@schoolai/shipyard 0.1.0 → 0.5.0

package/dist/index.js

@@ -1,15 +1,25 @@
 #!/usr/bin/env node
 import {
+  AuthGitHubCallbackRequestSchema,
+  AuthGitHubCallbackResponseSchema,
+  AuthVerifyResponseSchema,
+  BRANCH_NAME_PATTERN,
+  CollabCreateRequestSchema,
+  CollabCreateResponseSchema,
+  ErrorResponseSchema,
+  HealthResponseSchema,
   PermissionModeSchema,
   PersonalRoomConnection,
-  ROUTES
-} from "./chunk-HOG3H5HO.js";
+  ROUTES,
+  ValidationErrorResponseSchema
+} from "./chunk-CQBP5B4G.js";
 import {
+  getShipyardHome,
   validateEnv
-} from "./chunk-WB5DGKI3.js";
+} from "./chunk-6S523TH3.js";
 
 // src/index.ts
-import { mkdir as mkdir3 } from "fs/promises";
+import { mkdir as mkdir4 } from "fs/promises";
 import { homedir as homedir3 } from "os";
 import { resolve as resolve2 } from "path";
 import { parseArgs } from "util";
@@ -3255,6 +3265,9 @@ function changeRef(ref, fn) {
   internals.getDoc().commit();
   return ref;
 }
+function getLoroDoc(docOrRef) {
+  return loro(docOrRef).doc;
+}
 function createPathSelector(segments) {
   return {
     __resultType: void 0,
@@ -11179,6 +11192,14 @@ var EpochDocumentSchema = Shape.doc({
     version: Shape.plain.number()
   })
 });
+var SUPPORTED_IMAGE_MEDIA_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp"];
+var ImageSourceShape = Shape.plain.discriminatedUnion("type", {
+  base64: Shape.plain.struct({
+    type: Shape.plain.string("base64"),
+    mediaType: Shape.plain.string(),
+    data: Shape.plain.string()
+  })
+});
 var ContentBlockShape = Shape.plain.discriminatedUnion("type", {
   text: Shape.plain.struct({
     type: Shape.plain.string("text"),
@@ -11201,6 +11222,11 @@ var ContentBlockShape = Shape.plain.discriminatedUnion("type", {
   thinking: Shape.plain.struct({
     type: Shape.plain.string("thinking"),
     text: Shape.plain.string()
+  }),
+  image: Shape.plain.struct({
+    type: Shape.plain.string("image"),
+    id: Shape.plain.string(),
+    source: ImageSourceShape
   })
 });
 var A2A_TASK_STATES = [
@@ -11215,6 +11241,9 @@ var A2A_TASK_STATES = [
 var SESSION_STATES = ["pending", "active", "completed", "failed", "interrupted"];
 var REASONING_EFFORTS = ["low", "medium", "high"];
 var PERMISSION_MODES = ["default", "accept-edits", "plan", "bypass"];
+var ANTHROPIC_AUTH_STATUSES = ["authenticated", "unauthenticated", "unknown"];
+var ANTHROPIC_AUTH_METHODS = ["api-key", "oauth", "none"];
+var ANTHROPIC_LOGIN_STATUSES = ["starting", "waiting", "done", "error"];
 var MessageShape = Shape.plain.struct({
   messageId: Shape.plain.string(),
   role: Shape.plain.string("user", "assistant"),
@@ -11281,6 +11310,17 @@ var DiffCommentShape = Shape.plain.struct({
   createdAt: Shape.plain.number(),
   resolvedAt: Shape.plain.number().nullable()
 });
+var PlanCommentShape = Shape.plain.struct({
+  commentId: Shape.plain.string(),
+  planId: Shape.plain.string(),
+  from: Shape.plain.number(),
+  to: Shape.plain.number(),
+  body: Shape.plain.string(),
+  authorType: Shape.plain.string(...COMMENT_AUTHOR_TYPES),
+  authorId: Shape.plain.string(),
+  createdAt: Shape.plain.number(),
+  resolvedAt: Shape.plain.number().nullable()
+});
 var TaskDocumentSchema = Shape.doc({
   meta: Shape.struct({
     id: Shape.plain.string(),
@@ -11293,7 +11333,9 @@ var TaskDocumentSchema = Shape.doc({
   sessions: Shape.list(SessionEntryShape),
   diffState: DiffStateShape,
   plans: Shape.list(PlanVersionShape),
-  diffComments: Shape.record(DiffCommentShape)
+  planEditorDocs: Shape.record(Shape.any()),
+  diffComments: Shape.record(DiffCommentShape),
+  planComments: Shape.record(PlanCommentShape)
 });
 var TOOL_RISK_LEVELS = ["low", "medium", "high"];
 var PERMISSION_DECISIONS = ["approved", "denied"];
@@ -11335,8 +11377,26 @@ var TaskIndexEntryShape = Shape.struct({
   createdAt: Shape.plain.number(),
   updatedAt: Shape.plain.number()
 });
+var WORKTREE_SETUP_STATUSES = ["running", "done", "failed"];
+var WorktreeSetupStatusShape = Shape.struct({
+  status: Shape.plain.string(...WORKTREE_SETUP_STATUSES),
+  machineId: Shape.plain.string(),
+  startedAt: Shape.plain.number(),
+  completedAt: Shape.plain.number().nullable(),
+  exitCode: Shape.plain.number().nullable(),
+  signal: Shape.plain.string().nullable(),
+  pid: Shape.plain.number().nullable()
+});
+var WorktreeScriptShape = Shape.plain.struct({
+  script: Shape.plain.string()
+});
+var UserSettingsShape = Shape.struct({
+  worktreeScripts: Shape.record(WorktreeScriptShape)
+});
 var TaskIndexDocumentSchema = Shape.doc({
-  taskIndex: Shape.record(TaskIndexEntryShape)
+  taskIndex: Shape.record(TaskIndexEntryShape),
+  worktreeSetupStatus: Shape.record(WorktreeSetupStatusShape),
+  userSettings: UserSettingsShape
 });
 var ReasoningCapabilityShape = Shape.plain.struct({
   efforts: Shape.plain.array(Shape.plain.string(...REASONING_EFFORTS)),
@@ -11354,14 +11414,68 @@ var GitRepoInfoShape = Shape.plain.struct({
   branch: Shape.plain.string(),
   remote: Shape.plain.string().nullable()
 });
+var AnthropicAuthShape = Shape.plain.struct({
+  status: Shape.plain.string(...ANTHROPIC_AUTH_STATUSES),
+  method: Shape.plain.string(...ANTHROPIC_AUTH_METHODS),
+  email: Shape.plain.string().nullable()
+});
 var MachineCapabilitiesEphemeral = Shape.plain.struct({
   models: Shape.plain.array(ModelInfoShape),
   environments: Shape.plain.array(GitRepoInfoShape),
   permissionModes: Shape.plain.array(Shape.plain.string(...PERMISSION_MODES)),
-  homeDir: Shape.plain.string().nullable()
+  homeDir: Shape.plain.string().nullable(),
+  anthropicAuth: AnthropicAuthShape.nullable()
+});
+var EnhancePromptRequestEphemeral = Shape.plain.struct({
+  machineId: Shape.plain.string(),
+  prompt: Shape.plain.string(),
+  requestedAt: Shape.plain.number()
