@qredence/fleet 0.5.10 → 0.6.0

package/dist/web/server/{router-CgSWrAYc-5UBYSZTJ.js → router-DWALoX_M-I5CBL7FQ.js}

@@ -1,4 +1,7 @@
 import {
+  ChatMcpDeleteRequestSchema,
+  ChatMcpOAuthLoginRequestSchema,
+  ChatMcpUpsertRequestSchema,
   ChatModelsDiscoverRequestSchema,
   ChatProviderOAuthLoginRequestSchema,
   ChatProviderRemoveRequestSchema,
@@ -12,18 +15,21 @@ import {
   domAnimation,
   initAnalytics,
   isServer
-} from "./chunk-VHBFU4TG.js";
+} from "./chunk-EH4BZ6QM.js";
 import {
   DEFAULT_UI_PREFERENCES,
   isModelPatternEnabled,
   readUiPreferences
-} from "./chunk-54II5QXQ.js";
+} from "./chunk-ETTDO4UO.js";
 import {
   Toaster
 } from "./chunk-KOUEJ3NU.js";
 import {
+  fallbackSessionLabel,
+  meaningfulSessionLabel,
   redactSessionLabelSecrets
-} from "./chunk-QK4CHLVV.js";
+} from "./chunk-PTCKOR23.js";
+import "./chunk-SZJUXVWG.js";
 import "./chunk-TNL4YV63.js";
 import {
   drag,
@@ -36,7 +42,7 @@ import {
   CardHeader,
   CardTitle,
   validateAndNormalizeOpenUIHtmlArtifact
-} from "./chunk-K5ESTT4A.js";
+} from "./chunk-EAE2QXRK.js";
 import {
   ChatNewRequestSchema,
   ChatOpenUIArtifactUpsertRequestSchema,
@@ -54,8 +60,9 @@ import {
   ProjectRenameRequestSchema,
   SessionIdSchema,
   UploadedAttachmentSchema,
+  ZodError,
   external_exports
-} from "./chunk-NRDG2ISJ.js";
+} from "./chunk-YNUWKMNQ.js";
 import {
   KNOWN_PROVIDERS,
   OPENAI_CHAT_COMPLETIONS_PROVIDER_ID,
@@ -89,7 +96,7 @@ import "./chunk-JDCCC7A7.js";
 import "./chunk-L547YHC4.js";
 import "./chunk-MLKGABMK.js";
 
-// web/app/dist/server/assets/router-CgSWrAYc.js
+// web/app/dist/server/assets/router-DWALoX_M.js
 import { useEffect, useLayoutEffect } from "react";
 import { jsx, jsxs } from "react/jsx-runtime";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -123,7 +130,8 @@ function NotFoundPage({ title = "404", description = "The requested page could n
     })
   });
 }
-var globals_default = "/assets/globals-DisQPFtV.css";
+var globals_default = "/assets/globals-B_I1Eq1u.css";
+var inter_latin_wght_normal_default = "/assets/inter-latin-wght-normal-Dx4kXJAl.woff2";
 function makeQueryClient() {
   return new QueryClient({ defaultOptions: { queries: {
     staleTime: 6e4,
@@ -137,7 +145,7 @@ function getQueryClient() {
   if (!browserQueryClient) browserQueryClient = makeQueryClient();
   return browserQueryClient;
 }
-var Route$27 = createRootRoute({
+var Route$29 = createRootRoute({
   head: () => ({
     meta: [
       { charSet: "utf-8" },
@@ -152,6 +160,13 @@ var Route$27 = createRootRoute({
         rel: "stylesheet",
         href: globals_default
       },
+      {
+        rel: "preload",
+        href: inter_latin_wght_normal_default,
+        as: "font",
+        type: "font/woff2",
+        crossOrigin: "anonymous"
+      },
       {
         rel: "icon",
         href: "/favicon-dark.svg",
@@ -200,8 +215,8 @@ function RootDocument({ children }) {
     ] })]
   });
 }
-var $$splitComponentImporter = () => import("./routes-CP_BBhD0-BAWQYGKY.js");
-var Route$26 = createFileRoute("/")({ component: lazyRouteComponent($$splitComponentImporter, "component") });
+var $$splitComponentImporter = () => import("./routes-BBVirYfL-5WXMOT7M.js");
+var Route$28 = createFileRoute("/")({ component: lazyRouteComponent($$splitComponentImporter, "component") });
 var ManagedAttachmentValidationError = class extends Error {
   status;
   constructor(message, status) {
@@ -1950,6 +1965,34 @@ var defaultPersistence = {
 };
 var TOKEN_TTL_MS = 6e5;
 var MAX_DIRECTORY_ENTRIES = 200;
+var SENSITIVE_HOME_DIRECTORY_NAMES = [
+  ".ssh",
+  ".gnupg",
+  ".aws",
+  ".pki",
+  ".docker",
+  ".kube",
+  ".azure",
+  ".gcloud",
+  ".gsutil",
+  ".password-store",
+  ".config/gh"
+];
+function isSameOrWithin(candidate, ancestor) {
+  return candidate === ancestor || candidate.startsWith(`${ancestor}${sep}`);
+}
+async function assertAllowedProjectDirectory(canonical) {
+  if (dirname(canonical) === canonical) throw new Error("Project path must not be a filesystem root");
+  const home = await realpath(homedir()).catch(() => homedir());
+  if (canonical === home) throw new Error("Project path must not be the home directory");
+  for (const name of SENSITIVE_HOME_DIRECTORY_NAMES) if (isSameOrWithin(canonical, join(home, name))) throw new Error("Project path must not be a credentials directory");
+  const xdgConfigHome = process.env.XDG_CONFIG_HOME;
+  if (xdgConfigHome && isAbsolute(xdgConfigHome)) {
+    const canonicalConfigHome = await realpath(xdgConfigHome).catch(() => resolve(xdgConfigHome));
+    if (isSameOrWithin(canonical, join(canonicalConfigHome, "gh"))) throw new Error("Project path must not be a credentials directory");
+  }
+  if (isSameOrWithin(canonical, await realpath("/etc").catch(() => "/etc"))) throw new Error("Project path must not be a system directory");
+}
 var ProjectRegistryPersistenceError = class extends Error {
   constructor(operation, cause) {
     super(`Could not ${operation}. Please try again.`, { cause });
@@ -2047,6 +2090,7 @@ var ProjectRegistry = class {
     if (!candidate || !isAbsolute(candidate)) throw new Error("Project path must be absolute");
     const canonical = await realpath(candidate);
     if (!(await stat(canonical)).isDirectory()) throw new Error("Project path must be a directory");
+    await assertAllowedProjectDirectory(canonical);
     return canonical;
   }
   #findByPath(canonicalPath) {
@@ -2167,7 +2211,7 @@ var ProjectRegistry = class {
     if (options.token) {
       const token = this.#directoryTokens.get(options.token);
       if (!token || token.expiresAt < Date.now()) throw new Error("Directory token expired");
-      path = token.path;
+      path = await this.#canonicalDirectory(token.path);
     } else path = await this.#canonicalDirectory(options.path ?? this.#initialPath);
     const entries = await readdir(path, { withFileTypes: true });
     const directories = [];
@@ -4689,6 +4733,13 @@ function fallbackSessionPath(connectionState, cwd) {
   const sessionDir = connectionState.sessionDir ?? sessionDirectoryForCwd(cwd);
   return resolve(sessionDir, `${connectionState.sessionId}.jsonl`);
 }
+var SessionExportPathError = class extends Error {
+  status = 400;
+  constructor() {
+    super("Export path must stay inside the session project directory");
+    this.name = "SessionExportPathError";
+  }
+};
 function findSessionTreeEntry(nodes, entryId) {
   for (const node of nodes) {
     if (node.entry.id === entryId) return node.entry;
@@ -5094,10 +5145,7 @@ var PrimeBridge = class {
   async resumeSessionById(sessionId, requestedProjectId, options) {
     const live = this.#sessions.get(sessionId);
     if (live) {
-      if (requestedProjectId && live.projectId !== requestedProjectId) {
-        const forkedId = await this.forkSessionIntoProject(sessionId, requestedProjectId);
-        return this.#requireSession(forkedId);
-      }
+      if (requestedProjectId && live.projectId !== requestedProjectId) return void 0;
       return live;
     }
     const match = (await this.#sessionLister()).find((info) => info.sessionId === sessionId || info.id === sessionId);
@@ -5110,10 +5158,7 @@ var PrimeBridge = class {
       if (isSessionNotResumableError(error)) return void 0;
       throw error;
     }
-    if (requestedProjectId && resumed.projectId !== requestedProjectId) {
-      const forkedId = await this.forkSessionIntoProject(resumed.sessionId, requestedProjectId);
-      return this.#requireSession(forkedId);
-    }
+    if (requestedProjectId && resumed.projectId !== requestedProjectId) return void 0;
     return resumed;
   }
   async listSessions(cwd) {
@@ -5586,9 +5631,14 @@ var PrimeBridge = class {
   async followUp(sessionId, text) {
     await this.#requireSession(sessionId).connection.followUp(text);
   }
-  async deleteQueuedMessage(sessionId, lane, index, expectedText) {
+  async mutateQueuedMessage(sessionId, lane, index, expectedText, mutation) {
     const session = this.#requireSession(sessionId);
-    const status = await session.connection.mutateQueuedMessage(lane, index, expectedText, { type: "delete" });
+    const upstreamMutation = mutation.type === "delete" ? { type: "delete" } : {
+      type: "replace",
+      text: mutation.text,
+      lane: mutation.lane ?? lane
+    };
+    const status = await session.connection.mutateQueuedMessage(lane, index, expectedText, upstreamMutation);
     const queue = await session.connection.getQueue();
     return {
       status,
@@ -5598,6 +5648,9 @@ var PrimeBridge = class {
       }
     };
   }
+  async deleteQueuedMessage(sessionId, lane, index, expectedText) {
+    return this.mutateQueuedMessage(sessionId, lane, index, expectedText, { type: "delete" });
+  }
   async abort(sessionId) {
     const session = this.#requireSession(sessionId);
     this.#dialogs.cancelAll(sessionId, "user-abort");
@@ -5714,15 +5767,43 @@ var PrimeBridge = class {
   /** /export — write the session to HTML (default) or JSONL (path ends with .jsonl). */
   async exportSession(sessionId, outputPath) {
     const session = this.#requireSession(sessionId);
+    const confinedPath = await this.#confineExportPath(session, outputPath);
     if (outputPath?.endsWith(".jsonl")) return {
-      path: await session.connection.exportToJsonl(outputPath),
+      path: await session.connection.exportToJsonl(confinedPath),
       format: "jsonl"
     };
     return {
-      path: await session.connection.exportToHtml(outputPath),
+      path: await session.connection.exportToHtml(confinedPath),
       format: "html"
     };
   }
+  /**
+  * Confine an explicit /export path inside the session's project directory
+  * (the connection's live cwd). Absolute paths and `..` escapes that leave
+  * the directory throw a 400-status error; an omitted path passes through
+  * untouched so the default export location is unchanged.
+  */
+  async #confineExportPath(session, outputPath) {
+    if (outputPath === void 0) return void 0;
+    const { cwd } = await session.connection.getState();
+    const root2 = resolve(cwd);
+    const canonicalRoot = await realpath(root2).catch(() => root2);
+    const candidate = resolve(root2, outputPath);
+    const existingCandidate = await realpath(candidate).catch(() => void 0);
+    if (existingCandidate && existingCandidate !== canonicalRoot && !existingCandidate.startsWith(`${canonicalRoot}${sep}`)) throw new SessionExportPathError();
+    let ancestor = dirname(candidate);
+    while (true) {
+      const resolvedAncestor = await realpath(ancestor).catch(() => void 0);
+      if (resolvedAncestor) {
+        if (resolvedAncestor !== canonicalRoot && !resolvedAncestor.startsWith(`${canonicalRoot}${sep}`)) throw new SessionExportPathError();
+        break;
+      }
+      const parent = dirname(ancestor);
+      if (parent === ancestor) throw new SessionExportPathError();
+      ancestor = parent;
+    }
+    return candidate;
+  }
   /** /reload — re-scan keybindings, extensions, skills, prompts, themes. */
   async reloadResources(_sessionId) {
     await Promise.all([...this.#sessions.values()].map((session) => session.connection.reload?.()));
@@ -5815,9 +5896,9 @@ var PrimeBridge = class {
   }
   /** Fork the complete persisted history into another registered project. */
   async forkSessionIntoProject(sessionId, targetProjectId) {
+    const targetCwd = await getPrimeConfig().projectRegistry.cwdForProject(targetProjectId);
     const source = this.#sessions.get(sessionId) ?? await this.resumeSessionById(sessionId);
     if (!source) throw new Error(`Unknown session: ${sessionId}`);
-    const targetCwd = await getPrimeConfig().projectRegistry.cwdForProject(targetProjectId);
     await source.connection.waitForIdle();
     const sourceState = await source.connection.getState();
     const sourcePath = sourceState.sessionFile;
@@ -5838,7 +5919,7 @@ var PrimeBridge = class {
     await copyManagedPlanPresentationsForFork(source, forked, (await this.getMessages(forked.sessionId)).length);
     forked.mapperState.presentation = source.mapperState.presentation;
     this.#persistPresentation(forked.sessionId, forked.sessionPath, forked.mapperState.presentation);
-    return forked.sessionId;
+    return this.#requireProjectSession(forked.sessionId, targetProjectId).sessionId;
   }
   /** Reads message history from a live session, or from the JSONL transcript for a cold session. */
   async getMessages(sessionId) {
@@ -5880,6 +5961,17 @@ var PrimeBridge = class {
     if (!session) throw new Error(`Unknown session: ${sessionId}`);
     return session;
   }
+  /**
+  * Project-membership gate over the bridge's session records. Returns the
+  * live session only when its project linkage matches the caller-asserted
+  * project, and throws `Unknown session` otherwise so foreign sessions are
+  * indistinguishable from missing ones.
+  */
+  #requireProjectSession(sessionId, projectId) {
+    const session = this.#requireSession(sessionId);
+    if (session.projectId !== projectId) throw new Error(`Unknown session: ${sessionId}`);
+    return session;
+  }
 };
 var globalStore = globalThis;
 function getBridge() {
@@ -5890,7 +5982,20 @@ function getBridge() {
   });
   return globalStore.__primeBridge;
 }
+function isLoopbackHostname(hostname) {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  if (host === "localhost") return true;
+  const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  const mapped = bare.startsWith("::ffff:") ? bare.slice(7) : bare;
+  if (mapped === "::1" || mapped === "0:0:0:0:0:0:0:1") return true;
+  if (mapped.startsWith("127.")) {
+    const parts = mapped.split(".");
+    if (parts.length === 4 && parts.every((p) => /^\d{1,3}$/.test(p) && Number(p) <= 255)) return true;
+  }
+  return false;
+}
 function getResponseStatus(error) {
+  if (error instanceof ZodError || error instanceof Error && error.name === "ZodError") return 422;
   if (error && typeof error === "object" && "status" in error) {
     const status = error.status;
     if (typeof status === "number" && status >= 400 && status < 600) return status;
@@ -5907,8 +6012,14 @@ function getErrorMessage(error) {
   }
 }
 function safeErrorMessage(error) {
-  return getErrorMessage(error).replace(/(['"])(\/(?!\/)[^'"\n]*|[A-Za-z]:\\[^'"\n]*)\1/g, "$1[local path]$1").replace(/(^|[\s'"(])\/(?!\/)[^'"\s)]+/g, "$1[local path]").replace(/[A-Za-z]:\\[^'"\s)]+/g, "[local path]");
+  const message = getErrorMessage(error);
+  return SECRET_PATTERNS.reduce((scrubbed, [pattern, replacement]) => scrubbed.replace(pattern, replacement), message.replace(/(['"])(\/(?!\/)[^'"\n]*|[A-Za-z]:\\[^'"\n]*)\1/g, "$1[local path]$1").replace(/(^|[\s'"(])\/(?!\/)[^'"\s)]+/g, "$1[local path]").replace(/[A-Za-z]:\\[^'"\s)]+/g, "[local path]"));
 }
+var SECRET_PATTERNS = [
+  [/\b(bearer\s+)[A-Za-z0-9\-._~+/=]{8,}/gi, "$1[redacted]"],
+  [/(api[_-]?key\s*[:=]\s*)["']?[^"'\s;,]+["']?/gi, "$1[redacted]"],
+  [/\bkey(\s*=\s*)[^"'\s;&,]+/gi, "key$1[redacted]"]
+];
 var DAEMON_DISCONNECT_PATTERNS = [/cannot send daemon command/i, /daemon is not connected/i];
 function isDaemonDisconnectError(error) {
   const message = getErrorMessage(error);
@@ -5928,14 +6039,43 @@ function chatErrorEnvelope(error) {
     message: safeErrorMessage(error)
   };
 }
-function wrapApiHandler(handler) {
+function isOriginAllowed(request) {
+  const origin = request.headers.get("origin");
+  if (!origin) return true;
+  let originUrl;
+  try {
+    originUrl = new URL(origin);
+  } catch {
+    return false;
+  }
+  if (isLoopbackHostname(originUrl.hostname)) return true;
+  try {
+    return originUrl.host.toLowerCase() === new URL(request.url).host.toLowerCase();
+  } catch {
+    return true;
+  }
+}
+function wrapApiHandler(handler, request) {
+  if (request && request.method.toUpperCase() !== "GET" && !isOriginAllowed(request)) return Promise.resolve(Response.json({
+    code: "UNKNOWN_ERROR",
+    message: "Cross-origin request rejected."
