      row.hasTrace ? 1 : 0,
-      row.createdAt
-    );
+    this.runInsert("INSERT", row);
   }
   /** Idempotent insert: used when Trace directory discovery backfills a row (concurrent listing discovering the same Session no longer triggers a UNIQUE violation). */
   insertOrIgnore(row) {
+    this.runInsert("INSERT OR IGNORE", row);
+  }
+  /**
+   * Allocate the source Session's next persistent fork number and insert its fork atomically.
+   * Keeping both writes in one transaction prevents concurrent requests from sharing a number,
+   * while retaining `fork_count` on the source means deleting an older fork never reuses it.
+   */
+  insertFork(sourceSessionId, row) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const source = this.db.prepare(
+        `UPDATE sessions SET fork_count = fork_count + 1 WHERE session_id = ?
+           RETURNING title, fork_count`
+      ).get(sourceSessionId);
+      if (!source) throw new Error(`Source Session not found: ${sourceSessionId}`);
+      const forkTitle = source.title ? `${source.title} (${source.fork_count})` : `(${source.fork_count})`;
+      const forkRow = { ...row, title: forkTitle };
+      this.runInsert("INSERT", forkRow);
+      this.db.exec("COMMIT");
+      return forkRow;
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
+    }
+  }
+  /**
+   * The two inserts' shared column list and binding order (they differ only in conflict
+   * handling). `last_active_at` defaults **in SQL** (`COALESCE(?, ?)` over the row's own
+   * created_at, bound twice — SQLite forbids referencing a sibling column inside VALUES,
+   * and a column added by ALTER TABLE cannot be given a DEFAULT): the column is nullable
+   * for legacy reasons, so this is the one place that can guarantee it is never written
+   * NULL, whatever a caller passes.
+   */
+  runInsert(verb, row) {
     this.db.prepare(
-      `INSERT OR IGNORE INTO sessions (session_id, project_id, agent_id, provider, model_id, workspace, approval_mode, title, client, has_trace, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      `${verb} INTO sessions (session_id, project_id, agent_id, provider, model_id, workspace, approval_mode, title, client, has_trace, last_active_at, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, COALESCE(?, ?), ?)`
     ).run(
       row.sessionId,
       row.projectId,
@@ -829,13 +739,34 @@ var SessionsRepo = class {
       row.title,
       row.client ?? null,
       row.hasTrace ? 1 : 0,
+      row.lastActiveAt ?? null,
+      row.createdAt,
       row.createdAt
     );
   }
-  /** Flip the has_trace cache once a Trace record exists (task start / discovery hydration); idempotent. */
+  /** Flip the has_trace cache once a Trace record exists (discovery hydration); idempotent. */
   markHasTrace(sessionId) {
     this.db.prepare("UPDATE sessions SET has_trace = 1 WHERE session_id = ?").run(sessionId);
   }
+  /**
+   * A driven run touched this Session: flip the has_trace cache and stamp last_active_at in
+   * ONE statement (drive's run start — one WAL commit instead of two).
+   * `MAX(COALESCE(...))` keeps the stamp monotonic: a backwards clock step (NTP, resume
+   * from suspend) leaves the stored value alone rather than regressing the row.
+   */
+  markDriven(sessionId, at) {
+    this.db.prepare(
+      `UPDATE sessions SET has_trace = 1, last_active_at = MAX(COALESCE(last_active_at, ''), ?)
+         WHERE session_id = ?`
+    ).run(at, sessionId);
+  }
+  /** Stamp last_active_at alone (drive's run end); monotonic like markDriven. */
+  touchLastActive(sessionId, at) {
+    this.db.prepare(
+      `UPDATE sessions SET last_active_at = MAX(COALESCE(last_active_at, ''), ?)
+         WHERE session_id = ?`
+    ).run(at, sessionId);
+  }
   findById(sessionId) {
     const r = this.db.prepare("SELECT * FROM sessions WHERE session_id = ?").get(sessionId);
     return r ? mapRow4(r) : null;
@@ -860,6 +791,10 @@ var SessionsRepo = class {
   updateApprovalMode(sessionId, mode) {
     this.db.prepare("UPDATE sessions SET approval_mode = ? WHERE session_id = ?").run(mode, sessionId);
   }
+  /** Pin the session's thinking level (runs without one of their own then use it). */
+  updateThinkingLevel(sessionId, level) {
+    this.db.prepare("UPDATE sessions SET thinking_level = ? WHERE session_id = ?").run(level, sessionId);
+  }
   updateTitle(sessionId, title) {
     this.db.prepare("UPDATE sessions SET title = ? WHERE session_id = ?").run(title, sessionId);
   }
@@ -1199,92 +1134,8 @@ var UsageRepo = class {
   }
 };
 
-// src/db/repos/users.ts
-function mapRow5(r) {
-  return {
-    userId: r.user_id,
-    passwordHash: r.password_hash,
-    isAdmin: r.is_admin === 1,
-    passwordIsInitial: r.password_is_initial === 1,
-    createdAt: r.created_at
-  };
-}
-var UsersRepo = class {
-  constructor(db) {
-    this.db = db;
-  }
-  db;
-  insert(row) {
-    this.db.prepare(
-      "INSERT INTO users (user_id, password_hash, is_admin, password_is_initial, created_at) VALUES (?, ?, ?, ?, ?)"
-    ).run(
-      row.userId,
-      row.passwordHash,
-      row.isAdmin ? 1 : 0,
-      row.passwordIsInitial ? 1 : 0,
-      row.createdAt
-    );
-  }
-  findById(userId) {
-    const r = this.db.prepare("SELECT * FROM users WHERE user_id = ?").get(userId);
-    return r ? mapRow5(r) : null;
-  }
-  /** All users (for the admin user backend), ordered by creation time ascending. */
-  list() {
-    const rows = this.db.prepare("SELECT * FROM users ORDER BY created_at ASC, user_id ASC").all();
-    return rows.map(mapRow5);
-  }
-  count() {
-    const r = this.db.prepare("SELECT COUNT(*) AS n FROM users").get();
-    return r?.n ?? 0;
-  }
-  /** Update the password hash; isInitial marks whether the password was set by someone else (seed / admin). */
-  updatePassword(userId, passwordHash, isInitial) {
-    this.db.prepare("UPDATE users SET password_hash = ?, password_is_initial = ? WHERE user_id = ?").run(passwordHash, isInitial ? 1 : 0, userId);
-  }
-  /** Used by admin user deletion and account-creation compensation paths (owned Projects must be cleaned up first). */
-  delete(userId) {
-    this.db.prepare("DELETE FROM users WHERE user_id = ?").run(userId);
-  }
-};
-
 // src/auth/middleware.ts
 import { getCookie } from "hono/cookie";
-
-// src/http/errors.ts
-var HttpError = class extends Error {
-  constructor(status, code, message) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.name = "HttpError";
-  }
-  status;
-  code;
-};
-function errorBody(code, message) {
-  return { error: { code, message } };
-}
-function isMissingCredential(err) {
-  const message = err instanceof Error ? err.message : String(err);
-  return /missing credentials|api[_ ]?key/i.test(message);
-}
-function modelCredentialMissing(modelId) {
-  return new HttpError(
-    400,
-    "model_credential_missing",
-    `Model ${modelId} has no API key yet. Configure it on the Models page first.`
-  );
-}
-function handleError(err, c) {
-  if (err instanceof HttpError) {
-    return c.json(errorBody(err.code, err.message), err.status);
-  }
-  console.error(`[server] Unhandled exception: ${err.stack ?? err.message}`);
-  return c.json(errorBody("internal", "Internal server error."), 500);
-}
-
-// src/auth/middleware.ts
 var SESSION_COOKIE = "penguin_session";
 function authMiddleware(auth) {
   return async (c, next) => {
@@ -1299,253 +1150,25 @@ function authMiddleware(auth) {
   };
 }
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var ALLOWED_WRITE_CONTENT_TYPES = [
+  "application/json",
+  "application/gzip",
+  "application/octet-stream"
+];
 var jsonOnlyWrites = async (c, next) => {
   if (WRITE_METHODS.has(c.req.method)) {
-    const contentType = c.req.header("content-type");
-    if (contentType && !contentType.toLowerCase().startsWith("application/json")) {
+    const contentType = c.req.header("content-type")?.toLowerCase();
+    if (contentType && !ALLOWED_WRITE_CONTENT_TYPES.some((t) => contentType.startsWith(t))) {
       throw new HttpError(
         415,
         "unsupported_media_type",
-        "Write requests only accept application/json."
+        "Write requests only accept application/json (or, for the hot-update web push, a gzip artifact)."
       );
     }
   }
   await next();
 };
 
-// src/auth/service.ts
-import { createHash, randomBytes as randomBytes2, randomInt } from "crypto";
-
-// src/auth/password.ts
-import { randomBytes, scrypt, timingSafeEqual } from "crypto";
-var SCRYPT_N = 16384;
-var SCRYPT_R = 8;
-var SCRYPT_P = 1;
-var SALT_BYTES = 16;
-var KEY_BYTES = 64;
-function scryptAsync(password, salt, keyLen, n, r, p) {
-  return new Promise((resolve, reject) => {
-    scrypt(password, salt, keyLen, { N: n, r, p, maxmem: 128 * 1024 * 1024 }, (err, key) => {
-      if (err) reject(err);
-      else resolve(key);
-    });
-  });
-}
-async function hashPassword(password) {
-  const salt = randomBytes(SALT_BYTES);
-  const key = await scryptAsync(password, salt, KEY_BYTES, SCRYPT_N, SCRYPT_R, SCRYPT_P);
-  return [
-    "scrypt",
-    String(SCRYPT_N),
-    String(SCRYPT_R),
-    String(SCRYPT_P),
-    salt.toString("base64"),
-    key.toString("base64")
-  ].join("$");
-}
-async function verifyPassword(password, stored) {
-  const parts = stored.split("$");
-  if (parts.length !== 6 || parts[0] !== "scrypt") return false;
-  const n = Number(parts[1]);
-  const r = Number(parts[2]);
-  const p = Number(parts[3]);
-  if (!Number.isInteger(n) || !Number.isInteger(r) || !Number.isInteger(p)) return false;
-  let salt;
-  let expected;
-  try {
-    salt = Buffer.from(parts[4], "base64");
-    expected = Buffer.from(parts[5], "base64");
-  } catch {
-    return false;
-  }
-  if (salt.length === 0 || expected.length === 0) return false;
-  let actual;
-  try {
-    actual = await scryptAsync(password, salt, expected.length, n, r, p);
-  } catch {
-    return false;
-  }
-  return actual.length === expected.length && timingSafeEqual(actual, expected);
-}
-
-// src/auth/service.ts
-var MIN_PASSWORD_LENGTH = 8;
-var ADMIN_USER_ID = "admin";
-var LOGIN_FREE_ATTEMPTS = 5;
-var LOGIN_BACKOFF_START_MS = 1e3;
-var LOGIN_BACKOFF_CAP_MS = 6e4;
-var LOGIN_FAILURE_IDLE_MS = 15 * 6e4;
-function generateInitialAdminPassword() {
-  return "penguin-" + String(randomInt(0, 1e4)).padStart(4, "0");
-}
-function sha256Hex(value) {
-  return createHash("sha256").update(value).digest("hex");
-}
-function toUserInfo(row) {
-  return {
-    userId: row.userId,
-    isAdmin: row.isAdmin,
-    passwordIsInitial: row.passwordIsInitial,
-    createdAt: row.createdAt
-  };
-}
-var AuthService = class {
-  constructor(deps2) {
-    this.deps = deps2;
-    this.now = deps2.now ?? (() => /* @__PURE__ */ new Date());
-  }
-  deps;
-  now;
-  /**
-   * Startup seeding (idempotent): creates the built-in admin and adopts
-   * default_project when the users table is empty; if the initial Project fails,
-   * the user row is rolled back and the server retries on next startup.
-   * Returns the initial password when it actually seeded — the caller prints it,
-   * the only place a generated password is ever shown — and null when users
-   * already exist.
-   */
-  async seedAdmin() {
-    if (this.deps.users.count() > 0) return null;
-    const password = this.deps.seedAdminPassword ?? generateInitialAdminPassword();
-    if (password.length < MIN_PASSWORD_LENGTH) {
-      throw new Error(
-        `PENGUIN_SEED_ADMIN_PASSWORD must be at least ${MIN_PASSWORD_LENGTH} characters.`
-      );
-    }
-    const user = {
-      userId: ADMIN_USER_ID,
-      passwordHash: await hashPassword(password),
-      isAdmin: true,
-      passwordIsInitial: true,
-      createdAt: this.now().toISOString()
-    };
-    this.deps.users.insert(user);
-    try {
-      await this.deps.provisionInitialProject(user, true);
-    } catch (err) {
-      this.deps.users.delete(user.userId);
-      throw err;
-    }
-    return password;
-  }
-  /** Whether the built-in admin still runs on its initial password (drives the startup reminder notice). */
-  adminPasswordIsInitial() {
-    return this.deps.users.findById(ADMIN_USER_ID)?.passwordIsInitial === true;
-  }
-  /** Consecutive login failures per userId (see the throttling comment on the constants). */
-  loginFailures = /* @__PURE__ */ new Map();
-  /** The wait imposed after `failures` consecutive failures (0 while within the free attempts). */
-  loginDelayMs(failures) {
-    const excess = failures - LOGIN_FREE_ATTEMPTS;
-    if (excess <= 0) return 0;
-    return Math.min(LOGIN_BACKOFF_START_MS * 2 ** (excess - 1), LOGIN_BACKOFF_CAP_MS);
-  }
-  async login(userId, password) {
-    const nowMs = this.now().getTime();
-    for (const [key, entry] of this.loginFailures) {
-      if (nowMs - entry.lastFailureAt > LOGIN_FAILURE_IDLE_MS) this.loginFailures.delete(key);
-    }
-    const failed = this.loginFailures.get(userId);
-    if (failed) {
-      const readyAt = failed.lastFailureAt + this.loginDelayMs(failed.failures);
-      if (nowMs < readyAt) {
-        throw new HttpError(
-          429,
-          "too_many_attempts",
-          `Too many failed sign-in attempts. Try again in ${Math.ceil((readyAt - nowMs) / 1e3)}s.`
-        );
-      }
-    }
-    const row = this.deps.users.findById(userId);
-    const ok = row !== null && await verifyPassword(password, row.passwordHash);
-    if (!row || !ok) {
-      this.loginFailures.set(userId, {
-        failures: (failed?.failures ?? 0) + 1,
-        lastFailureAt: this.now().getTime()
-      });
-      throw new HttpError(401, "invalid_credentials", "Incorrect username or password.");
-    }
-    this.loginFailures.delete(userId);
-    this.deps.authSessions.deleteExpired(this.now().toISOString());
-    return { user: toUserInfo(row), token: this.issueSession(row.userId, "password") };
-  }
-  /**
-   * Desktop-mode sign-in: issues an admin session WITHOUT a password check — the caller
-   * (the desktop-login route) has already redeemed the shell's one-shot token, which is
-   * the credential here. Throws if the admin has not been seeded yet (desktop-login runs
-   * after startup seeding, so this only trips on a broken deployment).
-   */
-  loginDesktop() {
-    const row = this.deps.users.findById(ADMIN_USER_ID);
-    if (!row) {
-      throw new HttpError(500, "internal", "Built-in admin has not been seeded.");
-    }
-    this.deps.authSessions.deleteExpired(this.now().toISOString());
-    return { user: toUserInfo(row), token: this.issueSession(row.userId, "desktop") };
-  }
-  /** Self password change (user settings): validates the old password, and on success clears the initial-password flag; the current session remains valid. */
-  async changePassword(userId, oldPassword, newPassword) {
-    const row = this.deps.users.findById(userId);
-    if (!row || !await verifyPassword(oldPassword, row.passwordHash)) {
-      throw new HttpError(400, "password_mismatch", "Current password is incorrect.");
-    }
-    if (newPassword.length < MIN_PASSWORD_LENGTH) {
-      throw new HttpError(400, "invalid_password", "Password must be at least 8 characters.");
-    }
-    this.deps.users.updatePassword(userId, await hashPassword(newPassword), false);
-    this.deps.onPasswordChanged?.(userId);
-  }
-  /**
-   * Desktop-session password set: no old-password check. Only reachable for sessions
-   * established via desktop-login (the me route gates on sessionVia) — the seed password
-   * of a desktop-created root is random and never shown, so its holder has nothing to
-   * type into an old-password field; the shell's token already proved machine ownership.
-   */
-  async setPasswordDesktop(userId, newPassword) {
-    if (newPassword.length < MIN_PASSWORD_LENGTH) {
-      throw new HttpError(400, "invalid_password", "Password must be at least 8 characters.");
-    }
-    this.deps.users.updatePassword(userId, await hashPassword(newPassword), false);
-    this.deps.onPasswordChanged?.(userId);
-  }
-  logout(token) {
-    this.deps.authSessions.delete(sha256Hex(token));
-  }
-  /** Validates the cookie token: returns null if expired/unknown; sliding renewal once less than 6 days remain. */
-  authenticateWithMeta(token) {
-    const tokenHash = sha256Hex(token);
-    const session = this.deps.authSessions.findByTokenHash(tokenHash);
-    if (!session) return null;
-    const now = this.now();
-    const expiresAt = Date.parse(session.expiresAt);
-    if (!(expiresAt > now.getTime())) {
-      this.deps.authSessions.delete(tokenHash);
-      return null;
-    }
-    if (expiresAt - now.getTime() < this.deps.sessionRenewMs) {
-      this.deps.authSessions.touch(
-        tokenHash,
-        new Date(now.getTime() + this.deps.sessionTtlMs).toISOString()
-      );
-    }
-    const user = this.deps.users.findById(session.userId);
-    if (!user) return null;
-    return { user, via: session.via === "desktop" ? "desktop" : "password" };
-  }
-  issueSession(userId, via) {
-    const token = randomBytes2(32).toString("base64url");
-    const now = this.now();
-    this.deps.authSessions.insert({
-      tokenHash: sha256Hex(token),
-      userId,
-      createdAt: now.toISOString(),
-      expiresAt: new Date(now.getTime() + this.deps.sessionTtlMs).toISOString(),
-      via
-    });
-    return token;
-  }
-};
-
 // src/http/routes/admin.ts
 import { Hono as Hono2 } from "hono";
 
@@ -1749,7 +1372,17 @@ function parseProxyUrl(value) {
   throw new HttpError(
     400,
     "invalid_proxy_url",
-    "proxyUrl must be http://host[:port], https://host[:port], or host[:port] (empty or null clears it)."
+    "proxyUrl must be a proxy URL undici supports \u2014 http(s)://host[:port] or socks5://host[:port] \u2014 or bare host[:port] (empty or null clears it)."
+  );
+}
+function parseAttachmentMb(value, field) {
+  if (typeof value === "number" && Number.isInteger(value)) {
+    if (value >= MIN_ATTACHMENT_MB && value <= MAX_ATTACHMENT_MB) return value;
+  }
+  throw new HttpError(
+    400,
+    "invalid_attachment_limit",
+    `${field} must be a whole number of MB between ${MIN_ATTACHMENT_MB} and ${MAX_ATTACHMENT_MB}.`
   );
 }
 function adminSettingsRoutes(deps2) {
@@ -1764,7 +1397,8 @@ function adminSettingsRoutes(deps2) {
     settings: {
       proxyForApp: deps2.serverSettingsRepo.getProxyForApp(),
       proxyForAgent: deps2.serverSettingsRepo.getProxyForAgent(),
-      proxyUrl: deps2.serverSettingsRepo.getProxyUrl()
+      proxyUrl: deps2.serverSettingsRepo.getProxyUrl(),
+      ...deps2.serverSettingsRepo.getAttachmentLimitsMb()
     }
   });
   app2.get("/", (c) => c.json(settings()));
@@ -1774,9 +1408,25 @@ function adminSettingsRoutes(deps2) {
     const proxyForAgent = optionalBoolean(body, "proxyForAgent");
     const proxyUrlProvided = body.proxyUrl !== void 0;
     const proxyUrl = proxyUrlProvided ? parseProxyUrl(body.proxyUrl) : null;
+    const attachmentMaxMb = body.attachmentMaxMb === void 0 ? void 0 : parseAttachmentMb(body.attachmentMaxMb, "attachmentMaxMb");
+    const attachmentTotalMb = body.attachmentTotalMb === void 0 ? void 0 : parseAttachmentMb(body.attachmentTotalMb, "attachmentTotalMb");
+    const stored = deps2.serverSettingsRepo.getAttachmentLimitsMb();
+    const effectiveMax = attachmentMaxMb ?? stored.attachmentMaxMb;
+    const effectiveTotal = attachmentTotalMb ?? stored.attachmentTotalMb;
+    if (effectiveTotal < effectiveMax) {
+      throw new HttpError(
+        400,
+        "invalid_attachment_limit",
+        `attachmentTotalMb (${effectiveTotal}) must not be below attachmentMaxMb (${effectiveMax}).`
+      );
+    }
     if (proxyForApp !== void 0) deps2.serverSettingsRepo.setProxyForApp(proxyForApp);
     if (proxyForAgent !== void 0) deps2.serverSettingsRepo.setProxyForAgent(proxyForAgent);
     if (proxyUrlProvided) deps2.serverSettingsRepo.setProxyUrl(proxyUrl);
+    if (attachmentMaxMb !== void 0) deps2.serverSettingsRepo.setAttachmentMaxMb(attachmentMaxMb);
+    if (attachmentTotalMb !== void 0) {
+      deps2.serverSettingsRepo.setAttachmentTotalMb(attachmentTotalMb);
+    }
     applyProxySettings({
       proxyForApp: deps2.serverSettingsRepo.getProxyForApp(),
       proxyUrl: deps2.serverSettingsRepo.getProxyUrl()
@@ -1833,12 +1483,12 @@ function authRoutes(deps2) {
 import { Hono as Hono5 } from "hono";
 