+});
+var EnhancePromptResponseEphemeral = Shape.plain.struct({
+  status: Shape.plain.string("streaming", "done", "error"),
+  text: Shape.plain.string(),
+  error: Shape.plain.string().nullable()
+});
+var WorktreeCreateRequestEphemeral = Shape.plain.struct({
+  machineId: Shape.plain.string(),
+  sourceRepoPath: Shape.plain.string(),
+  branchName: Shape.plain.string(),
+  baseRef: Shape.plain.string(),
+  setupScript: Shape.plain.string().nullable(),
+  requestedAt: Shape.plain.number()
+});
+var WorktreeCreateResponseEphemeral = Shape.plain.struct({
+  status: Shape.plain.string("creating-worktree", "copying-files", "running-setup-script", "refreshing-environments", "done", "error"),
+  detail: Shape.plain.string().nullable(),
+  worktreePath: Shape.plain.string().nullable(),
+  branchName: Shape.plain.string().nullable(),
+  setupScriptStarted: Shape.plain.boolean().nullable(),
+  warnings: Shape.plain.array(Shape.plain.string()).nullable(),
+  error: Shape.plain.string().nullable()
+});
+var WorktreeSetupResultEphemeral = Shape.plain.struct({
+  exitCode: Shape.plain.number().nullable(),
+  signal: Shape.plain.string().nullable(),
+  worktreePath: Shape.plain.string()
+});
+var AnthropicLoginRequestEphemeral = Shape.plain.struct({
+  machineId: Shape.plain.string(),
+  requestedAt: Shape.plain.number()
+});
+var AnthropicLoginResponseEphemeral = Shape.plain.struct({
+  status: Shape.plain.string(...ANTHROPIC_LOGIN_STATUSES),
+  loginUrl: Shape.plain.string().nullable(),
+  error: Shape.plain.string().nullable()
 });
 var ROOM_EPHEMERAL_DECLARATIONS = {
-  capabilities: MachineCapabilitiesEphemeral
+  capabilities: MachineCapabilitiesEphemeral,
+  enhancePromptReqs: EnhancePromptRequestEphemeral,
+  enhancePromptResps: EnhancePromptResponseEphemeral,
+  worktreeCreateReqs: WorktreeCreateRequestEphemeral,
+  worktreeCreateResps: WorktreeCreateResponseEphemeral,
+  worktreeSetupResps: WorktreeSetupResultEphemeral,
+  anthropicLoginReqs: AnthropicLoginRequestEphemeral,
+  anthropicLoginResps: AnthropicLoginResponseEphemeral
 };
 
 // src/file-storage-adapter.ts
@@ -11440,6 +11554,11 @@ var FileStorageAdapter = class extends StorageAdapter {
   }
 };
 
+// src/lifecycle.ts
+import { unlinkSync } from "fs";
+import { readFile as readFile2, unlink as unlink2, writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
+
 // src/logger.ts
 import pino from "pino";
 var logger = pino({
@@ -11451,11 +11570,24 @@ function createChildLogger(context) {
 }
 
 // src/lifecycle.ts
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isEnoent(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
 var LifecycleManager = class {
   #abortControllers = /* @__PURE__ */ new Set();
   #shutdownCallbacks = [];
   #isShuttingDown = false;
+  // biome-ignore lint/suspicious/noExplicitAny: process event handlers have heterogeneous signatures
   #signalHandlers = [];
+  #pidFilePath = null;
   constructor() {
     const termHandler = () => void this.#shutdown("SIGTERM");
     const intHandler = () => void this.#shutdown("SIGINT");
@@ -11465,6 +11597,32 @@ var LifecycleManager = class {
       { signal: "SIGTERM", handler: termHandler },
       { signal: "SIGINT", handler: intHandler }
     ];
+    const exceptionHandler = (error) => {
+      try {
+        logger.error({ error }, "Uncaught exception \u2014 initiating shutdown");
+      } catch {
+      }
+      void this.#shutdown("uncaughtException");
+    };
+    const rejectionHandler = (reason) => {
+      try {
+        let jsonStr;
+        try {
+          jsonStr = JSON.stringify(reason);
+        } catch {
+          jsonStr = "(not serializable)";
+        }
+        const detail = reason instanceof Error ? { message: reason.message, stack: reason.stack } : { inspected: `${String(reason)} ${jsonStr}` };
+        logger.error(detail, "Unhandled rejection (non-fatal)");
+      } catch {
+      }
+    };
+    process.on("uncaughtException", exceptionHandler);
+    process.on("unhandledRejection", rejectionHandler);
+    this.#signalHandlers.push(
+      { signal: "uncaughtException", handler: exceptionHandler },
+      { signal: "unhandledRejection", handler: rejectionHandler }
+    );
   }
   destroy() {
     for (const { signal, handler } of this.#signalHandlers) {
@@ -11474,6 +11632,43 @@ var LifecycleManager = class {
     this.#isShuttingDown = false;
     this.#shutdownCallbacks = [];
     this.#abortControllers.clear();
+    this.#removePidFileSync();
+  }
+  async acquirePidFile(shipyardHome) {
+    const pidFilePath = join2(shipyardHome, "daemon.pid");
+    try {
+      const existing = await readFile2(pidFilePath, "utf-8");
+      const pid = Number.parseInt(existing.trim(), 10);
+      if (!Number.isNaN(pid) && isProcessAlive(pid)) {
+        logger.error(
+          { pid, pidFile: pidFilePath },
+          "Another daemon is already running. Stop it first or remove the stale PID file."
+        );
+        process.exit(1);
+      }
+      logger.info({ stalePid: pid, pidFile: pidFilePath }, "Removing stale PID file");
+    } catch (err) {
+      if (!isEnoent(err)) throw err;
+    }
+    await writeFile2(pidFilePath, String(process.pid), { mode: 420 });
+    this.#pidFilePath = pidFilePath;
+    logger.info({ pid: process.pid, pidFile: pidFilePath }, "PID file acquired");
+  }
+  #removePidFileSync() {
+    if (!this.#pidFilePath) return;
+    try {
+      unlinkSync(this.#pidFilePath);
+    } catch {
+    }
+    this.#pidFilePath = null;
+  }
+  async #removePidFile() {
+    if (!this.#pidFilePath) return;
+    try {
+      await unlink2(this.#pidFilePath);
+    } catch {
+    }
+    this.#pidFilePath = null;
   }
   /**
    * Create an AbortController tracked by this manager.