+  }, { status: 403 }));
   return handler().catch((error) => {
     const envelope = chatErrorEnvelope(error);
-    if (envelope.code === "NETWORK_DISCONNECTED") process.stderr.write(`[api] daemon transport failure: ${getErrorMessage(error)}
+    if (envelope.code === "NETWORK_DISCONNECTED") process.stderr.write(`[api] daemon transport failure: ${safeErrorMessage(error)}
 `);
     return Response.json(envelope, { status: getResponseStatus(error) });
   });
 }
+async function requireProjectSession(session) {
+  if (!session?.projectId) return false;
+  try {
+    await getPrimeConfig().projectRegistry.get(session.projectId);
+  } catch {
+    return false;
+  }
+  return true;
+}
 function resolveChatStreamingBehavior(streamingBehavior) {
   return streamingBehavior ?? "steer";
 }
@@ -5944,7 +6084,8 @@ function chooseChatStartId(mapperState, streamingBehavior, sessionIsStreaming =
   return crypto.randomUUID();
 }
 async function handleChatChildPost(bridge, parentSessionId, childId, message, streamingBehavior) {
-  if (!(bridge.getSession(parentSessionId) ?? await bridge.resumeSessionById(parentSessionId, void 0, {}))) return Response.json({ message: `Unknown session: ${parentSessionId}` }, { status: 404 });
+  const session = bridge.getSession(parentSessionId) ?? await bridge.resumeSessionById(parentSessionId, void 0, {});
+  if (!session || !await requireProjectSession(session)) return Response.json({ message: `Unknown session: ${parentSessionId}` }, { status: 404 });
   const encoder = new TextEncoder();
   const stream = new ReadableStream({ start(controller) {
     let closed = false;
@@ -6032,7 +6173,7 @@ function handleChatPost(request) {
     if (process.env.PRIME_BRIDGE_DEBUG === "1") process.stderr.write(`[chat] received session=${targetSessionId.slice(0, 8)} bytes=${message.length}
 `);
     const session = bridge.getSession(targetSessionId) ?? await bridge.resumeSessionById(targetSessionId, void 0, { openUI });
-    if (!session) return Response.json({ message: `Unknown session: ${targetSessionId}` }, { status: 404 });
+    if (!session || !await requireProjectSession(session)) return Response.json({ message: `Unknown session: ${targetSessionId}` }, { status: 404 });
     const uploadAttachments = (body.attachments ?? []).filter((attachment) => attachment.kind === "upload");
     let uploadInspections;
     try {
@@ -6186,7 +6327,7 @@ ${attachmentContext.join("\n\n")}` : message;
       Connection: "keep-alive",
       "X-Accel-Buffering": "no"
     } });
-  });
+  }, request);
 }
 var BodySchema$3 = external_exports.object({
   sessionId: SessionIdSchema.optional(),
@@ -6199,6 +6340,7 @@ function handleChatAbortPost(request) {
     const sessionId = body.sessionId;
     if (!sessionId) return Response.json({ message: "abort requires sessionId" }, { status: 400 });
     const bridge = getBridge();
+    if (!await requireProjectSession(bridge.getSession(sessionId) ?? await bridge.resumeSessionById(sessionId))) return Response.json({ message: `Unknown session: ${sessionId}` }, { status: 404 });
     if (body.childId) {
       if (!await bridge.abortRlmChild(sessionId, body.childId)) return Response.json({ message: `No active subagent turn: ${body.childId}` }, { status: 404 });
       return Response.json({
@@ -6212,13 +6354,33 @@ function handleChatAbortPost(request) {
       ok: true,
       sessionId
     });
-  });
+  }, request);
 }
 var AttachmentIdSchema = external_exports.uuid();
 var ATTACHMENT_WRITE_CONCURRENCY = 8;
+function isSafeRasterImage(mimeType, data) {
+  if (mimeType === "image/png") return data.length >= 8 && data.subarray(0, 8).every((byte, index) => byte === [
+    137,
+    80,
+    78,
+    71,
+    13,
+    10,
+    26,
+    10
+  ][index]);
+  if (mimeType === "image/jpeg") return data.length >= 3 && data[0] === 255 && data[1] === 216 && data[2] === 255;
+  if (mimeType === "image/gif") {
+    const header = new TextDecoder().decode(data.subarray(0, 6));
+    return header === "GIF87a" || header === "GIF89a";
+  }
+  return mimeType === "image/webp" && data.length >= 12 && new TextDecoder().decode(data.subarray(0, 4)) === "RIFF" && new TextDecoder().decode(data.subarray(8, 12)) === "WEBP";
+}
 async function resolveSession(sessionId) {
   const bridge = getBridge();
-  return bridge.getSession(sessionId) ?? await bridge.resumeSessionById(sessionId);
+  const session = bridge.getSession(sessionId) ?? await bridge.resumeSessionById(sessionId);
+  if (!await requireProjectSession(session)) return void 0;
+  return session;
 }
 function handleChatAttachmentsPost(request) {
   return wrapApiHandler(async () => {
@@ -6241,7 +6403,7 @@ function handleChatAttachmentsPost(request) {
     }
     const attachments = settled.flatMap((result) => result.status === "fulfilled" ? [result.value] : []);
     return Response.json({ attachments });
-  });
+  }, request);
 }
 function handleChatAttachmentGet(request) {
   return wrapApiHandler(async () => {
@@ -6252,18 +6414,19 @@ function handleChatAttachmentGet(request) {
     if (!session) return Response.json({ message: `Unknown session: ${sessionId}` }, { status: 404 });
     const attachment = await readManagedAttachment(session, attachmentId).catch(() => void 0);
     if (!attachment) return Response.json({ message: "Attachment not found" }, { status: 404 });
+    const safeRasterImage = isSafeRasterImage(attachment.metadata.mimeType, attachment.data);
     return new Response(attachment.data, { headers: {
-      "Content-Type": attachment.metadata.mimeType,
-      "Content-Disposition": `inline; filename*=UTF-8''${encodeURIComponent(attachment.metadata.name)}`,
+      "Content-Type": safeRasterImage ? attachment.metadata.mimeType : "application/octet-stream",
+      ...safeRasterImage ? {} : { "Content-Disposition": `attachment; filename*=UTF-8''${encodeURIComponent(attachment.metadata.name)}` },
       "Cache-Control": "private, no-store",
       "X-Content-Type-Options": "nosniff"
     } });
-  });
+  }, request);
 }
 var BodySchema$2 = external_exports.object({
   sessionId: SessionIdSchema,
   command: external_exports.string(),
-  args: external_exports.string().optional()
+  args: external_exports.string().max(1024).optional()
 });
 function handleChatCommandPost(request) {
   return wrapApiHandler(async () => {
@@ -6338,7 +6501,7 @@ function handleChatCommandPost(request) {
       default:
         return Response.json({ message: `Unknown slash command: /${body.command}` }, { status: 404 });
     }
-  });
+  }, request);
 }
 async function cwdForRequest(request) {
   const projectIdParam = new URL(request.url).searchParams.get("projectId");
@@ -6556,7 +6719,7 @@ function handleChatCommandsGet(request) {
       ],
       diagnostics
     });
-  });
+  }, request);
 }
 function shouldReplaySseEvent(event, pendingQuestionIds) {
   if (!pendingQuestionIds) return true;
@@ -6705,7 +6868,10 @@ function handleChatEventsGet(request) {
       const childId = SessionIdSchema.safeParse(childIdParam);
       if (!parentSessionId.success || !childId.success) return Response.json({ message: "Invalid subagent stream identifiers" }, { status: 400 });
       if (streamGenerationParam !== null && !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(streamGenerationParam)) return Response.json({ message: "Invalid child stream generation" }, { status: 400 });
-      const childStream = await getBridge().openRlmChildStream(parentSessionId.data, childId.data, {
+      const bridge = getBridge();
+      const parent = bridge.getSession(parentSessionId.data) ?? await bridge.resumeSessionById(parentSessionId.data);
+      if (!parent || !await requireProjectSession(parent)) return Response.json({ message: "Unknown live subagent stream" }, { status: 404 });
+      const childStream = await bridge.openRlmChildStream(parentSessionId.data, childId.data, {
         ...streamGenerationParam ? { streamGeneration: streamGenerationParam } : {},
         lastEventId: lastEventIdFor(request, url)
       });
@@ -6725,367 +6891,13 @@ function handleChatEventsGet(request) {
     if (!sessionIdParam) return Response.json({ message: "SSE requires ?sessionId=" }, { status: 400 });
     const sessionId = SessionIdSchema.safeParse(sessionIdParam);
     if (!sessionId.success) return Response.json({ message: "Invalid session identifier" }, { status: 400 });
-    return createSseResponse(request, getBridge(), { sessionId: sessionId.data }, lastEventIdFor(request, url));
-  });
-}
-var BodySchema$1 = external_exports.object({
-  sessionId: SessionIdSchema,
-  model: external_exports.object({
-    provider: external_exports.string(),
-    id: external_exports.string()
-  })
-});
-function handleChatModelPost(request) {
-  return wrapApiHandler(async () => {
-    const raw = await request.json().catch(() => ({}));
-    const body = BodySchema$1.parse(raw);
-    await getBridge().setModel(body.sessionId, {
-      provider: body.model.provider,
-      id: body.model.id
-    });
-    return Response.json({ ok: true });
-  });
-}
-function toPatternCandidate(model) {
-  return {
-    id: model.id,
-    name: model.name,
-    provider: model.provider,
-    modelId: model.id,
-    key: `${model.provider}/${model.id}`
-  };
-}
-function handleChatModelsGet(request) {
-  return wrapApiHandler(async () => {
-    const config = getPrimeConfig();
-    const cwd = await cwdForRequest(request);
-    const settings = config.settingsFor(cwd);
-    const registry = config.modelRegistry;
-    const scope = new URL(request.url).searchParams.get("scope") === "all" ? "all" : "enabled";
-    let models = registry.getAll();
-    if (scope === "enabled") {
-      models = models.filter((model) => registry.hasConfiguredAuth(model));
-      const patterns = settings.getEnabledModels();
-      if (patterns !== void 0) models = models.filter((model) => isModelPatternEnabled(toPatternCandidate(model), patterns));
-    }
-    const diagnostics = [];
-    const defaultProvider = settings.getDefaultProvider();
-    const defaultModel = settings.getDefaultModel();
-    const defaultThinkingLevel = settings.getDefaultThinkingLevel();
-    const selectedModelKey = defaultProvider && defaultModel ? `${defaultProvider}/${defaultModel}` : void 0;
-    return Response.json({
-      models: models.map((m) => {
-        const thinkingLevels = getSupportedThinkingLevels(m);
-        const fallback = m.reasoning ? "medium" : "off";
-        return {
-          key: `${m.provider}/${m.id}`,
-          provider: m.provider,
-          id: m.id,
-          name: m.name,
-          reasoning: m.reasoning,
-          input: m.input,
-          contextWindow: m.contextWindow,
-          maxTokens: m.maxTokens,
-          available: registry.hasConfiguredAuth(m),
-          thinkingLevels,
-          defaultThinkingLevel: thinkingLevels.includes(fallback) ? fallback : thinkingLevels[0] ?? "off"
-        };
-      }),
-      ...selectedModelKey ? { selectedModelKey } : {},
-      ...defaultProvider ? { defaultProvider } : {},
-      ...defaultModel ? { defaultModel } : {},
-      ...defaultThinkingLevel ? { defaultThinkingLevel } : {},
-      diagnostics
-    });
-  });
-}
-function storedApiForCustomProvider(api) {
-  return api === "google-genai" ? "google-generative-ai" : api;
-}
-function uiApiForCustomProvider(value) {
-  if (value === "google-generative-ai") return "google-genai";
-  return isPiCustomProviderApi(value) ? value : void 0;
-}
-function envVarNameForManagedProvider(providerId) {
-  if (providerId === "openai-chat-completions") return "OPENAI_CHAT_COMPLETIONS_API_KEY";
-  const slug = providerId.slice(providerId.indexOf("+") + 1).toUpperCase().replace(/[^A-Z0-9]+/g, "_");
-  return isOccProviderId(providerId) ? `OPENAI_CHAT_COMPLETIONS_${slug}_API_KEY` : `CUSTOM_${slug}_API_KEY`;
-}
-function readModelsJson(filePath) {
-  try {
-    if (!existsSync(filePath)) return {};
-    return parseModelsJson(readFileSync(filePath, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-function stripJsonComments(input) {
-  return input.replace(/"(?:\\.|[^"\\])*"|\/\/[^\n]*/g, (match) => match[0] === '"' ? match : "").replace(/"(?:\\.|[^"\\])*"|,(\s*[}\]])/g, (match, tail) => tail ?? (match[0] === '"' ? match : ""));
-}
-function parseModelsJson(raw) {
-  const parsed = JSON.parse(stripJsonComments(raw));
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("models.json must contain an object");
-  return parsed;
-}
-function readModelsJsonForWrite(filePath) {
-  if (!existsSync(filePath)) return {};
-  try {
-    return parseModelsJson(readFileSync(filePath, "utf-8"));
-  } catch (error) {
-    throw new Error(`Refusing to update models.json because it could not be parsed: ${error instanceof Error ? error.message : error}`);
-  }
-}
-function mergeModelDefinitions(existing, incoming) {
-  const existingById = new Map((existing ?? []).map((model) => [model.id, model]));
-  const seen = /* @__PURE__ */ new Set();
-  return incoming.flatMap((model) => {
-    if (seen.has(model.id)) return [];
-    seen.add(model.id);
-    return [{
-      ...existingById.get(model.id),
-      ...model
-    }];
-  });
-}
-function listCustomProviders(filePath) {
-  return readModelsJson(filePath).providers ?? {};
-}
-function writeModelsJson(filePath, data) {
-  mkdirSync(dirname(filePath), {
-    recursive: true,
-    mode: 448
-  });
-  const serialized = `${JSON.stringify(data, null, "	")}
-`;
-  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync(tmpPath, serialized, "utf-8");
-  renameSync(tmpPath, filePath);
-}
-function upsertCustomProvider(filePath, providerId, input) {
-  const data = readModelsJsonForWrite(filePath);
-  const providers = { ...data.providers ?? {} };
-  const existing = providers[providerId] ?? {};
-  providers[providerId] = {
-    ...existing,
-    name: input.name ?? existing.name,
-    baseUrl: input.baseUrl,
-    api: storedApiForCustomProvider(input.api),
-    apiKey: input.apiKey,
-    models: mergeModelDefinitions(existing.models, input.models)
-  };
-  writeModelsJson(filePath, {
-    ...data,
-    providers
-  });
-}
-function addCustomProviderModelIds(filePath, providerId, modelIds) {
-  const data = readModelsJsonForWrite(filePath);
-  const providers = { ...data.providers ?? {} };
-  const existing = providers[providerId];
-  if (!existing) return;
-  providers[providerId] = {
-    ...existing,
-    models: mergeModelDefinitions(existing.models, [...existing.models ?? [], ...modelIds.map((id) => ({ id }))])
-  };
-  writeModelsJson(filePath, {
-    ...data,
-    providers
-  });
-}
-function removeCustomProvider(filePath, providerId) {
-  const data = readModelsJsonForWrite(filePath);
-  const providers = data.providers;
-  if (!providers || !(providerId in providers)) return;
-  const next = { ...providers };
-  delete next[providerId];
-  writeModelsJson(filePath, {
-    ...data,
-    providers: next
-  });
-}
-function isDiscoverableEntry(entry) {
-  const baseUrl = entry?.baseUrl;
-  if (!baseUrl) return false;
-  const api = uiApiForCustomProvider(entry?.api);
-  if (api && !isOccFamilyApi(api)) return false;
-  if (entry?.api && !api) return false;
-  try {
-    const parsed = new URL(baseUrl);