 // src/services/preview-token.ts
-import { createHmac, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 var PREVIEW_TOKEN_TTL_MS = 10 * 60 * 1e3;
 function b64url(buf) {
   return buf.toString("base64url");
 }
-function createPreviewTokenSigner(secret = randomBytes3(32)) {
+function createPreviewTokenSigner(secret = randomBytes(32)) {
   const mac = (body) => createHmac("sha256", secret).update(body).digest();
   return {
     sign(payload) {
@@ -1851,7 +1501,7 @@ function createPreviewTokenSigner(secret = randomBytes3(32)) {
       const body = token.slice(0, dot);
       const provided = Buffer.from(token.slice(dot + 1), "base64url");
       const expected = mac(body);
-      if (provided.length !== expected.length || !timingSafeEqual2(provided, expected)) return null;
+      if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) return null;
       let payload;
       try {
         payload = JSON.parse(
@@ -1937,7 +1587,14 @@ function meRoutes(deps2) {
       user: toUserInfo(c.var.user),
       previewIsolated: target !== null,
       desktopMode: deps2.desktop !== null,
-      sessionVia: c.var.sessionVia
+      sessionVia: c.var.sessionVia,
+      uploadLimits: {
+        ...deps2.serverSettingsRepo.getAttachmentLimitsMb(),
+        attachmentMaxCount: MAX_ATTACHMENT_COUNT,
+        imageMaxMb: INLINE_IMAGE_MAX_MB,
+        attachmentLimitMinMb: MIN_ATTACHMENT_MB,
+        attachmentLimitMaxMb: MAX_ATTACHMENT_MB
+      }
     });
   });
   app2.put("/password", async (c) => {
@@ -2123,6 +1780,154 @@ function membersRoutes(deps2) {
 
 // src/http/routes/models.ts
 import { Hono as Hono9 } from "hono";
+
+// src/services/protocol-detect.ts
+import { resolveModelEnv } from "@prismshadow/penguin-core";
+var PROBE_TIMEOUT_MS = 5e3;
+function bearerHeaders(apiKey) {
+  return {
+    "content-type": "application/json",
+    ...apiKey ? { authorization: `Bearer ${apiKey}` } : {}
+  };
+}
+function anthropicHeaders(apiKey) {
+  return {
+    "content-type": "application/json",
+    "anthropic-version": "2023-06-01",
+    ...apiKey ? { authorization: `Bearer ${apiKey}`, "x-api-key": apiKey } : {}
+  };
+}
+var PROTOCOL_PROBES = [
+  { clientType: "openai-responses", path: "/responses", headers: bearerHeaders },
+  { clientType: "ant-messages", path: "/v1/messages", headers: anthropicHeaders },
+  { clientType: "openai-chat", path: "/chat/completions", headers: bearerHeaders }
+];
+function envApiKeyForProtocol(clientType, env = process.env) {
+  const envKey = resolveModelEnv("", clientType)?.envKey;
+  if (!envKey) return void 0;
+  return env[envKey]?.trim() || void 0;
+}
+function isHttpUrl(value) {
+  try {
+    const u = new URL(value);
+    return u.protocol === "http:" || u.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function probeUrl(baseUrl, path20) {
+  return baseUrl.trim().replace(/\/+$/, "") + path20;
+}
+function isApiErrorShape(body) {
+  const err = body.error;
+  if (err !== null && typeof err === "object") return true;
+  if (typeof err === "string" && err !== "") return true;
+  if (body.type === "error") return true;
+  if (body.object === "error") return true;
+  if (typeof body.message === "string" && body.message !== "") return true;
+  const detail = body.detail;
+  if (typeof detail === "string") return detail !== "";
+  if (detail !== null && (typeof detail === "object" || typeof detail === "number")) return true;
+  return false;
+}
+function isSuccessShape(clientType, body) {
+  switch (clientType) {
+    case "openai-responses":
+      return body.object === "response" || Array.isArray(body.output);
+    case "ant-messages":
+      return body.type === "message" || Array.isArray(body.content) && "role" in body;
+    case "openai-chat":
+      return body.object === "chat.completion" || Array.isArray(body.choices);
+  }
+}
+function classifyProbeResponse(clientType, status, bodyText) {
+  if (status === 404 || status === 405) return "route_missing";
+  let parsed;
+  try {
+    parsed = JSON.parse(bodyText);
+  } catch {
+    return "junk";
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return "junk";
+  const body = parsed;
+  if (status >= 200 && status < 300) return isSuccessShape(clientType, body) ? "served" : "junk";
+  if (status >= 500) return "server_error";
+  return isApiErrorShape(body) ? "served" : "junk";
+}
+function isTimeoutError(err) {
+  return err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+}
+var MAX_PROBE_BODY_BYTES = 64 * 1024;
+async function readCappedBody(res) {
+  const body = res.body;
+  if (!body) return { text: await res.text(), truncated: false };
+  const reader = body.getReader();
+  const chunks = [];
+  let size = 0;
+  let truncated = false;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      size += value.byteLength;
+      if (size > MAX_PROBE_BODY_BYTES) {
+        truncated = true;
+        break;
+      }
+      chunks.push(value);
+    }
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+  }
+  return { text: truncated ? "" : Buffer.concat(chunks).toString("utf8"), truncated };
+}
+async function runProbe(spec, baseUrl, apiKey, fetchImpl, timeoutMs) {
+  const url = probeUrl(baseUrl, spec.path);
+  try {
+    const res = await fetchImpl(url, {
+      method: "POST",
+      headers: spec.headers(apiKey),
+      body: "{}",
+      signal: AbortSignal.timeout(timeoutMs)
+      // Redirects stay followed (fetch's default). It is tempting to pin `redirect: "manual"`
+      // so a base URL cannot bounce the server somewhere it never named, but the SDKs the
+      // real clients wrap follow redirects too — pinning it would report "no protocol" for
+      // the ordinary case of a base URL that 301s http -> https, i.e. break the invariant
+      // that a detected protocol is one that actually works after saving. The probe reply is
+      // reduced to an outcome enum plus a status and is never echoed, so a followed redirect
+      // leaks no response content.
+    });
+    const { text, truncated } = await readCappedBody(res);
+    return {
+      clientType: spec.clientType,
+      url,
+      outcome: truncated ? "junk" : classifyProbeResponse(spec.clientType, res.status, text),
+      status: res.status
+    };
+  } catch (err) {
+    return {
+      clientType: spec.clientType,
+      url,
+      outcome: isTimeoutError(err) ? "timeout" : "network_error"
+    };
+  }
+}
+async function detectModelProtocol(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const timeoutMs = options.timeoutMs ?? PROBE_TIMEOUT_MS;
+  const probes = [];
+  for (const spec of PROTOCOL_PROBES) {
+    const apiKey = options.apiKey ?? envApiKeyForProtocol(spec.clientType, options.env);
+    const probe = await runProbe(spec, options.baseUrl, apiKey, fetchImpl, timeoutMs);
+    probes.push(probe);
+    if (probe.outcome === "served") return { detected: spec.clientType, probes };
+  }
+  return { probes };
+}
+
+// src/http/routes/models.ts
 function publishCredentialsUpdated(deps2, projectId) {
   const event = { type: "credentials_updated" };
   for (const row of deps2.sessionsRepo.listByProject(projectId)) {
@@ -2191,6 +1996,12 @@ function parseModelsUpdate(body) {
       }
       entry.maxTokens = m.maxTokens;
     }
+    if (m.fastMode !== void 0) {
+      if (typeof m.fastMode !== "boolean") {
+        throw badRequest(`models[${i}].fastMode must be a boolean.`);
+      }
+      entry.fastMode = m.fastMode;
+    }
     if (m.pricing !== void 0) {
       const p = m.pricing;
       if (p === null || typeof p !== "object" || Array.isArray(p)) {
@@ -2253,18 +2064,76 @@ function modelsRoutes(deps2) {
     publishCredentialsUpdated(deps2, projectId);
     return c.json(res);
   });
-  app2.put("/default", async (c) => {
+  app2.put("/default", async (c) => {
+    const projectId = requireValidId(c, "projectId");
+    deps2.projectService.requireProjectOwner(c.var.user.userId, projectId);
+    const body = await readJson(c);
+    const ref = {
+      provider: requireString(body, "provider", { minLen: 1, maxLen: 64 }),
+      modelId: requireString(body, "modelId", { minLen: 1, maxLen: 200 })
+    };
+    const defaultModel = await deps2.projectConfigService.setDefaultModelRef(projectId, ref);
+    return c.json({ defaultModel });
+  });
+  app2.post("/test", async (c) => {
+    const projectId = requireValidId(c, "projectId");
+    deps2.projectService.requireProjectOwner(c.var.user.userId, projectId);
+    const body = await readJson(c);
+    const req = {
+      provider: requireString(body, "provider", { minLen: 1, maxLen: 64 }),
+      modelId: requireString(body, "modelId", { minLen: 1, maxLen: 200 })
+    };
+    if (body.apiKey !== void 0) {
+      if (typeof body.apiKey !== "string") throw badRequest("apiKey must be a string.");
+      if (body.apiKey) req.apiKey = body.apiKey;
+    }
+    if (body.clearApiKey !== void 0) {
+      if (typeof body.clearApiKey !== "boolean") throw badRequest("clearApiKey must be a boolean.");
+      req.clearApiKey = body.clearApiKey;
+    }
+    if (body.speed !== void 0) {
+      if (typeof body.speed !== "boolean") throw badRequest("speed must be a boolean.");
+      req.speed = body.speed;
+    }
+    if (body.baseUrl !== void 0) {
+      if (body.baseUrl !== null && typeof body.baseUrl !== "string") {
+        throw badRequest("baseUrl must be a string or null.");
+      }
+      req.baseUrl = body.baseUrl ? body.baseUrl : null;
+    }
+    if (body.clientType !== void 0) {
+      if (typeof body.clientType !== "string") throw badRequest("clientType must be a string.");
+      if (body.clientType) req.clientType = body.clientType;
+    }
+    if (body.fastMode !== void 0) {
+      if (typeof body.fastMode !== "boolean") throw badRequest("fastMode must be a boolean.");
+      req.fastMode = body.fastMode;
+    }
+    return c.json(await deps2.projectConfigService.testModel(projectId, req));
+  });
+  app2.post("/detect", async (c) => {
     const projectId = requireValidId(c, "projectId");
     deps2.projectService.requireProjectOwner(c.var.user.userId, projectId);
     const body = await readJson(c);
-    const ref = {
-      provider: requireString(body, "provider", { minLen: 1, maxLen: 64 }),
-      modelId: requireString(body, "modelId", { minLen: 1, maxLen: 200 })
+    const req = {
+      baseUrl: requireString(body, "baseUrl", { minLen: 1, maxLen: 2e3 })
     };
-    const defaultModel = await deps2.projectConfigService.setDefaultModelRef(projectId, ref);
-    return c.json({ defaultModel });
+    if (!isHttpUrl(req.baseUrl)) throw badRequest("baseUrl must be an absolute http(s) URL.");
+    if (body.apiKey !== void 0) {
+      if (typeof body.apiKey !== "string") throw badRequest("apiKey must be a string.");
+      if (body.apiKey) req.apiKey = body.apiKey;
+    }
+    if (body.clearApiKey !== void 0) {
+      if (typeof body.clearApiKey !== "boolean") throw badRequest("clearApiKey must be a boolean.");
+      req.clearApiKey = body.clearApiKey;
+    }
+    if (body.provider !== void 0 || body.modelId !== void 0) {
+      req.provider = requireString(body, "provider", { minLen: 1, maxLen: 64 });
+      req.modelId = requireString(body, "modelId", { minLen: 1, maxLen: 200 });
+    }
+    return c.json(await deps2.projectConfigService.detectProtocol(projectId, req));
   });
-  app2.post("/test", async (c) => {
+  app2.post("/detect-vision", async (c) => {
     const projectId = requireValidId(c, "projectId");
     deps2.projectService.requireProjectOwner(c.var.user.userId, projectId);
     const body = await readJson(c);
@@ -2280,21 +2149,17 @@ function modelsRoutes(deps2) {
       if (typeof body.clearApiKey !== "boolean") throw badRequest("clearApiKey must be a boolean.");
       req.clearApiKey = body.clearApiKey;
     }
-    if (body.speed !== void 0) {
-      if (typeof body.speed !== "boolean") throw badRequest("speed must be a boolean.");
-      req.speed = body.speed;
-    }
     if (body.baseUrl !== void 0) {
       if (body.baseUrl !== null && typeof body.baseUrl !== "string") {
         throw badRequest("baseUrl must be a string or null.");
       }
-      req.baseUrl = body.baseUrl ? body.baseUrl : null;
+      req.baseUrl = body.baseUrl;
     }
     if (body.clientType !== void 0) {
       if (typeof body.clientType !== "string") throw badRequest("clientType must be a string.");
       if (body.clientType) req.clientType = body.clientType;
     }
-    return c.json(await deps2.projectConfigService.testModel(projectId, req));
+    return c.json(await deps2.projectConfigService.detectVision(projectId, req));
   });
   return app2;
 }
@@ -2305,7 +2170,7 @@ import { DEFAULT_CHAT_THINKING_LEVELS, isValidId as isValidId2 } from "@prismsha
 
 // src/http/routes/sessions.ts
 import fs4 from "fs/promises";
-import path4 from "path";
+import path3 from "path";
 import { Hono as Hono10 } from "hono";
 import { imageUrlMessage, scratchpadDir, userText } from "@prismshadow/penguin-core";
 
@@ -2551,7 +2416,7 @@ async function assertWorkspaceAllowed(args) {
 // src/services/workspace-files-service.ts
 import fs2 from "fs/promises";
 import { constants as fsc } from "fs";
-import path2 from "path";
+import path from "path";
 var MAX_READ_BYTES = 50 * 1024 * 1024;
 var MAX_UPLOAD_BYTES = 14 * 1024 * 1024;
 var CONTENT_TYPES = {
@@ -2583,7 +2448,7 @@ var WorkspaceFilesService = class {
   /** Canonical path (realpath) of the Workspace root; 404 if it doesn't exist. */
   async realBase(workspace) {
     try {
-      return await fs2.realpath(path2.resolve(workspace));
+      return await fs2.realpath(path.resolve(workspace));
     } catch {
       throw new HttpError(404, "workspace_missing", "This Session's Workspace no longer exists.");
     }
@@ -2596,13 +2461,13 @@ var WorkspaceFilesService = class {
    * compared, so a legitimate name like "..foo" isn't mistakenly rejected.
    */
   isInside(target, base) {
-    const rel = path2.relative(base, target);
-    return rel !== ".." && !rel.startsWith(`..${path2.sep}`) && !path2.isAbsolute(rel);
+    const rel = path.relative(base, target);
+    return rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel);
   }
   /** Lexical prefix check (a relative path, once resolved, must still be inside the Workspace); returns the absolute target path. */
   lexicalTarget(base, rel) {
     if (rel.includes("\0")) throw badRequest("path is invalid.");
-    const target = path2.resolve(base, rel === "" ? "." : rel);
+    const target = path.resolve(base, rel === "" ? "." : rel);
     if (!this.isInside(target, base)) {
       throw badRequest("path must be inside the Workspace.");
     }
@@ -2622,7 +2487,7 @@ var WorkspaceFilesService = class {
    */
   async resolveRead(workspace, rel) {
     const realBase = await this.realBase(workspace);
-    const target = this.lexicalTarget(path2.resolve(workspace), rel);
+    const target = this.lexicalTarget(path.resolve(workspace), rel);
     let canonical;
     try {
       canonical = await fs2.realpath(target);
@@ -2651,10 +2516,10 @@ var WorkspaceFilesService = class {
    */
   async resolveWriteParent(workspace, rel) {
     const realBase = await this.realBase(workspace);
-    const target = this.lexicalTarget(path2.resolve(workspace), rel);
-    const name = path2.basename(target);
+    const target = this.lexicalTarget(path.resolve(workspace), rel);
+    const name = path.basename(target);
     if (name === "" || name === "." || name === "..") throw badRequest("path must be a file path.");
-    const parent = path2.dirname(target);
+    const parent = path.dirname(target);
     let canonicalParent;
     try {
       canonicalParent = await fs2.realpath(parent);
@@ -2667,7 +2532,7 @@ var WorkspaceFilesService = class {
           break;
         } catch (probeErr) {
           if (probeErr.code !== "ENOENT") throw probeErr;
-          const up = path2.dirname(probe);
+          const up = path.dirname(probe);
           if (up === probe) throw badRequest("path is invalid.");
           probe = up;
         }
@@ -2723,7 +2588,7 @@ var WorkspaceFilesService = class {
     const listed = await Promise.all(
       dirents.map(async (d) => {
         try {
-          const canonical = await fs2.realpath(path2.join(dir, d.name));
+          const canonical = await fs2.realpath(path.join(dir, d.name));
           this.assertInside(canonical, realBase);
           const stat = await fs2.stat(canonical);
           return {
@@ -2775,10 +2640,10 @@ var WorkspaceFilesService = class {
     } else {
       data = await fs2.readFile(file);
     }
-    const ext = path2.extname(file).toLowerCase();
+    const ext = path.extname(file).toLowerCase();
     return {
       data,
-      fileName: path2.basename(file),
+      fileName: path.basename(file),
       contentType: CONTENT_TYPES[ext] ?? "application/octet-stream",
       scriptable: ext === ".html" || ext === ".htm" || ext === ".svg",
       ...truncated ? { truncated: true } : {}
@@ -2798,7 +2663,7 @@ var WorkspaceFilesService = class {
       throw new HttpError(413, "file_too_large", "Uploaded file exceeds the 14MB limit.");
     }
     const { dir, name } = await this.resolveWriteParent(workspace, rel);
-    const file = path2.join(dir, name);
+    const file = path.join(dir, name);
     if (process.platform === "win32") {
       const st = await fs2.lstat(file).catch(() => null);
       if (st?.isSymbolicLink()) throw badRequest("path must not be a symlink.");
@@ -2825,16 +2690,13 @@ var WorkspaceFilesService = class {
 