@@ -11499,17 +11694,35 @@ var LifecycleManager = class {
     if (this.#isShuttingDown) return;
     this.#isShuttingDown = true;
     logger.info({ signal }, "Shutdown signal received");
+    const HARD_KILL_MS = 15e3;
+    const forceExit = setTimeout(() => {
+      logger.error("Graceful shutdown timed out, forcing exit");
+      process.exit(1);
+    }, HARD_KILL_MS);
+    forceExit.unref();
     for (const controller of this.#abortControllers) {
       controller.abort();
     }
     this.#abortControllers.clear();
+    const CALLBACK_TIMEOUT_MS = 5e3;
     for (const callback of this.#shutdownCallbacks) {
+      let timeoutId;
       try {
-        await callback();
+        await Promise.race([
+          callback(),
+          new Promise((_, reject) => {
+            timeoutId = setTimeout(
+              () => reject(new Error("Shutdown callback timed out")),
+              CALLBACK_TIMEOUT_MS
+            );
+          })
+        ]).finally(() => clearTimeout(timeoutId));
       } catch (error) {
         logger.error({ error }, "Error during shutdown callback");
       }
     }
+    await this.#removePidFile();
+    clearTimeout(forceExit);
     logger.info("Shutdown complete");
     await new Promise((resolve3) => setTimeout(resolve3, 100));
     process.exit(0);
@@ -11517,9 +11730,11 @@ var LifecycleManager = class {
 };
 
 // src/serve.ts
-import { mkdir as mkdir2 } from "fs/promises";
+import { spawn as spawn3 } from "child_process";
+import { mkdir as mkdir3 } from "fs/promises";
 import { homedir as homedir2, hostname as hostname2 } from "os";
 import { resolve } from "path";
+import { query as query2 } from "@anthropic-ai/claude-agent-sdk";
 
 // ../../node_modules/.pnpm/@loro-extended+adapter-webrtc@5.4.2_loro-crdt@1.10.5/node_modules/@loro-extended/adapter-webrtc/dist/index.js
 var WebRtcDataChannelAdapter = class extends Adapter {
@@ -11755,15 +11970,307 @@ var WebRtcDataChannelAdapter = class extends Adapter {
   }
 };
 
+// ../../packages/session/src/client.ts
+var SignalingClientError = class extends Error {
+  constructor(code, message, status, details) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.details = details;
+    this.name = "SignalingClientError";
+  }
+};
+var SignalingClientValidationError = class extends Error {
+  constructor(message, response) {
+    super(message);
+    this.response = response;
+    this.name = "SignalingClientValidationError";
+  }
+};
+var SignalingClient = class {
+  /**
+   * Creates a new SignalingClient instance.
+   *
+   * @param baseUrl - Base URL of the signaling server (e.g., 'https://signaling.shipyard.dev')
+   * @param options - Optional configuration
+   */
+  constructor(baseUrl, options = {}) {
+    this.baseUrl = baseUrl;
+    this.fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+    this.defaultHeaders = options.defaultHeaders ?? {};
+  }
+  fetch;
+  defaultHeaders;
+  /**
+   * Check server health.
+   *
+   * GET /health
+   *
+   * @returns Health status with service name and environment
+   * @throws {SignalingClientError} If the server returns an error
+   * @throws {SignalingClientValidationError} If the response doesn't match expected schema
+   */
+  async health() {
+    const response = await this.fetch(`${this.baseUrl}${ROUTES.HEALTH}`, {
+      method: "GET",
+      headers: this.defaultHeaders
+    });
+    const data = await response.json();
+    if (!response.ok) {
+      this.throwError(response.status, data);
+    }
+    const result = HealthResponseSchema.safeParse(data);
+    if (!result.success) {
+      throw new SignalingClientValidationError(
+        `Invalid health response: ${result.error.message}`,
+        data
+      );
+    }
+    return result.data;
+  }
+  /**
+   * Verify a JWT against the database.
+   *
+   * GET /auth/verify
+   *
+   * Checks both cryptographic validity and that the user still exists in the database.
+   * Does NOT throw on 401 — returns `{ valid: false, reason }` instead.
+   *
+   * @param token - Shipyard JWT to verify
+   * @returns Verification result with user info (if valid) or failure reason
+   * @throws {SignalingClientError} If the server returns a non-401 error
+   * @throws {SignalingClientValidationError} If the response doesn't match expected schema
+   */
+  async verify(token) {
+    const response = await this.fetch(`${this.baseUrl}${ROUTES.AUTH_VERIFY}`, {
+      method: "GET",
+      headers: {
+        ...this.defaultHeaders,
+        Authorization: `Bearer ${token}`
+      }
+    });
+    const data = await response.json();
+    if (!response.ok && response.status !== 401) {
+      this.throwError(response.status, data);
+    }
+    const result = AuthVerifyResponseSchema.safeParse(data);
+    if (!result.success) {
+      throw new SignalingClientValidationError(
+        `Invalid verify response: ${result.error.message}`,
+        data
+      );
+    }
+    return result.data;
+  }
+  /**
+   * Exchange a GitHub OAuth code for a Shipyard JWT.
+   *
+   * POST /auth/github/callback
+   *
+   * @param request - OAuth code and redirect URI
+   * @returns JWT token and user info
+   * @throws {SignalingClientError} If authentication fails
+   * @throws {SignalingClientValidationError} If request/response doesn't match expected schema
+   */
+  async authGitHubCallback(request) {
+    const requestResult = AuthGitHubCallbackRequestSchema.safeParse(request);
+    if (!requestResult.success) {
+      throw new SignalingClientValidationError(
+        `Invalid request: ${requestResult.error.message}`,
+        request
+      );
+    }
+    const response = await this.fetch(`${this.baseUrl}${ROUTES.AUTH_GITHUB_CALLBACK}`, {
+      method: "POST",
+      headers: {
+        ...this.defaultHeaders,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(requestResult.data)
+    });
+    const data = await response.json();
+    if (!response.ok) {
+      this.throwError(response.status, data);
+    }
+    const result = AuthGitHubCallbackResponseSchema.safeParse(data);
+    if (!result.success) {
+      throw new SignalingClientValidationError(
+        `Invalid auth response: ${result.error.message}`,
+        data
+      );
+    }
+    return result.data;
+  }
+  /**
+   * Create a new collaboration room.
+   *
+   * POST /collab/create
+   *
+   * Requires authentication - use `withAuth()` to create an authenticated client.
+   *
+   * @param request - Task ID and optional expiration
+   * @param token - Shipyard JWT for authentication
+   * @returns Pre-signed WebSocket URL and room info
+   * @throws {SignalingClientError} If authorization fails or request is invalid
+   * @throws {SignalingClientValidationError} If request/response doesn't match expected schema
+   */
+  async createCollab(request, token) {
+    const requestResult = CollabCreateRequestSchema.safeParse(request);
+    if (!requestResult.success) {
+      throw new SignalingClientValidationError(
+        `Invalid request: ${requestResult.error.message}`,
+        request
+      );
+    }
+    const response = await this.fetch(`${this.baseUrl}${ROUTES.COLLAB_CREATE}`, {
+      method: "POST",
+      headers: {
+        ...this.defaultHeaders,
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify(requestResult.data)
+    });
+    const data = await response.json();
+    if (!response.ok) {
+      this.throwError(response.status, data);
+    }
+    const result = CollabCreateResponseSchema.safeParse(data);
+    if (!result.success) {
+      throw new SignalingClientValidationError(
+        `Invalid collab create response: ${result.error.message}`,
+        data
+      );
+    }
+    return result.data;
+  }
+  /**
+   * Build a WebSocket URL for connecting to a personal room.
+   *
+   * Note: This method only builds the URL. Use a WebSocket library to connect.
+   *
+   * @param userId - The user ID to connect as
+   * @param token - Shipyard JWT for authentication
+   * @returns WebSocket URL for connecting to the personal room
+   */
+  buildPersonalRoomUrl(userId, token) {
+    const wsBaseUrl = this.baseUrl.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
+    return `${wsBaseUrl}/personal/${encodeURIComponent(userId)}?token=${encodeURIComponent(token)}`;
+  }
+  /**
+   * Build a WebSocket URL for connecting to a collaboration room.
+   *
+   * Note: This method only builds the URL. Use a WebSocket library to connect.
+   * The token should be extracted from the pre-signed URL returned by createCollab().