-    return parsed.protocol === "https:" || parsed.protocol === "http:";
-  } catch {
-    return false;
-  }
-}
-function openAiModelsUrl(baseUrl) {
-  const parsed = new URL(baseUrl);
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error("model discovery requires an http(s) URL");
-  const path = parsed.pathname.replace(/\/+$/, "");
-  parsed.pathname = path.endsWith("/v1") ? `${path}/models` : `${path}/v1/models`;
-  parsed.search = "";
-  parsed.hash = "";
-  return parsed;
-}
-function handleChatModelsDiscoverPost(request) {
-  return wrapApiHandler(async () => {
-    const raw = await request.json().catch(() => ({}));
-    const body = ChatModelsDiscoverRequestSchema.parse(raw);
-    const config = getPrimeConfig();
-    const apiKey = await config.modelRegistry.getApiKeyForProvider(body.providerId);
-    if (!apiKey) return Response.json({
-      providerId: body.providerId,
-      models: []
-    });
-    const provider = body.providerId;
-    const entry = listCustomProviders(`${config.agentDir}/models.json`)[provider];
-    const api = uiApiForCustomProvider(entry?.api);
-    if (entry?.api && !api || api && !isOccFamilyApi(api)) return Response.json({
-      providerId: provider,
-      models: []
-    });
-    const baseUrl = entry?.baseUrl;
-    if (!baseUrl) return Response.json({
-      providerId: provider,
-      models: []
-    });
-    try {
-      const modelsUrl = openAiModelsUrl(baseUrl);
-      const response = await fetch(modelsUrl, {
-        headers: { Authorization: `Bearer ${apiKey}` },
-        signal: AbortSignal.timeout(1e4)
-      });
-      if (!response.ok) return Response.json({
-        providerId: provider,
-        models: []
-      });
-      const models = ((await response.json()).data ?? []).map((m) => ({
-        key: `${provider}/${m.id}`,
-        provider,
-        id: m.id,
-        name: m.id,
-        reasoning: false,
-        input: ["text"],
-        available: true,
-        defaultThinkingLevel: "off",
-        thinkingLevels: ["off"]
-      }));
-      if (models.length > 0) {
-        addCustomProviderModelIds(`${config.agentDir}/models.json`, provider, models.map((model) => model.id));
-        config.reloadAuth();
-      }
-      return Response.json({
-        providerId: provider,
-        models
-      });
-    } catch {
-      return Response.json({
-        providerId: provider,
-        models: []
-      });
+    {
+      const bridge = getBridge();
+      const session = bridge.getSession(sessionId.data) ?? await bridge.resumeSessionById(sessionId.data);
+      if (!session || !await requireProjectSession(session)) return Response.json({ message: `Unknown session: ${sessionId.data}` }, { status: 404 });
     }
-  });
-}
-function toThinkingLevel(level) {
-  return level;
-}
-function handleChatNewPost(request) {
-  return wrapApiHandler(async () => {
-    const bridge = getBridge();
-    const registry = getPrimeConfig().projectRegistry;
-    const raw = await request.json().catch(() => ({}));
-    const body = ChatNewRequestSchema.parse(raw);
-    const projectId = body.projectId ?? await registry.projectIdForCwd(getPrimeConfig().defaultCwd) ?? (await registry.register(getPrimeConfig().defaultCwd)).projectId;
-    const project = await registry.get(projectId);
-    bridge.ensureKernelReady(project.canonicalPath).catch(() => {
-    });
-    const session = await bridge.createSession({
-      cwd: project.canonicalPath,
-      projectId,
-      thinkingLevel: toThinkingLevel(body.thinkingLevel),
-      mode: body.mode,
-      openUI: body.openUI
-    });
-    if (body.model) {
-      await bridge.setModel(session.sessionId, body.model);
-      const thinking = body.model.thinkingLevel ?? body.thinkingLevel;
-      if (thinking) await session.connection.setThinkingLevel(toThinkingLevel(thinking));
-    }
-    return Response.json({
-      session: {
-        sessionId: session.sessionId,
-        projectId
-      },
-      messages: [],
-      planPresentations: [],
-      presentation: bridge.getPresentation(session.sessionId)
-    });
-  });
-}
-function record(value) {
-  return typeof value === "object" && value !== null ? value : void 0;
-}
-function artifactIndexFor(artifact) {
-  const input = record(artifact.input);
-  return typeof input?.artifactIndex === "number" ? input.artifactIndex : void 0;
-}
-function handleChatOpenUIArtifactPut(request) {
-  return wrapApiHandler(async () => {
-    const raw = await request.json().catch(() => ({}));
-    const parsed = ChatOpenUIArtifactUpsertRequestSchema.safeParse(raw);
-    if (!parsed.success) return Response.json({ message: "Invalid OpenUI artifact request." }, { status: 400 });
-    const body = parsed.data;
-    const validation = validateAndNormalizeOpenUIHtmlArtifact(body.artifact);
-    if (!validation.ok) return Response.json({ message: validation.reason }, { status: validation.status ?? 400 });
-    const bridge = getBridge();
-    const session = bridge.getSession(body.sessionId) ?? await bridge.resumeSessionById(body.sessionId);
-    if (!session) return Response.json({ message: `Unknown session: ${body.sessionId}` }, { status: 404 });
-    const messages = await bridge.getMessages(session.sessionId);
-    const incomingId = body.assistantMessageId;
-    const exact = messages.find((message) => message.role === "assistant" && message.id === incomingId);
-    const existing = bridge.getPresentation(session.sessionId).artifactRuns.flatMap((run) => run.artifacts).filter((artifact2) => artifact2.kind === "openui-html").find((artifact2) => artifactIndexFor(artifact2) === body.artifactIndex && (record(artifact2.input)?.clientMessageId === incomingId || artifact2.sourceMessageId === incomingId));
-    const fallback = existing ? void 0 : [...messages].reverse().find((message) => message.role === "assistant");
-    const assistantMessageId = exact?.id ?? existing?.sourceMessageId ?? fallback?.id;
-    if (!assistantMessageId) return Response.json({ message: "Unable to associate OpenUI artifact with an assistant message." }, { status: 409 });
-    const artifact = {
-      id: stablePresentationId(`${assistantMessageId}:openui-html:${body.artifactIndex}`),
-      runId: stablePresentationId(`${assistantMessageId}:openui`),
-      sourceMessageId: assistantMessageId,
-      kind: "openui-html",
-      title: validation.value.title,
-      status: "success",
-      input: {
-        clientMessageId: incomingId,
-        artifactIndex: body.artifactIndex
-      },
-      output: validation.value,
-      timestamp: Date.now()
-    };
-    const presentation = await bridge.upsertPresentationArtifact(session.sessionId, artifact);
-    return Response.json({
-      artifact,
-      presentation
-    });
-  });
-}
-function handleChatPlanPresentationPut(request) {
-  return wrapApiHandler(async () => {
-    const body = ChatPlanPresentationUpsertRequestSchema.parse(await request.json().catch(() => ({})));
-    const bridge = getBridge();
-    const session = bridge.getSession(body.sessionId) ?? await bridge.resumeSessionById(body.sessionId);
-    if (!session) return Response.json({ message: `Unknown session: ${body.sessionId}` }, { status: 404 });
-    const messages = await bridge.getMessages(body.sessionId);
-    const incomingId = body.presentation.assistantMessageId;
-    const known = messages.find((message) => message.id === incomingId && message.role === "assistant");
-    const existing = (await loadManagedPlanPresentations(session)).find((item) => item.assistantMessageId === incomingId || item.clientMessageId === incomingId);
-    const fallback = existing ? void 0 : [...messages].reverse().find((message) => message.role === "assistant");
-    const assistantMessageId = known?.id ?? existing?.assistantMessageId ?? fallback?.id;
-    if (!assistantMessageId) return Response.json({ message: "Unable to associate Plan presentation with an assistant message" }, { status: 409 });
-    const clientMessageId = incomingId !== assistantMessageId ? existing?.clientMessageId ?? incomingId : existing?.clientMessageId;
-    return Response.json({ presentation: await upsertManagedPlanPresentation(session, {
-      ...body.presentation,
-      assistantMessageId,
-      ...clientMessageId ? { clientMessageId } : {}
-    }) });
-  });
+    return createSseResponse(request, getBridge(), { sessionId: sessionId.data }, lastEventIdFor(request, url));
+  }, request);
 }
 var PRIME_BUTTERFLY_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 178 178" aria-hidden="true"><path fill="currentColor" d="m 123.322,84.092671 c -0.192,0.0065 -0.43,0.0147 -0.74,0.0147 l -0.018,-0.0247 c -0.873,0.1977 -1.958,0.1266 -3.067,0.0537 -3.29,-0.216 -6.799,-0.4465 -5.635,6.2824 0.259,1.4822 -1.538,1.8465 -2.73,1.9082 -3.384,0.1853 -6.78,0.2594 -10.171,0.1915 -0.641,-0.0106 -1.2979,-0.5506 -1.8904,-1.0388 -0.1022,-0.0844 -0.2034,-0.1673 -0.3016,-0.2457 -0.1052,-0.0865 0.2898,-1.2042 0.4942,-1.2166 3.3078,-0.1931 4.5068,-2.4361 5.7028,-4.6724 0.603,-1.1253 1.204,-2.2488 2.072,-3.1088 7.856,-7.7874 15.878,-15.4265 25.054,-21.7008 0.895,-0.6114 1.989,-1.1733 2.73,-0.1111 0.571,0.8205 0.036,1.2854 -0.512,1.7627 -0.24,0.2088 -0.482,0.4199 -0.637,0.6642 -0.554,0.8792 -1.538,1.5273 -2.514,2.1717 -1.92,1.2655 -3.82,2.5172 -2.408,5.4798 1.225,2.5651 0.129,3.0202 -1.555,3.7198 l -0.069,0.0287 c -0.72,0.3021 -1.458,0.5764 -2.194,0.8506 -1.568,0.5835 -3.134,1.1662 -4.537,2.0149 -1.408,0.8522 -2.081,2.5134 0.222,3.4954 5.033,2.1428 18.064,-1.2784 20.608,-5.9965 2.377,-4.4147 5.931,-7.6891 9.481,-10.9611 1.992,-1.836 3.984,-3.6712 5.767,-5.7067 3.844,-4.3849 8.344,-8.1939 12.846,-12.005 2.239,-1.8944 4.478,-3.78938 6.637,-5.75588 1.624,-1.48207 2.297,-3.43353 1.026,-5.56412 -1.267,-2.118215 -3.416,-2.402287 -5.435,-1.926802 -13.309,3.130982 -26.166,7.355122 -37.585,15.241302 -18.23,12.5919 -36.4911,25.1406 -54.9002,37.4669 -6.2743,4.2056 -10.0723,2.1491 -12.1657,-5.1318 -4.6502,-16.1676 -11.4681,-30.2664 -31.0569,-32.4587 -7.1574,-0.8028 -12.4066,3.6807 -11.3692,10.7949 0.5249,3.6065 0.0495,7.003 -1.6858,10.3872 -0.3827,0.7472 -0.7689,1.4947 -1.1556,2.243 -2.672,5.1706 -5.3671,10.3857 -7.0394,15.8885 -0.1399,0.4602 -0.3002,0.9444 -0.4654,1.4437 -1.4909,4.5052 -3.3862,10.2323 5.659,10.5492 0.3705,0.0123 1.0808,0.944799 0.9943,1.290699 -0.1976,0.8213 -0.5991,1.797 -1.2413,2.2725 -8.6705,6.3917 -15.79706,14.1294 -18.860151,24.5971 -1.550066,5.2865 -0.524909,10.7765 3.989391,14.8705 3.22984,2.928 7.35516,4.625 10.97396,2.162 3.3009,-2.247 6.9232,-3.754 10.538,-5.259 3.1819,-1.324 6.358,-2.646 9.3041,-4.468 0.7101,-0.439 1.5727,-0.841 2.4456,-1.248 2.4138,-1.1228 4.9063,-2.2843 4.4709,-4.3841 -0.6854,-3.2908 -4.1623,-6.3418 -7.0586,-8.7384 -2.8716,-2.3769 -10.1897,-18.3411 -9.3189,-22.176099 1.2193,-5.3704 3.9645,-10.0201 6.7125,-14.6744 2.3458,-3.9731 4.6935,-7.9497 6.0956,-12.3806 0.5804,-1.828 2.8037,-2.8284 4.9466,-2.0997 1.4543,0.4928 1.2068,1.8278 0.9762,3.0715 -0.0063,0.0344 -0.0127,0.0685 -0.019,0.1027 -0.8688,4.7802 -1.721,9.566 -2.5733,14.3517 -0.4261,2.3924 -0.8521,4.7847 -1.2803,7.1762 -0.2717,1.5316 0.2038,2.7544 1.7909,3.0631 3.0569,0.599 2.989,1.9762 1.6119,4.341499 -1.4636,2.5072 -1.6674,5.5703 -0.0309,7.8861 1.6427,2.3282 4.3908,2.8161 7.1821,1.4204 1.7415,-0.8646 3.094,-0.0927 3.0755,1.6612 -0.1112,9.3688 3.8103,7.2561 8.584,3.1681 0.439,-0.3763 1.0373,-0.5846 1.6152,-0.7857 0.1048,-0.0366 0.2091,-0.0728 0.3116,-0.1098 0.4529,-0.1616 0.9062,-0.3224 1.3595,-0.4833 8.986,-3.1884 17.9603,-6.3725 23.0334,-15.573099 0.392,-0.7187 1.6783,-1.0669 2.6795,-1.3377 0.057,-0.0154 0.113,-0.0307 0.1681,-0.0456 5.8013,-1.5766 11.7248,-1.6001 17.6438,-1.6237 4.445,-0.0176 8.888,-0.0352 13.277,-0.7107 4.329,-0.667 9.047,-3.1928 9.084,-7.3736 0.035,-3.3707 -2.546,-3.1612 -5.123,-2.9519 -1.115,0.0906 -2.231,0.1811 -3.134,-0.0185 -0.182,-0.0381 -0.375,-0.0316 -0.686,-0.0209 z"/><path fill="currentColor" d="m 55.1325,131.29447 c -1.0745,7.1515 1.6551,13.2715 12.8266,13.1915 h -0.0062 c 9.5413,-0.389 20.3365,-6.164 30.8838,-13.5492 6.9653,-4.8787 12.9873,-10.0236 16.8903,-17.6253 2.872,-5.5889 1.395,-10.0723 -2.933,-13.993799 -1.908,-1.7291 -3.73,-1.9205 -5.867,0.1667 -7.5842,7.423099 -17.0261,11.474299 -26.7218,15.550099 -2.4706,1.0393 -5.2847,1.5582 -8.1187,2.0809 -7.5511,1.3924 -15.2431,2.8103 -16.954,14.1791 z"/></svg>`;
 function escapeHtml(value) {
@@ -7214,10 +7026,10 @@ var decode$1 = (s) => atob(s);
 var CLIENT_ID$2 = decode$1("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
 var AUTHORIZE_URL$1 = "https://claude.ai/oauth/authorize";
 var TOKEN_URL$1 = "https://platform.claude.com/v1/oauth/token";
-var CALLBACK_HOST$1 = process.env.PI_OAUTH_CALLBACK_HOST || "127.0.0.1";
+var CALLBACK_HOST$2 = process.env.PI_OAUTH_CALLBACK_HOST || "127.0.0.1";
 var CALLBACK_PORT = 53692;
-var CALLBACK_PATH = "/callback";
-var REDIRECT_URI$1 = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+var CALLBACK_PATH$1 = "/callback";
+var REDIRECT_URI$1 = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH$1}`;
 var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
 async function getNodeApis() {
   if (nodeApis) return nodeApis;
@@ -7267,7 +7079,7 @@ function formatErrorDetails(error) {
   }
   return String(error);
 }
-async function startCallbackServer(expectedState) {
+async function startCallbackServer$1(expectedState) {
   const { createServer } = await getNodeApis();
   return new Promise((resolve2, reject) => {
     let settleWait;
@@ -7282,7 +7094,7 @@ async function startCallbackServer(expectedState) {
     const server = createServer((req, res) => {
       try {
         const url = new URL(req.url || "", "http://localhost");
-        if (url.pathname !== CALLBACK_PATH) {
+        if (url.pathname !== CALLBACK_PATH$1) {
           res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
           res.end(oauthErrorHtml("Callback route not found."));
           return;
@@ -7319,7 +7131,7 @@ async function startCallbackServer(expectedState) {
     server.on("error", (err) => {
       reject(err);
     });
-    server.listen(CALLBACK_PORT, CALLBACK_HOST$1, () => {
+    server.listen(CALLBACK_PORT, CALLBACK_HOST$2, () => {
       resolve2({
         server,
         redirectUri: REDIRECT_URI$1,
@@ -7373,7 +7185,7 @@ async function exchangeAuthorizationCode$1(code, state, verifier, redirectUri) {
 }
 async function loginAnthropic(options) {
   const { verifier, challenge } = await generatePKCE();
-  const server = await startCallbackServer(verifier);
+  const server = await startCallbackServer$1(verifier);
   let code;
   let state;
   let redirectUriForExchange = REDIRECT_URI$1;
@@ -34448,7 +34260,7 @@ function getGitHubCopilotBaseUrl(token, enterpriseDomain) {
   if (enterpriseDomain) return `https://copilot-api.${enterpriseDomain}`;
   return "https://api.individual.githubcopilot.com";
 }
-async function fetchJson(url, init) {
+async function fetchJson$1(url, init) {
   const response = await fetch(url, init);
   if (!response.ok) {
     const text = await response.text();
@@ -34457,7 +34269,7 @@ async function fetchJson(url, init) {
   return response.json();
 }
 async function startDeviceFlow(domain) {
-  const data = await fetchJson(getUrls(domain).deviceCodeUrl, {