 // src/services/task-attachments.ts
 import fs3 from "fs/promises";
-import path3 from "path";
-import { randomBytes as randomBytes4 } from "crypto";
+import path2 from "path";
+import { randomBytes as randomBytes2 } from "crypto";
 import {
   appendAttachmentLines,
   attachedFileLine,
   modelVisiblePath
 } from "@prismshadow/penguin-core";
-var MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;
-var MAX_ATTACHMENT_COUNT = 20;
-var MAX_TOTAL_ATTACHMENT_BYTES = 12 * 1024 * 1024;
 var MAX_STEM_BYTES = 80;
 var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
 var INVISIBLE_CHAR = new RegExp("\\p{C}", "u");
@@ -2855,7 +2717,7 @@ function truncateBytes(value, maxBytes) {
   return out;
 }
 var MAX_NAME_ATTEMPTS = 16;
-function parseAttachmentPart(part, index, field = "input") {
+function parseAttachmentPart(part, index, limits, field = "input") {
   const fileName = part.fileName;
   if (typeof fileName !== "string" || fileName.length === 0 || fileName.includes("/") || fileName.includes("\\") || fileName.includes("..") || fileName.includes("\0")) {
     throw badRequest(
@@ -2863,55 +2725,69 @@ function parseAttachmentPart(part, index, field = "input") {
     );
   }
   const dataUrl = part.dataUrl;
-  const match = typeof dataUrl === "string" ? /^data:[^,]*;base64,([A-Za-z0-9+/=\s]+)$/.exec(dataUrl) : null;
+  const match = typeof dataUrl === "string" ? /^data:([^,]*);base64,([A-Za-z0-9+/=\s]+)$/.exec(dataUrl) : null;
   if (!match) {
     throw badRequest(`${field}[${index}].dataUrl must be a base64 data: URL of the file's bytes.`);
   }
-  const bytes = Buffer.from(match[1], "base64");
+  const bytes = Buffer.from(match[2], "base64");
   if (bytes.length === 0) {
     throw badRequest(`${field}[${index}].dataUrl decodes to an empty file.`);
   }
-  if (bytes.length > MAX_ATTACHMENT_BYTES) {
+  if (bytes.length > limits.maxBytes) {
     throw new HttpError(
       413,
       "file_too_large",
-      `Attached file exceeds the ${MAX_ATTACHMENT_BYTES / (1024 * 1024)}MB limit.`
+      `Attached file exceeds the ${limits.maxBytes / (1024 * 1024)}MB limit.`
     );
   }
-  return { fileName, bytes };
+  return { fileName, bytes, mime: match[1] };
 }
-function assertAttachmentBudget(attachments) {
-  if (attachments.length > MAX_ATTACHMENT_COUNT) {
+async function readRecalledFiles(files) {
+  const read = await Promise.all(
+    files.map(async (f) => {
+      try {
+        const bytes = await fs3.readFile(f.path);
+        const mime = f.mime || "application/octet-stream";
+        return { fileName: f.fileName, dataUrl: `data:${mime};base64,${bytes.toString("base64")}` };
+      } catch {
+        return null;
+      }
+    })
+  );
+  return read.filter((f) => f !== null);
+}
+function assertAttachmentBudget(attachments, limits) {
+  if (attachments.length > limits.maxCount) {
     throw new HttpError(
       413,
       "too_many_files",
-      `A message may carry at most ${MAX_ATTACHMENT_COUNT} attached files.`
+      `A message may carry at most ${limits.maxCount} attached files.`
     );
   }
   let total = 0;
   for (const a of attachments) total += a.bytes.length;
-  if (total > MAX_TOTAL_ATTACHMENT_BYTES) {
+  if (total > limits.totalBytes) {
     throw new HttpError(
       413,
       "payload_too_large",
-      `Attached files exceed the ${MAX_TOTAL_ATTACHMENT_BYTES / (1024 * 1024)}MB total limit for one message.`
+      `Attached files exceed the ${limits.totalBytes / (1024 * 1024)}MB total limit for one message.`
     );
   }
 }
 function scratchpadName(fileName) {
-  const ext = sanitizeSegment(path3.extname(fileName));
-  const rawStem = fileName.slice(0, fileName.length - path3.extname(fileName).length);
+  const ext = sanitizeSegment(path2.extname(fileName));
+  const rawStem = fileName.slice(0, fileName.length - path2.extname(fileName).length);
   const stem = truncateBytes(sanitizeSegment(rawStem), MAX_STEM_BYTES).replace(/[. ]+$/, "");
   if (!stem || /^-+$/.test(stem)) return `file${ext}`;
   return WINDOWS_RESERVED.test(stem) ? `_${stem}${ext}` : `${stem}${ext}`;
 }
 async function writeAttachment(dir, attachment) {
   const base = scratchpadName(attachment.fileName);
-  const ext = path3.extname(base);
+  const ext = path2.extname(base);
   const stem = base.slice(0, base.length - ext.length);
   for (let attempt = 0; attempt < MAX_NAME_ATTEMPTS; attempt++) {
-    const name = attempt === 0 ? base : `${stem}-${randomBytes4(3).toString("hex")}${ext}`;
-    const file = path3.join(dir, name);
+    const name = attempt === 0 ? base : `${stem}-${randomBytes2(3).toString("hex")}${ext}`;
+    const file = path2.join(dir, name);
     try {
       await fs3.writeFile(file, attachment.bytes, { flag: "wx" });
       return file;
@@ -2924,10 +2800,10 @@ async function writeAttachment(dir, attachment) {
   );
 }
 async function openScratchpadDir(root, sessionId) {
-  const dir = path3.join(root, sessionId);
+  const dir = path2.join(root, sessionId);
   await fs3.mkdir(dir, { recursive: true });
   const canonicalRoot = await fs3.realpath(root);
-  const rel = path3.relative(canonicalRoot, await fs3.realpath(dir));
+  const rel = path2.relative(canonicalRoot, await fs3.realpath(dir));
   if (rel !== sessionId) {
     throw new Error(
       `session scratchpad ${dir} resolves outside the agent scratchpad root; refusing to write attachments`
@@ -2970,7 +2846,14 @@ var APPROVAL_MODES = [
   "read-only",
   "always-ask"
 ];
-var THINKING_LEVELS = ["none", "low", "medium", "high", "xhigh"];
+var THINKING_LEVELS = [
+  "none",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max"
+];
 var MESSAGES_PAGE_LIMIT_MAX = 1e3;
 var MESSAGES_PAGE_LIMIT_DEFAULT = 200;
 function pageLimit(raw, name) {
@@ -2983,8 +2866,12 @@ function pageLimit(raw, name) {
 }
 function appendPendingInputs(messages, pending) {
   if (pending.length === 0) return messages;
-  const tail = new Set(messages.slice(-50).map((m) => JSON.stringify(m)));
-  const missing = pending.filter((m) => !tail.has(JSON.stringify(m)));
+  const envelopeKey = (message) => {
+    const { tracePosition: _tracePosition, ...envelope } = message;
+    return JSON.stringify(envelope);
+  };
+  const tail = new Set(messages.slice(-50).map(envelopeKey));
+  const missing = pending.filter((message) => !tail.has(envelopeKey(message)));
   return missing.length > 0 ? [...messages, ...missing] : messages;
 }
 function messagesPageQuery(c) {
@@ -3020,28 +2907,44 @@ var IMAGE_DATA_URL = /^data:[^;,]+;base64,[A-Za-z0-9+/=\s]+$/;
 function requireImageUrl(url, field) {
   if (typeof url === "string") {
     if (url.startsWith("http://") || url.startsWith("https://")) return url;
-    if (IMAGE_DATA_URL.test(url)) return url;
+    if (IMAGE_DATA_URL.test(url)) {
+      const bytes = dataUrlByteLength(url);
+      if (bytes > INLINE_IMAGE_MAX_BYTES) {
+        throw new HttpError(
+          413,
+          "image_too_large",
+          `${field} exceeds the ${INLINE_IMAGE_MAX_MB}MB inline image limit.`
+        );
+      }
+      return url;
+    }
   }
   throw badRequest(
     `${field} must be an http(s) URL or a base64 data: URL (data:<mime>;base64,<bytes>).`
   );
 }
+function dataUrlByteLength(dataUrl) {
+  const payload = dataUrl.slice(dataUrl.indexOf(",") + 1).replace(/[=\s]+/g, "");
+  return Math.floor(payload.length * 3 / 4);
+}
 function resolveScratchpadFile(dir, fileName) {
   if (!fileName || fileName === "." || fileName === "..") return null;
   for (const ch of fileName) {
     const code = ch.codePointAt(0);
     if (code < 32 || code === 127 || ch === "/" || ch === "\\") return null;
   }
-  const resolved = path4.resolve(dir, fileName);
-  return path4.dirname(resolved) === path4.resolve(dir) ? resolved : null;
+  const resolved = path3.resolve(dir, fileName);
+  return path3.dirname(resolved) === path3.resolve(dir) ? resolved : null;
 }
-function parseTaskInput(body) {
+function parseTaskInput(body, limits) {
   const input = body.input;
   if (!Array.isArray(input) || input.length === 0) {
     throw badRequest("input must be an array with at least one item.");
   }
   const messages = [];
   const attachments = [];
+  const texts = [];
+  const images = [];
   input.forEach((item, i) => {
     if (item === null || typeof item !== "object" || Array.isArray(item)) {
       throw badRequest(`input[${i}] must be an object.`);
@@ -3052,20 +2955,44 @@ function parseTaskInput(body) {
         throw badRequest(`input[${i}].text must be a non-empty string.`);
       }
       messages.push(userText(part.text));
+      texts.push(part.text);
       return;
     }
     if (part.type === "image_url") {
-      messages.push(imageUrlMessage(requireImageUrl(part.imageUrl, `input[${i}].imageUrl`)));
+      const url = requireImageUrl(part.imageUrl, `input[${i}].imageUrl`);
+      messages.push(imageUrlMessage(url));
+      images.push(url);
       return;
     }
     if (part.type === "file") {
-      attachments.push(parseAttachmentPart(part, i));
-      assertAttachmentBudget(attachments);
+      attachments.push(parseAttachmentPart(part, i, limits));
+      assertAttachmentBudget(attachments, limits);
       return;
     }
     throw badRequest(`input[${i}].type must be one of text / image_url / file.`);
   });
-  return { messages, attachments };
+  return { messages, attachments, texts, images };
+}
+function recallStore(text, images, attachments, written) {
+  return {
+    text,
+    images,
+    files: written.map((p, i) => ({
+      fileName: attachments[i].fileName,
+      path: p,
+      mime: attachments[i].mime
+    }))
+  };
+}
+async function recalledResponse(recall, thinkingLevel) {
+  const files = await readRecalledFiles(recall.files);
+  await removeAttachments(recall.files.map((f) => f.path));
+  return {
+    text: recall.text,
+    images: recall.images,
+    files,
+    ...thinkingLevel !== void 0 ? { thinkingLevel } : {}
+  };
 }
 function parseSteerImages(body) {
   const images = body.images;
@@ -3073,7 +3000,7 @@ function parseSteerImages(body) {
   if (!Array.isArray(images)) throw badRequest("images must be an array.");
   return images.map((url, i) => requireImageUrl(url, `images[${i}]`));
 }
-function parseSteerFiles(body) {
+function parseSteerFiles(body, limits) {
   const files = body.files;
   if (files === void 0) return [];
   if (!Array.isArray(files)) throw badRequest("files must be an array.");
@@ -3082,8 +3009,8 @@ function parseSteerFiles(body) {
     if (item === null || typeof item !== "object" || Array.isArray(item)) {
       throw badRequest(`files[${i}] must be an object.`);
     }
-    attachments.push(parseAttachmentPart(item, i, "files"));
-    assertAttachmentBudget(attachments);
+    attachments.push(parseAttachmentPart(item, i, limits, "files"));
+    assertAttachmentBudget(attachments, limits);
   });
   return attachments;
 }
@@ -3197,6 +3124,7 @@ function sessionsRoutes(deps2) {
     const row = resolveSession(c);
     const body = await readJson(c);
     const approvalMode = optionalEnum(body, "approvalMode", APPROVAL_MODES);
+    const thinkingLevel = optionalEnum(body, "thinkingLevel", THINKING_LEVELS);
     const archivedRaw = body.archived;
     const archived = typeof archivedRaw === "boolean" ? archivedRaw : void 0;
     const titleRaw = body.title;
@@ -3214,11 +3142,11 @@ function sessionsRoutes(deps2) {
         );
       }
     }
-    if (approvalMode === void 0 && archived === void 0 && title === void 0) {
+    if (approvalMode === void 0 && thinkingLevel === void 0 && archived === void 0 && title === void 0) {
       throw new HttpError(
         400,
         "no_update",
-        "No updatable field provided (approvalMode / archived / title)."
+        "No updatable field provided (approvalMode / thinkingLevel / archived / title)."
       );
     }
     let updated = { ...row };
@@ -3230,16 +3158,73 @@ function sessionsRoutes(deps2) {
       deps2.sessionsRepo.updateApprovalMode(row.sessionId, approvalMode);
       updated = { ...updated, approvalMode };
     }
+    if (thinkingLevel !== void 0) {
+      deps2.sessionsRepo.updateThinkingLevel(row.sessionId, thinkingLevel);
+      updated = { ...updated, thinkingLevel };
+    }
     if (archived !== void 0) {
       const at = archived ? (/* @__PURE__ */ new Date()).toISOString() : null;
       deps2.sessionsRepo.setArchived(row.sessionId, at);
       updated = { ...updated, archivedAt: at };
     }
     const hasTrace = await deps2.sessionService.hasTrace(updated);
+    const fresh = deps2.sessionsRepo.findById(row.sessionId) ?? updated;
     return c.json({
-      session: await deps2.sessionService.toInfo(updated, hasTrace)
+      session: await deps2.sessionService.toInfo(fresh, hasTrace)
     });
   });
+  app2.post("/:sessionId/fork", async (c) => {
+    const row = resolveSession(c);
+    const body = await readJson(c);
+    const raw = body.position;
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+      throw badRequest("position must be a Trace position object.");
+    }
+    const { fileIndex, ordinal } = raw;
+    if (!Number.isSafeInteger(fileIndex) || fileIndex < 1 || !Number.isSafeInteger(ordinal) || ordinal < 0) {
+      throw badRequest("position.fileIndex must be positive and position.ordinal non-negative.");
+    }
+    const fork = await deps2.manager.atIdleBoundary(
+      row.sessionId,
+      () => deps2.traceService.forkSessionTrace(row.projectId, row.agentId, row.sessionId, {
+        fileIndex,
+        ordinal
+      })
+    );
+    const forkRow = {
+      sessionId: fork.sessionId,
+      projectId: row.projectId,
+      agentId: row.agentId,
+      provider: row.provider,
+      modelId: row.modelId,
+      workspace: row.workspace,
+      approvalMode: row.approvalMode,
+      // insertFork replaces this with the source's current title plus its persistent number.
+      title: null,
+      client: "web",
+      hasTrace: true,
+      lastActiveAt: fork.createdAt,
+      createdAt: fork.createdAt
+    };
+    try {
+      const insertedForkRow = deps2.sessionsRepo.insertFork(row.sessionId, forkRow);
+      deps2.sessionSources.set(fork.sessionId, null);
+      return c.json(
+        {
+          session: await deps2.sessionService.toInfo(insertedForkRow, true)
+        },
+        201
+      );
+    } catch (err) {
+      deps2.sessionsRepo.deleteById(fork.sessionId);
+      await deps2.traceService.deleteSessionTraces(row.projectId, row.agentId, fork.sessionId);
+      await fs4.rm(
+        path3.join(scratchpadDir(deps2.config.root, row.projectId, row.agentId), fork.sessionId),
+        { recursive: true, force: true }
+      );
+      throw err;
+    }
+  });
   app2.delete("/:sessionId", async (c) => {
     const row = resolveSession(c);
     const runnings = deps2.manager.beginSessionDeletion(row.sessionId);
@@ -3252,7 +3237,7 @@ function sessionsRoutes(deps2) {
       }
       await deps2.traceService.deleteSessionTraces(row.projectId, row.agentId, row.sessionId);
       await fs4.rm(
-        path4.join(scratchpadDir(deps2.config.root, row.projectId, row.agentId), row.sessionId),
+        path3.join(scratchpadDir(deps2.config.root, row.projectId, row.agentId), row.sessionId),
         { recursive: true, force: true }
       );
       deps2.sessionsRepo.deleteById(row.sessionId);
@@ -3267,7 +3252,7 @@ function sessionsRoutes(deps2) {
     const row = resolveSession(c);
     const fileName = c.req.param("fileName") ?? "";
     const filePath = resolveScratchpadFile(
-      path4.join(scratchpadDir(deps2.config.root, row.projectId, row.agentId), row.sessionId),
+      path3.join(scratchpadDir(deps2.config.root, row.projectId, row.agentId), row.sessionId),
       fileName
     );
     if (!filePath) throw new HttpError(404, "file_not_found", "File does not exist.");
@@ -3284,7 +3269,7 @@ function sessionsRoutes(deps2) {
       ".gif": "image/gif",
       ".webp": "image/webp"
     };
-    const mime = MIME_BY_EXT[path4.extname(fileName).toLowerCase()];
+    const mime = MIME_BY_EXT[path3.extname(fileName).toLowerCase()];
     return c.body(new Uint8Array(bytes), 200, {
       "content-type": mime ?? "application/octet-stream",
       // nosniff: the composer's file attachments land in this same directory, so the bytes
@@ -3356,14 +3341,16 @@ function sessionsRoutes(deps2) {
     const row = resolveSession(c);
     const channel = deps2.channels.get(row.sessionId);
     const pendingSteering = deps2.manager.pendingSteeringOf(row.sessionId);
+    const pendingFollowUps = deps2.manager.pendingFollowUpsOf(row.sessionId);
     const initialEvents = [
       {
         type: "task_state",
         state: deps2.manager.statusOf(row.sessionId),
         queued: deps2.manager.pendingFollowUpCount(row.sessionId),
-        // Undelivered steering rides the snapshot too, so the composer's "steering queued"
-        // hint (and what it says) survives a reload.
-        ...pendingSteering.length > 0 ? { pendingSteering } : {}
+        // Undelivered steering and queued follow-ups ride the snapshot too, so the composer's
+        // queued hints (and what they say) survive a reload.
+        ...pendingSteering.length > 0 ? { pendingSteering } : {},
+        ...pendingFollowUps.length > 0 ? { pendingFollowUps } : {}
       },
       ...deps2.manager.pendingApprovals(row.sessionId).map((p) => ({
         type: "approval_request",
@@ -3378,8 +3365,9 @@ function sessionsRoutes(deps2) {
     const body = await readJson(c);
     const goal = parseGoalField(body);
     const thinkingLevel = optionalEnum(body, "thinkingLevel", THINKING_LEVELS);
+    const limits = toAttachmentLimits(deps2.serverSettingsRepo.getAttachmentLimitsMb());
     if (goal) {
-      const { messages, attachments } = parseTaskInput(body);
+      const { messages, attachments } = parseTaskInput(body, limits);
       const text = messages.filter((m) => m.payload.type === "text").map((m) => m.payload.text).join("\n").trim();
       if (!text) {
         throw badRequest("goal mode requires a non-empty text objective.");
@@ -3394,7 +3382,7 @@ function sessionsRoutes(deps2) {
       });
       return c.json({ sessionId }, 202);
     }
-    const parsed = parseTaskInput(body);
+    const parsed = parseTaskInput(body, limits);
     const queueIfBusy = body.queueIfBusy === true;
     deps2.manager.assertCanAcceptTask(row.sessionId, { queueIfBusy });
     const { input, written } = await attachFilesToInput(
@@ -3406,7 +3394,10 @@ function sessionsRoutes(deps2) {
     try {
       const { sessionId, queued } = await deps2.manager.startTask(row.sessionId, input, {
         ...thinkingLevel !== void 0 ? { thinkingLevel } : {},
-        queueIfBusy
+        queueIfBusy,
+        // Original content, kept while the input waits in the follow-up queue so a recall
+        // (DELETE /follow-ups/:id) can hand it back; unused when the task starts directly.
+        recall: recallStore(parsed.texts.join("\n"), parsed.images, parsed.attachments, written)
       });
       return c.json({ sessionId, queued }, 202);
     } catch (err) {
@@ -3419,7 +3410,10 @@ function sessionsRoutes(deps2) {
     const body = await readJson(c);
     const text = typeof body.text === "string" ? body.text.trim() : "";
     const images = parseSteerImages(body);
-    const files = parseSteerFiles(body);
+    const files = parseSteerFiles(
+      body,
+      toAttachmentLimits(deps2.serverSettingsRepo.getAttachmentLimitsMb())
+    );
     if (!text && images.length === 0 && files.length === 0) {
       throw badRequest("text, images or files must carry the steering message.");
     }
@@ -3430,17 +3424,28 @@ function sessionsRoutes(deps2) {
       row.sessionId
     );
     try {
-      deps2.manager.steer(row.sessionId, input, {
-        text,
-        images: images.length,
-        files: files.length
-      });
+      deps2.manager.steer(row.sessionId, input, recallStore(text, images, files, written));
     } catch (err) {
       await removeAttachments(written);
       throw err;
     }
     return c.body(null, 202);
   });
+  app2.delete("/:sessionId/steer/:steerId", async (c) => {
+    const row = resolveSession(c);
+    const recall = deps2.manager.recallSteering(row.sessionId, pathParam(c, "steerId"));
+    return c.json(await recalledResponse(recall));
+  });
+  app2.delete("/:sessionId/follow-ups/:followUpId", async (c) => {
+    const row = resolveSession(c);
+    const { recall, thinkingLevel } = deps2.manager.recallFollowUp(
+      row.sessionId,
+      pathParam(c, "followUpId")
+    );
+    return c.json(
+      await recalledResponse(recall, thinkingLevel)
+    );
+  });
   app2.get("/:sessionId/goal", (c) => {
     const row = resolveSession(c);
     const g = deps2.goalsRepo.latestForSession(row.sessionId);
@@ -3498,6 +3503,25 @@ function sessionsRoutes(deps2) {
     }
     return c.body(null, 204);
   });
+  app2.delete("/:sessionId/processes/:processId", (c) => {
+    const row = resolveSession(c);
+    const result = deps2.manager.removeProcess(row.sessionId, pathParam(c, "processId"));
+    if (result === "running") {
+      throw new HttpError(
+        409,
+        "process_running",
+        "Process is still running; stop it instead of removing it."
+      );
+    }
+    if (result === "not_found") {
+      throw new HttpError(
+        404,
+        "process_not_found",
+        "Process does not exist or has already been removed."
+      );
+    }
+    return c.body(null, 204);
+  });
   app2.post("/:sessionId/retry-now", (c) => {
     const row = resolveSession(c);
     const skipped = deps2.manager.retryNow(row.sessionId);
@@ -3745,7 +3769,7 @@ function memoryRoutes(deps2) {
 }
 