+   *
+   * @param roomId - The room ID to connect to
+   * @param presignedToken - The pre-signed URL token from createCollab()
+   * @param userToken - Optional user JWT for authenticated users
+   * @returns WebSocket URL for connecting to the collab room
+   */
+  buildCollabRoomUrl(roomId, presignedToken, userToken) {
+    const wsBaseUrl = this.baseUrl.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
+    let url = `${wsBaseUrl}/collab/${encodeURIComponent(roomId)}?token=${encodeURIComponent(presignedToken)}`;
+    if (userToken) {
+      url += `&userToken=${encodeURIComponent(userToken)}`;
+    }
+    return url;
+  }
+  /**
+   * Extract the pre-signed token from a collab URL.
+   *
+   * @param presignedUrl - The full pre-signed URL from createCollab()
+   * @returns The token query parameter value, or null if not found
+   */
+  extractTokenFromPresignedUrl(presignedUrl) {
+    try {
+      const url = new URL(presignedUrl);
+      return url.searchParams.get("token");
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Create an authenticated client that automatically includes the token.
+   *
+   * @param token - Shipyard JWT to include in all requests
+   * @returns A new SignalingClient configured with the auth token
+   */
+  withAuth(token) {
+    return new AuthenticatedSignalingClient(this.baseUrl, token, {
+      fetch: this.fetch,
+      defaultHeaders: this.defaultHeaders
+    });
+  }
+  /**
+   * Parse error response and throw appropriate error.
+   */
+  throwError(status, data) {
+    const validationResult = ValidationErrorResponseSchema.safeParse(data);
+    if (validationResult.success) {
+      throw new SignalingClientError(
+        validationResult.data.error,
+        validationResult.data.message,
+        status,
+        validationResult.data.details
+      );
+    }
+    const errorResult = ErrorResponseSchema.safeParse(data);
+    if (errorResult.success) {
+      throw new SignalingClientError(errorResult.data.error, errorResult.data.message, status);
+    }
+    throw new SignalingClientError("unknown_error", `Server returned status ${status}`, status);
+  }
+};
+var AuthenticatedSignalingClient = class extends SignalingClient {
+  constructor(baseUrl, token, options = {}) {
+    super(baseUrl, options);
+    this.token = token;
+  }
+  async createCollab(request, _token) {
+    return super.createCollab(request, this.token);
+  }
+  buildPersonalRoomUrl(userId, _token) {
+    return super.buildPersonalRoomUrl(userId, this.token);
+  }
+  /**
+   * Build a WebSocket URL for connecting to a collaboration room with user authentication.
+   *
+   * @param roomId - The room ID to connect to
+   * @param presignedToken - The pre-signed URL token from createCollab()
+   * @returns WebSocket URL for connecting to the collab room
+   */
+  buildCollabRoomUrl(roomId, presignedToken) {
+    return super.buildCollabRoomUrl(roomId, presignedToken, this.token);
+  }
+  /**
+   * Verify the stored token against the database.
+   *
+   * Convenience wrapper around verify() using the authenticated client's token.
+   */
+  async verifyToken() {
+    return this.verify(this.token);
+  }
+  /**
+   * Get the authentication token.
+   *
+   * @returns The JWT token used for authentication
+   */
+  getToken() {
+    return this.token;
+  }
+};
+
 // src/branch-watcher.ts
 import { watch } from "fs";
-import { join as join3 } from "path";
+import { readFile as readFile3, stat } from "fs/promises";
+import { isAbsolute, join as join4 } from "path";
 
 // src/capabilities.ts
 import { execFile } from "child_process";
 import { readdir as readdir2 } from "fs/promises";
 import { homedir } from "os";
-import { basename, join as join2 } from "path";
+import { basename, join as join3 } from "path";
 var TIMEOUT_MS = 5e3;
 function run(command, args, cwd) {
   return new Promise((resolve3, reject) => {
@@ -12033,7 +12540,7 @@ async function findGitRepos(dir, depth = 0) {
       if (!entry.isDirectory()) continue;
       if (entry.name.startsWith(".")) continue;
       if (EXCLUDE_DIRS.has(entry.name)) continue;
-      promises.push(findGitRepos(join2(dir, entry.name), depth + 1));
+      promises.push(findGitRepos(join3(dir, entry.name), depth + 1));
     }
     const results = await Promise.all(promises);
     return results.flat();
@@ -12064,14 +12571,48 @@ async function detectEnvironments() {
   const repoInfos = await Promise.all(repoPaths.map(getRepoMetadata));
   return repoInfos.filter((info) => info !== null);
 }
+async function detectAnthropicAuth() {
+  if (process.env.ANTHROPIC_API_KEY) {
+    return { status: "authenticated", method: "api-key" };
+  }
+  try {
+    const stdout = await run("claude", ["auth", "status", "--json"], void 0);
+    const parsed = JSON.parse(stdout);
+    if (parsed.loggedIn) {
+      return { status: "authenticated", method: "oauth", email: parsed.email };
+    }
+    return { status: "unauthenticated", method: "none" };
+  } catch {
+    return { status: "unknown", method: "none" };
+  }
+}
 async function detectCapabilities() {
-  const [models, environments] = await Promise.all([detectModels(), detectEnvironments()]);
+  const [models, environments, anthropicAuth] = await Promise.all([
+    detectModels(),
+    detectEnvironments(),
+    detectAnthropicAuth()
+  ]);
   const permissionModes = [...PermissionModeSchema.options];
-  return { models, environments, permissionModes, homeDir: homedir() };
+  return { models, environments, permissionModes, homeDir: homedir(), anthropicAuth };
 }
 
 // src/branch-watcher.ts
 var DEBOUNCE_MS = 500;
+async function resolveHeadPath(repoPath) {
+  const gitPath = join4(repoPath, ".git");
+  const gitStat = await stat(gitPath);
+  if (gitStat.isDirectory()) {
+    return join4(gitPath, "HEAD");
+  }
+  const content = await readFile3(gitPath, "utf-8");
+  const match = content.trim().match(/^gitdir:\s*(.+)$/);
+  if (!match?.[1]) {
+    throw new Error(`Invalid .git file at ${gitPath}`);
+  }
+  const gitDir = match[1];
+  const resolvedGitDir = isAbsolute(gitDir) ? gitDir : join4(repoPath, gitDir);
+  return join4(resolvedGitDir, "HEAD");
+}
 function createBranchWatcher(options) {
   const log = logger.child({ component: "branch-watcher" });
   const watchers = /* @__PURE__ */ new Map();
@@ -12080,11 +12621,18 @@ function createBranchWatcher(options) {
   let environments = [...options.environments];
   for (const env of environments) {
     branches.set(env.path, env.branch);
-    startWatching(env.path);
+    void startWatching(env.path);
   }
   log.info({ count: environments.length }, "Branch watcher started");
-  function startWatching(repoPath) {
-    const headPath = join3(repoPath, ".git", "HEAD");
+  async function startWatching(repoPath) {
+    let headPath;
+    try {
+      headPath = await resolveHeadPath(repoPath);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      log.debug({ repoPath, err: msg }, "Failed to resolve HEAD path, skipping watch");