+  const data = await fetchJson$1(getUrls(domain).deviceCodeUrl, {
     method: "POST",
     headers: {
       Accept: "application/json",
@@ -34507,7 +34319,7 @@ async function pollForGitHubAccessToken(domain, deviceCode, intervalSeconds, exp
     if (signal?.aborted) throw new Error("Login cancelled");
     const remainingMs = deadline - Date.now();
     await abortableSleep(Math.min(Math.ceil(intervalMs * intervalMultiplier), remainingMs), signal);
-    const raw = await fetchJson(urls.accessTokenUrl, {
+    const raw = await fetchJson$1(urls.accessTokenUrl, {
       method: "POST",
       headers: {
         Accept: "application/json",
@@ -34538,7 +34350,7 @@ async function pollForGitHubAccessToken(domain, deviceCode, intervalSeconds, exp
   throw new Error("Device flow timed out");
 }
 async function refreshGitHubCopilotToken(refreshToken, enterpriseDomain) {
-  const raw = await fetchJson(getUrls(enterpriseDomain || "github.com").copilotTokenUrl, { headers: {
+  const raw = await fetchJson$1(getUrls(enterpriseDomain || "github.com").copilotTokenUrl, { headers: {
     Accept: "application/json",
     Authorization: `Bearer ${refreshToken}`,
     ...COPILOT_HEADERS
@@ -34638,7 +34450,7 @@ if (typeof process !== "undefined" && (process.versions?.node || process.version
     _http = m;
   });
 }
-var CALLBACK_HOST = process.env.PI_OAUTH_CALLBACK_HOST || "127.0.0.1";
+var CALLBACK_HOST$1 = process.env.PI_OAUTH_CALLBACK_HOST || "127.0.0.1";
 var CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
 var TOKEN_URL = "https://auth.openai.com/oauth/token";
@@ -34820,7 +34632,7 @@ function startLocalOAuthServer(state) {
     }
   });
   return new Promise((resolve2) => {
-    server.listen(1455, CALLBACK_HOST, () => {
+    server.listen(1455, CALLBACK_HOST$1, () => {
       resolve2({
         close: () => server.close(),
         cancelWait: () => {
@@ -34946,9 +34758,652 @@ var oauthProviderRegistry = new Map([
 function getOAuthProvider(id) {
   return oauthProviderRegistry.get(id);
 }
+function registerOAuthProvider(provider) {
+  oauthProviderRegistry.set(provider.id, provider);
+}
 function getOAuthProviders() {
   return Array.from(oauthProviderRegistry.values());
 }
+var CALLBACK_HOST = process.env.PI_OAUTH_CALLBACK_HOST || "127.0.0.1";
+var CALLBACK_PORT_BASE = Number(process.env.PI_MCP_OAUTH_CALLBACK_PORT || 53700);
+var CALLBACK_PORT_COUNT = 10;
+var CALLBACK_PATH = "/callback";
+var CALLBACK_PORTS = Array.from({ length: CALLBACK_PORT_COUNT }, (_, i) => CALLBACK_PORT_BASE + i);
+var redirectUriFor = (port) => `http://localhost:${port}${CALLBACK_PATH}`;
+var ALL_REDIRECT_URIS = CALLBACK_PORTS.map(redirectUriFor);
+var TOKEN_EXPIRY_BUFFER_MS = 3e5;
+function validatedHttpsUrl(value, name) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${name} must be an absolute HTTPS URL`);
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.hash) throw new Error(`${name} must be an absolute HTTPS URL without credentials or a fragment`);
+  return url;
+}
+function canonicalResource(url) {
+  if (url.pathname === "/" && !url.search) return url.origin;
+  return `${url.origin}${url.pathname}${url.search}`;
+}
+function authorizationServerMetadataUrls(issuer) {
+  const url = validatedHttpsUrl(issuer, "Authorization server issuer");
+  if (url.search) throw new Error("Authorization server issuer must not contain a query string");
+  const path = url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "");
+  return [new URL(`/.well-known/oauth-authorization-server${path}`, url.origin).toString(), new URL(`${path}/.well-known/openid-configuration`, url.origin).toString()];
+}
+async function fetchResponse(url, init) {
+  return fetch(url, {
+    ...init,
+    redirect: "error"
+  });
+}
+async function fetchJson(url, init) {
+  const res = await fetchResponse(url, init);
+  if (!res.ok) throw new Error(`${init?.method ?? "GET"} ${url} failed: ${res.status}`);
+  return res.json();
+}
+function authorizationServerMetadata(value, issuer, requireExactIssuer) {
+  if (!value || typeof value !== "object") throw new Error(`Authorization server metadata for ${issuer} is invalid`);
+  const metadata = value;
+  if (typeof metadata.issuer !== "string") throw new Error(`Authorization server metadata for ${issuer} is missing its issuer`);
+  if (requireExactIssuer) {
+    if (metadata.issuer !== issuer) throw new Error(`Authorization server metadata issuer does not exactly match ${issuer}`);
+  } else {
+    const advertisedIssuer = validatedHttpsUrl(metadata.issuer, "Authorization server metadata issuer");
+    if (advertisedIssuer.origin !== new URL(issuer).origin || advertisedIssuer.search) throw new Error(`Origin authorization server metadata issuer must stay on ${new URL(issuer).origin}`);
+  }
+  if (typeof metadata.authorization_endpoint !== "string" || typeof metadata.token_endpoint !== "string") throw new Error(`Authorization server metadata for ${issuer} is missing required endpoints`);
+  validatedHttpsUrl(metadata.authorization_endpoint, "Authorization endpoint");
+  validatedHttpsUrl(metadata.token_endpoint, "Token endpoint");
+  if (metadata.registration_endpoint) validatedHttpsUrl(metadata.registration_endpoint, "Registration endpoint");
+  return metadata;
+}
+async function jsonMetadata(response, url) {
+  if (response.status !== 200) throw new Error(`GET ${url} failed: ${response.status}`);
+  if (response.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase() !== "application/json") throw new Error(`GET ${url} did not return application/json`);
+  return response.json();
+}
+async function discoverAuthorizationServer(issuer, requireExactIssuer) {
+  const candidates = authorizationServerMetadataUrls(issuer);
+  let lastError;
+  for (const candidate of candidates) try {
+    const response = await fetchResponse(candidate);
+    if (response.status === 404) continue;
+    return authorizationServerMetadata(await jsonMetadata(response, candidate), issuer, requireExactIssuer);
+  } catch (error) {
+    lastError = error;
+  }
+  throw new Error(`Could not discover OAuth metadata for ${issuer}. Tried ${candidates.join(", ")}. Last error: ${String(lastError)}`);
+}
+function randomState() {
+  const bytes = /* @__PURE__ */ new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function resourceMetadata(value, resource) {
+  if (!value || typeof value !== "object") throw new Error("Protected-resource metadata is invalid");
+  const metadata = value;
+  if (metadata.resource !== resource) throw new Error(`Protected-resource metadata resource does not exactly match ${resource}`);
+  if (!Array.isArray(metadata.authorization_servers) || metadata.authorization_servers.length === 0) throw new Error("Protected-resource metadata has no authorization_servers");
+  for (const issuer of metadata.authorization_servers) {
+    if (typeof issuer !== "string") throw new Error("Protected-resource metadata has an invalid authorization server");
+    validatedHttpsUrl(issuer, "Authorization server issuer");
+  }
+  return metadata;
+}
+function resourceMetadataUrl(resource) {
+  const path = resource.pathname === "/" ? "" : resource.pathname;
+  return `${resource.origin}/.well-known/oauth-protected-resource${path}${resource.search}`;
+}
+function headerResourceMetadata(value) {
+  const match = value?.match(/(?:^|[,\s])resource_metadata\s*=\s*"((?:[^"\\]|\\.)*)"/i);
+  if (!match) return void 0;
+  return match[1].replace(/\\(.)/g, "$1");
+}
+async function tryProtectedResourceMetadata(url) {
+  const resource = validatedHttpsUrl(url, "MCP endpoint");
+  let headerUrl;
+  try {
+    const response2 = await fetchResponse(resource.toString());
+    headerUrl = headerResourceMetadata(response2.headers.get("www-authenticate"));
+    await response2.body?.cancel();
+  } catch {
+  }
+  const candidate = headerUrl ? validatedHttpsUrl(headerUrl, "resource_metadata").toString() : resourceMetadataUrl(resource);
+  const response = await fetchResponse(candidate);
+  if (response.status === 404 && !headerUrl) return void 0;
+  return resourceMetadata(await jsonMetadata(response, candidate), canonicalResource(resource));
+}
+async function discover(url) {
+  const protectedResource = await tryProtectedResourceMetadata(url);
+  if (protectedResource) {
+    const issuer2 = protectedResource.authorization_servers[0];
+    return {
+      metadata: await discoverAuthorizationServer(issuer2, true),
+      resource: protectedResource.resource,
+      issuer: issuer2
+    };
+  }
+  const issuer = validatedHttpsUrl(url, "MCP endpoint").origin;
+  return { metadata: await discoverAuthorizationServer(issuer, false) };
+}
+async function registerClient(registrationEndpoint, label) {
+  validatedHttpsUrl(registrationEndpoint, "Registration endpoint");
+  const data = await fetchJson(registrationEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_name: label,
+      redirect_uris: ALL_REDIRECT_URIS,
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none"
+    })
+  });
+  if (typeof data.client_id !== "string" || !data.client_id) throw new Error(`Dynamic client registration at ${registrationEndpoint} returned no client_id`);
+  return data.client_id;
+}
+async function startCallbackServer(label) {
+  const { createServer } = await import("node:http");
+  let settle;
+  const waitPromise = new Promise((resolve2) => {
+    let settled = false;
+    settle = (value) => {
+      if (!settled) {
+        settled = true;
+        resolve2(value);
+      }
+    };
+  });
+  const handler = (req, res) => {
+    const url = new URL(req.url || "", "http://localhost");
+    if (url.pathname !== CALLBACK_PATH) {
+      res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(oauthErrorHtml("Callback route not found."));
+      return;
+    }
+    const error = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    res.writeHead(error || !code ? 400 : 200, { "Content-Type": "text/html; charset=utf-8" });
+    if (error) {
+      res.end(oauthErrorHtml(`${label} authentication failed.`, `Error: ${error}`));
+      settle?.(null);
+      return;
+    }
+    if (!code || !state) {
+      res.end(oauthErrorHtml("Missing code or state parameter."));
+      settle?.(null);
+      return;
+    }
+    res.end(oauthSuccessHtml(`${label} authentication completed. You can close this window.`));
+    settle?.({
+      code,
+      state
+    });
+  };
+  let lastError;
+  for (const port of CALLBACK_PORTS) {
+    const server = createServer(handler);
+    let bindErr;
+    server.on("error", (err) => bindErr?.(err));
+    try {
+      if (await new Promise((resolve2) => {
+        bindErr = () => resolve2(false);
+        server.listen(port, CALLBACK_HOST, () => {
+          bindErr = void 0;
+          resolve2(true);
+        });
+      })) return {
+        server,
+        redirectUri: redirectUriFor(port),
+        cancel: () => settle?.(null),
+        waitForCode: () => waitPromise
+      };
+      lastError = `port ${port} in use`;
+      server.close();
+    } catch (err) {
+      lastError = err;
+      server.close();
+    }
+  }
+  throw new Error(`Could not start the OAuth callback server: ports ${CALLBACK_PORT_BASE}-${CALLBACK_PORT_BASE + CALLBACK_PORT_COUNT - 1} are all in use. Close other login attempts and retry. (${String(lastError)})`);
+}
+function parseRedirectInput(input, expectedState) {
+  const value = input.trim();
+  let code;
+  let state;
+  try {
+    const url = new URL(value);
+    code = url.searchParams.get("code") ?? void 0;
+    state = url.searchParams.get("state") ?? void 0;
+  } catch {
+    const params = new URLSearchParams(value);
+    code = params.get("code") ?? value;
+    state = params.get("state") ?? void 0;
+  }
+  if (state && state !== expectedState) throw new Error("OAuth state mismatch");
+  if (!code) throw new Error("Missing authorization code");
+  return {
+    code,
+    state: state ?? expectedState
+  };
+}
+async function exchangeToken(tokenEndpoint, params) {
+  validatedHttpsUrl(tokenEndpoint, "Token endpoint");
+  const res = await fetchResponse(tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(params).toString()
+  });
+  const text = await res.text();
+  if (!res.ok) throw new Error(`Token request to ${tokenEndpoint} failed: ${res.status}`);
+  let token;
+  try {
+    token = JSON.parse(text);
+  } catch {
+    throw new Error(`Token request to ${tokenEndpoint} returned invalid JSON`);
+  }
+  if (!token || typeof token !== "object" || typeof token.access_token !== "string") throw new Error(`Token request to ${tokenEndpoint} returned no access_token`);
+  const result = token;
+  if (!result.access_token) throw new Error(`Token request to ${tokenEndpoint} returned no access_token`);
+  if (result.refresh_token !== void 0 && typeof result.refresh_token !== "string") throw new Error(`Token request to ${tokenEndpoint} returned an invalid refresh_token`);
+  if (result.expires_in !== void 0 && (typeof result.expires_in !== "number" || !Number.isFinite(result.expires_in))) throw new Error(`Token request to ${tokenEndpoint} returned an invalid expires_in`);
+  return result;
+}
+function toCredentials(token, tokenEndpoint, clientId, endpoint, resource, issuer, previousRefresh) {
+  return {
+    access: token.access_token,
+    refresh: token.refresh_token ?? previousRefresh ?? "",
+    expires: token.expires_in ? Date.now() + token.expires_in * 1e3 - TOKEN_EXPIRY_BUFFER_MS : Date.now() + 36e5 - TOKEN_EXPIRY_BUFFER_MS,
+    tokenEndpoint,
+    clientId,
+    endpoint,
+    resource,
+    issuer
+  };
+}
+function createMcpOAuthProvider(config) {
+  const label = config.label ?? config.server;
+  async function login(callbacks) {
+    const discovery = await discover(config.url);
+    const { metadata: meta } = discovery;
+    callbacks.onProgress?.(`Discovered ${discovery.issuer ?? meta.issuer}`);
+    let clientId = config.clientId;
+    if (!clientId) {
+      if (!meta.registration_endpoint) throw new Error(`${label} does not support dynamic client registration and no clientId was configured. Set a pre-registered client id for this server.`);
+      callbacks.onProgress?.("Registering OAuth client\u2026");
+      clientId = await registerClient(meta.registration_endpoint, `Prime Agent (${label})`);
+    }
+    const { verifier, challenge } = await generatePKCE();
+    const state = randomState();
+    const scope = config.scopes ?? meta.scopes_supported?.join(" ");
+    const cb = await startCallbackServer(label);
+    try {
+      const authParams = new URLSearchParams({
+        client_id: clientId,
+        response_type: "code",
+        redirect_uri: cb.redirectUri,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        state
+      });
+      if (scope) authParams.set("scope", scope);
+      if (discovery.resource) authParams.set("resource", discovery.resource);
+      const authorizationUrl = new URL(meta.authorization_endpoint);
+      for (const [name, value] of authParams) authorizationUrl.searchParams.set(name, value);
+      callbacks.onAuth({
+        url: authorizationUrl.toString(),
+        instructions: "Complete login in your browser. If the browser is on another machine, paste the final redirect URL here."