 // src/http/routes/schedules.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash } from "crypto";
 import { Hono as Hono14 } from "hono";
 import { isValidId as isValidId3 } from "@prismshadow/penguin-core";
 
@@ -3891,7 +3915,7 @@ function nextSlotAfter(def, nowMs) {
 
 // src/runtime/schedule-store.ts
 import fs6 from "fs/promises";
-import path5 from "path";
+import path4 from "path";
 import { stringify as stringifyToml } from "smol-toml";
 import { resolveModelRef, scheduleDir } from "@prismshadow/penguin-core";
 
@@ -3988,7 +4012,7 @@ var ScheduleFileCache = class {
   }
   /** Reuses the cached parse while the file's stat still matches; re-reads otherwise. */
   async revalidate(dir, name, cached) {
-    const file = path5.join(dir, `${name}.toml`);
+    const file = path4.join(dir, `${name}.toml`);
     let stat;
     try {
       stat = await fs6.stat(file);
@@ -4011,7 +4035,7 @@ var ScheduleFileCache = class {
   }
 };
 async function readScheduleFile(root, projectId, agentId, name) {
-  const file = path5.join(scheduleDir(root, projectId, agentId), `${name}.toml`);
+  const file = path4.join(scheduleDir(root, projectId, agentId), `${name}.toml`);
   try {
     const raw = await fs6.readFile(file, "utf8");
     return { name, raw, parsed: parseScheduleFile(name, raw) };
@@ -4050,10 +4074,10 @@ async function validateScheduleModelRef(configs, projectId, def) {
 async function writeScheduleFile(root, projectId, agentId, name, raw) {
   const dir = scheduleDir(root, projectId, agentId);
   await fs6.mkdir(dir, { recursive: true });
-  await fs6.writeFile(path5.join(dir, `${name}.toml`), raw, "utf8");
+  await fs6.writeFile(path4.join(dir, `${name}.toml`), raw, "utf8");
 }
 async function deleteScheduleFile(root, projectId, agentId, name) {
-  const file = path5.join(scheduleDir(root, projectId, agentId), `${name}.toml`);
+  const file = path4.join(scheduleDir(root, projectId, agentId), `${name}.toml`);
   try {
     await fs6.unlink(file);
     return true;
@@ -4212,7 +4236,7 @@ async function upsert(deps2, userId, projectId, agentId, name, body) {
     agentId,
     name,
     startAtMs: parsed.def.startAtMs,
-    defHash: createHash2("sha1").update(raw).digest("hex"),
+    defHash: createHash("sha1").update(raw).digest("hex"),
     creatorUserId: userId
   });
   await deps2.scheduler.reconcileAgent(projectId, agentId);
@@ -4305,7 +4329,7 @@ function benchmarksRoutes(deps2) {
 
 // src/http/routes/skills.ts
 import fs7 from "fs/promises";
-import path6 from "path";
+import path5 from "path";
 import { unzipSync, strFromU8, zipSync } from "fflate";
 import { Hono as Hono16 } from "hono";
 import {
@@ -4408,7 +4432,7 @@ async function collectSkillArchive(dir, name) {
   let total = 0;
   const walk = async (abs, rel) => {
     for (const entry of await fs7.readdir(abs, { withFileTypes: true })) {
-      const absChild = path6.join(abs, entry.name);
+      const absChild = path5.join(abs, entry.name);
       const relChild = `${rel}/${entry.name}`;
       if (entry.isDirectory()) {
         await walk(absChild, relChild);
@@ -4516,9 +4540,9 @@ function agentSkillsRoutes(deps2) {
       throw badRequest("The zip archive exceeds the 14MB limit.");
     }
     const skill = parseSkillArchive(archive);
-    const dir = path6.join(skillsDir(deps2.config.root, projectId, agentId), skill.name);
+    const dir = path5.join(skillsDir(deps2.config.root, projectId, agentId), skill.name);
     if (!overwrite) {
-      const installed2 = await fs7.access(path6.join(dir, "SKILL.md")).then(
+      const installed2 = await fs7.access(path5.join(dir, "SKILL.md")).then(
         () => true,
         () => false
       );
@@ -4528,8 +4552,8 @@ function agentSkillsRoutes(deps2) {
     }
     await fs7.rm(dir, { recursive: true, force: true });
     for (const [rel, data] of skill.files) {
-      const file = path6.join(dir, rel);
-      await fs7.mkdir(path6.dirname(file), { recursive: true });
+      const file = path5.join(dir, rel);
+      await fs7.mkdir(path5.dirname(file), { recursive: true });
       await fs7.writeFile(file, data);
     }
     return c.json(await listResponse(projectId, agentId), 201);
@@ -4539,9 +4563,9 @@ function agentSkillsRoutes(deps2) {
     const agentId = requireValidId(c, "agentId");
     deps2.projectService.requireProjectAccess(c.var.user.userId, projectId);
     const name = requireValidId(c, "name");
-    const dir = path6.join(skillsDir(deps2.config.root, projectId, agentId), name);
+    const dir = path5.join(skillsDir(deps2.config.root, projectId, agentId), name);
     try {
-      await fs7.access(path6.join(dir, "SKILL.md"));
+      await fs7.access(path5.join(dir, "SKILL.md"));
     } catch {
       throw new HttpError(404, "not_found", `Skill is not installed: ${name}`);
     }
@@ -4563,7 +4587,7 @@ function agentSkillsRoutes(deps2) {
     const agentId = requireValidId(c, "agentId");
     deps2.projectService.requireProjectAccess(c.var.user.userId, projectId);
     const name = requireValidId(c, "name");
-    const file = path6.join(skillsDir(deps2.config.root, projectId, agentId), name, "SKILL.md");
+    const file = path5.join(skillsDir(deps2.config.root, projectId, agentId), name, "SKILL.md");
     try {
       await fs7.access(file);
     } catch {
@@ -4699,7 +4723,7 @@ function agentsRoutes(deps2) {
 // src/http/routes/dirs.ts
 import fs9 from "fs/promises";
 import os from "os";
-import path7 from "path";
+import path6 from "path";
 import { Hono as Hono19 } from "hono";
 function dirsRoutes(deps2) {
   const app2 = new Hono19();
@@ -4708,7 +4732,7 @@ function dirsRoutes(deps2) {
     deps2.projectService.requireProjectAccess(c.var.user.userId, projectId);
     const raw = c.req.query("path");
     const target = raw && raw.trim() ? raw.trim() : os.homedir();
-    if (!path7.isAbsolute(target)) {
+    if (!path6.isAbsolute(target)) {
       throw new HttpError(400, "dir_not_absolute", "Directory must be an absolute path.");
     }
     let real;
@@ -4731,8 +4755,8 @@ function dirsRoutes(deps2) {
     } catch {
       dirents = [];
     }
-    const entries = dirents.filter((d) => d.isDirectory()).map((d) => ({ name: d.name, path: path7.join(real, d.name) })).sort((a, b) => a.name.localeCompare(b.name));
-    const parent = path7.dirname(real);
+    const entries = dirents.filter((d) => d.isDirectory()).map((d) => ({ name: d.name, path: path6.join(real, d.name) })).sort((a, b) => a.name.localeCompare(b.name));
+    const parent = path6.dirname(real);
     return c.json({
       path: real,
       parent: parent === real ? null : parent,
@@ -5206,6 +5230,17 @@ var ChannelHub = class {
   peek(key) {
     return this.channels.get(key);
   }
+  /**
+   * Publishes to every live channel whose key starts with `prefix` — global
+   * notices (e.g. `user:` for "the web assets were hot-swapped, reload").
+   * Only reaches channels that exist (i.e. someone connected at least once);
+   * that is the right scope for a notice that only matters to live clients.
+   */
+  broadcast(prefix, data, event) {
+    for (const [key, ch] of this.channels) {
+      if (key.startsWith(prefix)) ch.publish(data, event);
+    }
+  }
   /** Reclaim idle channels (skips active Sessions: no reclaim even without a publish while awaiting approval); `now` is injectable for tests. */
   sweep(now = Date.now()) {
     for (const [key, ch] of this.channels) {
@@ -5294,8 +5329,9 @@ var ErrorRecorder = class {
 };
 
 // src/runtime/session-manager.ts
+import { randomUUID as randomUUID2 } from "crypto";
 import fs10 from "fs/promises";
-import path9 from "path";
+import path8 from "path";
 import {
   createAgent,
   findLatestTraceFile,
@@ -5556,7 +5592,7 @@ var SessionSources = class {
 
 // src/runtime/stream-error-watcher.ts
 import { isEventMessage, isModelMessage, isSessionMeta } from "@prismshadow/penguin-core";
-import path8 from "path";
+import path7 from "path";
 var TOOL_NAMES_MAX = 1e3;
 var ORIGIN_CTX_MAX = 200;
 var LLM_FAILURES = {
@@ -5661,7 +5697,7 @@ var StreamErrorWatcher = class {
   registerOrigin(msg) {
     const key = originKey(msg);
     if (!key) return;
-    const agentId = path8.basename(path8.dirname(msg.payload.agent_state));
+    const agentId = path7.basename(path7.dirname(msg.payload.agent_state));
     if (!agentId || agentId === "." || agentId === "..") return;
     this.originCtx.delete(key);
     this.originCtx.set(key, { agentId, sessionId: key });
@@ -5796,12 +5832,22 @@ var StreamErrorWatcher = class {
 
 // src/runtime/session-manager.ts
 function compactUnavailable(why) {
-  const messages = {
-    unsupported: "This Agent does not have context compaction configured.",
-    empty: "The current context has nothing to compact (no completed conversation turns yet).",
-    just_compacted: "The context was just compacted and there is no new conversation since; no need to compact again."
+  const reasons = {
+    unsupported: {
+      code: "compaction_not_configured",
+      message: "This Agent does not have context compaction configured."
+    },
+    empty: {
+      code: "nothing_to_compact",
+      message: "The current context has nothing to compact (no completed conversation turns yet)."
+    },
+    just_compacted: {
+      code: "already_compacted",
+      message: "The context was just compacted and there is no new conversation since; no need to compact again."
+    }
   };
-  return new HttpError(409, "nothing_to_compact", messages[why]);
+  const { code, message } = reasons[why];
+  return new HttpError(409, code, message);
 }
 function createCoreSessionLoader(root, sources, opts = {}) {
   return {
@@ -5865,6 +5911,14 @@ var EARLY_TITLE_BODY_CHARS = 1e3;
 function agentKey(projectId, agentId) {
   return `${projectId}\0${agentId}`;
 }
+function followUpInfo(f) {
+  return {
+    id: f.id,
+    text: f.recall?.text ?? "",
+    images: f.recall?.images.length ?? 0,
+    files: f.recall?.files.length ?? 0
+  };
+}
 function isDeliveredSteering(msg) {
   const p = msg.payload;
   if (msg.type !== "model_msg" || p.type !== "text" || p.role !== "user") return false;
@@ -5909,6 +5963,7 @@ var SessionManager = class {
   constructor(deps2) {
     this.deps = deps2;
     this.log = deps2.log ?? ((line) => console.error(line));
+    this.now = deps2.now ?? (() => /* @__PURE__ */ new Date());
     this.sweepTimer = setInterval(() => this.sweepIdle(), ENTRY_SWEEP_INTERVAL_MS);
     this.sweepTimer.unref?.();
   }
@@ -5928,6 +5983,8 @@ var SessionManager = class {
   /** Open streaming fragments of running sessions (fed by drive, served to GET /messages; see live-tail.ts). */
   liveTail = new LiveTailTracker();
   sweepTimer;
+  /** Clock for persisted timestamps (see SessionManagerDeps.now); wall clock unless injected. */
+  now;
   // —— Query surface (used by Session listing / Agent active-count / SSE subscription replay) ——
   statusOf(sessionId) {
     return this.entries.get(sessionId)?.status ?? "idle";
@@ -5944,7 +6001,11 @@ var SessionManager = class {
   }
   /** Steering messages queued but not yet delivered to the model (display mirror; see RuntimeEntry.pendingSteering). */
   pendingSteeringOf(sessionId) {
-    return this.entries.get(sessionId)?.pendingSteering ?? [];
+    return (this.entries.get(sessionId)?.pendingSteering ?? []).map((p) => p.info);
+  }
+  /** Queued follow-up tasks awaiting auto-start, as their display/recall info (id + content summary). */
+  pendingFollowUpsOf(sessionId) {
+    return (this.entries.get(sessionId)?.followUps ?? []).map(followUpInfo);
   }
   /**
    * Live tail of a running session: one synthetic `partial_* start` OmniMessage per open
@@ -6044,6 +6105,22 @@ var SessionManager = class {
     const entry = this.entries.get(sessionId);
     if (entry && !opts?.queueIfBusy) this.assertIdle(entry);
   }
+  /**
+   * Run a metadata operation at an idle Session boundary under the same mutex as Task and
+   * compaction starts. Session fork uses this to snapshot an append-only Trace without a Task
+   * beginning between its status check and final read. An uncached Session is idle by definition;
+   * unlike startTask this path deliberately does not load a heavyweight runtime.
+   */
+  async atIdleBoundary(sessionId, operation) {
+    return this.withLock(sessionId, async () => {
+      this.assertOpen();
+      this.assertAgentNotDeleting(sessionId);
+      this.assertSessionNotDeleting(sessionId);
+      const entry = this.entries.get(sessionId);
+      if (entry) this.assertIdle(entry);
+      return operation();
+    });
+  }
   /**
    * Start a Task: get-or-load → 409
    * mutual-exclusion check → publish the input messages first → drive run in the
@@ -6063,8 +6140,11 @@ var SessionManager = class {
       const entry = await this.ensureEntry(sessionId);
       if (entry.status !== "idle" && opts?.queueIfBusy) {
         entry.followUps.push({
+          id: randomUUID2(),
           input,
-          ...opts.thinkingLevel !== void 0 ? { thinkingLevel: opts.thinkingLevel } : {}
+          ...opts.thinkingLevel !== void 0 ? { thinkingLevel: opts.thinkingLevel } : {},
+          // The original content rides the queue so a recall can hand it back (see recallFollowUp).
+          ...opts.recall !== void 0 ? { recall: opts.recall } : {}
         });
         entry.lastActivityMs = Date.now();
         this.publishState(entry, entry.status);
@@ -6123,10 +6203,11 @@ var SessionManager = class {
         objective,
         budget: args.budget
       });
+      const thinkingLevel = this.runThinkingLevel(entry.sessionId, args.thinkingLevel);
       const gen = this.goalStream(entry, {
         input: args.input,
         budget: args.budget,
-        ...args.thinkingLevel !== void 0 ? { thinkingLevel: args.thinkingLevel } : {},
+        ...thinkingLevel !== void 0 ? { thinkingLevel } : {},
         approve,
         signal: ac.signal,
         ...goalId !== void 0 ? { goalId } : {}
@@ -6207,7 +6288,18 @@ var SessionManager = class {
     });
   }
   /** Shared task launch (fresh tasks and auto-started follow-ups): flips to running, publishes the input, and drives the run with the per-turn thinking level (if any). Caller holds the session lock and has verified idle. */
-  launchTask(entry, input, thinkingLevel) {
+  /**
+   * Thinking level for one run: the level the request carried wins, else the level pinned
+   * on the Session row (PATCH /api/sessions/:id — the Web App's in-chat picker), else
+   * undefined so core keeps falling back to the Agent config. Resolved at LAUNCH time, so
+   * a queued follow-up that carried no level of its own picks up the pin as it stands when
+   * it finally starts, and a pin set mid-run applies from the next run.
+   */
+  runThinkingLevel(sessionId, requested) {
+    return requested ?? this.deps.sessions.findById(sessionId)?.thinkingLevel ?? void 0;
+  }
+  launchTask(entry, input, requestedThinkingLevel) {
+    const thinkingLevel = this.runThinkingLevel(entry.sessionId, requestedThinkingLevel);
     const channel = this.deps.channels.get(entry.sessionId);
     const ac = new AbortController();
     entry.status = "running";
@@ -6293,12 +6385,13 @@ var SessionManager = class {
    * or the run finished in the race window — the caller falls back to submitting a normal
    * task, which carries the same text and images.
    *
-   * `info` is the queued message's display summary: mirrored on the entry and broadcast via
-   * `task_state` (and the SSE subscribe snapshot) until the delivered `[user_steering]`
-   * message is observed on the stream — that is what keeps the composer's "steering queued"
-   * hint, content included, alive across reloads.
+   * `recall` is the queued message's original content: its summary (with a fresh id) is
+   * mirrored on the entry and broadcast via `task_state` (and the SSE subscribe snapshot)
+   * until the delivered `[user_steering]` message is observed on the stream — that is what
+   * keeps the composer's "steering queued" hint, content included, alive across reloads —
+   * and the content itself is what a recall (recallSteering) hands back to the composer.
    */
-  steer(sessionId, input, info) {
+  steer(sessionId, input, recall) {
     const entry = this.entries.get(sessionId);
     if (!entry || entry.status !== "running" || !entry.session.steer(input)) {
       throw new HttpError(
@@ -6307,9 +6400,68 @@ var SessionManager = class {
         "This Session has no Task in progress; send the message as a new task instead."
       );
     }
-    entry.pendingSteering.push(info);
+    entry.pendingSteering.push({
+      info: {
+        id: randomUUID2(),
+        text: recall.text,
+        images: recall.images.length,
+        files: recall.files.length
+      },
+      input,
+      recall
+    });
+    entry.lastActivityMs = Date.now();
+    this.publishState(entry, entry.status);
+  }
+  /**
+   * Recall an undelivered steering message (#287): withdraw it from core's queue and the
+   * display mirror, re-broadcast state, and hand back its original content for the composer
+   * to restore. 409 `not_pending` when the entry is no longer queued — already delivered to
+   * the model (core's `unsteer` says so authoritatively; the mirror can lag behind delivery
+   * until the `[user_steering]` message is observed on the stream), the run exited, or the
+   * id is unknown — all the same outcome for the caller: nothing left to take back.
+   */
+  recallSteering(sessionId, steerId) {
+    const entry = this.entries.get(sessionId);
+    const i = entry?.pendingSteering.findIndex((p) => p.info.id === steerId) ?? -1;
+    const pending = i >= 0 ? entry.pendingSteering[i] : void 0;
+    if (!entry || !pending || !(entry.session.unsteer?.(pending.input) ?? false)) {
+      throw new HttpError(
+        409,
+        "not_pending",
+        "This steering message was already delivered to the model and can no longer be recalled."
+      );
+    }
+    entry.pendingSteering.splice(i, 1);
+    entry.lastActivityMs = Date.now();
+    this.publishState(entry, entry.status);
+    return pending.recall;
+  }
+  /**
+   * Recall a queued follow-up task (#287): remove it from the queue before it auto-starts,
+   * re-broadcast state, and hand back its original content (plus the thinking level it was
+   * queued with). 409 `not_pending` when the id is not in the queue — it already
+   * auto-started (or the runtime was evicted/restarted, which empties the queue) — or the
+   * entry has no recall store to give back.
+   */
+  recallFollowUp(sessionId, followUpId) {
+    const entry = this.entries.get(sessionId);
+    const i = entry?.followUps.findIndex((f) => f.id === followUpId) ?? -1;
+    const queued = i >= 0 ? entry.followUps[i] : void 0;
+    if (!entry || !queued?.recall) {
+      throw new HttpError(
+        409,
+        "not_pending",
+        "This follow-up message already started and can no longer be recalled."
+      );
+    }
+    entry.followUps.splice(i, 1);
     entry.lastActivityMs = Date.now();
     this.publishState(entry, entry.status);
+    return {
+      recall: queued.recall,
+      ...queued.thinkingLevel !== void 0 ? { thinkingLevel: queued.thinkingLevel } : {}
+    };
   }
   /**
    * "Retry now" on the reconnect countdown: skip the in-progress backoff wait and fire
@@ -6354,6 +6506,32 @@ var SessionManager = class {
     if (killed) entry.lastActivityMs = Date.now();
     return killed;
   }
+  /**
+   * Removes one EXITED background command entry from a loaded session's process list.
+   * A running process is refused ("running") — stopping is killProcess's job, and a
+   * bare removal must never surprise-signal a live process group. "not_found" covers
+   * an unloaded session and an unknown id alike: the entry is gone either way. The
+   * removal itself reuses the kill path — core's registry removal signals the (dead)
+   * group defensively and drops the row, exactly like input_command's post-exit reap.
+   * The only race, an entry observed running that exits before a retry, is benign:
+   * the caller gets "running", refreshes, and sees the row exited on the next look.
+   *
+   * Note what leaves with the row: the registry entry owns the ManagedSession holding
+   * that process's captured output, so after a removal input_command on the same
+   * process_id answers "unknown process_id". Removal is a deliberate discard, not just
+   * a list tidy-up — the Web App says so at the button and in the docs.
+   */
+  removeProcess(sessionId, processId) {
+    const entry = this.entries.get(sessionId);
+    if (!entry) return "not_found";
+    const info = entry.session.listBackgroundCommands?.().find((p) => p.processId === processId);
+    if (!info) return "not_found";
+    if (info.running) return "running";
+    const removed = entry.session.killBackgroundCommand?.(processId) ?? false;
+    if (!removed) return "not_found";
+    entry.lastActivityMs = Date.now();
+    return "removed";
+  }
   /**
    * Disposes a just-removed entry's runtime — after its in-flight drive (if any)
    * settles, so interrupt cleanup never races a dying environment. Deleting a Session /
@@ -6571,7 +6749,6 @@ var SessionManager = class {
    * a title): it collects model text for automatic title generation.
    */
   async drive(entry, gen, titleSource) {
-    this.deps.sessions.markHasTrace(entry.sessionId);
     let earlyTitleFired = false;
     let mainBodyChars = 0;
     const ctx = {
@@ -6581,6 +6758,7 @@ var SessionManager = class {
       provider: entry.provider,
       modelId: entry.modelId
     };
+    this.touchRow(ctx, (repo, at) => repo.markDriven(ctx.sessionId, at));
     const watcher = this.deps.errors ? new StreamErrorWatcher(this.deps.errors, {
       projectId: entry.projectId,
       agentId: entry.agentId,
@@ -6675,6 +6853,7 @@ var SessionManager = class {
       entry.running = null;
       entry.pendingSteering = [];
       entry.lastActivityMs = Date.now();
+      this.touchRow(ctx, (repo, at) => repo.touchLastActive(ctx.sessionId, at));
       this.publishState(entry, "idle");
       if (titleSource && titleSource.userExcerpt.trim()) {
         this.deps.titles?.maybeGenerate(ctx, entry.session, {
@@ -6717,10 +6896,11 @@ var SessionManager = class {
     const childSid = msg.origin[msg.origin.length - 1];
     if (children.has(childSid)) return null;
     const p = msg.payload;
-    const agentId = path9.basename(path9.dirname(p.agent_state));
+    const agentId = path8.basename(path8.dirname(p.agent_state));
     if (!agentId || agentId === "." || agentId === "..") return null;
     const source = asSessionSource(p.source) ?? "subagent";
     this.deps.sources.set(childSid, source);
+    const createdAt = this.now().toISOString();
     this.deps.sessions.insertOrIgnore({
       sessionId: childSid,
       projectId: entry.projectId,
@@ -6734,7 +6914,10 @@ var SessionManager = class {
       title: null,
       // Spawned by this server's run (client NULL = web); its Trace exists by construction.
       hasTrace: true,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      // A subagent's own runs are driven through the PARENT entry's drive, so nothing ever
+      // stamps this row: it stays at its registration time (see SessionRow.lastActiveAt).
+      lastActiveAt: createdAt,
+      createdAt
     });
     this.publishEvent(entry, {
       type: "session_created",
@@ -6753,12 +6936,50 @@ var SessionManager = class {
     children.set(childSid, child);
     return child;
   }
+  /**
+   * Runs one `sessions` row write for a driven run's bookkeeping (has_trace /
+   * last_active_at), swallowing failures the same way the per-message `recorder.record`
+   * call does: bookkeeping must never take down a run's lifecycle. The two call sites both
+   * sit outside a covering try — the run-start write precedes drive's try block, the
+   * run-end one lives in its finally — and the realistic failure (the DatabaseSync handle
+   * closed by shutdown while a run outlived its drain window) throws ERR_INVALID_STATE.
+   */
+  touchRow(ctx, write) {
+    try {
+      write(this.deps.sessions, this.now().toISOString());
+    } catch (err) {
+      this.log(
+        `[session] last-active bookkeeping failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+      this.deps.errors?.record({ source: "session", err, ctx, code: "session_touch_failed" });
+    }
+  }
   publishState(entry, state) {
     this.publishEvent(entry, {
       type: "task_state",
       state,
       queued: entry.followUps.length,
-      ...entry.pendingSteering.length > 0 ? { pendingSteering: entry.pendingSteering } : {}
+      ...entry.pendingSteering.length > 0 ? { pendingSteering: entry.pendingSteering.map((p) => p.info) } : {},
+      ...entry.followUps.length > 0 ? { pendingFollowUps: entry.followUps.map(followUpInfo) } : {}
+    });
+    const notify = this.deps.notifyProjectUsers;
+    if (!notify) return;
+    let lastActiveAt;
+    let hasTrace;
+    try {
+      const row = this.deps.sessions.findById(entry.sessionId);
+      if (!row) return;
+      lastActiveAt = row.lastActiveAt;
+      hasTrace = row.hasTrace === true || state !== "idle";
+    } catch {
+      return;
+    }
+    notify(entry.projectId, {
+      type: "session_state",
+      sessionId: entry.sessionId,
+      state,
+      lastActiveAt,
+      hasTrace
     });
   }
   publishEvent(entry, event) {
@@ -6780,7 +7001,7 @@ var SessionManager = class {
 };
 