+      return;
+    }
     try {
       const watcher = watch(headPath, () => {
         debouncedCheck(repoPath);
@@ -12096,7 +12644,7 @@ function createBranchWatcher(options) {
       watchers.set(repoPath, watcher);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      log.debug({ repoPath, err: msg }, "Failed to watch .git/HEAD");
+      log.debug({ repoPath, err: msg }, "Failed to watch HEAD");
     }
   }
   function removeWatcher(repoPath) {
@@ -12157,10 +12705,57 @@ function createBranchWatcher(options) {
       }
       watchers.clear();
       log.info("Branch watcher closed");
+    },
+    addEnvironment(repoPath, branch) {
+      if (watchers.has(repoPath)) {
+        log.debug({ repoPath }, "Already watching, skipping addEnvironment");
+        return;
+      }
+      branches.set(repoPath, branch);
+      environments.push({
+        path: repoPath,
+        name: repoPath.split("/").pop() ?? repoPath,
+        branch,
+        remote: void 0
+      });
+      void startWatching(repoPath);
+      log.info({ repoPath, branch }, "Added environment to branch watcher");
     }
   };
 }
 
+// src/crash-recovery.ts
+function recoverOrphanedTask(taskDoc, log) {
+  const json = taskDoc.toJSON();
+  const { status } = json.meta;
+  if (status !== "working" && status !== "starting" && status !== "input-required") {
+    return false;
+  }
+  const sessions = json.sessions;
+  let lastActiveIdx = -1;
+  for (let i = sessions.length - 1; i >= 0; i--) {
+    const s = sessions[i];
+    if (s?.status === "active" || s?.status === "pending") {
+      lastActiveIdx = i;
+      break;
+    }
+  }
+  change(taskDoc, (draft) => {
+    if (lastActiveIdx >= 0) {
+      const session = draft.sessions.get(lastActiveIdx);
+      if (session) {
+        session.status = "interrupted";
+        session.completedAt = Date.now();
+        session.error = "Daemon process exited unexpectedly";
+      }
+    }
+    draft.meta.status = "failed";
+    draft.meta.updatedAt = Date.now();
+  });
+  log.info({ previousStatus: status }, "Recovered orphaned task after daemon crash");
+  return true;
+}
+
 // src/peer-manager.ts
 var ICE_SERVERS = [{ urls: "stun:stun.l.google.com:19302" }];
 function machineIdToPeerId(machineId) {
@@ -12198,9 +12793,14 @@ function createPeerManager(config) {
     };
     pc.ondatachannel = (event) => {
       const channel = event.channel;
-      if (channel.label === "terminal-io") {
-        logger.info({ machineId }, "Terminal data channel received");
-        config.onTerminalChannel?.(machineId, event.channel);
+      if (channel.label?.startsWith("terminal-io:")) {
+        const taskId = channel.label.slice("terminal-io:".length);
+        if (!taskId) {
+          logger.warn({ machineId }, "Terminal channel with empty taskId, ignoring");
+          return;
+        }
+        logger.info({ machineId, taskId }, "Terminal data channel received");
+        config.onTerminalChannel?.(machineId, event.channel, taskId);
       } else {
         logger.info({ machineId }, "Data channel received from browser");
         config.webrtcAdapter.attachDataChannel(
@@ -12258,6 +12858,13 @@ function createPeerManager(config) {
         return pc;
       })();
       pendingCreates.set(fromMachineId, promise);
+      const HANDSHAKE_TIMEOUT_MS = 3e4;
+      setTimeout(() => {
+        if (pendingCreates.get(fromMachineId) === promise) {
+          pendingCreates.delete(fromMachineId);
+          logger.warn({ fromMachineId }, "WebRTC handshake timed out");
+        }
+      }, HANDSHAKE_TIMEOUT_MS);
       await promise;
     },
     async handleAnswer(fromMachineId, answer) {
@@ -12296,73 +12903,381 @@ function createPeerManager(config) {
         pc.close();
       }
       peers.clear();
+      pendingCreates.clear();
     }
   };
 }
 
-// src/pty-manager.ts
-import * as pty from "node-pty";
-var KILL_TIMEOUT_MS = 5e3;
-var DEFAULT_COLS = 80;
-var DEFAULT_ROWS = 24;
-function createPtyManager() {
-  const log = createChildLogger({ mode: "pty" });
-  let process2 = null;
-  let isAlive = false;
-  let killTimer = null;
-  const dataCallbacks = [];
-  const exitCallbacks = [];
-  function getDefaultShell() {
-    return globalThis.process.env.SHELL ?? "/bin/zsh";
-  }
-  function spawn2(options) {
-    if (isAlive) {
-      throw new Error("PTY already spawned. Call kill() or dispose() first.");
-    }
-    const shell = options.shell ?? getDefaultShell();
-    const cols = options.cols ?? DEFAULT_COLS;
-    const rows = options.rows ?? DEFAULT_ROWS;
-    const env = {};
-    for (const [key, val] of Object.entries({ ...globalThis.process.env, ...options.env })) {
-      if (val !== void 0) env[key] = val;
-    }
-    log.info({ shell, cwd: options.cwd, cols, rows }, "Spawning PTY");
-    try {
-      process2 = pty.spawn(shell, ["--login"], {
-        name: "xterm-256color",
-        cols,
-        rows,
-        cwd: options.cwd,
-        env
-      });
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      log.error({ err: msg, shell }, "Failed to spawn PTY");
-      throw new Error(`Failed to spawn PTY: ${msg}`);
+// src/plan-editor/format-plan-feedback.ts
+function formatPlanFeedbackForClaudeCode(original, edited, comments, generalFeedback) {
+  const sections = [];
+  if (generalFeedback) {
+    sections.push("## General Feedback\n");
+    sections.push(generalFeedback);
+    sections.push("");
+  }
+  if (comments.length > 0) {
+    appendCommentSection(sections, comments, edited);
+  }
+  if (original !== edited) {
+    sections.push("## Edits Made\n");
+    sections.push("The user edited the following sections of the plan:\n");
+    sections.push("```diff");
+    sections.push(computeLineDiff(original, edited));
+    sections.push("```");
+    sections.push("");
+  }
+  return sections.join("\n").trim();
+}
+function appendCommentSection(sections, comments, edited) {
+  sections.push("## Inline Comments\n");
+  sections.push("The user left the following comments on specific parts of the plan:\n");
+  const editedLines = edited.split("\n");
+  const sorted = [...comments].sort((a, b) => a.from - b.from);
+  for (const comment of sorted) {
+    const nearbyLine = findNearestLine(editedLines, comment.from);
+    if (nearbyLine) {
+      sections.push(`> Near "${truncate(nearbyLine, 60)}": ${comment.body}`);
+    } else {
+      sections.push(`> ${comment.body}`);
     }
-    isAlive = true;
-    process2.onData((data) => {
-      for (const cb of dataCallbacks) {
-        cb(data);
-      }
-    });
-    process2.onExit(({ exitCode, signal }) => {
-      log.info({ exitCode, signal, pid: process2?.pid }, "PTY exited");
-      isAlive = false;
-      clearKillTimer();
-      for (const cb of exitCallbacks) {
-        cb(exitCode, signal);
-      }
-    });
-    log.info({ pid: process2.pid }, "PTY spawned");