+      });
+      let result;
+      let manualCancelled = false;
+      let manualError;
+      if (callbacks.onManualCodeInput) {
+        const manual = callbacks.onManualCodeInput().then((input) => {
+          const parsed = parseRedirectInput(input, state);
+          cb.cancel();
+          return parsed;
+        }).catch(async (err) => {
+          if (err instanceof Error && /state mismatch|authorization code/i.test(err.message)) manualError = err;
+          else manualCancelled = true;
+          await new Promise((r) => setTimeout(r, 500));
+          cb.cancel();
+          return null;
+        });
+        result = await cb.waitForCode() ?? await manual;
+        if (!result && manualError) throw manualError;
+      } else {
+        result = await cb.waitForCode();
+        if (!result) result = parseRedirectInput(await callbacks.onPrompt({
+          message: "Paste the authorization code or full redirect URL:",
+          placeholder: cb.redirectUri
+        }), state);
+      }
+      if (!result) throw new Error(manualCancelled ? "Login cancelled" : "Missing authorization code");
+      if (result.state !== state) throw new Error("OAuth state mismatch");
+      callbacks.onProgress?.("Exchanging authorization code for tokens\u2026");
+      return toCredentials(await exchangeToken(meta.token_endpoint, {
+        grant_type: "authorization_code",
+        code: result.code,
+        redirect_uri: cb.redirectUri,
+        client_id: clientId,
+        code_verifier: verifier,
+        ...discovery.resource ? { resource: discovery.resource } : {}
+      }), meta.token_endpoint, clientId, config.url, discovery.resource, discovery.issuer);
+    } finally {
+      cb.server.close();
+    }
+  }
+  async function refreshToken(credentials) {
+    const creds = credentials;
+    if (creds.endpoint !== config.url) throw new Error(`Stored OAuth credentials are not bound to ${config.url}; re-run /mcp login ${config.server}`);
+    const configuredResource = canonicalResource(validatedHttpsUrl(config.url, "MCP endpoint"));
+    if (creds.resource !== void 0 && creds.resource !== configuredResource) throw new Error(`Stored OAuth credentials are not bound to ${configuredResource}; re-run /mcp login ${config.server}`);
+    if (creds.resource === void 0 !== (creds.issuer === void 0)) throw new Error(`Stored OAuth credentials for ${label} have incomplete resource binding; re-run /mcp login ${config.server}`);
+    if (creds.issuer !== void 0) validatedHttpsUrl(creds.issuer, "Stored authorization server issuer");
+    if (!creds.refresh) throw new Error(`No refresh token stored for ${label}; re-run /mcp login ${config.server}`);
+    const discovery = await discover(config.url);
+    if (creds.resource === void 0 !== (discovery.resource === void 0)) throw new Error(`OAuth discovery mode changed for ${config.url}; re-run /mcp login ${config.server}`);
+    if (creds.resource) {
+      if (discovery.resource !== creds.resource || discovery.issuer !== creds.issuer) throw new Error(`Stored OAuth credentials do not match current protected-resource metadata for ${config.url}`);
+    }
+    const tokenEndpoint = creds.tokenEndpoint ?? discovery.metadata.token_endpoint;
+    if (creds.tokenEndpoint && discovery.metadata.token_endpoint !== creds.tokenEndpoint) throw new Error(`Stored OAuth token endpoint does not match current authorization-server metadata for ${config.url}`);
+    const clientId = creds.clientId ?? config.clientId;
+    if (!tokenEndpoint) throw new Error(`No token endpoint stored for ${label}; re-run /mcp login ${config.server}`);
+    return toCredentials(await exchangeToken(tokenEndpoint, {
+      grant_type: "refresh_token",
+      refresh_token: creds.refresh,
+      ...clientId ? { client_id: clientId } : {},
+      ...creds.resource ? { resource: creds.resource } : {}
+    }), tokenEndpoint, clientId ?? "", creds.endpoint, creds.resource, creds.issuer, creds.refresh);
+  }
+  return {
+    id: `mcp:${config.server}`,
+    name: label,
+    usesCallbackServer: true,
+    login,
+    refreshToken,
+    getApiKey: (credentials) => credentials.access
+  };
+}
+var BUILTIN_MCP_CATALOG = [{
+  server: "linear",
+  label: "Linear",
+  url: "https://mcp.linear.app/mcp",
+  oauth: {
+    kind: "oauth",
+    label: "Linear"
+  }
+}, {
+  server: "notion",
+  label: "Notion",
+  url: "https://mcp.notion.com/mcp",
+  oauth: {
+    kind: "oauth",
+    label: "Notion"
+  }
+}];
+function getCatalogEntry(server) {
+  return BUILTIN_MCP_CATALOG.find((entry) => entry.server === server);
+}
+function registerBuiltinMcpOAuthProviders() {
+  for (const entry of BUILTIN_MCP_CATALOG) {
+    if (entry.oauth?.kind !== "oauth") continue;
+    if (getOAuthProvider(`mcp:${entry.server}`)) continue;
+    registerOAuthProvider(createMcpOAuthProvider({
+      server: entry.server,
+      label: entry.label,
+      url: entry.url,
+      scopes: entry.oauth.scopes,
+      clientId: entry.oauth.clientId
+    }));
+  }
+}
+var MCP_AUTH_PREFIX = "mcp:";
+function mcpProviderId(name) {
+  return `${MCP_AUTH_PREFIX}${name}`;
+}
+var McpRequestError = class extends Error {
+  status = 400;
+  constructor(message) {
+    super(message);
+    this.name = "McpRequestError";
+  }
+};
+function validateHttpMcpUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new McpRequestError("Invalid MCP URL.");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:" || !url.hostname || url.username || url.password) throw new McpRequestError("MCP URL must be an http(s) URL without embedded credentials.");
+  return url.toString();
+}
+function stdioCommandPreview(config) {
+  return [config.command, ...config.args ?? []].join(" ");
+}
+function mcpEnvBindings(config) {
+  if (config.type !== "stdio" || !config.env) return void 0;
+  const bindings = Object.entries(config.env).map(([child, mapping]) => ({
+    child,
+    source: mapping.env
+  }));
+  return bindings.length > 0 ? bindings : void 0;
+}
+function isMcpAuthed(server, auth, env) {
+  if (server.config.enabled === false) return false;
+  if (server.userDeclared && getCatalogEntry(server.name)) return false;
+  if (server.config.type === "stdio") return true;
+  const usesOAuth = server.config.type === "http" && server.config.oauth === true;
+  const bearerTokenEnvVar = server.config.type === "http" ? server.config.bearerTokenEnvVar : void 0;
+  if (!usesOAuth && !bearerTokenEnvVar) return true;
+  if (bearerTokenEnvVar && env[bearerTokenEnvVar]?.trim()) return true;
+  const cred = auth.get(mcpProviderId(server.name));
+  if (cred === void 0) return false;
+  if (!server.userDeclared) return true;
+  const endpoint = cred.endpoint;
+  return typeof endpoint === "string" && server.config.type === "http" && endpoint === server.config.url;
+}
+function mcpConnectionStatus(server, authed) {
+  if (server.config.enabled === false) return "disabled";
+  if (authed) return server.config.type === "http" && server.config.oauth !== true && !server.config.bearerTokenEnvVar ? "anonymous" : "connected";
+  return "needs_auth";
+}
+function toMcpConnectionInfo(server, auth, env) {
+  const usesOAuth = server.config.type === "http" && server.config.oauth === true;
+  const catalogShadow = server.userDeclared && Boolean(getCatalogEntry(server.name));
+  const authed = isMcpAuthed(server, auth, env);
+  const envBindings = mcpEnvBindings(server.config);
+  return {
+    name: server.name,
+    label: server.label,
+    source: server.source,
+    transport: server.config.type,
+    usesOAuth,
+    enabled: authed,
+    status: mcpConnectionStatus(server, authed),
+    ...server.config.type === "http" ? { url: server.config.url } : {},
+    ...server.config.type === "stdio" ? { commandPreview: stdioCommandPreview(server.config) } : {},
+    ...server.config.type === "stdio" && server.config.cwd ? { cwdPreview: safePathLabel(server.config.cwd) } : {},
+    ...server.config.type === "http" && server.config.bearerTokenEnvVar ? { bearerTokenEnvVar: server.config.bearerTokenEnvVar } : {},
+    ...envBindings ? { envBindings } : {},
+    ...catalogShadow ? { error: "This name is reserved for a built-in integration." } : {}
+  };
+}
+function listMcpServers(userServers) {
+  const listed = [];
+  for (const entry of BUILTIN_MCP_CATALOG) listed.push({
+    name: entry.server,
+    label: entry.label,
+    source: "builtin",
+    userDeclared: false,
+    config: {
+      type: "http",
+      url: entry.url,
+      oauth: true
+    }
+  });
+  for (const [name, config] of Object.entries(userServers ?? {}).sort(([left], [right]) => left.localeCompare(right))) listed.push({
+    name,
+    label: name,
+    source: "user",
+    userDeclared: true,
+    config
+  });
+  return listed;
+}
+function listMcpConnections(userServers, auth, env = process.env) {
+  return listMcpServers(userServers).map((server) => toMcpConnectionInfo(server, auth, env));
+}
+function dropMcpServerCredentials(name, auth) {
+  if (getCatalogEntry(name)) return;
+  try {
+    auth.removeVerified(mcpProviderId(name));
+  } catch (error) {
+    throw new McpRequestError(`Could not remove stored credentials for this MCP server: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function confineMcpStdioCwd(cwd, workspaceRoot) {
+  if (cwd === void 0 || cwd.trim() === "") return void 0;
+  const root2 = resolve(workspaceRoot);
+  const canonicalRoot = await realpath(root2).catch(() => root2);
+  const candidate = resolve(root2, cwd);
+  const existingCandidate = await realpath(candidate).catch(() => void 0);
+  if (existingCandidate && existingCandidate !== canonicalRoot && !existingCandidate.startsWith(`${canonicalRoot}${sep}`)) throw new McpRequestError("MCP stdio working directory must stay inside the workspace.");
+  let ancestor = dirname(candidate);
+  while (true) {
+    const resolvedAncestor = await realpath(ancestor).catch(() => void 0);
+    if (resolvedAncestor) {
+      if (resolvedAncestor !== canonicalRoot && !resolvedAncestor.startsWith(`${canonicalRoot}${sep}`)) throw new McpRequestError("MCP stdio working directory must stay inside the workspace.");
+      break;
+    }
+    const parent = dirname(ancestor);
+    if (parent === ancestor) throw new McpRequestError("MCP stdio working directory must stay inside the workspace.");
+    ancestor = parent;
+  }
+  return candidate;
+}
+function storedApiForCustomProvider(api) {
+  return api === "google-genai" ? "google-generative-ai" : api;
+}
+function uiApiForCustomProvider(value) {
+  if (value === "google-generative-ai") return "google-genai";
+  return isPiCustomProviderApi(value) ? value : void 0;
+}
+function envVarNameForManagedProvider(providerId) {
+  if (providerId === "openai-chat-completions") return "OPENAI_CHAT_COMPLETIONS_API_KEY";
+  const slug = providerId.slice(providerId.indexOf("+") + 1).toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+  return isOccProviderId(providerId) ? `OPENAI_CHAT_COMPLETIONS_${slug}_API_KEY` : `CUSTOM_${slug}_API_KEY`;
+}
+function readModelsJson(filePath) {
+  try {
+    if (!existsSync(filePath)) return {};
+    return parseModelsJson(readFileSync(filePath, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function stripJsonComments(input) {
+  return input.replace(/"(?:\\.|[^"\\])*"|\/\/[^\n]*/g, (match) => match[0] === '"' ? match : "").replace(/"(?:\\.|[^"\\])*"|,(\s*[}\]])/g, (match, tail) => tail ?? (match[0] === '"' ? match : ""));
+}
+function parseModelsJson(raw) {
+  const parsed = JSON.parse(stripJsonComments(raw));
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("models.json must contain an object");
+  return parsed;
+}
+function readModelsJsonForWrite(filePath) {
+  if (!existsSync(filePath)) return {};
+  try {
+    return parseModelsJson(readFileSync(filePath, "utf-8"));
+  } catch (error) {
+    throw new Error(`Refusing to update models.json because it could not be parsed: ${error instanceof Error ? error.message : error}`);
+  }
+}
+function mergeModelDefinitions(existing, incoming) {
+  const existingById = new Map((existing ?? []).map((model) => [model.id, model]));
+  const seen = /* @__PURE__ */ new Set();
+  return incoming.flatMap((model) => {
+    if (seen.has(model.id)) return [];
+    seen.add(model.id);
+    return [{
+      ...existingById.get(model.id),
+      ...model
+    }];
+  });
+}
+function listCustomProviders(filePath) {
+  return readModelsJson(filePath).providers ?? {};
+}
+function writeModelsJson(filePath, data) {
+  mkdirSync(dirname(filePath), {
+    recursive: true,
+    mode: 448
+  });
+  const serialized = `${JSON.stringify(data, null, "	")}
+`;
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(tmpPath, serialized, "utf-8");
+  renameSync(tmpPath, filePath);
+}
+function upsertCustomProvider(filePath, providerId, input) {
+  const data = readModelsJsonForWrite(filePath);
+  const providers = { ...data.providers ?? {} };
+  const existing = providers[providerId] ?? {};
+  providers[providerId] = {
+    ...existing,
+    name: input.name ?? existing.name,
+    baseUrl: input.baseUrl,
+    api: storedApiForCustomProvider(input.api),
+    apiKey: input.apiKey,
+    models: mergeModelDefinitions(existing.models, input.models)
+  };
+  writeModelsJson(filePath, {
+    ...data,
+    providers
+  });
+}
+function addCustomProviderModelIds(filePath, providerId, modelIds) {
+  const data = readModelsJsonForWrite(filePath);
+  const providers = { ...data.providers ?? {} };
+  const existing = providers[providerId];
+  if (!existing) return;
+  providers[providerId] = {
+    ...existing,
+    models: mergeModelDefinitions(existing.models, [...existing.models ?? [], ...modelIds.map((id) => ({ id }))])
+  };
+  writeModelsJson(filePath, {
+    ...data,
+    providers
+  });
+}
+function removeCustomProvider(filePath, providerId) {
+  const data = readModelsJsonForWrite(filePath);
+  const providers = data.providers;
+  if (!providers || !(providerId in providers)) return;
+  const next = { ...providers };
+  delete next[providerId];
+  writeModelsJson(filePath, {
+    ...data,
+    providers: next
+  });
+}
+function isDiscoverableEntry(entry) {
+  const baseUrl = entry?.baseUrl;
+  if (!baseUrl) return false;
+  const api = uiApiForCustomProvider(entry?.api);
+  if (api && !isOccFamilyApi(api)) return false;
+  if (entry?.api && !api) return false;
+  try {
+    const parsed = new URL(baseUrl);
+    return parsed.protocol === "https:" || parsed.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
 var PRIME_PROVIDER_ENV_MAP = {
   openai: "OPENAI_API_KEY",
   "azure-openai-responses": "AZURE_OPENAI_API_KEY",
@@ -35072,7 +35527,7 @@ function listChatProviders() {
 function handleChatProvidersGet(_request) {
   return wrapApiHandler(async () => {
     return Response.json({ providers: buildProviders() });
-  });
+  }, _request);
 }
 function requireBaseUrl(baseUrl, providerId) {
   const trimmed = baseUrl?.trim() ?? "";
@@ -35141,7 +35596,7 @@ function handleChatProvidersPost(request) {
       success: true,
       providers: buildProviders()
     });
-  });
+  }, request);
 }
 function handleChatProvidersDelete(request) {
   return wrapApiHandler(async () => {
@@ -35155,7 +35610,7 @@ function handleChatProvidersDelete(request) {
       success: true,
       providers: buildProviders()
     });
-  });
+  }, request);
 }
 var LOGIN_TTL_MS = 96e4;
 var sessions = /* @__PURE__ */ new Map();
@@ -35285,7 +35740,7 @@ function cancelOAuthLogin(loginId) {
     error: "Login cancelled"
   };
 }
-function oauthDeps() {
+function oauthDeps$1() {
   const config = getPrimeConfig();
   return {
     login: (providerId, callbacks) => config.authStorage.login(providerId, callbacks),
@@ -35312,8 +35767,423 @@ function handleChatProvidersOAuthPost(request) {
       status: "error",
       error: `Unknown OAuth provider: ${body.providerId}`
     }, { status: 400 });
-    return Response.json(startOAuthLogin(body.providerId, oauthDeps()));