 // src/runtime/scheduler.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import fs11 from "fs/promises";
 import { agentsDir, buildScheduledMessage, userText as userText2 } from "@prismshadow/penguin-core";
 var TICK_INTERVAL_MS = 3e4;
@@ -6957,7 +7178,7 @@ var Scheduler = class {
   }
   /** Register (or sync) run state; set the no-backfill baseline only at first registration / start_at reset. */
   registerEntry(projectId, agentId, ownerUserId, def, raw) {
-    const defHash = createHash3("sha1").update(raw).digest("hex");
+    const defHash = createHash2("sha1").update(raw).digest("hex");
     const { row, fresh } = this.deps.repo.registerOrSync({
       projectId,
       agentId,
@@ -7240,7 +7461,7 @@ var UsageRecorder = class {
 };
 
 // src/services/ids.ts
-import { randomBytes as randomBytes5 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 var SEMANTIC_ID_PATTERN = /^[a-z][a-z0-9_]{1,63}$/;
 var USERNAME_PATTERN = /^[a-z][a-z0-9_]{1,31}$/;
 var PROJECT_SUFFIX_PATTERN = /^[a-z0-9_]+$/;
@@ -7317,9 +7538,9 @@ var AdminService = class {
 };
 
 // src/services/desktop-service.ts
-import { createHash as createHash4, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 function digest(value) {
-  return createHash4("sha256").update(value).digest();
+  return createHash3("sha256").update(value).digest();
 }
 var DesktopService = class {
   tokenDigest;
@@ -7330,7 +7551,7 @@ var DesktopService = class {
   }
   /** Constant-time token check (no consumption). */
   verifyToken(candidate) {
-    return timingSafeEqual3(digest(candidate), this.tokenDigest);
+    return timingSafeEqual2(digest(candidate), this.tokenDigest);
   }
   /** One-shot login redemption: true exactly once, for the correct token. */
   redeemLoginToken(candidate) {
@@ -7384,20 +7605,64 @@ import {
 
 // src/services/project-config-service.ts
 import fs12 from "fs/promises";
-import path10 from "path";
+import path9 from "path";
 import { parse as parseToml2 } from "smol-toml";
 import {
   CHAT_APPROVAL_MODES,
   DEFAULT_CHAT_THINKING_LEVELS as DEFAULT_CHAT_THINKING_LEVELS2,
   GenerativeModel,
+  canonicalClientType,
   catalogEntryFor,
   defaultProjectConfig,
+  imageUrlMessage as imageUrlMessage2,
   projectConfigFromTable,
   projectConfigPath,
   renderProjectConfigToml,
-  resolveModelEnv,
+  resolveModelEnv as resolveModelEnv2,
   userText as userText3
 } from "@prismshadow/penguin-core";
+
+// src/services/vision-detect.ts
+var VISION_PROBE_IMAGE = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=";
+var VISION_PROBE_PROMPT = 'Reply with the single word "ok" and nothing else. Do not think or explain.\n<think></think>';
+var VISION_PROBE_MAX_TOKENS = 8;
+var VISION_PROBE_TIMEOUT_MS = 2e4;
+var UNSUPPORTED_PATTERNS = [
+  "image_url",
+  "image url",
+  "does not support image",
+  "not support image",
+  "unsupported image",
+  "image input",
+  "image content",
+  "invalid image",
+  "vision",
+  "multimodal",
+  "modality",
+  "image is not supported",
+  "no support for image",
+  "content type 'image",
+  'content type "image',
+  "unsupported content",
+  "cannot process image",
+  "image not supported"
+];
+function isImageRejection(message) {
+  const m = message.toLowerCase();
+  return UNSUPPORTED_PATTERNS.some((p) => m.includes(p));
+}
+function classifyVisionProbe(outcome, sawContent) {
+  if (outcome.status === "completed") return "supported";
+  if (sawContent) return "supported";
+  const detail = "errorMessage" in outcome && outcome.errorMessage ? outcome.errorMessage : outcome.status;
+  return isImageRejection(String(detail)) ? "unsupported" : "failed";
+}
+function classifyVisionProbeError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return isImageRejection(message) ? "unsupported" : "failed";
+}
+
+// src/services/project-config-service.ts
 function maskApiKey(key) {
   if (key.length <= 12) return "***";
   return `${key.slice(0, 4)}\u2026${key.slice(-4)}`;
@@ -7513,7 +7778,7 @@ var ProjectConfigService = class {
    */
   async writeRaw(projectId, data) {
     const file = this.filePath(projectId);
-    await fs12.mkdir(path10.dirname(file), { recursive: true });
+    await fs12.mkdir(path9.dirname(file), { recursive: true });
     await fs12.writeFile(file, renderProjectConfigToml(data), { encoding: "utf8", mode: 384 });
     await fs12.chmod(file, 384);
     this.cache.delete(projectId);
@@ -7669,6 +7934,59 @@ var ProjectConfigService = class {
    * Tokens (single-digit output; speed mode spends up to its 64-token cap to have a
    * window worth timing), and writes no Trace and records no usage.
    */
+  /**
+   * Vision capability probe: sends one 1x1 PNG plus a one-word prompt and reports whether
+   * the model took it (see services/vision-detect.ts for the verdict rules and why this
+   * one costs real money, unlike the protocol probes).
+   *
+   * Credential resolution is the connectivity test's, verbatim — the request's key, else
+   * the stored one, unless "clear" is checked. The environment layer needs no code here:
+   * omitting apiKey lets AgentHub read the protocol's own variable, which is the same
+   * chain protocol detection spells out by hand because it bypasses the SDK. Nothing
+   * secret is returned; the failure message is the provider's own text, truncated.
+   */
+  async detectVision(projectId, req) {
+    const raw = await this.readRaw(projectId);
+    const entry = asArray(raw.models).find((m) => entryMatches(m, req.provider, req.modelId)) ?? {};
+    const savedKey = optStr(entry.api_key);
+    const apiKey = req.clearApiKey ? void 0 : req.apiKey ?? savedKey;
+    const savedBaseUrl = optStr(entry.base_url);
+    const baseUrl = req.baseUrl === null ? void 0 : req.baseUrl ?? savedBaseUrl;
+    const clientType = canonicalClientType(req.clientType ?? optStr(entry.client_type));
+    try {
+      const llm = new GenerativeModel({
+        modelId: req.modelId,
+        ...apiKey ? { apiKey } : {},
+        ...baseUrl ? { baseUrl } : {},
+        ...clientType ? { clientType } : {},
+        tools: [],
+        thinkingLevel: "none",
+        maxTokens: VISION_PROBE_MAX_TOKENS,
+        requestTimeoutMs: VISION_PROBE_TIMEOUT_MS
+      });
+      const gen = llm.streamGenerate({
+        newMessages: [userText3(VISION_PROBE_PROMPT), imageUrlMessage2(VISION_PROBE_IMAGE)]
+      });
+      let sawContent = false;
+      for (; ; ) {
+        const step = await gen.next();
+        if (step.done) {
+          const outcome = classifyVisionProbe(step.value, sawContent);
+          if (outcome !== "failed") return { outcome };
+          const detail = "errorMessage" in step.value && step.value.errorMessage ? step.value.errorMessage : step.value.status;
+          return { outcome, message: String(detail).slice(0, 300) };
+        }
+        if (isProbeContent(step.value)) sawContent = true;
+      }
+    } catch (err) {
+      const outcome = classifyVisionProbeError(err);
+      if (outcome !== "failed") return { outcome };
+      return {
+        outcome,
+        message: (err instanceof Error ? err.message : String(err)).slice(0, 300)
+      };
+    }
+  }
   async testModel(projectId, req) {
     const raw = await this.readRaw(projectId);
     const entry = asArray(raw.models).find((m) => entryMatches(m, req.provider, req.modelId)) ?? {};
@@ -7676,7 +7994,8 @@ var ProjectConfigService = class {
     const apiKey = req.clearApiKey ? void 0 : req.apiKey ?? savedKey;
     const savedBaseUrl = optStr(entry.base_url);
     const baseUrl = req.baseUrl === null ? void 0 : req.baseUrl ?? savedBaseUrl;
-    const clientType = req.clientType ?? optStr(entry.client_type);
+    const clientType = canonicalClientType(req.clientType ?? optStr(entry.client_type));
+    const fastMode = req.fastMode ?? entry.fast_mode === true;
     const startedAt = Date.now();
     try {
       const llm = new GenerativeModel({
@@ -7684,6 +8003,7 @@ var ProjectConfigService = class {
         ...apiKey ? { apiKey } : {},
         ...baseUrl ? { baseUrl } : {},
         ...clientType ? { clientType } : {},
+        ...fastMode ? { fastMode: true } : {},
         tools: [],
         thinkingLevel: "none",
         // Speed mode pairs a raised cap with a prompt that keeps generating (see
@@ -7728,6 +8048,31 @@ var ProjectConfigService = class {
       };
     }
   }
+  /**
+   * Protocol detection for a custom base URL (see services/protocol-detect.ts for the
+   * probe order and classification). Credential resolution has three layers, in order:
+   *   1. the request body's key (what the user just typed in the dialog);
+   *   2. otherwise, when the optional paired reference names a stored entry and "clear"
+   *      isn't checked, that entry's saved key (the frontend only ever sees the mask);
+   *   3. otherwise the environment variable for whichever protocol each probe speaks,
+   *      resolved inside detectModelProtocol because the protocol is the thing being
+   *      determined (ANTHROPIC_API_KEY for ant-messages, OPENAI_API_KEY for the two
+   *      OpenAI protocols).
+   * Layers 2 and 3 are read server-side only and never travel back to the browser.
+   * Detection still runs with no credential at all: a protocol-shaped 401/403 proves the
+   * route. Never throws on probe failures — every outcome is reported per probe.
+   */
+  async detectProtocol(projectId, req) {
+    let apiKey = req.apiKey;
+    if (apiKey === void 0 && !req.clearApiKey && req.provider && req.modelId) {
+      const raw = await this.readRaw(projectId);
+      const entry = asArray(raw.models).find(
+        (m) => entryMatches(m, req.provider, req.modelId)
+      );
+      apiKey = entry !== void 0 ? optStr(entry.api_key) : void 0;
+    }
+    return detectModelProtocol({ baseUrl: req.baseUrl, ...apiKey ? { apiKey } : {} });
+  }
   /**
    * GET models view: masks credential (inline fields), flags the default Model;
    * the group is the entry's `provider` field, looked up in the built-in catalog by
@@ -7750,11 +8095,12 @@ var ProjectConfigService = class {
         cacheWrite: optNum(pricing.cache_write) ?? 0,
         output: optNum(pricing.output) ?? 0
       } : void 0;
-      const clientType = optStr(m.client_type);
+      const clientType = canonicalClientType(optStr(m.client_type));
       const cat = catalogEntryFor(provider, modelId);
-      const envKey = resolveModelEnv(modelId, clientType)?.envKey;
+      const envKey = resolveModelEnv2(modelId, clientType)?.envKey;
       const vision = typeof m.vision === "boolean" ? m.vision : cat?.supportsVision;
       const maxTokens = optNum(m.max_tokens);
+      const fastMode = m.fast_mode === true ? true : void 0;
       const displayName = optStr(m.display_name) ?? cat?.displayName;
       const apiKey = optStr(m.api_key);
       const credBaseUrl = optStr(m.base_url);
@@ -7768,6 +8114,7 @@ var ProjectConfigService = class {
         ...clientType ? { clientType } : {},
         ...vision !== void 0 ? { vision } : {},
         ...maxTokens !== void 0 ? { maxTokens } : {},
+        ...fastMode !== void 0 ? { fastMode } : {},
         ...envKey ? { envKey } : {},
         ...pricingDto ? { pricing: pricingDto } : {},
         ...apiKey !== void 0 || credBaseUrl !== void 0 ? {
@@ -7829,6 +8176,7 @@ var ProjectConfigService = class {
       delete next2.client_type;
       delete next2.vision;
       delete next2.max_tokens;
+      delete next2.fast_mode;
       delete next2.pricing;
       delete next2.display_name;
       delete next2.request_model_id;
@@ -7837,9 +8185,10 @@ var ProjectConfigService = class {
         next2.display_name = entry.displayName;
       }
       if (entry.contextWindow !== void 0) next2.context_window = entry.contextWindow;
-      if (entry.clientType) next2.client_type = entry.clientType;
+      if (entry.clientType) next2.client_type = canonicalClientType(entry.clientType);
       if (entry.vision !== void 0) next2.vision = entry.vision;
       if (entry.maxTokens !== void 0) next2.max_tokens = entry.maxTokens;
+      if (entry.fastMode === true) next2.fast_mode = true;
       if (entry.pricing !== void 0) {
         next2.pricing = {
           unit: "usd_per_mtok",
@@ -7939,7 +8288,14 @@ function probeTps(outputTokens, windowMs) {
 }
 
 // src/services/agent-config-service.ts
-var THINKING_LEVELS2 = ["none", "low", "medium", "high", "xhigh"];
+var THINKING_LEVELS2 = [
+  "none",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max"
+];
 var COMPACTION_MODES = ["summarize", "discard"];
 function asRecord(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
@@ -8304,7 +8660,7 @@ function validateMcpServers(value) {
 
 // src/services/memory-service.ts
 import fs14 from "fs/promises";
-import path11 from "path";
+import path10 from "path";
 import {
   MEMORY_INDEX_FILENAME,
   USER_SCOPE_KEY,
@@ -8365,7 +8721,7 @@ var MemoryService = class {
     } catch {
     }
     const workspaces = await Promise.all(
-      entries.map((key) => this.scopeInfo(path11.join(base, key), key, "workspace"))
+      entries.map((key) => this.scopeInfo(path10.join(base, key), key, "workspace"))
     );
     workspaces.sort((a, b) => {
       if (a.updatedAt && b.updatedAt) return b.updatedAt.localeCompare(a.updatedAt);
@@ -8373,7 +8729,7 @@ var MemoryService = class {
       if (b.updatedAt) return 1;
       return a.scopeKey.localeCompare(b.scopeKey);
     });
-    const userScope = await this.scopeInfo(path11.join(base, USER_SCOPE_KEY), USER_SCOPE_KEY, "user");
+    const userScope = await this.scopeInfo(path10.join(base, USER_SCOPE_KEY), USER_SCOPE_KEY, "user");
     return [userScope, ...workspaces];
   }
   async scopeInfo(dir, key, kind) {
@@ -8381,7 +8737,7 @@ var MemoryService = class {
     let latest = 0;
     for (const name of files) {
       try {
-        const stat = await fs14.stat(path11.join(dir, name));
+        const stat = await fs14.stat(path10.join(dir, name));
         latest = Math.max(latest, stat.mtimeMs);
       } catch {
       }
@@ -8447,7 +8803,7 @@ var MemoryService = class {
   }
   /** Removes index lines linking to a deleted file. Best-effort: a missing or unreadable index is left alone. */
   async pruneIndexLines(dir, fileName) {
-    const indexPath = path11.join(dir, MEMORY_INDEX_FILENAME);
+    const indexPath = path10.join(dir, MEMORY_INDEX_FILENAME);
     let content;
     try {
       content = await fs14.readFile(indexPath, "utf8");
@@ -8464,8 +8820,8 @@ var MemoryService = class {
   async fileInfo(dir, name) {
     try {
       const [content, stat] = await Promise.all([
-        fs14.readFile(path11.join(dir, name), "utf8"),
-        fs14.stat(path11.join(dir, name))
+        fs14.readFile(path10.join(dir, name), "utf8"),
+        fs14.stat(path10.join(dir, name))
       ]);
       return this.describe(name, content, stat.size, stat.mtime);
     } catch {
@@ -8524,7 +8880,7 @@ var MemoryService = class {
   async requireRealScopeDir(projectId, agentId, scopeKey, dir) {
     try {
       const realBase = await fs14.realpath(memoryDir(this.root, projectId, agentId));
-      if (await fs14.realpath(dir) === path11.join(realBase, scopeKey)) return dir;
+      if (await fs14.realpath(dir) === path10.join(realBase, scopeKey)) return dir;
     } catch {
     }
     throw new HttpError(
@@ -8544,9 +8900,9 @@ var MemoryService = class {
         `File name must be a Markdown topic file \u2014 no path, no leading dot, and not the ${MEMORY_INDEX_FILENAME} index.`
       );
     }
-    const target = path11.join(dir, fileName);
-    const rel = path11.relative(dir, target);
-    if (rel !== fileName || rel.includes(path11.sep)) {
+    const target = path10.join(dir, fileName);
+    const rel = path10.relative(dir, target);
+    if (rel !== fileName || rel.includes(path10.sep)) {
       throw badRequest("File name must not contain a path.");
     }
     return target;
@@ -8555,7 +8911,7 @@ var MemoryService = class {
 