   }
-  function write(data) {
-    if (!process2 || !isAlive) {
-      throw new Error("PTY is not running");
+  sections.push("");
+}
+function findNearestLine(lines, charOffset) {
+  let pos = 0;
+  for (const line of lines) {
+    if (pos + line.length >= charOffset) {
+      const trimmed = line.trim();
+      if (trimmed.length > 0) return trimmed;
     }
-    process2.write(data);
+    pos += line.length + 1;
   }
-  function resize(cols, rows) {
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const trimmed = lines[i]?.trim();
+    if (trimmed && trimmed.length > 0) return trimmed;
+  }
+  return null;
+}
+function truncate(text, maxLen) {
+  if (text.length <= maxLen) return text;
+  return `${text.slice(0, maxLen - 3)}...`;
+}
+function computeLineDiff(original, edited) {
+  const oldLines = original.split("\n");
+  const newLines = edited.split("\n");
+  const result = [];
+  let oi = 0;
+  let ni = 0;
+  while (oi < oldLines.length && ni < newLines.length) {
+    if (oldLines[oi] === newLines[ni]) {
+      result.push(` ${oldLines[oi]}`);
+      oi++;
+      ni++;
+    } else {
+      const consumed = consumeMismatch(oldLines, newLines, oi, ni, result);
+      oi = consumed.oi;
+      ni = consumed.ni;
+    }
+  }
+  appendRemainder(result, oldLines, oi, "-");
+  appendRemainder(result, newLines, ni, "+");
+  return result.join("\n");
+}
+function consumeMismatch(oldLines, newLines, oi, ni, result) {
+  const newInOld = findNext(oldLines, newLines[ni], oi);
+  const oldInNew = findNext(newLines, oldLines[oi], ni);
+  if (newInOld !== null && (oldInNew === null || newInOld - oi <= oldInNew - ni)) {
+    while (oi < newInOld) {
+      result.push(`-${oldLines[oi]}`);
+      oi++;
+    }
+  } else if (oldInNew !== null) {
+    while (ni < oldInNew) {
+      result.push(`+${newLines[ni]}`);
+      ni++;
+    }
+  } else {
+    result.push(`-${oldLines[oi]}`);
+    result.push(`+${newLines[ni]}`);
+    oi++;
+    ni++;
+  }
+  return { oi, ni };
+}
+function appendRemainder(result, lines, start, prefix) {
+  for (let i = start; i < lines.length; i++) {
+    result.push(`${prefix}${lines[i]}`);
+  }
+}
+function findNext(lines, target, from) {
+  if (target === void 0) return null;
+  const lookAhead = 5;
+  for (let i = from; i < Math.min(from + lookAhead, lines.length); i++) {
+    if (lines[i] === target) return i;
+  }
+  return null;
+}
+
+// src/plan-editor/init-plan-editor-doc.ts
+import { EditorState } from "@tiptap/pm/state";
+import { LoroMap as LoroMap3 } from "loro-crdt";
+import { updateLoroToPmState } from "loro-prosemirror";
+
+// src/plan-editor/schema.ts
+import { getSchema, Mark } from "@tiptap/core";
+import StarterKit from "@tiptap/starter-kit";
+import MarkdownIt from "markdown-it";
+import { MarkdownParser, MarkdownSerializer } from "prosemirror-markdown";
+var CommentMark = Mark.create({
+  name: "comment",
+  addAttributes() {
+    return { commentId: { default: null } };
+  }
+});
+var planEditorSchema = getSchema([StarterKit.configure({ undoRedo: false }), CommentMark]);
+var configuredDocs = /* @__PURE__ */ new WeakSet();
+function configurePlanEditorTextStyles(loroDoc) {
+  if (configuredDocs.has(loroDoc)) return;
+  configuredDocs.add(loroDoc);
+  const config = {};
+  for (const [name, markType] of Object.entries(planEditorSchema.marks)) {
+    const expand = markType.spec.inclusive !== false ? "after" : "none";
+    config[name] = { expand };
+  }
+  loroDoc.configTextStyle(config);
+}
+var planEditorParser = new MarkdownParser(
+  planEditorSchema,
+  MarkdownIt("commonmark", { html: false }).enable("strikethrough").disable("image"),
+  {
+    blockquote: { block: "blockquote" },
+    paragraph: { block: "paragraph" },
+    list_item: { block: "listItem" },
+    bullet_list: { block: "bulletList" },
+    ordered_list: {
+      block: "orderedList",
+      getAttrs: (tok) => ({ start: Number(tok.attrGet("start") ?? 1) })
+    },
+    heading: {
+      block: "heading",
+      getAttrs: (tok) => ({ level: Number(tok.tag.slice(1)) })
+    },
+    code_block: { block: "codeBlock", noCloseToken: true },
+    fence: {
+      block: "codeBlock",
+      getAttrs: (tok) => ({ language: tok.info || null }),
+      noCloseToken: true
+    },
+    hr: { node: "horizontalRule" },
+    hardbreak: { node: "hardBreak" },
+    link: {
+      mark: "link",
+      getAttrs: (tok) => ({ href: tok.attrGet("href"), target: tok.attrGet("target") })
+    },
+    em: { mark: "italic" },
+    strong: { mark: "bold" },
+    code_inline: { mark: "code", noCloseToken: true },
+    s: { mark: "strike" }
+  }
+);
+function backticksFor(node, side) {
+  const ticks = /`+/g;
+  let len = 0;
+  if (node.isText && node.text) {
+    for (const match of node.text.matchAll(ticks)) {
+      len = Math.max(len, match[0].length);
+    }
+  }
+  let result = len > 0 && side > 0 ? " `" : "`";
+  for (let i = 0; i < len; i++) result += "`";
+  if (len > 0 && side < 0) result += " ";
+  return result;
+}
+var planEditorSerializer = new MarkdownSerializer(
+  {
+    blockquote(state, node) {
+      state.wrapBlock("> ", null, node, () => state.renderContent(node));
+    },
+    codeBlock(state, node) {
+      const info = String(node.attrs.language ?? "");
+      state.write(`\`\`\`${info}
+`);
+      state.text(node.textContent, false);
+      state.ensureNewLine();
+      state.write("```");
+      state.closeBlock(node);
+    },
+    heading(state, node) {
+      state.write(`${state.repeat("#", Number(node.attrs.level))} `);
+      state.renderInline(node);
+      state.closeBlock(node);
+    },
+    horizontalRule(state, node) {
+      state.write("---");
+      state.closeBlock(node);
+    },
+    bulletList(state, node) {
+      state.renderList(node, "  ", () => "- ");
+    },
+    orderedList(state, node) {
+      const start = Number(node.attrs.start) || 1;
+      const maxW = String(start + node.childCount - 1).length;
+      const space = state.repeat(" ", maxW + 2);
+      state.renderList(node, space, (i) => {
+        const nStr = String(start + i);
+        return `${state.repeat(" ", maxW - nStr.length)}${nStr}. `;
+      });
+    },
+    listItem(state, node) {
+      state.renderContent(node);
+    },
+    paragraph(state, node) {
+      state.renderInline(node);
+      state.closeBlock(node);
+    },
+    hardBreak(state, node, parent, index) {
+      for (let i = index + 1; i < parent.childCount; i++) {
+        if (parent.child(i).type !== node.type) {
+          state.write("\\\n");
+          return;
+        }
+      }
+    },
+    text(state, node) {
+      state.text(node.text ?? "");
+    }
+  },
+  {
+    italic: { open: "*", close: "*", mixable: true, expelEnclosingWhitespace: true },
+    bold: { open: "**", close: "**", mixable: true, expelEnclosingWhitespace: true },
+    strike: { open: "~~", close: "~~", mixable: true, expelEnclosingWhitespace: true },