-  });
+    return Response.json(startOAuthLogin(body.providerId, oauthDeps$1()));
+  }, request);
+}
+function defaultMcpDeps() {
+  const config = getPrimeConfig();
+  const settings = config.defaultSettings;
+  return {
+    getUserServers: () => settings.getGlobalMcpServers(),
+    setUserServer: (name, serverConfig, force) => {
+      settings.setGlobalMcpServer(name, serverConfig, force);
+    },
+    removeUserServer: (name) => settings.removeGlobalMcpServer(name),
+    flushSettings: async () => {
+      await settings.flush();
+      const error = settings.drainErrors("global")[0];
+      if (error) throw error.error;
+    },
+    auth: config.authStorage,
+    workspaceRoot: config.defaultCwd,
+    env: process.env,
+    reloadAuth: () => {
+      config.reloadAuth();
+    },
+    reloadResources: async () => {
+      await getBridge().reloadResources();
+    }
+  };
+}
+function listedConnections(deps) {
+  return listMcpConnections(deps.getUserServers(), deps.auth, deps.env);
+}
+function listResponse(deps) {
+  return { connections: listedConnections(deps) };
+}
+function toMcpOAuthResponse(snapshot2, connections) {
+  return {
+    status: snapshot2.status,
+    ...snapshot2.loginId ? { loginId: snapshot2.loginId } : {},
+    ...snapshot2.authUrl ? { authUrl: snapshot2.authUrl } : {},
+    ...snapshot2.userCode ? { userCode: snapshot2.userCode } : {},
+    ...snapshot2.instructions ? { instructions: snapshot2.instructions } : {},
+    ...snapshot2.prompt ? { prompt: snapshot2.prompt } : {},
+    ...snapshot2.error ? { error: snapshot2.error } : {},
+    ...connections ? { connections } : {}
+  };
+}
+function ensureMcpOAuthProvider(name, deps) {
+  registerBuiltinMcpOAuthProviders();
+  if (getCatalogEntry(name)) return;
+  const config = deps.getUserServers()?.[name];
+  if (!config || config.type !== "http" || config.oauth !== true) throw new McpRequestError("This MCP server does not use OAuth.");
+  registerOAuthProvider(createMcpOAuthProvider({
+    server: name,
+    label: name,
+    url: config.url
+  }));
+}
+function oauthDeps(deps) {
+  return {
+    login: (providerId, callbacks) => deps.auth.login(providerId, callbacks),
+    reloadAuth: () => {
+      deps.reloadAuth();
+      deps.reloadResources();
+    },
+    listProviders: () => []
+  };
+}
+async function logoutMcp(name, deps) {
+  try {
+    deps.auth.removeVerified(mcpProviderId(name));
+  } catch (error) {
+    throw new McpRequestError(`Could not remove stored credentials: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  deps.reloadAuth();
+  await deps.reloadResources();
+  return {
+    status: "success",
+    connections: listedConnections(deps)
+  };
+}
+function handleChatMcpGet(_request, deps = defaultMcpDeps()) {
+  return wrapApiHandler(async () => Response.json(listResponse(deps)), _request);
+}
+function handleChatMcpPost(request, deps = defaultMcpDeps()) {
+  return wrapApiHandler(async () => {
+    const body = ChatMcpUpsertRequestSchema.parse(await request.json().catch(() => ({})));
+    if (getCatalogEntry(body.name)) throw new McpRequestError(`MCP server name "${body.name}" is reserved for a built-in integration.`);
+    if (deps.getUserServers()?.[body.name] && body.force !== true) throw new McpRequestError(`MCP server "${body.name}" already exists. Replace it to continue.`);
+    let config;
+    switch (body.transport) {
+      case "http":
+        if (body.bearerTokenEnvVar && body.oauth) throw new McpRequestError("OAuth and a bearer-token environment variable cannot be combined.");
+        config = {
+          type: "http",
+          url: validateHttpMcpUrl(body.url),
+          ...body.bearerTokenEnvVar ? { bearerTokenEnvVar: body.bearerTokenEnvVar } : {},
+          ...body.oauth ? { oauth: true } : {}
+        };
+        break;
+      case "stdio": {
+        if (body.command.includes("\0") || body.args?.some((part) => part.includes("\0"))) throw new McpRequestError("MCP command arguments cannot contain NUL.");
+        const env = Object.fromEntries((body.env ?? []).map((binding) => [binding.child, { env: binding.source }]));
+        const cwd = await confineMcpStdioCwd(body.cwd, deps.workspaceRoot);
+        config = {
+          type: "stdio",
+          command: body.command,
+          ...body.args && body.args.length > 0 ? { args: body.args } : {},
+          ...cwd ? { cwd } : {},
+          ...Object.keys(env).length > 0 ? { env } : {}
+        };
+        break;
+      }
+      default:
+        throw new McpRequestError(`Unsupported MCP transport: ${String(body)}`);
+    }
+    dropMcpServerCredentials(body.name, deps.auth);
+    deps.setUserServer(body.name, config, true);
+    await deps.flushSettings();
+    deps.reloadAuth();
+    await deps.reloadResources();
+    return Response.json(listResponse(deps));
+  }, request);
+}
+function handleChatMcpDelete(request, deps = defaultMcpDeps()) {
+  return wrapApiHandler(async () => {
+    const body = ChatMcpDeleteRequestSchema.parse(await request.json().catch(() => ({})));
+    if (!deps.removeUserServer(body.name)) throw new McpRequestError(`MCP server "${body.name}" was not found.`);
+    await deps.flushSettings();
+    dropMcpServerCredentials(body.name, deps.auth);
+    deps.reloadAuth();
+    await deps.reloadResources();
+    return Response.json(listResponse(deps));
+  }, request);
+}
+function handleChatMcpOAuthPost(request, deps = defaultMcpDeps()) {
+  return wrapApiHandler(async () => {
+    const body = ChatMcpOAuthLoginRequestSchema.parse(await request.json().catch(() => ({})));
+    if (![...BUILTIN_MCP_CATALOG.map((entry) => entry.server), ...Object.keys(deps.getUserServers() ?? {})].includes(body.name) && !body.loginId) throw new McpRequestError(`Unknown MCP server: ${body.name}`);
+    if (body.cancel) {
+      if (!body.loginId) return Response.json({
+        status: "error",
+        error: "loginId is required to cancel"
+      }, { status: 400 });
+      return Response.json(toMcpOAuthResponse(cancelOAuthLogin(body.loginId)));
+    }
+    if (body.loginId && body.promptAnswer !== void 0) return Response.json(toMcpOAuthResponse(continueOAuthLogin(body.loginId, body.promptAnswer)));
+    if (body.loginId) {
+      const snapshot2 = pollOAuthLogin(body.loginId);
+      return Response.json(toMcpOAuthResponse(snapshot2, snapshot2.status === "success" ? listedConnections(deps) : void 0));
+    }
+    const action = body.action ?? "login";
+    switch (action) {
+      case "logout":
+        return Response.json(await logoutMcp(body.name, deps));
+      case "reconnect":
+        await logoutMcp(body.name, deps);
+        break;
+      case "login":
+        break;
+      default:
+        throw new McpRequestError(`Unsupported MCP OAuth action: ${String(action)}`);
+    }
+    ensureMcpOAuthProvider(body.name, deps);
+    const providerId = mcpProviderId(body.name);
+    if (!getOAuthProvider(providerId)) return Response.json({
+      status: "error",
+      error: `Unknown OAuth provider: ${providerId}`
+    }, { status: 400 });
+    return Response.json(toMcpOAuthResponse(startOAuthLogin(providerId, oauthDeps(deps))));
+  }, request);
+}
+var BodySchema$1 = external_exports.object({
+  sessionId: SessionIdSchema,
+  model: external_exports.object({
+    provider: external_exports.string(),
+    id: external_exports.string()
+  })
+});
+function handleChatModelPost(request) {
+  return wrapApiHandler(async () => {
+    const raw = await request.json().catch(() => ({}));
+    const body = BodySchema$1.parse(raw);
+    const bridge = getBridge();
+    const session = bridge.getSession(body.sessionId) ?? await bridge.resumeSessionById(body.sessionId);
+    if (!session || !await requireProjectSession(session)) return Response.json({ message: `Unknown session: ${body.sessionId}` }, { status: 404 });
+    await bridge.setModel(body.sessionId, {
+      provider: body.model.provider,
+      id: body.model.id
+    });
+    return Response.json({ ok: true });
+  }, request);
+}
+function toPatternCandidate(model) {
+  return {
+    id: model.id,
+    name: model.name,
+    provider: model.provider,
+    modelId: model.id,
+    key: `${model.provider}/${model.id}`
+  };
+}
+function handleChatModelsGet(request) {
+  return wrapApiHandler(async () => {
+    const config = getPrimeConfig();
+    const cwd = await cwdForRequest(request);
+    const settings = config.settingsFor(cwd);
+    const registry = config.modelRegistry;
+    const scope = new URL(request.url).searchParams.get("scope") === "all" ? "all" : "enabled";
+    let models = registry.getAll();
+    if (scope === "enabled") {
+      models = models.filter((model) => registry.hasConfiguredAuth(model));
+      const patterns = settings.getEnabledModels();
+      if (patterns !== void 0) models = models.filter((model) => isModelPatternEnabled(toPatternCandidate(model), patterns));
+    }
+    const diagnostics = [];
+    const defaultProvider = settings.getDefaultProvider();
+    const defaultModel = settings.getDefaultModel();
+    const defaultThinkingLevel = settings.getDefaultThinkingLevel();
+    const selectedModelKey = defaultProvider && defaultModel ? `${defaultProvider}/${defaultModel}` : void 0;
+    return Response.json({
+      models: models.map((m) => {
+        const thinkingLevels = getSupportedThinkingLevels(m);
+        const fallback = m.reasoning ? "medium" : "off";
+        return {
+          key: `${m.provider}/${m.id}`,
+          provider: m.provider,
+          id: m.id,
+          name: m.name,
+          reasoning: m.reasoning,
+          input: m.input,
+          contextWindow: m.contextWindow,
+          maxTokens: m.maxTokens,
+          available: registry.hasConfiguredAuth(m),
+          thinkingLevels,
+          defaultThinkingLevel: thinkingLevels.includes(fallback) ? fallback : thinkingLevels[0] ?? "off"
+        };
+      }),
+      ...selectedModelKey ? { selectedModelKey } : {},
+      ...defaultProvider ? { defaultProvider } : {},
+      ...defaultModel ? { defaultModel } : {},
+      ...defaultThinkingLevel ? { defaultThinkingLevel } : {},
+      diagnostics
+    });
+  }, request);
+}
+function openAiModelsUrl(baseUrl) {
+  const parsed = new URL(baseUrl);
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error("model discovery requires an http(s) URL");
+  if (parsed.protocol === "http:" && !isLoopbackHostname(parsed.hostname)) throw new Error("model discovery requires https for non-loopback hosts");
+  const path = parsed.pathname.replace(/\/+$/, "");
+  parsed.pathname = path.endsWith("/v1") ? `${path}/models` : `${path}/v1/models`;
+  parsed.search = "";
+  parsed.hash = "";
+  return parsed;
+}
+function handleChatModelsDiscoverPost(request) {
+  return wrapApiHandler(async () => {
+    const raw = await request.json().catch(() => ({}));
+    const body = ChatModelsDiscoverRequestSchema.parse(raw);
+    const config = getPrimeConfig();
+    const apiKey = await config.modelRegistry.getApiKeyForProvider(body.providerId);
+    if (!apiKey) return Response.json({
+      providerId: body.providerId,
+      models: []
+    });
+    const provider = body.providerId;
+    const entry = listCustomProviders(`${config.agentDir}/models.json`)[provider];
+    const api = uiApiForCustomProvider(entry?.api);
+    if (entry?.api && !api || api && !isOccFamilyApi(api)) return Response.json({
+      providerId: provider,
+      models: []
+    });
+    const baseUrl = entry?.baseUrl;
+    if (!baseUrl) return Response.json({
+      providerId: provider,
+      models: []
+    });
+    try {
+      const modelsUrl = openAiModelsUrl(baseUrl);
+      const response = await fetch(modelsUrl, {
+        headers: { Authorization: `Bearer ${apiKey}` },
+        redirect: "error",
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (!response.ok) return Response.json({
+        providerId: provider,
+        models: []
+      });
+      const models = ((await response.json()).data ?? []).map((m) => ({
+        key: `${provider}/${m.id}`,
+        provider,
+        id: m.id,
+        name: m.id,
+        reasoning: false,
+        input: ["text"],
+        available: true,
+        defaultThinkingLevel: "off",
+        thinkingLevels: ["off"]
+      }));
+      if (models.length > 0) {
+        addCustomProviderModelIds(`${config.agentDir}/models.json`, provider, models.map((model) => model.id));
+        config.reloadAuth();
+      }
+      return Response.json({
+        providerId: provider,
+        models
+      });
+    } catch {
+      return Response.json({
+        providerId: provider,
+        models: []
+      });
+    }
+  }, request);
+}
+function toThinkingLevel(level) {
+  return level;
+}
+function handleChatNewPost(request) {
+  return wrapApiHandler(async () => {
+    const bridge = getBridge();
+    const registry = getPrimeConfig().projectRegistry;
+    const raw = await request.json().catch(() => ({}));
+    const body = ChatNewRequestSchema.parse(raw);
+    const projectId = body.projectId ?? await registry.projectIdForCwd(getPrimeConfig().defaultCwd) ?? (await registry.register(getPrimeConfig().defaultCwd)).projectId;
+    const project = await registry.get(projectId);
+    bridge.ensureKernelReady(project.canonicalPath).catch(() => {
+    });
+    const session = await bridge.createSession({
+      cwd: project.canonicalPath,
+      projectId,
+      thinkingLevel: toThinkingLevel(body.thinkingLevel),
+      mode: body.mode,
+      openUI: body.openUI
+    });
+    if (body.model) {
+      await bridge.setModel(session.sessionId, body.model);
+      const thinking = body.model.thinkingLevel ?? body.thinkingLevel;
+      if (thinking) await session.connection.setThinkingLevel(toThinkingLevel(thinking));
+    }
+    return Response.json({
+      session: {
+        sessionId: session.sessionId,
+        projectId
+      },
+      messages: [],
+      planPresentations: [],
+      presentation: bridge.getPresentation(session.sessionId)
+    });
+  }, request);
+}
+function record(value) {
+  return typeof value === "object" && value !== null ? value : void 0;
+}
+function artifactIndexFor(artifact) {
+  const input = record(artifact.input);
+  return typeof input?.artifactIndex === "number" ? input.artifactIndex : void 0;
+}
+function handleChatOpenUIArtifactPut(request) {
+  return wrapApiHandler(async () => {
+    const raw = await request.json().catch(() => ({}));
+    const parsed = ChatOpenUIArtifactUpsertRequestSchema.safeParse(raw);
+    if (!parsed.success) return Response.json({ message: "Invalid OpenUI artifact request." }, { status: 400 });
+    const body = parsed.data;
+    const validation = validateAndNormalizeOpenUIHtmlArtifact(body.artifact);
+    if (!validation.ok) return Response.json({ message: validation.reason }, { status: validation.status ?? 400 });
+    const bridge = getBridge();
+    const session = bridge.getSession(body.sessionId) ?? await bridge.resumeSessionById(body.sessionId);
+    if (!session || !await requireProjectSession(session)) return Response.json({ message: `Unknown session: ${body.sessionId}` }, { status: 404 });
+    const messages = await bridge.getMessages(session.sessionId);
+    const incomingId = body.assistantMessageId;
+    const exact = messages.find((message) => message.role === "assistant" && message.id === incomingId);
+    const existing = bridge.getPresentation(session.sessionId).artifactRuns.flatMap((run) => run.artifacts).filter((artifact2) => artifact2.kind === "openui-html").find((artifact2) => artifactIndexFor(artifact2) === body.artifactIndex && (record(artifact2.input)?.clientMessageId === incomingId || artifact2.sourceMessageId === incomingId));
+    const fallback = existing ? void 0 : [...messages].reverse().find((message) => message.role === "assistant");
+    const assistantMessageId = exact?.id ?? existing?.sourceMessageId ?? fallback?.id;