 // src/services/agent-service.ts
 import fs15 from "fs/promises";
-import path12 from "path";
+import path11 from "path";
 import {
   agentDir,
   agentsDir as agentsDir2,
@@ -8656,7 +9012,7 @@ var AgentService = class {
     const present = await Promise.all(
       dirents.filter((d) => d.isDirectory()).map(async (d) => {
         try {
-          await fs15.access(path12.join(base, d.name, "SKILL.md"));
+          await fs15.access(path11.join(base, d.name, "SKILL.md"));
           return true;
         } catch {
           return false;
@@ -8677,7 +9033,7 @@ var AgentService = class {
     const counts = await Promise.all(
       scopes.filter((d) => d.isDirectory()).map(async (d) => {
         try {
-          const files = await fs15.readdir(path12.join(base, d.name), { withFileTypes: true });
+          const files = await fs15.readdir(path11.join(base, d.name), { withFileTypes: true });
           return files.filter((f) => f.isFile() && isTopicFileName(f.name)).length;
         } catch {
           return 0;
@@ -8778,7 +9134,7 @@ var AgentService = class {
 
 // src/services/benchmark-service.ts
 import fs16 from "fs/promises";
-import path13 from "path";
+import path12 from "path";
 import { parse as parseToml3 } from "smol-toml";
 import { parse as parseYaml2 } from "yaml";
 import { benchmarksDir } from "@prismshadow/penguin-core";
@@ -8809,8 +9165,8 @@ function stringOr(v) {
   return typeof v === "string" && v !== "" ? v : void 0;
 }
 function isWithin(parent, child) {
-  const relative = path13.relative(parent, child);
-  return relative !== "" && !relative.startsWith("..") && !path13.isAbsolute(relative);
+  const relative = path12.relative(parent, child);
+  return relative !== "" && !relative.startsWith("..") && !path12.isAbsolute(relative);
 }
 function statementTitle(statement, fallback) {
   const heading = /^#\s+(.+)$/m.exec(statement)?.[1]?.trim();
@@ -8906,13 +9262,13 @@ var BenchmarkService = class {
     }
     const benchmarks = [];
     for (const item of items.filter((i) => i.isDir).sort((a, b) => a.name.localeCompare(b.name))) {
-      benchmarks.push(await this.readBenchmark(path13.join(dir, item.name), item.name));
+      benchmarks.push(await this.readBenchmark(path12.join(dir, item.name), item.name));
     }
     return { benchmarks };
   }
   async listCases(projectId, agentId, benchmarkId) {
     const baseDir = benchmarksDir(this.root, projectId, agentId);
-    const benchDir = path13.join(baseDir, benchmarkId);
+    const benchDir = path12.join(baseDir, benchmarkId);
     let entries;
     let realBaseDir;
     let realBenchDir;
@@ -8937,7 +9293,7 @@ var BenchmarkService = class {
           entry.name,
           "statement"
         );
-        const realReadme = await fs16.realpath(path13.join(statementDir, "README.md"));
+        const realReadme = await fs16.realpath(path12.join(statementDir, "README.md"));
         if (!isWithin(statementDir, realReadme)) throw new Error("README escapes Statement");
         cases.push({
           id: entry.name,
@@ -8970,16 +9326,16 @@ var BenchmarkService = class {
     return this.workspaceFiles.read(materialRoot, rel, options);
   }
   async caseMaterialRoot(projectId, agentId, benchmarkId, caseId, material) {
-    const benchDir = path13.join(benchmarksDir(this.root, projectId, agentId), benchmarkId);
-    const caseDir = path13.join(benchDir, caseId);
-    const materialRoot = path13.join(caseDir, material);
+    const benchDir = path12.join(benchmarksDir(this.root, projectId, agentId), benchmarkId);
+    const caseDir = path12.join(benchDir, caseId);
+    const materialRoot = path12.join(caseDir, material);
     try {
       const [realBenchDir, realCaseDir, realMaterialRoot] = await Promise.all([
         fs16.realpath(benchDir),
         fs16.realpath(caseDir),
         fs16.realpath(materialRoot)
       ]);
-      if (!isWithin(realBenchDir, realCaseDir) || path13.dirname(realMaterialRoot) !== realCaseDir || path13.basename(realMaterialRoot) !== material) {
+      if (!isWithin(realBenchDir, realCaseDir) || path12.dirname(realMaterialRoot) !== realCaseDir || path12.basename(realMaterialRoot) !== material) {
         throw new Error("Case material is not canonical");
       }
       return realMaterialRoot;
@@ -8993,7 +9349,7 @@ var BenchmarkService = class {
     let runs;
     try {
       const config2 = asRecord2(
-        parseToml3(await fs16.readFile(path13.join(benchDir, "benchmark_config.toml"), "utf8"))
+        parseToml3(await fs16.readFile(path12.join(benchDir, "benchmark_config.toml"), "utf8"))
       );
       if (typeof config2.title === "string" && config2.title !== "") title = config2.title;
       if (typeof config2.description === "string" && config2.description !== "") {
@@ -9008,7 +9364,7 @@ var BenchmarkService = class {
     let evaluations = [];
     try {
       const scoreboard = asRecord2(
-        parseYaml2(await fs16.readFile(path13.join(benchDir, "scoreboard.yaml"), "utf8"))
+        parseYaml2(await fs16.readFile(path12.join(benchDir, "scoreboard.yaml"), "utf8"))
       );
       if (Array.isArray(scoreboard.evaluations)) {
         evaluations = scoreboard.evaluations.map(toEvaluation).filter((e) => e !== null);
@@ -9033,9 +9389,9 @@ var BenchmarkService = class {
 };
 
 // src/services/snapshot-service.ts
-import { randomBytes as randomBytes6 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 import fs17 from "fs/promises";
-import path14 from "path";
+import path13 from "path";
 import * as tar from "tar";
 import { parse as parseYaml3 } from "yaml";
 import {
@@ -9048,7 +9404,7 @@ import {
 } from "@prismshadow/penguin-core";
 var VAULT_BASENAME = ".vault.toml";
 function isVaultEntry(entryPath) {
-  return path14.posix.basename(entryPath.replaceAll("\\", "/")) === VAULT_BASENAME;
+  return path13.posix.basename(entryPath.replaceAll("\\", "/")) === VAULT_BASENAME;
 }
 var SnapshotService = class {
   constructor(root) {
@@ -9072,14 +9428,14 @@ var SnapshotService = class {
   async ensureSnapshot(projectId, agentId) {
     const version = await this.currentVersion(projectId, agentId);
     const dir = snapshotsDir(this.root, projectId, agentId);
-    const file = path14.join(dir, `v${version}.tar.gz`);
+    const file = path13.join(dir, `v${version}.tar.gz`);
     try {
       await fs17.access(file);
       return { version, file };
     } catch {
     }
     await fs17.mkdir(dir, { recursive: true });
-    const tmp = `${file}.tmp-${randomBytes6(4).toString("hex")}`;
+    const tmp = `${file}.tmp-${randomBytes4(4).toString("hex")}`;
     await tar.create(
       {
         gzip: true,
@@ -9107,12 +9463,12 @@ var SnapshotService = class {
   async importArchive(projectId, agentId, archive, confirm) {
     const current2 = await this.currentVersion(projectId, agentId);
     const base = agentDir2(this.root, projectId, agentId);
-    const staging = path14.join(base, `.import-${randomBytes6(6).toString("hex")}`);
+    const staging = path13.join(base, `.import-${randomBytes4(6).toString("hex")}`);
     await fs17.mkdir(staging, { recursive: true });
     try {
-      const archiveFile = path14.join(staging, "archive.tar.gz");
+      const archiveFile = path13.join(staging, "archive.tar.gz");
       await fs17.writeFile(archiveFile, archive);
-      const extractDir = path14.join(staging, "extracted");
+      const extractDir = path13.join(staging, "extracted");
       await fs17.mkdir(extractDir, { recursive: true });
       try {
         await tar.extract({
@@ -9123,7 +9479,7 @@ var SnapshotService = class {
       } catch {
         throw badRequest("Import failed: not a valid tar.gz snapshot package.");
       }
-      const configPath = path14.join(extractDir, "agent_state", "system_config.yaml");
+      const configPath = path13.join(extractDir, "agent_state", "system_config.yaml");
       let parsed;
       try {
         parsed = parseYaml3(await fs17.readFile(configPath, "utf8"));
@@ -9149,16 +9505,16 @@ var SnapshotService = class {
       }
       await this.ensureSnapshot(projectId, agentId);
       const stateDir = agentStateDir2(this.root, projectId, agentId);
-      const incomingState = path14.join(extractDir, "agent_state");
+      const incomingState = path13.join(extractDir, "agent_state");
       let vault = null;
       try {
         vault = await fs17.readFile(agentVaultPath(this.root, projectId, agentId));
       } catch {
       }
       if (vault !== null) {
-        await fs17.writeFile(path14.join(incomingState, VAULT_BASENAME), vault, { mode: 384 });
+        await fs17.writeFile(path13.join(incomingState, VAULT_BASENAME), vault, { mode: 384 });
       }
-      const trash = path14.join(staging, "replaced-agent_state");
+      const trash = path13.join(staging, "replaced-agent_state");
       await fs17.rename(stateDir, trash);
       try {
         await fs17.rename(incomingState, stateDir);
@@ -9483,7 +9839,7 @@ import { createAgent as createAgent2, isSessionMeta as isSessionMeta5 } from "@p
 
 // src/services/trace-index.ts
 import fs19 from "fs/promises";
-import path15 from "path";
+import path14 from "path";
 import { agentsDir as agentsDir3, isSessionMeta as isSessionMeta4, tracesDir as tracesDir2 } from "@prismshadow/penguin-core";
 
 // src/internal/trace-head.ts
@@ -9516,7 +9872,7 @@ async function readTraceHead(filePath) {
 var TRACE_FILE_RE = /^(.+)_(\d{3})\.jsonl$/;
 function traceFilePath(root, row) {
   const name = `${row.sessionId}_${String(row.fileIndex).padStart(3, "0")}.jsonl`;
-  return path15.join(tracesDir2(root, row.projectId, row.agentId), row.date, name);
+  return path14.join(tracesDir2(root, row.projectId, row.agentId), row.date, name);
 }
 async function listDirs(dir) {
   try {
@@ -9576,9 +9932,10 @@ var TraceIndexService = class {
    */
   counters = { gateStats: 0, dirScans: 0, headReads: 0 };
   /**
-   * Brings one Agent's index in step with disk. Hot path (nothing changed): two stat
-   * calls, zero readdir. `force` ignores the mtime gate and diffs every date dir (the
-   * consumers' miss-retry path).
+   * Brings one Agent's index in step with disk. Hot path: one root stat, then the
+   * newest date dir — a change there short-circuits — else the remaining N-1 date dirs
+   * concurrently; zero readdir either way. `force` ignores the mtime gate and diffs
+   * every date dir (the consumers' miss-retry path).
    */
   reconcileAgent(projectId, agentId, opts = {}) {
     const key = `${projectId}\0${agentId}`;
@@ -9610,11 +9967,18 @@ var TraceIndexService = class {
       return;
     }
     if (!force && cached && cached.root === rootMtime) {
-      const newest = [...cached.dates.keys()].sort().at(-1);
+      const dates = [...cached.dates.keys()].sort();
+      const newest = dates.pop();
       if (newest === void 0) return;
       this.counters.gateStats += 1;
-      const m = await statMtime(path15.join(dir, newest));
-      if (m !== null && m === cached.dates.get(newest)) return;
+      const newestMtime = await statMtime(path14.join(dir, newest));
+      let changed = newestMtime === null || newestMtime !== cached.dates.get(newest);
+      if (!changed && dates.length > 0) {
+        this.counters.gateStats += dates.length;
+        const older = await Promise.all(dates.map((d) => statMtime(path14.join(dir, d))));
+        changed = older.some((m, i) => m === null || m !== cached.dates.get(dates[i]));
+      }
+      if (!changed) return;
     }
     this.counters.dirScans += 1;
     const next = { root: cacheable(rootMtime), dates: /* @__PURE__ */ new Map() };
@@ -9627,14 +9991,14 @@ var TraceIndexService = class {
     const newSessions = /* @__PURE__ */ new Set();
     const dateDirs = await listDirs(dir);
     for (const date of dateDirs) {
-      const m = await statMtime(path15.join(dir, date));
+      const m = await statMtime(path14.join(dir, date));
       if (m === null) continue;
       next.dates.set(date, cacheable(m));
       if (!force && cached?.dates.get(date) === m) continue;
       const known = new Map(
         (knownByDate.get(date) ?? []).map((r) => [`${r.sessionId}\0${r.fileIndex}`, r])
       );
-      for (const file of await listFiles(path15.join(dir, date))) {
+      for (const file of await listFiles(path14.join(dir, date))) {
         const match = TRACE_FILE_RE.exec(file);
         if (!match) continue;
         const sessionId = match[1];
@@ -9642,7 +10006,7 @@ var TraceIndexService = class {
         const fileKey = `${sessionId}\0${fileIndex}`;
         let size = 0;
         try {
-          size = (await fs19.stat(path15.join(dir, date, file))).size;
+          size = (await fs19.stat(path14.join(dir, date, file))).size;
         } catch {
           continue;
         }
@@ -9748,9 +10112,11 @@ var SessionService = class {
       modelId: row.modelId,
       workspace: row.workspace,
       approvalMode: row.approvalMode,
+      ...row.thinkingLevel ? { thinkingLevel: row.thinkingLevel } : {},
       ...row.title !== null ? { title: row.title } : {},
       ...source !== void 0 ? { source } : {},
       createdAt: row.createdAt,
+      lastActiveAt: row.lastActiveAt,
       status: this.deps.manager.statusOf(row.sessionId),
       pendingApprovalCount: this.deps.manager.pendingApprovalCount(row.sessionId),
       pendingFollowUpCount: this.deps.manager.pendingFollowUpCount(row.sessionId),
@@ -9962,6 +10328,7 @@ var SessionService = class {
       session.sessionId,
       isSessionMeta5(metaMsg) ? asSessionSource(metaMsg.payload.source) ?? null : null
     );
+    const createdAt = (/* @__PURE__ */ new Date()).toISOString();
     const row = {
       sessionId: session.sessionId,
       projectId: args.projectId,
@@ -9974,7 +10341,9 @@ var SessionService = class {
       // Everything created through this service is the Web App's (schedule runs included);
       // "cli" is stamped only by Trace adoption. NULL means a legacy row, treated as web.
       client: "web",
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      // Creation is the first activity; the first driven run advances it (see SessionManager.drive).
+      lastActiveAt: createdAt,
+      createdAt
     };
     this.deps.sessions.insert(row);
     this.deps.manager.adopt(row, session);
@@ -10029,6 +10398,7 @@ var SessionService = class {
     if (!facts?.metaRead) return null;
     if (facts.provider === null || facts.modelId === null) return null;
     this.deps.sources.set(sessionId, facts.source);
+    const createdAt = sessionIdCreatedAt(sessionId) ?? facts.firstTs ?? (/* @__PURE__ */ new Date()).toISOString();
     const row = {
       sessionId,
       projectId,
@@ -10043,7 +10413,11 @@ var SessionService = class {
       // (web-only) excludes these rows; the "show CLI sessions" preference includes them.
       client: "cli",
       hasTrace: true,
-      createdAt: sessionIdCreatedAt(sessionId) ?? facts.firstTs ?? (/* @__PURE__ */ new Date()).toISOString()
+      createdAt,
+      // The CLI's own activity leaves no mark on this row (this server drives none of its
+      // runs), so an adopted Session reads as last-active at its creation time until it is
+      // resumed here; the Trace tail is not consulted (see SessionRow.lastActiveAt).
+      lastActiveAt: createdAt
     };
     this.deps.sessions.insertOrIgnore(row);
     return row;
@@ -10056,16 +10430,69 @@ function localDate(d) {
 