+    code: {
+      open(_state, _mark, parent, index) {
+        return backticksFor(parent.child(index), -1);
+      },
+      close(_state, _mark, parent, index) {
+        return backticksFor(parent.child(index - 1), 1);
+      },
+      escape: false
+    },
+    link: {
+      open: "[",
+      close(_state, mark) {
+        const href = String(mark.attrs.href ?? "");
+        const title = mark.attrs.title ? ` "${String(mark.attrs.title)}"` : "";
+        return `](${href}${title})`;
+      }
+    },
+    comment: { open: "", close: "" }
+  },
+  { hardBreakNodeName: "hardBreak", strict: false }
+);
+
+// src/plan-editor/init-plan-editor-doc.ts
+function initPlanEditorDoc(loroDoc, planId, markdown) {
+  try {
+    const pmDoc = planEditorParser.parse(markdown);
+    const planEditorDocs = loroDoc.getMap("planEditorDocs");
+    const planContainer = planEditorDocs.setContainer(planId, new LoroMap3());
+    configurePlanEditorTextStyles(loroDoc);
+    const editorState = EditorState.create({ doc: pmDoc, schema: planEditorSchema });
+    const mapping = /* @__PURE__ */ new Map();
+    updateLoroToPmState(loroDoc, mapping, editorState, planContainer.id);
+    loroDoc.commit();
+    return true;
+  } catch (error) {
+    logger.warn({ planId, error }, "initPlanEditorDoc failed");
+    return false;
+  }
+}
+
+// src/plan-editor/serialize-plan-editor-doc.ts
+import { LoroMap as LoroMap4 } from "loro-crdt";
+import { createNodeFromLoroObj } from "loro-prosemirror";
+function tryCreateNode(raw, mapping) {
+  try {
+    return createNodeFromLoroObj(planEditorSchema, raw, mapping);
+  } catch {
+    return null;
+  }
+}
+function serializePlanEditorDoc(loroDoc, planId) {
+  const planEditorDocs = loroDoc.getMap("planEditorDocs");
+  const raw = planEditorDocs.get(planId);
+  if (!(raw instanceof LoroMap4)) return "";
+  const mapping = /* @__PURE__ */ new Map();
+  const pmNode = tryCreateNode(raw, mapping);
+  if (!pmNode) return "";
+  if (pmNode.childCount === 0 || pmNode.childCount === 1 && pmNode.firstChild?.textContent === "") {
+    return "";
+  }
+  return planEditorSerializer.serialize(pmNode, { tightLists: true });
+}
+
+// src/pty-manager.ts
+import * as pty from "node-pty";
+var KILL_TIMEOUT_MS = 5e3;
+var DEFAULT_COLS = 80;
+var DEFAULT_ROWS = 24;
+function createPtyManager() {
+  const log = createChildLogger({ mode: "pty" });
+  let process2 = null;
+  let isAlive = false;
+  let killTimer = null;
+  const dataCallbacks = [];
+  const exitCallbacks = [];
+  function getDefaultShell() {
+    return globalThis.process.env.SHELL ?? "/bin/zsh";
+  }
+  function spawn4(options) {
+    if (isAlive) {
+      throw new Error("PTY already spawned. Call kill() or dispose() first.");
+    }
+    const shell = options.shell ?? getDefaultShell();
+    const cols = options.cols ?? DEFAULT_COLS;
+    const rows = options.rows ?? DEFAULT_ROWS;
+    const env = {};
+    for (const [key, val] of Object.entries({ ...globalThis.process.env, ...options.env })) {
+      if (val !== void 0) env[key] = val;
+    }
+    log.info({ shell, cwd: options.cwd, cols, rows }, "Spawning PTY");
+    try {
+      process2 = pty.spawn(shell, ["--login"], {
+        name: "xterm-256color",
+        cols,
+        rows,
+        cwd: options.cwd,
+        env
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      log.error({ err: msg, shell }, "Failed to spawn PTY");
+      throw new Error(`Failed to spawn PTY: ${msg}`);
+    }
+    isAlive = true;
+    process2.onData((data) => {
+      for (const cb of dataCallbacks) {
+        cb(data);
+      }
+    });
+    process2.onExit(({ exitCode, signal }) => {
+      log.info({ exitCode, signal, pid: process2?.pid }, "PTY exited");
+      isAlive = false;
+      clearKillTimer();
+      for (const cb of exitCallbacks) {
+        cb(exitCode, signal);
+      }
+    });
+    log.info({ pid: process2.pid }, "PTY spawned");
+  }
+  function write(data) {
+    if (!process2 || !isAlive) {
+      throw new Error("PTY is not running");
+    }
+    process2.write(data);
+  }
+  function resize(cols, rows) {
     if (!process2 || !isAlive) {
       throw new Error("PTY is not running");
     }
@@ -12407,7 +13322,7 @@ function createPtyManager() {
     get alive() {
       return isAlive;
     },
-    spawn: spawn2,
+    spawn: spawn4,
     write,
     resize,
     onData,
@@ -12480,6 +13395,49 @@ var StreamingInputController = class {
 };
 
 // src/session-manager.ts
+var IDLE_TIMEOUT_MS = 5 * 60 * 1e3;
+var IDLE_CHECK_INTERVAL_MS = 3e4;
+var SAFE_MEDIA_TYPES = new Set(SUPPORTED_IMAGE_MEDIA_TYPES);
+function isSafeMediaType(value) {
+  return SAFE_MEDIA_TYPES.has(value);
+}
+function toSdkContent(blocks) {
+  const imageBlocks = [];
+  const textBlocks = [];
+  for (const block of blocks) {
+    if (block.type === "image") imageBlocks.push(block);
+    else if (block.type === "text") textBlocks.push(block);
+  }
+  const result = [];
+  for (let i = 0; i < imageBlocks.length; i++) {
+    const img = imageBlocks[i];
+    if (!img) continue;
+    if (img.source.type !== "base64") {
+      logger.warn({ sourceType: img.source.type }, "Skipping image with unsupported source type");
+      continue;
+    }
+    if (!isSafeMediaType(img.source.mediaType)) {
+      logger.warn(
+        { mediaType: img.source.mediaType },
+        "Skipping image with unsupported media type"
+      );
+      continue;
+    }
+    result.push({ type: "text", text: `Attachment ${i + 1}:` });
+    result.push({
+      type: "image",
+      source: {
+        type: "base64",
+        media_type: img.source.mediaType,
+        data: img.source.data
+      }
+    });
+  }
+  for (const block of textBlocks) {
+    result.push({ type: "text", text: block.text });
+  }
+  return result;
+}
 function safeStringify(value) {
   try {
     return JSON.stringify(value);
@@ -12525,6 +13483,17 @@ function parseSdkBlock(block, parentToolUseId) {
       return parseToolResultBlock(block, parentToolUseId);
     case "thinking":
       return typeof block.thinking === "string" ? { type: "thinking", text: block.thinking } : null;
+    case "image": {
+      const source = block.source;
+      if (source && source.type === "base64" && typeof source.media_type === "string" && typeof source.data === "string") {
+        return {
+          type: "image",
+          id: typeof block.id === "string" ? block.id : nanoid(),
+          source: { type: "base64", mediaType: source.media_type, data: source.data }
+        };
+      }
+      return null;
+    }
     default:
       return null;
   }
@@ -12563,6 +13532,24 @@ var SessionManager = class {
     }
     return null;
   }
+  /**
+   * Extract the latest user message as content blocks (text + image).
+   * Used when sending messages to Claude so images are included.
+   * Filters out tool_use/tool_result/thinking blocks that aren't
+   * relevant when constructing a new prompt.