+    if (!assistantMessageId) return Response.json({ message: "Unable to associate OpenUI artifact with an assistant message." }, { status: 409 });
+    const artifact = {
+      id: stablePresentationId(`${assistantMessageId}:openui-html:${body.artifactIndex}`),
+      runId: stablePresentationId(`${assistantMessageId}:openui`),
+      sourceMessageId: assistantMessageId,
+      kind: "openui-html",
+      title: validation.value.title,
+      status: "success",
+      input: {
+        clientMessageId: incomingId,
+        artifactIndex: body.artifactIndex
+      },
+      output: validation.value,
+      timestamp: Date.now()
+    };
+    const presentation = await bridge.upsertPresentationArtifact(session.sessionId, artifact);
+    return Response.json({
+      artifact,
+      presentation
+    });
+  }, request);
+}
+function handleChatPlanPresentationPut(request) {
+  return wrapApiHandler(async () => {
+    const body = ChatPlanPresentationUpsertRequestSchema.parse(await request.json().catch(() => ({})));
+    const bridge = getBridge();
+    const session = bridge.getSession(body.sessionId) ?? await bridge.resumeSessionById(body.sessionId);
+    if (!session || !await requireProjectSession(session)) return Response.json({ message: `Unknown session: ${body.sessionId}` }, { status: 404 });
+    const messages = await bridge.getMessages(body.sessionId);
+    const incomingId = body.presentation.assistantMessageId;
+    const known = messages.find((message) => message.id === incomingId && message.role === "assistant");
+    const existing = (await loadManagedPlanPresentations(session)).find((item) => item.assistantMessageId === incomingId || item.clientMessageId === incomingId);
+    const fallback = existing ? void 0 : [...messages].reverse().find((message) => message.role === "assistant");
+    const assistantMessageId = known?.id ?? existing?.assistantMessageId ?? fallback?.id;
+    if (!assistantMessageId) return Response.json({ message: "Unable to associate Plan presentation with an assistant message" }, { status: 409 });
+    const clientMessageId = incomingId !== assistantMessageId ? existing?.clientMessageId ?? incomingId : existing?.clientMessageId;
+    return Response.json({ presentation: await upsertManagedPlanPresentation(session, {
+      ...body.presentation,
+      assistantMessageId,
+      ...clientMessageId ? { clientMessageId } : {}
+    }) });
+  }, request);
 }
 function handleChatQuestionPost(request) {
   return wrapApiHandler(async () => {
@@ -35325,19 +36195,27 @@ function handleChatQuestionPost(request) {
       ok: false,
       message: "answer requires sessionId and toolCallId"
     }, { status: 400 });
-    if (!getBridge().answerDialog(sessionId, toolCallId, body.answer)) return Response.json({
+    const bridge = getBridge();
+    if (!await requireProjectSession(bridge.getSession(sessionId) ?? await bridge.resumeSessionById(sessionId))) return Response.json({
+      ok: false,
+      message: `Unknown session: ${sessionId}`
+    }, { status: 404 });
+    if (!bridge.answerDialog(sessionId, toolCallId, body.answer)) return Response.json({
       ok: false,
       message: "Question is no longer active"
     }, { status: 404 });
     return Response.json({ ok: true });
-  });
+  }, request);
 }
 function handleChatQueueMutationPost(request) {
   return wrapApiHandler(async () => {
     const body = ChatQueueMutationRequestSchema.parse(await request.json().catch(() => ({})));
-    const result = await getBridge().deleteQueuedMessage(body.sessionId, body.lane, body.index, body.expectedText);
+    const bridge = getBridge();
+    if (!await requireProjectSession(bridge.getSession(body.sessionId) ?? await bridge.resumeSessionById(body.sessionId))) return Response.json({ message: `Unknown session: ${body.sessionId}` }, { status: 404 });
+    const mutation = body.mutation ?? { type: "delete" };
+    const result = await bridge.mutateQueuedMessage(body.sessionId, body.lane, body.index, body.expectedText, mutation);
     return Response.json(ChatQueueMutationResponseSchema.parse(result));
-  });
+  }, request);
 }
 function packageSourceToString(source) {
   if (typeof source === "string") return { name: source };
@@ -35394,7 +36272,7 @@ function handleChatResourcesGet(request) {
       })),
       diagnostics
     });
-  });
+  }, request);
 }
 var BodySchema = ChatSessionMetadataSchema.extend({ sessionId: SessionIdSchema });
 function handleChatResumePost(request) {
@@ -35416,7 +36294,7 @@ function handleChatResumePost(request) {
       });
     }
     return Response.json({ message: "resume requires sessionId" }, { status: 400 });
-  });
+  }, request);
 }
 function handleChatSessionGet(request) {
   return wrapApiHandler(async () => {
@@ -35428,7 +36306,10 @@ function handleChatSessionGet(request) {
       const parsedParentSessionId = SessionIdSchema.safeParse(parentSessionId);
       const parsedChildId = SessionIdSchema.safeParse(childId);
       if (!parsedParentSessionId.success || !parsedChildId.success) return Response.json({ message: "Invalid subagent session identifiers" }, { status: 400 });
-      const child = await getBridge().loadRlmChildTranscript(parsedParentSessionId.data, parsedChildId.data);
+      const bridge2 = getBridge();
+      const liveParent = bridge2.getSession(parsedParentSessionId.data);
+      if (liveParent && !await requireProjectSession(liveParent)) return Response.json({ message: `Unknown session: ${parsedParentSessionId.data}` }, { status: 404 });
+      const child = await bridge2.loadRlmChildTranscript(parsedParentSessionId.data, parsedChildId.data);
       if (!child) return Response.json({ message: "Unknown subagent transcript" }, { status: 404 });
       return Response.json({
         session: {
@@ -35447,7 +36328,7 @@ function handleChatSessionGet(request) {
     const bridge = getBridge();
     const projectId = requestedProjectId ? ProjectIdSchema.parse(requestedProjectId) : void 0;
     const existing = projectId ? await bridge.resumeSessionById(sessionId, projectId, { openUI }) : bridge.getSession(sessionId) ?? await bridge.resumeSessionById(sessionId, void 0, { openUI });
-    if (!existing) return Response.json({ message: `Unknown session: ${sessionId}` }, { status: 404 });
+    if (!existing || !await requireProjectSession(existing)) return Response.json({ message: `Unknown session: ${sessionId}` }, { status: 404 });
     return Response.json({
       session: {
         sessionId: existing.sessionId,
@@ -35457,7 +36338,7 @@ function handleChatSessionGet(request) {
       planPresentations: await loadManagedPlanPresentations(existing),
       presentation: bridge.getPresentation(existing.sessionId)
     });
-  });
+  }, request);
 }
 var RenameSessionSchema = external_exports.object({
   sessionId: SessionIdSchema,
@@ -35468,24 +36349,28 @@ function handleChatSessionRenamePatch(request) {
   return wrapApiHandler(async () => {
     const body = RenameSessionSchema.parse(await request.json().catch(() => ({})));
     const bridge = getBridge();
-    if (!(bridge.getSession(body.sessionId) ?? await bridge.resumeSessionById(body.sessionId))) return Response.json({ message: `Unknown session: ${body.sessionId}` }, { status: 404 });
+    const session = bridge.getSession(body.sessionId) ?? await bridge.resumeSessionById(body.sessionId);
+    if (!session || !await requireProjectSession(session)) return Response.json({ message: `Unknown session: ${body.sessionId}` }, { status: 404 });
     bridge.setSessionName(body.sessionId, body.title);
     return Response.json({
       ok: true,
       sessionId: body.sessionId,
       title: body.title
     });
-  });
+  }, request);
 }
 function handleChatSessionDelete(request) {
   return wrapApiHandler(async () => {
     const body = DeleteSessionSchema.parse(await request.json().catch(() => ({})));
-    if (!await getBridge().deleteSession(body.sessionId)) return Response.json({ message: `Unknown session: ${body.sessionId}` }, { status: 404 });
+    const bridge = getBridge();
+    const session = bridge.getSession(body.sessionId) ?? await bridge.resumeSessionById(body.sessionId);
+    if (!session || !await requireProjectSession(session)) return Response.json({ message: `Unknown session: ${body.sessionId}` }, { status: 404 });
+    if (!await bridge.deleteSession(body.sessionId)) return Response.json({ message: `Unknown session: ${body.sessionId}` }, { status: 404 });
     return Response.json({
       ok: true,
       sessionId: body.sessionId
     });
-  });
+  }, request);
 }
 function stringValue(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
@@ -35509,14 +36394,53 @@ function normalizeSessionListRow(source) {
     source,
     sessionId,
     cwd,
-    title: stringValue(raw.sessionName) ?? stringValue(raw.name),
+    title: meaningfulSessionLabel(stringValue(raw.sessionName) ?? stringValue(raw.name)),
     createdAt,
     updatedAt,
     messageCount: messageCountValue(raw.messageCount),
-    firstMessage: typeof raw.firstMessage === "string" ? raw.firstMessage : "",
+    firstMessage: meaningfulSessionLabel(typeof raw.firstMessage === "string" ? raw.firstMessage : void 0) ?? "",
     isSubagent
   };
 }
+function sessionSourcePath(source) {
+  const raw = source;
+  return stringValue(raw.sessionFile) ?? stringValue(raw.path);
+}
+function latestBy(entries, time) {
+  if (entries.length === 0) return void 0;
+  return entries.reduce((latest, entry) => time(entry) >= time(latest) ? entry : latest);
+}
+function presentationListActivity(presentation) {
+  if (!presentation) return { activityCount: 0 };
+  const artifacts = presentation.artifactRuns.flatMap((run) => run.artifacts);
+  const latestRefinement = latestBy(presentation.refinements, (entry) => entry.timestamp);
+  const latestArtifact = latestBy(artifacts, (entry) => entry.timestamp);
+  const latestBash = latestBy(presentation.userBash, (entry) => entry.startedAt);
+  return {
+    title: meaningfulSessionLabel(presentation.sessionName) ?? meaningfulSessionLabel(latestRefinement?.summary) ?? meaningfulSessionLabel(latestArtifact?.title) ?? meaningfulSessionLabel(latestBash?.command),
+    activityCount: presentation.refinements.length + artifacts.length + presentation.userBash.length
+  };
+}
+function applyPresentationToSessionRow(row, presentation) {
+  const { title: presentationTitle, activityCount } = presentationListActivity(presentation);
+  const firstMessage = row.firstMessage || presentationTitle || "";
+  return {
+    title: row.title ?? meaningfulSessionLabel(firstMessage) ?? presentationTitle ?? fallbackSessionLabel(row.sessionId),
+    firstMessage,
+    messageCount: row.messageCount > 0 ? row.messageCount : activityCount > 0 ? 1 : 0
+  };
+}
+function sessionNeedsPresentationJoin(row) {
+  return row.messageCount === 0 || !row.title || !row.firstMessage;
+}
+async function loadSessionListPresentation(row, source, livePresentation) {
+  const liveActivity = presentationListActivity(livePresentation);
+  if (liveActivity.activityCount > 0 || liveActivity.title) return livePresentation;
+  if (!sessionNeedsPresentationJoin(row)) return livePresentation;
+  const path = sessionSourcePath(source);
+  if (!path) return livePresentation;
+  return await loadManagedPrimePresentation({ sessionPath: path }) ?? livePresentation;
+}
 function sessionStatus(info, live) {
   if (live?.isStreaming || live?.session?.isStreaming || info.isStreaming) return "running";
   if (info.activity === "working" && (info.isSessionActive || info.hasRunningRlmChildren === true)) return "running";
@@ -35544,22 +36468,24 @@ function handleProjectsGet(_request) {
     for (const projectId of assignments.values()) if (projectId) counts.set(projectId, (counts.get(projectId) ?? 0) + 1);
     return Response.json({
       projects: await getPrimeConfig().projectRegistry.list(counts),
-      sessions: sessions2.map((source) => {
+      sessions: await Promise.all(sessions2.map(async (source) => {
         const session = normalizeSessionListRow(source);
+        const liveSession = getBridge().getSession(session.sessionId);
+        const fields = applyPresentationToSessionRow(session, await loadSessionListPresentation(session, source, liveSession?.mapperState?.presentation));
         return {
           sessionId: session.sessionId,
           projectId: assignments.get(session.sessionId) ?? null,
-          title: redactSessionLabelSecrets(session.title || session.firstMessage || session.sessionId.slice(0, 8)),
+          title: redactSessionLabelSecrets(fields.title),
           createdAt: session.createdAt,
           updatedAt: session.updatedAt,
-          status: sessionStatus(session.source, getBridge().getSession(session.sessionId)),
-          messageCount: session.messageCount,
-          firstMessage: session.firstMessage ? redactSessionLabelSecrets(session.firstMessage) : "",
+          status: sessionStatus(session.source, liveSession),
+          messageCount: fields.messageCount,
+          firstMessage: fields.firstMessage ? redactSessionLabelSecrets(fields.firstMessage) : "",
           ...session.isSubagent ? { isSubagent: true } : {}
         };
-      })
+      }))
     });
-  });
+  }, _request);
 }
 function handleProjectsPost(request) {
   return wrapApiHandler(async () => {
@@ -35567,20 +36493,20 @@ function handleProjectsPost(request) {
     const registry = getPrimeConfig().projectRegistry;
     const path = await registry.resolveDirectoryInput(body);
     return Response.json({ project: await registry.register(path, body.name) }, { status: 201 });
-  });
+  }, request);
 }
 function handleProjectPatch(request) {
   return wrapApiHandler(async () => {
     const projectId = ProjectIdSchema.parse(new URL(request.url).searchParams.get("projectId") ?? "");
     const body = ProjectRenameRequestSchema.parse(await request.json().catch(() => ({})));
     return Response.json({ project: await getPrimeConfig().projectRegistry.rename(projectId, body.name) });
-  });
+  }, request);
 }
 function handleProjectDelete(request) {
   return wrapApiHandler(async () => {
     const projectId = ProjectIdSchema.parse(new URL(request.url).searchParams.get("projectId") ?? "");
     return Response.json({ project: await getPrimeConfig().projectRegistry.unregister(projectId) });
-  });
+  }, request);
 }
 function handleProjectSessionFork(request) {
   return wrapApiHandler(async () => {
@@ -35590,7 +36516,7 @@ function handleProjectSessionFork(request) {
       sessionId,
       projectId: body.targetProjectId
     }, { status: 201 });
-  });
+  }, request);
 }
 function handleProjectBrowseGet(request) {
   return wrapApiHandler(async () => {
@@ -35600,7 +36526,7 @@ function handleProjectBrowseGet(request) {
       token: url.searchParams.get("token") ?? void 0
     });
     return Response.json(result);
-  });
+  }, request);
 }
 function handleChatSessionsGet(_request) {
   return wrapApiHandler(async () => {
@@ -35611,20 +36537,21 @@ function handleChatSessionsGet(_request) {
     const formatted = await Promise.all(sessions2.map(async (s) => {
       const session = normalizeSessionListRow(s);
       const liveSession = bridge.getSession(session.sessionId);
+      const fields = applyPresentationToSessionRow(session, await loadSessionListPresentation(session, s, liveSession?.mapperState?.presentation));
       return {
         sessionId: session.sessionId,
         projectId: await getPrimeConfig().projectRegistry.projectIdForSession(session.sessionId, liveSession?.cwd ?? session.cwd),
-        title: session.title || session.firstMessage || session.sessionId.slice(0, 8),
+        title: fields.title,
         createdAt: session.createdAt,
         updatedAt: session.updatedAt,
         status: sessionStatus(session.source, liveSession),
-        messageCount: session.messageCount,
-        firstMessage: session.firstMessage,