 // src/services/trace-service.ts
 import fs20 from "fs/promises";
-import path16 from "path";
+import path15 from "path";
+import { randomUUID as randomUUID3 } from "crypto";
 import {
+  attachedFileLine as attachedFileLine2,
+  attachedImageLine,
   isSessionMeta as isSessionMeta6,
+  matchAttachedFileLine,
+  matchAttachedImageLine,
+  modelVisiblePath as modelVisiblePath2,
   parseTraceLines as parseTraceLines2,
   parseUserSteeringText as parseUserSteeringText3,
   readTraceTolerant as readTraceTolerant2,
+  resumeTrace,
+  scratchpadDir as scratchpadDir2,
   tracesDir as tracesDir3
 } from "@prismshadow/penguin-core";
 var IMPORT_SESSION_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
 var MAX_SUBAGENT_DEPTH = 4;
+function forkSessionId(date) {
+  const pad = (n) => String(n).padStart(2, "0");
+  return `session-${formatLocalDate(date)}-${pad(date.getHours())}-${pad(date.getMinutes())}-${pad(date.getSeconds())}-${randomUUID3().replaceAll("-", "").slice(0, 8)}`;
+}
+function isAssistantText(msg) {
+  const p = msg.payload;
+  return msg.type === "model_msg" && p.type === "text" && p.role === "assistant" && typeof p.text === "string" && p.text.trim() !== "";
+}
+function isTaskStartingUser(msg) {
+  const p = msg.payload;
+  if (msg.type !== "model_msg") return false;
+  if (p.type === "image_url") return true;
+  if (p.type !== "text" || p.role !== "user" || typeof p.text !== "string") return false;
+  if (parseUserSteeringText3(p.text) !== null) return false;
+  return !p.text.startsWith("[context_summary]") && !p.text.startsWith("<context_summary>");
+}
+function rewriteForkText(text, sourceScratchpad, forkScratchpad) {
+  const source = modelVisiblePath2(sourceScratchpad).replace(/\/$/, "");
+  const target = modelVisiblePath2(forkScratchpad).replace(/\/$/, "");
+  const rewriteTarget = (value) => {
+    if (value === source) return target;
+    if (value.startsWith(`${source}/`)) return `${target}${value.slice(source.length)}`;
+    return null;
+  };
+  return text.split("\n").map((line) => {
+    const trimmed = line.trim();
+    const image = matchAttachedImageLine(trimmed);
+    if (image !== null) {
+      const rewritten = rewriteTarget(image);
+      return rewritten === null ? line : line.replace(trimmed, attachedImageLine(rewritten));
+    }
+    const file = matchAttachedFileLine(trimmed);
+    if (file !== null) {
+      const rewritten = rewriteTarget(file);
+      return rewritten === null ? line : line.replace(trimmed, attachedFileLine2(rewritten));
+    }
+    return line;
+  }).join("\n");
+}
+function positioned(messages, fileIndex, fromOrdinal = 0) {
+  return messages.map((msg, i) => ({
+    ...msg,
+    tracePosition: { fileIndex, ordinal: fromOrdinal + i }
+  }));
+}
 function subagentPointer(msg) {
   if (msg.type !== "event_msg") return null;
   const p = msg.payload;
@@ -10084,8 +10511,10 @@ var TraceService = class {
   /**
    * All of this Session's Trace files (sorted by index ascending), served from the
    * index. An empty answer force-reconciles once and retries before being believed:
-   * disk is the source of truth, and a gate blind spot (an external write into an old
-   * date dir) must cost one extra scan, never a false 404.
+   * disk is the source of truth, and a gate blind spot (a backdated write, or an
+   * in-place append, which moves no directory mtime — see trace-index's header) must
+   * cost one extra scan, never a false 404. Note this retry only covers a WHOLE-session
+   * miss: a session with some shards indexed and a later one missed is served as-is.
    */
   async locateAll(projectId, agentId, sessionId) {
     await this.deps.index.reconcileAgent(projectId, agentId);
@@ -10140,7 +10569,8 @@ var TraceService = class {
     const files = await this.locateAll(projectId, agentId, sessionId);
     const out = [];
     for (const file of files) {
-      out.push(...await this.expandMessages(projectId, await this.readShard(file.path), ctx));
+      const raw = await this.readShard(file.path);
+      out.push(...await this.expandMessages(projectId, positioned(raw, file.index), ctx));
     }
     return out;
   }
@@ -10349,11 +10779,154 @@ var TraceService = class {
       const messages = shardMessages.get(pos) ?? await this.readShard(files[pos].path);
       const from = pos === start.pos ? start.ordinal : 0;
       const to = pos === endPos && endOrdinal !== null ? Math.min(endOrdinal, messages.length) : messages.length;
-      for (let i = from; i < to; i++) windowRaw.push(messages[i]);
+      for (let i = from; i < to; i++) {
+        windowRaw.push({
+          ...messages[i],
+          tracePosition: { fileIndex: files[pos].index, ordinal: i }
+        });
+      }
     }
     const expanded = await this.expandMessages(projectId, windowRaw, ctx);
     return { messages: expanded, ...before !== void 0 ? { before } : {}, prior };
   }
+  /**
+   * Clone a source Session through one completed root-assistant reply. The supplied position
+   * names the reply record itself; this method validates it against raw Trace structure and
+   * chooses the exclusive cut after the request's closing records but before a later Task or
+   * compaction. Earlier shards stay intact so the fork renders the same history, while core
+   * resumes from the selected shard exactly as it would after a restart.
+   */
+  async forkSessionTrace(projectId, agentId, sourceSessionId, position) {
+    const invalid = (message) => new HttpError(400, "invalid_fork_position", message);
+    const files = await this.locateAll(projectId, agentId, sourceSessionId);
+    const targetFilePos = files.findIndex((file) => file.index === position.fileIndex);
+    if (targetFilePos < 0) throw invalid("The selected reply no longer exists in this Session.");
+    const shards = [];
+    for (let i = 0; i <= targetFilePos; i++) shards.push(await this.readShard(files[i].path));
+    const targetShard = shards[targetFilePos];
+    const target = targetShard[position.ordinal];
+    if (!target || !isAssistantText(target)) {
+      throw invalid("The fork position must identify a completed assistant reply.");
+    }
+    let inCompaction = false;
+    for (let filePos = 0; filePos <= targetFilePos; filePos++) {
+      const messages = shards[filePos];
+      const stop = filePos === targetFilePos ? position.ordinal : messages.length;
+      for (let i = 0; i < stop; i++) {
+        const p = messages[i].payload;
+        if (messages[i].type === "event_msg" && p.type === "compaction_begin") {
+          inCompaction = true;
+        } else if (messages[i].type === "event_msg" && p.type === "compaction_end") {
+          inCompaction = false;
+        }
+      }
+    }
+    if (inCompaction) throw invalid("A compaction summary cannot be used as a fork point.");
+    let cutOrdinal = position.ordinal + 1;
+    let completedRequest = false;
+    for (let i = position.ordinal + 1; i < targetShard.length; i++) {
+      const msg = targetShard[i];
+      const p = msg.payload;
+      if (isTaskStartingUser(msg) || msg.type === "event_msg" && p.type === "compaction_begin") {
+        break;
+      }
+      if (isAssistantText(msg)) {
+        throw invalid("The selected record is not the final assistant reply of its Task.");
+      }
+      cutOrdinal = i + 1;
+      if (msg.type === "event_msg" && p.type === "request_end") {
+        if (p.status === "completed") completedRequest = true;
+        else throw invalid("The selected assistant reply belongs to an incomplete request.");
+      }
+    }
+    if (!completedRequest) throw invalid("The selected assistant reply has not completed yet.");
+    const resumed = resumeTrace(targetShard.slice(0, cutOrdinal));
+    if (resumed.contextClosed || resumed.carryOver.length > 0 || !resumed.history.some((message) => message === target)) {
+      throw invalid("The selected reply is not a complete resumable Task boundary.");
+    }
+    const firstMeta = shards.flat().find(isSessionMeta6);
+    if (!firstMeta) throw invalid("The source Trace has no session metadata.");
+    const created = /* @__PURE__ */ new Date();
+    const createdAt = created.toISOString();
+    const newSessionId = forkSessionId(created);
+    const scratchpadRoot = scratchpadDir2(this.root, projectId, agentId);
+    const sourceScratchpad = path15.join(scratchpadRoot, sourceSessionId);
+    const forkScratchpad = path15.join(scratchpadRoot, newSessionId);
+    const written = [];
+    const rewrite = (msg) => {
+      if (isSessionMeta6(msg)) {
+        const sourcePrompt = msg.payload.system_prompt;
+        const sourceVisible = modelVisiblePath2(sourceScratchpad);
+        const forkVisible = modelVisiblePath2(forkScratchpad);
+        const payload = {
+          ...msg.payload,
+          session_id: newSessionId,
+          system_prompt: sourcePrompt.split(sourceSessionId).join(newSessionId).split(sourceVisible).join(forkVisible)
+        };
+        delete payload.source;
+        return { ...msg, payload };
+      }
+      const p = msg.payload;
+      if (msg.type === "model_msg" && p.type === "text" && p.role === "user" && typeof p.text === "string") {
+        return {
+          ...msg,
+          payload: {
+            ...msg.payload,
+            text: rewriteForkText(p.text, sourceScratchpad, forkScratchpad)
+          }
+        };
+      }
+      return msg;
+    };
+    try {
+      try {
+        const stat = await fs20.stat(sourceScratchpad);
+        if (stat.isDirectory()) {
+          await fs20.mkdir(scratchpadRoot, { recursive: true });
+          await fs20.cp(sourceScratchpad, forkScratchpad, {
+            recursive: true,
+            force: false,
+            errorOnExist: true
+          });
+        }
+      } catch (err) {
+        if (err.code !== "ENOENT") throw err;
+      }
+      for (let filePos = 0; filePos <= targetFilePos; filePos++) {
+        const sourceFile = files[filePos];
+        const sourceMessages = shards[filePos];
+        const limit = filePos === targetFilePos ? cutOrdinal : sourceMessages.length;
+        const records = sourceMessages.slice(0, limit).map(rewrite);
+        if (!isSessionMeta6(records[0])) {
+          throw invalid(`Trace shard ${sourceFile.index} does not start with session metadata.`);
+        }
+        const dir = path15.join(tracesDir3(this.root, projectId, agentId), sourceFile.date);
+        await fs20.mkdir(dir, { recursive: true });
+        const file = path15.join(
+          dir,
+          `${newSessionId}_${String(sourceFile.index).padStart(3, "0")}.jsonl`
+        );
+        const body = records.map((record) => JSON.stringify(record)).join("\n") + "\n";
+        await fs20.writeFile(file, body, { encoding: "utf8", flag: "wx" });
+        written.push(file);
+        this.deps.index.registerImportedFile({
+          projectId,
+          agentId,
+          sessionId: newSessionId,
+          fileIndex: sourceFile.index,
+          date: sourceFile.date,
+          sizeBytes: Buffer.byteLength(body, "utf8"),
+          records
+        });
+      }
+      return { sessionId: newSessionId, createdAt };
+    } catch (err) {
+      await Promise.all(written.map((file) => fs20.rm(file, { force: true }).catch(() => void 0)));
+      await fs20.rm(forkScratchpad, { recursive: true, force: true }).catch(() => void 0);
+      this.deps.index.removeSession(projectId, agentId, newSessionId);
+      throw err;
+    }
+  }
   /** List of Trace files (index / date / size / mtime). */
   async listTraceFiles(projectId, agentId, sessionId) {
     const files = await this.locateAll(projectId, agentId, sessionId);
@@ -10400,6 +10973,7 @@ var TraceService = class {
     let steeringImages = false;
     let sawToolCallThisRequest = false;
     let compactionActive = false;
+    let compactionMode = null;
     const taskStats = /* @__PURE__ */ new Map();
     const ensureTask = (ti) => {
       let t = taskStats.get(ti);
@@ -10447,7 +11021,10 @@ var TraceService = class {
           requests.push(openRequest);
           if (!hasOrigin) {
             const t = ensureTask(taskIndex);
-            if (compactionActive) t.compaction = true;
+            if (compactionActive) {
+              t.compaction = true;
+              if (compactionMode !== null) t.compactionMode = compactionMode;
+            }
             if (t.startTs === "") t.startTs = msg.timestamp;
             if (pendingFrom !== null) {
               for (let k = pendingFrom; k < mi; k++) {
@@ -10513,11 +11090,14 @@ var TraceService = class {
           if (!hasOrigin) {
             continuation = false;
             compactionActive = true;
+            const mode = p.mode;
+            compactionMode = mode === "summarize" || mode === "discard" ? mode : null;
           }
         } else if (p.type === "compaction_end") {
           if (!hasOrigin) {
             continuation = false;
             compactionActive = false;
+            compactionMode = null;
           }
         } else if (p.type === "token_usage") {
           const request = p.request;
@@ -10612,6 +11192,13 @@ var TraceService = class {
       const t = ensureTask(ti);
       if (t.messageFrom < 0 || k < t.messageFrom) t.messageFrom = k;
       if (k > t.messageTo) t.messageTo = k;
+      const cur = messages[k];
+      const cp = cur.payload;
+      const fromSubagent = cur.origin !== void 0 && cur.origin.length > 0;
+      if (!fromSubagent && cur.type === "event_msg" && cp.type === "compaction_begin") {
+        t.compaction = true;
+        if (cp.mode === "summarize" || cp.mode === "discard") t.compactionMode = cp.mode;
+      }
       if (messages[k].type === "session_meta") continue;
       const ts = messages[k].timestamp;
       if (t.endTs === "" || ts > t.endTs) t.endTs = ts;
@@ -10812,9 +11399,9 @@ var TraceService = class {
     const ts = Date.parse(first.timestamp);
     const date = formatLocalDate(Number.isNaN(ts) ? /* @__PURE__ */ new Date() : new Date(ts));
     const index = 1;
-    const dir = path16.join(tracesDir3(this.root, projectId, agentId), date);
+    const dir = path15.join(tracesDir3(this.root, projectId, agentId), date);
     await fs20.mkdir(dir, { recursive: true });
-    const file = path16.join(dir, `${sessionId}_${String(index).padStart(3, "0")}.jsonl`);
+    const file = path15.join(dir, `${sessionId}_${String(index).padStart(3, "0")}.jsonl`);
     const body = content.replace(/\n+$/, "") + "\n";
     try {
       await fs20.writeFile(file, body, { encoding: "utf8", flag: "wx" });
@@ -11132,11 +11719,573 @@ var UsageService = class {
   }
 };
 
-// src/http/routes/preview.ts
+// src/hmr/host.ts
+import crypto from "crypto";
+import fs21 from "fs";
+import fsp from "fs/promises";
+import path16 from "path";
+import zlib from "zlib";
+import { pathToFileURL } from "url";
+import { boot, initialDoc, upgrade } from "@prismshadow/penguin-core/kernel";
+
+// src/hmr/resources.ts
+var HotResources = class {
+  map = /* @__PURE__ */ new Map();
+  register(id, resource, dispose) {
+    this.map.set(id, { resource, dispose });
+  }
+  claim(id) {
+    return this.map.get(id)?.resource;
+  }
+  release(id) {
+    this.map.delete(id);
+  }
+  /**
+   * Process-exit sweep: run every registered disposer. Not part of any upgrade path —
+   * resources are meant to outlive swaps. A throwing disposer must not strand the rest.
+   */
+  disposeAll() {
+    for (const entry of this.map.values()) {
+      try {
+        entry.dispose?.();
+      } catch {
+      }
+    }
+    this.map.clear();
+  }
+};
+
+// src/platform/platform.ts
+import { defineIface, schema, type } from "@prismshadow/penguin-core/kernel";
+var PlatformIface = defineIface({
+  name: "platform",
+  version: 1,
+  context: schema(type({ motd: "string" })),
+  methods: ["park", "info"]
+});
+var platformImpl = {
+  create(_ctx, context) {
+    return {
+      park: () => ({ motd: context.motd }),
+      info: () => ({
+        impl: "packaged",
+        ifaceVersion: PlatformIface.version,
+        motd: context.motd
+      })
+    };
+  }
+};
+var packagedPlatform = {
+  id: "packaged",
+  iface: PlatformIface,
+  impl: platformImpl,
+  context: { motd: "hello from the penguin hot platform" }
+};
+
+// src/hmr/host.ts
+var STORE_KEEP = 2;
+var HmrHost = class {
+  constructor(root) {
+    this.root = root;
+    this.hmrDir = path16.join(root, "hmr");
+    this.storeDir = path16.join(this.hmrDir, "store");
+    this.manifestPath = path16.join(this.hmrDir, "harness.json");
+  }
+  root;
+  resources = new HotResources();
+  instance = null;
+  implId = packagedPlatform.id;
+  hmrDir;
+  storeDir;
+  manifestPath;
+  /**
+   * Single-flight guard for the first boot (see ensure()): every concurrent caller before the
+   * first successful boot awaits the SAME promise, so restore() and the packaged-default
+   * fallback can never run twice and race each other into assigning `this.instance` (a double
+   * boot, or a restored version clobbered by a concurrently-booted packaged default).
+   */
+  initPromise = null;
+  /** The freeze, as a queue: everything the HTTP layer gates on chains here. */
+  opQueue = Promise.resolve();
+  warn(msg) {
+    process.stderr.write(`[hmr] ${msg}
+`);
+  }
+  currentImplId() {
+    return this.implId;
+  }
+  /**
+   * The request gate: resolves once no swap is in flight. Requests arriving
+   * during an upgrade wait here — they observe latency, never an error.
+   */
+  waitIdle() {
+    return this.opQueue.then(
+      () => void 0,
+      () => void 0
+    );
+  }
+  /**
+   * Lazy first boot. Resumes the last committed version (platform + cli + web)
+   * from disk when present; otherwise boots the packaged platform v1 with a
+   * fresh document. Concurrent callers before the first boot completes share one
+   * in-flight promise (see `initPromise`) rather than each racing their own
+   * restore()/packaged-boot.
+   */
+  ensure() {
+    if (this.instance !== null) return Promise.resolve(this.instance);
+    this.initPromise ??= this.initialize();
+    return this.initPromise;
+  }
+  /** Runs exactly once per process (guarded by `initPromise` in ensure()). */
+  async initialize() {
+    try {
+      await this.restore();
+      if (this.instance === null) {
+        const bundle = packagedPlatform;
+        this.instance = await boot(
+          bundle.impl,
+          bundle.iface,
+          initialDoc(bundle.iface, bundle.context),
+          this.resources
+        );
+      }
+      return this.instance;
+    } catch (err) {
+      this.initPromise = null;
+      throw err;
+    }
+  }
+  /**
+   * Resume from harness.json, as ONE unit: the platform bundle, the cli bundle's own
+   * existence, and the web artifact are all read and validated BEFORE anything is
+   * committed to `this.instance` / `this.webMem` — so a failure partway through (a
+   * pruned bundle, a missing web artifact, a missing cli artifact) never leaves
+   * platform and web resumed from different versions. The cli bundle is never
+   * imported here (this process never runs it — only packages/cli's own loader
+   * does); its file just has to exist, so a restore can never leave `cli.bundle`
+   * pointing at nothing. Any failure is non-fatal: it warns and leaves the runtime
+   * to boot the packaged default — a bad persisted version must never brick the
+   * runtime. Only ever called once (from initialize(), itself single-flighted by
+   * ensure()'s `initPromise`).
+   *
+   * Boots the restored bundle against its OWN fresh initial context (bundle.context),
+   * not a resumed state — state is never written to disk (see the module doc), so a
+   * restart always resumes the pushed CODE with a clean slate, never last run's doc.
+   */
+  async restore() {
+    let manifest;
+    try {
+      manifest = JSON.parse(await fsp.readFile(this.manifestPath, "utf8"));
+    } catch {
+      return;
+    }
+    if (manifest.platform === void 0 && manifest.web === void 0) {
+      return;
+    }
+    try {
+      if (manifest.platform === void 0) {
+        throw new Error("harness.json has no `platform` entry");
+      }
+      if (manifest.cli === void 0) {
+        throw new Error("harness.json has no `cli` entry");
+      }
+      if (manifest.web === void 0) {
+        throw new Error("harness.json has no `web` entry");
+      }
+      const cliPath = path16.join(this.hmrDir, manifest.cli.bundle);
+      if (!fs21.existsSync(cliPath)) {
+        throw new Error(`cli bundle '${manifest.cli.bundle}' does not exist`);
+      }
+      const bundle = await this.importBundleFile(path16.join(this.hmrDir, manifest.platform.bundle));
+      const gz = await fsp.readFile(path16.join(this.hmrDir, manifest.web.manifest));
+      const webMem = filesMapFromGzip(gz);
+      const instance = await boot(
+        bundle.impl,
+        bundle.iface,
+        initialDoc(bundle.iface, bundle.context),
+        this.resources
+      );
+      this.instance = instance;
+      this.implId = bundle.id;
+      this.webMem = webMem;
+    } catch (err) {
+      this.warn(
+        `persisted version failed to restore (platform+cli+web are committed as one unit); using the packaged default: ${errMsg(err)}`
+      );
+    }
+  }
+  /** Strictly request-driven; serialized on the op queue (never auto-triggered). */
+  upgradeAll(target) {
+    const run = this.opQueue.then(() => this.doUpgradeAll(target));
+    this.opQueue = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run;
+  }
+  async doUpgradeAll(target) {
+    const current2 = await this.ensure();
+    if (typeof target.web["index.html"] !== "string") {
+      throw new Error("web dist manifest has no index.html");
+    }
+    const webMem = /* @__PURE__ */ new Map();
+    for (const [rel, b64] of Object.entries(target.web)) {
+      if (!isSafeRelPath(rel)) throw new Error(`unsafe path in web dist manifest: ${rel}`);
+      webMem.set(rel, Buffer.from(b64, "base64"));
+    }
+    const platformPath = await this.writeInlinePlatformBundle(target.platform);
+    const bundle = await this.importBundleFile(platformPath);
+    const source = target.source ?? null;
+    const result = await upgrade({
+      current: current2,
+      impl: bundle.impl,
+      iface: bundle.iface,
+      resources: this.resources
+    });
+    if (result.status === "blocked") {
+      return {
+        status: "blocked",
+        dropped: result.dropped,
+        missing: result.missing,
+        invalid: result.invalid
+      };
+    }
+    this.instance = result.instance;
+    this.implId = bundle.id;
+    this.webMem = webMem;
+    const digest2 = filesDigest(target.web);
+    const gz = zlib.gzipSync(Buffer.from(JSON.stringify({ files: target.web })));
+    const persisted = await this.persistVersion(
+      target.platform,
+      target.cli,
+      gz,
+      digest2.slice(0, 16)
+    );
+    return {
+      status: "ok",
+      mode: result.mode,
+      impl: bundle.id,
+      source,
+      web: { rev: digest2.slice(0, 12) },
+      persisted
+    };
+  }
+  /** Layer (a) core: import one JS file, cache-busted so re-imports load fresh code. */
+  async importBundleFile(file) {
+    const resolved = path16.resolve(file);
+    if (!fs21.existsSync(resolved)) throw new Error(`bundle file '${file}' does not exist`);
+    const url = `${pathToFileURL(resolved).href}?v=${Date.now()}`;
+    const mod = await import(url);
+    if (mod.hotPlatform === void 0) {
+      throw new Error(`${file} does not export 'hotPlatform'`);
+    }
+    if (mod.hotPlatform.context === void 0) {
+      throw new Error(`${file}'s 'hotPlatform' has no 'context'`);
+    }
+    return mod.hotPlatform;
+  }
+  /**
+   * Materializes the inline platform bundle (the single-file ESM sent in the
+   * request body) to disk and returns its path — how a push reaches a runtime
+   * over HTTP alone: the bytes travel in the request, the server writes them,
+   * then loads them via importBundleFile. Only the platform artifact needs
+   * this treatment: it is the only one of the three this process ever
+   * imports and boots. The cli artifact is never imported here (see
+   * persistVersion) — it goes straight from request body to content-addressed
+   * store.
+   */
+  async writeInlinePlatformBundle(content) {
+    const dir = path16.join(this.hmrDir, "uploads");
+    await fsp.mkdir(dir, { recursive: true });
+    const file = path16.join(dir, `platform-${sha1(content).slice(0, 16)}.mjs`);
+    await fsp.writeFile(file, content, "utf8");
+    return file;
+  }
+  // -- Web platform (the frontend package's built dist) ---------------------
+  /**
+   * The pushed web dist held in memory (relPath → bytes) — always installed
+   * together with a platform + cli version (see doUpgradeAll); never written or
+   * read file-by-file (see persistVersion). Null before anything has ever been
+   * pushed or restored.
+   */
+  webMem = null;
+  /** Static hosting's resolution: an in-memory pushed/restored dist, or null (the caller falls back to the configured webDist). */
+  resolveWebSource() {
+    return this.webMem !== null ? { kind: "mem", files: this.webMem } : null;
+  }
+  // -- Persistence ----------------------------------------------------------
+  /**
+   * Content-addresses the platform bundle (its CODE only — see the module doc: state
+   * is never persisted), the cli bundle (never imported — just stored, for
+   * packages/cli's own loader to pick up), and the web gzip artifact, then flips
+   * harness.json ONCE — `platform`, `cli`, and `web` all land in the SAME atomic
+   * rename, never three separate commits that could leave one pointer ahead of the
+   * others. `platform.bundle` and `cli.bundle` are genuinely independent files
+   * (distinct content, distinct sha) rather than the same physical bundle under two
+   * manifest keys.
+   *
+   * Returns whether the commit succeeded — the caller surfaces this to clients
+   * (`persisted` in UpgradeOutcome) so a live swap that could not be written to disk
+   * is visibly at risk of reverting on the next restart, rather than silently ok.
+   */
+  async persistVersion(platformContent, cliContent, webGz, webSha) {
+    try {
+      const platformSha = sha1(platformContent).slice(0, 16);
+      const platformDir = path16.join(this.storeDir, "platform");
+      await fsp.mkdir(platformDir, { recursive: true });
+      await fsp.writeFile(path16.join(platformDir, `${platformSha}.mjs`), platformContent, "utf8");
+      const cliSha = sha1(cliContent).slice(0, 16);
+      const cliDir = path16.join(this.storeDir, "cli");
+      await fsp.mkdir(cliDir, { recursive: true });
+      await fsp.writeFile(path16.join(cliDir, `${cliSha}.mjs`), cliContent, "utf8");
+      const webDir = path16.join(this.storeDir, "web");
+      await fsp.mkdir(webDir, { recursive: true });
+      await fsp.writeFile(path16.join(webDir, `${webSha}.webz`), webGz);
+      await this.commitManifest(() => ({
+        platform: { bundle: `store/platform/${platformSha}.mjs` },
+        cli: { bundle: `store/cli/${cliSha}.mjs` },
+        web: { manifest: `store/web/${webSha}.webz` }
+      }));
+      return true;
+    } catch (err) {
+      this.warn(`update not persisted (filesystem unavailable?): ${errMsg(err)}`);
+      return false;
+    }
+  }
+  /** Writes and atomically replaces harness.json (the single commit point for a whole version). */
+  async commitManifest(next) {
+    await fsp.mkdir(this.hmrDir, { recursive: true });
+    const manifest = next();
+    const tmp = `${this.manifestPath}.${process.pid}.tmp`;
+    await fsp.writeFile(tmp, JSON.stringify(manifest, null, 2));
+    await fsp.rename(tmp, this.manifestPath);
+    await this.pruneStore(manifest);
+  }
+  /**
+   * Store GC: keep at most STORE_KEEP versions — the committed one is always
+   * kept, the rest by recency. Best-effort; ordered after the manifest flip so
+   * nothing referenced can be pruned. `platform`, `cli`, and `web` are three
+   * independent subtrees now (no shared file to piggyback a sweep on), so each
+   * gets its own pass.
+   */
+  async pruneStore(manifest) {
+    const keepNewest = async (dir, keys, referenced, remove) => {
+      let names;
+      try {
+        names = await fsp.readdir(dir);
+      } catch {
+        return;
+      }
+      const byKey = /* @__PURE__ */ new Map();
+      for (const name of names) {
+        const key = keys(name);
+        if (key === null) continue;
+        try {
+          const mtime = (await fsp.stat(path16.join(dir, name))).mtimeMs;
+          byKey.set(key, Math.max(byKey.get(key) ?? 0, mtime));
+        } catch {
+        }
+      }
+      const ranked = [...byKey.entries()].sort((a, b) => b[1] - a[1]).map(([k]) => k);
+      const kept = new Set(ranked.slice(0, STORE_KEEP));
+      if (referenced !== null) kept.add(referenced);
+      for (const key of ranked) {
+        if (!kept.has(key)) await remove(key).catch(() => void 0);
+      }
+    };
+    const platformDir = path16.join(this.storeDir, "platform");
+    const platformBundleRef = manifest.platform?.bundle.match(/([0-9a-f]+)\.mjs$/)?.[1] ?? null;
+    await keepNewest(
+      platformDir,
+      (name) => /^([0-9a-f]+)\.mjs$/.exec(name)?.[1] ?? null,
+      platformBundleRef,
+      (sha) => fsp.rm(path16.join(platformDir, `${sha}.mjs`), { force: true })
+    );
+    const cliDir = path16.join(this.storeDir, "cli");
+    const cliRef = manifest.cli?.bundle.match(/([0-9a-f]+)\.mjs$/)?.[1] ?? null;
+    await keepNewest(
+      cliDir,
+      (name) => /^([0-9a-f]+)\.mjs$/.exec(name)?.[1] ?? null,
+      cliRef,
+      (sha) => fsp.rm(path16.join(cliDir, `${sha}.mjs`), { force: true })
+    );
+    const webDir = path16.join(this.storeDir, "web");
+    const webRef = manifest.web?.manifest.match(/([0-9a-f]+)\.webz$/)?.[1] ?? null;
+    await keepNewest(
+      webDir,
+      (name) => /^([0-9a-f]+)\.webz$/.exec(name)?.[1] ?? null,
+      webRef,
+      (sha) => fsp.rm(path16.join(webDir, `${sha}.webz`), { force: true })
+    );
+  }
+  /** Process-exit sweep only; never part of an upgrade. */
+  dispose() {
+    this.instance?.dispose();
+    this.instance = null;
+    this.resources.disposeAll();
+  }
+};
+function errMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function sha1(content) {
+  return crypto.createHash("sha1").update(content).digest("hex");
+}
+function filesDigest(files) {
+  const hash = crypto.createHash("sha1");
+  for (const rel of Object.keys(files).sort()) hash.update(rel).update("\0").update(files[rel]);
+  return hash.digest("hex");
+}
+function isSafeRelPath(rel) {
+  if (rel === "" || rel.startsWith("/") || rel.includes("\\")) return false;
+  return rel.split("/").every((seg) => seg !== "" && seg !== "." && seg !== "..");
+}
+function filesFromGzip(gz) {
+  let parsed;
+  try {
+    parsed = JSON.parse(zlib.gunzipSync(gz).toString("utf8"));
+  } catch (err) {
+    throw new Error(`invalid gzip web dist artifact: ${errMsg(err)}`);
+  }
+  if (typeof parsed.files !== "object" || parsed.files === null) {
+    throw new Error("gzip web dist artifact has no `files`");
+  }
+  return parsed.files;
+}
+function filesMapFromGzip(gz) {
+  const files = filesFromGzip(gz);
+  const mem = /* @__PURE__ */ new Map();
+  for (const [rel, b64] of Object.entries(files)) {
+    if (!isSafeRelPath(rel)) throw new Error(`unsafe path in web dist manifest: ${rel}`);
+    mem.set(rel, Buffer.from(b64, "base64"));
+  }
+  return mem;
+}
+
+// src/hmr/routes.ts
+import zlib2 from "zlib";
 import { Hono as Hono24 } from "hono";
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost"]);
+function hmrRoutes(deps2) {
+  const routes = new Hono24();
+  const hmr = deps2.hmr;
+  const cookieAuth = authMiddleware(deps2.authService);
+  routes.use("*", async (c, next) => {
+    if (!LOOPBACK_HOSTS.has(deps2.config.host.toLowerCase())) {
+      const proto = deps2.config.trustProxy ? c.req.header("x-forwarded-proto") ?? new URL(c.req.url).protocol.replace(":", "") : new URL(c.req.url).protocol.replace(":", "");
+      if (proto !== "https") {
+        throw new HttpError(
+          403,
+          "hmr_disabled",
+          "Hot platform APIs are disabled on a non-loopback bind without HTTPS. Serve over HTTPS to enable them."
+        );
+      }
+    }
+    const gated = async () => {
+      if (!c.req.path.endsWith("/upgrade")) await hmr.waitIdle();
+      await next();
+    };
+    return cookieAuth(c, async () => {
+      if (!c.get("user").isAdmin) {
+        throw new HttpError(403, "forbidden", "Hot platform APIs are admin-only.");
+      }
+      await gated();
+    });
+  });
+  routes.post("/upgrade", async (c) => {
+    const contentType = (c.req.header("content-type") ?? "").split(";")[0].trim().toLowerCase();
+    if (contentType !== "application/gzip" && contentType !== "application/octet-stream") {
+      throw new HttpError(
+        400,
+        "bad_request",
+        "expected a gzip(JSON.stringify({ platform, cli, web })) body (Content-Type application/gzip or application/octet-stream)"
+      );
+    }
+    let payload;
+    try {
+      const gz = Buffer.from(await c.req.arrayBuffer());
+      payload = JSON.parse(zlib2.gunzipSync(gz).toString("utf8"));
+    } catch (err) {
+      throw new HttpError(
+        400,
+        "bad_request",
+        `invalid gzip upgrade payload: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    if (typeof payload.platform !== "string") {
+      throw new HttpError(400, "bad_request", "payload has no `platform` (string)");
+    }
+    if (typeof payload.cli !== "string") {
+      throw new HttpError(400, "bad_request", "payload has no `cli` (string)");
+    }
+    if (typeof payload.web?.files !== "object" || payload.web.files === null) {
+      throw new HttpError(
+        400,
+        "bad_request",
+        "payload has no `web.files` (a { relPath: base64 } map)"
+      );
+    }
+    let outcome;
+    try {
+      outcome = await hmr.upgradeAll({
+        platform: payload.platform,
+        cli: payload.cli,
+        web: payload.web.files,
+        ...payload.source ? { source: payload.source } : {}
+      });
+    } catch (err) {
+      throw new HttpError(400, "bad_request", err instanceof Error ? err.message : String(err));
+    }
+    if (outcome.status === "ok") {
+      deps2.channels.broadcast(
+        "user:",
+        { type: "web_updated", rev: outcome.web.rev },
+        "server_event"
+      );
+    }
+    return c.json(outcome);
+  });
+  return routes;
+}
+
+// src/hmr/http-seam.ts
+var RESERVED_PREFIX = "/api/hmr";
+function platformHttpSeam(hmr) {
+  return async (c, next) => {
+    if (c.req.path.startsWith(RESERVED_PREFIX)) return next();
+    await hmr.waitIdle();
+    let handler;
+    try {
+      const instance = await hmr.ensure();
+      handler = instance.api.http?.bind(instance.api);
+    } catch {
+      return next();
+    }
+    if (!handler) return next();
+    let response;
+    try {
+      response = await handler(c.req.raw);
+    } catch (err) {
+      return c.json(
+        {
+          error: {
+            code: "platform_error",
+            message: `The platform failed to handle ${c.req.method} ${c.req.path}: ${err instanceof Error ? err.message : String(err)}`
+          }
+        },
+        500
+      );
+    }
+    if (response === null) return next();
+    return response;
+  };
+}
+
+// src/http/routes/preview.ts
+import { Hono as Hono25 } from "hono";
 var DIRECTORY_INDEX = "index.html";
 function previewRoutes(deps2) {
-  const app2 = new Hono24();
+  const app2 = new Hono25();
   app2.get("/:token/*", async (c) => {
     const token = c.req.param("token");
     const payload = token ? deps2.previewTokens.verify(token) : null;
@@ -11180,7 +12329,6 @@ function previewRoutes(deps2) {
 }
 