+        messageCount: fields.messageCount,
+        firstMessage: fields.firstMessage,
         ...session.isSubagent ? { isSubagent: true } : {}
       };
     }));
     return Response.json({ sessions: projectId ? formatted.filter((session) => session.projectId === projectId) : formatted });
-  });
+  }, _request);
 }
 function toProjectShape(project) {
   const out = {};
@@ -35694,7 +36621,7 @@ function handleChatSettingsGet(request) {
   return wrapApiHandler(async () => {
     const cwd = await cwdForRequest(request);
     return Response.json(buildResponse(cwd));
-  });
+  }, request);
 }
 function handleChatSettingsPatch(request) {
   return wrapApiHandler(async () => {
@@ -35719,7 +36646,7 @@ function handleChatSettingsPatch(request) {
     if (patch.themes !== void 0) manager.setThemePaths(patch.themes);
     if (patch.packages !== void 0) manager.setPackages(patch.packages);
     return Response.json(buildResponse(cwd));
-  });
+  }, request);
 }
 function handleHealthGet(request) {
   return wrapApiHandler(async () => {
@@ -35729,12 +36656,12 @@ function handleHealthGet(request) {
       kernel,
       uptimeMs: process.uptime() * 1e3
     });
-  });
+  }, request);
 }
 function handleWorkspaceBrowseGet(request) {
   return wrapApiHandler(async () => {
     return Response.json({ message: "Workspace root switching is disabled; use /api/projects/browse for opaque directory tokens." }, { status: 410 });
-  });
+  }, request);
 }
 function canonicalizePath(path) {
   try {
@@ -35855,7 +36782,7 @@ function handleWorkspaceFileGet(request) {
     const result = await readWorkspaceFile(await cwdForRequest(request), path);
     if (result.kind === "error") return Response.json({ message: result.message }, { status: result.status });
     return Response.json(result.body);
-  });
+  }, request);
 }
 var IGNORED = /* @__PURE__ */ new Set([
   ".git",
@@ -35935,179 +36862,195 @@ function handleWorkspaceTreeGet(_request) {
       nodes,
       diagnostics
     });
-  });
+  }, _request);
 }
-var Route$25 = createFileRoute("/api/chat")({ server: { handlers: { POST: ({ request }) => handleChatPost(request) } } });
-var Route$24 = createFileRoute("/api/health")({ server: { handlers: { GET: ({ request }) => handleHealthGet(request) } } });
-var Route$23 = createFileRoute("/api/projects")({ server: { handlers: {
+var Route$27 = createFileRoute("/api/chat")({ server: { handlers: { POST: ({ request }) => handleChatPost(request) } } });
+var Route$26 = createFileRoute("/api/health")({ server: { handlers: { GET: ({ request }) => handleHealthGet(request) } } });
+var Route$25 = createFileRoute("/api/projects")({ server: { handlers: {
   DELETE: ({ request }) => handleProjectDelete(request),
   GET: ({ request }) => handleProjectsGet(request),
   PATCH: ({ request }) => handleProjectPatch(request),
   POST: ({ request }) => handleProjectsPost(request)
 } } });
-var Route$22 = createFileRoute("/api/chat/abort")({ server: { handlers: { POST: ({ request }) => handleChatAbortPost(request) } } });
-var Route$21 = createFileRoute("/api/chat/artifacts")({ server: { handlers: { PUT: ({ request }) => handleChatOpenUIArtifactPut(request) } } });
-var Route$20 = createFileRoute("/api/chat/command")({ server: { handlers: { POST: ({ request }) => handleChatCommandPost(request) } } });
-var Route$19 = createFileRoute("/api/chat/commands")({ server: { handlers: { GET: ({ request }) => handleChatCommandsGet(request) } } });
-var Route$18 = createFileRoute("/api/chat/events")({ server: { handlers: { GET: ({ request }) => handleChatEventsGet(request) } } });
-var Route$17 = createFileRoute("/api/chat/model")({ server: { handlers: { POST: ({ request }) => handleChatModelPost(request) } } });
-var Route$16 = createFileRoute("/api/chat/models")({ server: { handlers: { GET: ({ request }) => handleChatModelsGet(request) } } });
-var Route$15 = createFileRoute("/api/chat/new")({ server: { handlers: { POST: ({ request }) => handleChatNewPost(request) } } });
-var Route$14 = createFileRoute("/api/chat/providers")({ server: { handlers: {
+var Route$24 = createFileRoute("/api/chat/abort")({ server: { handlers: { POST: ({ request }) => handleChatAbortPost(request) } } });
+var Route$23 = createFileRoute("/api/chat/artifacts")({ server: { handlers: { PUT: ({ request }) => handleChatOpenUIArtifactPut(request) } } });
+var Route$22 = createFileRoute("/api/chat/command")({ server: { handlers: { POST: ({ request }) => handleChatCommandPost(request) } } });
+var Route$21 = createFileRoute("/api/chat/commands")({ server: { handlers: { GET: ({ request }) => handleChatCommandsGet(request) } } });
+var Route$20 = createFileRoute("/api/chat/events")({ server: { handlers: { GET: ({ request }) => handleChatEventsGet(request) } } });
+var Route$19 = createFileRoute("/api/chat/mcp")({ server: { handlers: {
+  GET: ({ request }) => handleChatMcpGet(request),
+  POST: ({ request }) => handleChatMcpPost(request),
+  DELETE: ({ request }) => handleChatMcpDelete(request)
+} } });
+var Route$18 = createFileRoute("/api/chat/model")({ server: { handlers: { POST: ({ request }) => handleChatModelPost(request) } } });
+var Route$17 = createFileRoute("/api/chat/models")({ server: { handlers: { GET: ({ request }) => handleChatModelsGet(request) } } });
+var Route$16 = createFileRoute("/api/chat/new")({ server: { handlers: { POST: ({ request }) => handleChatNewPost(request) } } });
+var Route$15 = createFileRoute("/api/chat/providers")({ server: { handlers: {
   GET: ({ request }) => handleChatProvidersGet(request),
   POST: ({ request }) => handleChatProvidersPost(request),
   DELETE: ({ request }) => handleChatProvidersDelete(request)
 } } });
-var Route$13 = createFileRoute("/api/chat/question")({ server: { handlers: { POST: ({ request }) => handleChatQuestionPost(request) } } });
-var Route$12 = createFileRoute("/api/chat/resources")({ server: { handlers: { GET: ({ request }) => handleChatResourcesGet(request) } } });
-var Route$11 = createFileRoute("/api/chat/resume")({ server: { handlers: { POST: ({ request }) => handleChatResumePost(request) } } });
-var Route$10 = createFileRoute("/api/chat/session")({ server: { handlers: {
+var Route$14 = createFileRoute("/api/chat/question")({ server: { handlers: { POST: ({ request }) => handleChatQuestionPost(request) } } });
+var Route$13 = createFileRoute("/api/chat/resources")({ server: { handlers: { GET: ({ request }) => handleChatResourcesGet(request) } } });
+var Route$12 = createFileRoute("/api/chat/resume")({ server: { handlers: { POST: ({ request }) => handleChatResumePost(request) } } });
+var Route$11 = createFileRoute("/api/chat/session")({ server: { handlers: {
   GET: ({ request }) => new URL(request.url).searchParams.has("attachmentId") ? handleChatAttachmentGet(request) : handleChatSessionGet(request),
   POST: ({ request }) => handleChatAttachmentsPost(request),
   PUT: ({ request }) => handleChatPlanPresentationPut(request),
   PATCH: ({ request }) => handleChatQueueMutationPost(request)
 } } });
-var Route$9 = createFileRoute("/api/chat/sessions")({ server: { handlers: {
+var Route$10 = createFileRoute("/api/chat/sessions")({ server: { handlers: {
   DELETE: ({ request }) => handleChatSessionDelete(request),
   GET: ({ request }) => handleChatSessionsGet(request),
   PATCH: ({ request }) => handleChatSessionRenamePatch(request)
 } } });
-var Route$8 = createFileRoute("/api/chat/settings")({ server: { handlers: {
+var Route$9 = createFileRoute("/api/chat/settings")({ server: { handlers: {
   GET: ({ request }) => handleChatSettingsGet(request),
   PATCH: ({ request }) => handleChatSettingsPatch(request)
 } } });
-var Route$7 = createFileRoute("/api/projects/browse")({ server: { handlers: { GET: ({ request }) => handleProjectBrowseGet(request) } } });
-var Route$6 = createFileRoute("/api/projects/fork")({ server: { handlers: { POST: ({ request }) => handleProjectSessionFork(request) } } });
-var Route$5 = createFileRoute("/api/workspace/browse")({ server: { handlers: { GET: ({ request }) => handleWorkspaceBrowseGet(request) } } });
-var Route$4 = createFileRoute("/api/workspace/file")({ server: { handlers: { GET: ({ request }) => handleWorkspaceFileGet(request) } } });
-var Route$3 = createFileRoute("/api/workspace/root")({ server: { handlers: { POST: () => Response.json({ message: "The workspace root is fixed when Fleet starts" }, { status: 405 }) } } });
-var Route$2 = createFileRoute("/api/workspace/tree")({ server: { handlers: { GET: ({ request }) => handleWorkspaceTreeGet(request) } } });
+var Route$8 = createFileRoute("/api/projects/browse")({ server: { handlers: { GET: ({ request }) => handleProjectBrowseGet(request) } } });
+var Route$7 = createFileRoute("/api/projects/fork")({ server: { handlers: { POST: ({ request }) => handleProjectSessionFork(request) } } });
+var Route$6 = createFileRoute("/api/workspace/browse")({ server: { handlers: { GET: ({ request }) => handleWorkspaceBrowseGet(request) } } });
+var Route$5 = createFileRoute("/api/workspace/file")({ server: { handlers: { GET: ({ request }) => handleWorkspaceFileGet(request) } } });
+var Route$4 = createFileRoute("/api/workspace/root")({ server: { handlers: { POST: () => Response.json({ message: "The workspace root is fixed when Fleet starts" }, { status: 405 }) } } });
+var Route$3 = createFileRoute("/api/workspace/tree")({ server: { handlers: { GET: ({ request }) => handleWorkspaceTreeGet(request) } } });
+var Route$2 = createFileRoute("/api/chat/mcp/oauth")({ server: { handlers: { POST: ({ request }) => handleChatMcpOAuthPost(request) } } });
 var Route$1 = createFileRoute("/api/chat/models/discover")({ server: { handlers: { POST: ({ request }) => handleChatModelsDiscoverPost(request) } } });
 var Route = createFileRoute("/api/chat/providers/oauth")({ server: { handlers: { POST: ({ request }) => handleChatProvidersOAuthPost(request) } } });
-var IndexRoute = Route$26.update({
+var IndexRoute = Route$28.update({
   id: "/",
   path: "/",
-  getParentRoute: () => Route$27
+  getParentRoute: () => Route$29
 });
-var ApiChatRoute = Route$25.update({
+var ApiChatRoute = Route$27.update({
   id: "/api/chat",
   path: "/api/chat",
-  getParentRoute: () => Route$27
+  getParentRoute: () => Route$29
 });
-var ApiHealthRoute = Route$24.update({
+var ApiHealthRoute = Route$26.update({
   id: "/api/health",
   path: "/api/health",
-  getParentRoute: () => Route$27
+  getParentRoute: () => Route$29
 });
-var ApiProjectsRoute = Route$23.update({
+var ApiProjectsRoute = Route$25.update({
   id: "/api/projects",
   path: "/api/projects",
-  getParentRoute: () => Route$27
+  getParentRoute: () => Route$29
 });
-var ApiChatAbortRoute = Route$22.update({
+var ApiChatAbortRoute = Route$24.update({
   id: "/abort",
   path: "/abort",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatArtifactsRoute = Route$21.update({
+var ApiChatArtifactsRoute = Route$23.update({
   id: "/artifacts",
   path: "/artifacts",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatCommandRoute = Route$20.update({
+var ApiChatCommandRoute = Route$22.update({
   id: "/command",
   path: "/command",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatCommandsRoute = Route$19.update({
+var ApiChatCommandsRoute = Route$21.update({
   id: "/commands",
   path: "/commands",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatEventsRoute = Route$18.update({
+var ApiChatEventsRoute = Route$20.update({
   id: "/events",
   path: "/events",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatModelRoute = Route$17.update({
+var ApiChatMcpRoute = Route$19.update({
+  id: "/mcp",
+  path: "/mcp",
+  getParentRoute: () => ApiChatRoute
+});
+var ApiChatModelRoute = Route$18.update({
   id: "/model",
   path: "/model",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatModelsRoute = Route$16.update({
+var ApiChatModelsRoute = Route$17.update({
   id: "/models",
   path: "/models",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatNewRoute = Route$15.update({
+var ApiChatNewRoute = Route$16.update({
   id: "/new",
   path: "/new",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatProvidersRoute = Route$14.update({
+var ApiChatProvidersRoute = Route$15.update({
   id: "/providers",
   path: "/providers",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatQuestionRoute = Route$13.update({
+var ApiChatQuestionRoute = Route$14.update({
   id: "/question",
   path: "/question",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatResourcesRoute = Route$12.update({
+var ApiChatResourcesRoute = Route$13.update({
   id: "/resources",
   path: "/resources",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatResumeRoute = Route$11.update({
+var ApiChatResumeRoute = Route$12.update({
   id: "/resume",
   path: "/resume",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatSessionRoute = Route$10.update({
+var ApiChatSessionRoute = Route$11.update({
   id: "/session",
   path: "/session",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatSessionsRoute = Route$9.update({
+var ApiChatSessionsRoute = Route$10.update({
   id: "/sessions",
   path: "/sessions",
   getParentRoute: () => ApiChatRoute
 });
-var ApiChatSettingsRoute = Route$8.update({
+var ApiChatSettingsRoute = Route$9.update({
   id: "/settings",
   path: "/settings",
   getParentRoute: () => ApiChatRoute
 });
-var ApiProjectsBrowseRoute = Route$7.update({
+var ApiProjectsBrowseRoute = Route$8.update({
   id: "/browse",
   path: "/browse",
   getParentRoute: () => ApiProjectsRoute
 });
-var ApiProjectsForkRoute = Route$6.update({
+var ApiProjectsForkRoute = Route$7.update({
   id: "/fork",
   path: "/fork",
   getParentRoute: () => ApiProjectsRoute
 });
-var ApiWorkspaceBrowseRoute = Route$5.update({
+var ApiWorkspaceBrowseRoute = Route$6.update({
   id: "/api/workspace/browse",
   path: "/api/workspace/browse",
-  getParentRoute: () => Route$27
+  getParentRoute: () => Route$29
 });
-var ApiWorkspaceFileRoute = Route$4.update({
+var ApiWorkspaceFileRoute = Route$5.update({
   id: "/api/workspace/file",
   path: "/api/workspace/file",
-  getParentRoute: () => Route$27
+  getParentRoute: () => Route$29
 });
-var ApiWorkspaceRootRoute = Route$3.update({
+var ApiWorkspaceRootRoute = Route$4.update({
   id: "/api/workspace/root",
   path: "/api/workspace/root",
-  getParentRoute: () => Route$27
+  getParentRoute: () => Route$29
 });
-var ApiWorkspaceTreeRoute = Route$2.update({
+var ApiWorkspaceTreeRoute = Route$3.update({
   id: "/api/workspace/tree",
   path: "/api/workspace/tree",
-  getParentRoute: () => Route$27
+  getParentRoute: () => Route$29
+});
+var ApiChatMcpOauthRoute = Route$2.update({
+  id: "/oauth",
+  path: "/oauth",
+  getParentRoute: () => ApiChatMcpRoute
 });
 var ApiChatModelsDiscoverRoute = Route$1.update({
   id: "/discover",
@@ -36119,6 +37062,8 @@ var ApiChatProvidersOauthRoute = Route.update({
   path: "/oauth",
   getParentRoute: () => ApiChatProvidersRoute
 });
+var ApiChatMcpRouteChildren = { ApiChatMcpOauthRoute };
+var ApiChatMcpRouteWithChildren = ApiChatMcpRoute._addFileChildren(ApiChatMcpRouteChildren);
 var ApiChatModelsRouteChildren = { ApiChatModelsDiscoverRoute };
 var ApiChatModelsRouteWithChildren = ApiChatModelsRoute._addFileChildren(ApiChatModelsRouteChildren);
 var ApiChatProvidersRouteChildren = { ApiChatProvidersOauthRoute };
@@ -36128,6 +37073,7 @@ var ApiChatRouteChildren = {
   ApiChatCommandRoute,
   ApiChatCommandsRoute,
   ApiChatEventsRoute,
+  ApiChatMcpRoute: ApiChatMcpRouteWithChildren,
   ApiChatModelRoute,
   ApiChatModelsRoute: ApiChatModelsRouteWithChildren,
   ApiChatNewRoute,
@@ -36154,7 +37100,7 @@ var rootRouteChildren = {
   ApiWorkspaceRootRoute,
   ApiWorkspaceTreeRoute
 };
-var routeTree = Route$27._addFileChildren(rootRouteChildren)._addFileTypes();
+var routeTree = Route$29._addFileChildren(rootRouteChildren)._addFileTypes();
 function getRouter() {
   return createRouter({
     routeTree,