 // src/app.ts
-var MAX_BODY_BYTES = 20 * 1024 * 1024;
 function buildAppDeps(config2, overrides = {}) {
   const db = openDatabase(config2.dbPath);
   const log = overrides.log ?? ((line) => console.log(line));
@@ -11240,7 +12388,24 @@ function buildAppDeps(config2, overrides = {}) {
     errors,
     titles,
     log,
-    goals: goalsRepo
+    goals: goalsRepo,
+    // Run-state flips reach the whole login session, not just the tab watching that one
+    // conversation. Audience = the Project's owner plus its members, i.e. exactly who
+    // ProjectsRepo.listAccessible would grant the Project to — nobody learns that a Session
+    // they cannot open changed state.
+    //
+    // `peek`, deliberately not `get`: a user who has never opened an event stream has no
+    // channel, and conjuring one to buffer badge updates nobody is listening to is pure waste
+    // (their next connection fetches the list, which carries the same statuses anyway).
+    notifyProjectUsers: (projectId, event) => {
+      const ownerUserId = projectsRepo.findById(projectId)?.ownerUserId;
+      if (ownerUserId === void 0) return;
+      const audience = /* @__PURE__ */ new Set([ownerUserId, ...membersRepo.list(projectId).map((m) => m.userId)]);
+      for (const userId of audience) {
+        channels.peek(userChannelKey(userId))?.publish(event, "server_event");
+      }
+    },
+    ...overrides.now ? { now: overrides.now } : {}
   });
   managerRef = manager;
   const projectService = new ProjectService({
@@ -11333,11 +12498,12 @@ function buildAppDeps(config2, overrides = {}) {
     sessionSources,
     errors,
     desktop: config2.desktopToken !== null ? new DesktopService(config2.desktopToken) : null,
+    hmr: new HmrHost(config2.root),
     log
   };
 }
 function createApp(deps2) {
-  const app2 = new Hono25();
+  const app2 = new Hono26();
   app2.onError((err, c) => {
     const projectId = attributedProjectId(c, deps2);
     deps2.errors.record({
@@ -11369,22 +12535,35 @@ function createApp(deps2) {
       await next();
     });
   }
-  app2.use(
-    "/api/*",
-    bodyLimit({
-      maxSize: MAX_BODY_BYTES,
-      // Its default is a bare text/plain 413; throw the App's own error instead so the response
-      // stays the documented `payload_too_large` body that every client already handles.
-      onError: () => {
-        throw new HttpError(413, "payload_too_large", "Request body exceeds the 20MB limit.");
-      }
-    })
-  );
+  let capped = null;
+  app2.use("/api/*", (c, next) => {
+    const size = bodyLimitBytes(deps2.serverSettingsRepo.getAttachmentLimitsMb());
+    if (capped === null || capped.size !== size) {
+      capped = {
+        size,
+        mw: bodyLimit({
+          maxSize: size,
+          // Its default is a bare text/plain 413; throw the App's own error instead so the
+          // response stays the documented `payload_too_large` body that every client handles.
+          onError: () => {
+            throw new HttpError(
+              413,
+              "payload_too_large",
+              `Request body exceeds the ${Math.floor(size / (1024 * 1024))}MB limit.`
+            );
+          }
+        })
+      };
+    }
+    return capped.mw(c, next);
+  });
   app2.use("/api/*", jsonOnlyWrites);
   app2.route("/api/auth", authRoutes(deps2));
   if (deps2.desktop) {
     app2.route("/api/desktop", desktopRoutes(deps2));
   }
+  app2.route("/api/hmr", hmrRoutes(deps2));
+  app2.use("*", platformHttpSeam(deps2.hmr));
   const auth = authMiddleware(deps2.authService);
   app2.use("/api/*", auth);
   app2.route("/api/me", meRoutes(deps2));
@@ -11411,9 +12590,10 @@ function createApp(deps2) {
   app2.route("/api/projects/:projectId/usage", usageRoutes(deps2));
   app2.route("/api/sessions", sessionsRoutes(deps2));
   app2.route("/preview", previewRoutes(deps2));
-  if (fs21.existsSync(deps2.config.webDist)) {
-    registerStaticRoutes(app2, deps2.config.webDist);
-  }
+  registerStaticRoutes(app2, async () => {
+    await deps2.hmr.ensure();
+    return deps2.hmr.resolveWebSource() ?? { kind: "dir", dir: deps2.config.webDist };
+  });
   return app2;
 }
 function attributedProjectId(c, deps2) {
@@ -11440,41 +12620,58 @@ var CONTENT_TYPES2 = {
   ".txt": "text/plain; charset=utf-8",
   ".woff2": "font/woff2"
 };
-function registerStaticRoutes(app2, webDist) {
+function registerStaticRoutes(app2, resolveSource) {
   app2.get("*", async (c) => {
     const reqPath = decodeURIComponent(c.req.path);
     if (reqPath.startsWith("/api/")) {
       return c.json(errorBody("not_found", "Endpoint does not exist."), 404);
     }
-    const rel = reqPath.replace(/^\/+/, "");
-    const resolved = path17.resolve(webDist, rel === "" ? "index.html" : rel);
+    const rel = reqPath.replace(/^\/+/, "") || "index.html";
+    const source = await resolveSource();
+    if (source.kind === "mem") {
+      const servedPath = source.files.has(rel) ? rel : "index.html";
+      const content2 = source.files.get(servedPath);
+      if (content2 === void 0) {
+        return c.json(errorBody("not_found", "Resource does not exist."), 404);
+      }
+      const type3 = CONTENT_TYPES2[path17.extname(servedPath).toLowerCase()] ?? "application/octet-stream";
+      return new Response(new Uint8Array(content2), {
+        status: 200,
+        headers: { "Content-Type": type3 }
+      });
+    }
+    const webDist = source.dir;
+    if (!fs22.existsSync(webDist)) {
+      return c.json(errorBody("not_found", "Resource does not exist."), 404);
+    }
+    const resolved = path17.resolve(webDist, rel);
     const base = path17.resolve(webDist);
     const target = resolved === base || resolved.startsWith(base + path17.sep) ? resolved : path17.join(base, "index.html");
     let file = target;
     try {
-      const stat = await fsp.stat(file);
+      const stat = await fsp2.stat(file);
       if (stat.isDirectory()) file = path17.join(file, "index.html");
-      await fsp.access(file);
+      await fsp2.access(file);
     } catch {
       file = path17.join(base, "index.html");
     }
     let content;
     try {
-      content = await fsp.readFile(file);
+      content = await fsp2.readFile(file);
     } catch {
       return c.json(errorBody("not_found", "Resource does not exist."), 404);
     }
-    const type = CONTENT_TYPES2[path17.extname(file).toLowerCase()] ?? "application/octet-stream";
+    const type2 = CONTENT_TYPES2[path17.extname(file).toLowerCase()] ?? "application/octet-stream";
     return new Response(new Uint8Array(content), {
       status: 200,
-      headers: { "Content-Type": type }
+      headers: { "Content-Type": type2 }
     });
   });
 }
 
 // src/config.ts
-import { randomBytes as randomBytes7 } from "crypto";
-import fs22 from "fs";
+import { randomBytes as randomBytes5 } from "crypto";
+import fs23 from "fs";
 import path18 from "path";
 import { fileURLToPath } from "url";
 import { DEFAULT_SERVER_PORT, resolveRoot } from "@prismshadow/penguin-core";
@@ -11482,7 +12679,7 @@ var DAY_MS = 24 * 60 * 60 * 1e3;
 function defaultWebDist() {
   const here = path18.dirname(fileURLToPath(import.meta.url));
   const bundled = path18.resolve(here, "..", "web-dist");
-  if (fs22.existsSync(bundled)) return bundled;
+  if (fs23.existsSync(bundled)) return bundled;
   return path18.resolve(here, "..", "..", "web", "dist");
 }
 function normalizePreviewOrigin(raw) {
@@ -11520,11 +12717,12 @@ function resolveServerConfig(env = process.env) {
     // mode without a pinned value seeds a FULLY random password rather than the
     // printable penguin-<4 digits>: desktop sign-in goes through the shell's token, so
     // the seed never needs to be read — and index.ts deliberately does not print it.
-    seedAdminPassword: env.PENGUIN_SEED_ADMIN_PASSWORD?.trim() || (desktopToken !== null ? randomBytes7(24).toString("base64url") : null),
+    seedAdminPassword: env.PENGUIN_SEED_ADMIN_PASSWORD?.trim() || (desktopToken !== null ? randomBytes5(24).toString("base64url") : null),
     authSessionTtlMs: 7 * DAY_MS,
     authSessionRenewMs: 6 * DAY_MS,
     desktopToken,
-    portFile: env.PENGUIN_PORT_FILE?.trim() || null
+    portFile: env.PENGUIN_PORT_FILE?.trim() || null,
+    trustProxy: env.PENGUIN_TRUST_PROXY === "1"
   };
 }
 
@@ -11566,11 +12764,11 @@ deps.goalsRepo.abortOrphanedActive();
 var appHost = loopbackHostRoles(config.host)?.app ?? config.host;
 var ipv6Loopback = null;
 function writePortFile(file, port) {
-  fs23.mkdirSync(path19.dirname(file), { recursive: true });
+  fs24.mkdirSync(path19.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.tmp`;
-  fs23.writeFileSync(tmp, `${port}
+  fs24.writeFileSync(tmp, `${port}
 `);
-  fs23.renameSync(tmp, file);
+  fs24.renameSync(tmp, file);
 }
 var server = serve({ fetch: app.fetch, hostname: config.host, port: config.port }, (info) => {
   console.log(`penguin-server started: http://${appHost}:${info.port}`);
@@ -11597,7 +12795,7 @@ function cleanupInstanceFiles() {
   releaseServerLock(config.root);
   if (config.portFile !== null) {
     try {
-      fs23.rmSync(config.portFile, { force: true });
+      fs24.rmSync(config.portFile, { force: true });
     } catch {
     }
   }
@@ -11609,6 +12807,7 @@ async function shutdown(signal, exitCode = 0) {
   console.log(`Received ${signal}, shutting down\u2026`);
   deps.scheduler.stop();
   await deps.manager.shutdown(5e3);
+  deps.hmr.dispose();
   deps.channels.dispose();
   ipv6Loopback?.close();
   server.close(() => {