+   */
+  getLatestUserContentBlocks() {
+    const conversation = this.#taskDoc.toJSON().conversation;
+    for (let i = conversation.length - 1; i >= 0; i--) {
+      const msg = conversation[i];
+      if (msg?.role === "user") {
+        return msg.content.filter(
+          (block) => block.type === "text" || block.type === "image"
+        );
+      }
+    }
+    return null;
+  }
   /**
    * Determine whether to resume an existing session or start fresh.
    *
@@ -12614,7 +13601,7 @@ var SessionManager = class {
     });
     this.#notifyStatusChange("starting");
     const controller = new StreamingInputController();
-    controller.push(opts.prompt);
+    controller.push(typeof opts.prompt === "string" ? opts.prompt : toSdkContent(opts.prompt));
     const response = query({
       prompt: controller.iterable(),
       options: {
@@ -12649,7 +13636,7 @@ var SessionManager = class {
     if (!this.#inputController || this.#inputController.isDone) {
       throw new Error("No active streaming session to send follow-up to");
     }
-    this.#inputController.push(prompt);
+    this.#inputController.push(typeof prompt === "string" ? prompt : toSdkContent(prompt));
     change(this.#taskDoc, (draft) => {
       draft.meta.status = "working";
       draft.meta.updatedAt = Date.now();
@@ -12709,7 +13696,7 @@ var SessionManager = class {
     });
     this.#notifyStatusChange("starting");
     const controller = new StreamingInputController();
-    controller.push(prompt);
+    controller.push(typeof prompt === "string" ? prompt : toSdkContent(prompt));
     const response = query({
       prompt: controller.iterable(),
       options: {
@@ -12738,8 +13725,22 @@ var SessionManager = class {
   }
   async #processMessages(response, sessionId) {
     let agentSessionId = "";
+    let lastMessageAt = Date.now();
+    let idleTimedOut = false;
+    const idleTimer = setInterval(() => {
+      if (Date.now() - lastMessageAt >= IDLE_TIMEOUT_MS) {
+        clearInterval(idleTimer);
+        idleTimedOut = true;
+        logger.warn(
+          { sessionId, idleMs: Date.now() - lastMessageAt },
+          "Session idle timeout, closing"
+        );
+        response.close();
+      }
+    }, IDLE_CHECK_INTERVAL_MS);
     try {
       for await (const message of response) {
+        lastMessageAt = Date.now();
         const result = this.#handleMessage(message, sessionId, agentSessionId);
         if (result.agentSessionId) {
           agentSessionId = result.agentSessionId;
@@ -12749,24 +13750,26 @@ var SessionManager = class {
         }
       }
     } catch (error) {
-      const errorMsg = error instanceof Error ? error.message : String(error);
-      this.#markFailed(sessionId, errorMsg);
+      const errorMsg2 = idleTimedOut ? "Session idle timeout exceeded" : error instanceof Error ? error.message : String(error);
+      this.#markFailed(sessionId, errorMsg2);
       return {
         sessionId,
         agentSessionId,
         status: "failed",
-        error: errorMsg
+        error: errorMsg2
       };
     } finally {
+      clearInterval(idleTimer);
       this.#inputController = null;
       this.#activeQuery = null;
     }
-    this.#markFailed(sessionId, "Session ended without result message");
+    const errorMsg = idleTimedOut ? "Session idle timeout exceeded" : "Session ended without result message";
+    this.#markFailed(sessionId, errorMsg);
     return {
       sessionId,
       agentSessionId,
       status: "failed",
-      error: "Session ended without result message"
+      error: errorMsg
     };
   }
   /**
@@ -12779,7 +13782,27 @@ var SessionManager = class {
     return sessions.findIndex((s) => s.sessionId === sessionId);
   }
   #handleMessage(message, sessionId, agentSessionId) {
-    if (message.type === "system" && "subtype" in message && message.subtype === "init") {
+    switch (message.type) {
+      case "system":
+        return this.#handleSystemMessage(message, sessionId);
+      case "assistant":
+        return this.#handleAssistantMsg(message, sessionId);
+      case "user":
+        if (!("isReplay" in message && message.isReplay)) {
+          this.#appendUserToolResults(message);
+        }
+        return {};
+      case "result":
+        return { sessionResult: this.#handleResult(message, sessionId, agentSessionId) };
+      case "tool_progress":
+        this.#handleToolProgress(message);
+        return {};
+      default:
+        return {};
+    }
+  }
+  #handleSystemMessage(message, sessionId) {
+    if ("subtype" in message && message.subtype === "init") {
       const initSessionId = message.session_id;
       if ("model" in message && typeof message.model === "string") {
         this.#currentModel = message.model;
@@ -12797,24 +13820,27 @@ var SessionManager = class {
       this.#notifyStatusChange("working");
       return { agentSessionId: initSessionId };
     }
-    if (message.type === "assistant") {
-      if ("error" in message && message.error) {
-        logger.warn({ error: message.error, sessionId }, "Assistant message carried an error");
-      }
-      this.#appendAssistantMessage(message);
-      return {};
-    }
-    if (message.type === "user" && !("isReplay" in message && message.isReplay)) {
-      this.#appendUserToolResults(message);
-      return {};
+    if ("subtype" in message && message.subtype === "task_notification") {
+      const taskId = "task_id" in message ? message.task_id : "unknown";
+      const status = "status" in message ? message.status : "unknown";
+      const summary = "summary" in message ? message.summary : "";
+      logger.info({ taskId, status, summary }, "Received task_notification from subagent");
     }
-    if (message.type === "result") {
-      return {
-        sessionResult: this.#handleResult(message, sessionId, agentSessionId)
-      };
+    return {};
+  }
+  #handleAssistantMsg(message, sessionId) {
+    if ("error" in message && message.error) {
+      logger.warn({ error: message.error, sessionId }, "Assistant message carried an error");
     }
+    this.#appendAssistantMessage(message);
     return {};
   }
+  #handleToolProgress(message) {
+    const toolName = "tool_name" in message ? message.tool_name : "unknown";
+    const toolUseId = "tool_use_id" in message ? message.tool_use_id : "unknown";
+    const elapsedSeconds = "elapsed_time_seconds" in message ? message.elapsed_time_seconds : 0;
+    logger.debug({ toolName, toolUseId, elapsedSeconds }, "tool_progress heartbeat");
+  }
   /**
    * Extract tool_result blocks from SDK user messages (which carry tool outputs)
    * and append them to the last assistant conversation entry so the UI can
@@ -12912,9 +13938,10 @@ var SessionManager = class {
         );
         continue;
       }
+      const planId = nanoid();
       change(this.#taskDoc, (draft) => {
         draft.plans.push({
-          planId: nanoid(),
+          planId,
           toolUseId: block.toolUseId,
           markdown: planMarkdown,
           reviewStatus: "pending",
@@ -12922,7 +13949,18 @@ var SessionManager = class {
           createdAt: Date.now()
         });
       });
-      logger.info({ toolUseId: block.toolUseId }, "Extracted plan from ExitPlanMode tool call");
+      const loroDoc = getLoroDoc(this.#taskDoc);
+      const initOk = initPlanEditorDoc(loroDoc, planId, planMarkdown);
+      if (!initOk) {
+        logger.warn(
+          { planId, toolUseId: block.toolUseId },
+          "Failed to initialize plan editor doc from markdown"
+        );
+      }
+      logger.info(
+        { toolUseId: block.toolUseId, planId },
+        "Extracted plan from ExitPlanMode tool call"
+      );
     }
   }
   #handleResult(message, sessionId, agentSessionId) {
@@ -13016,8 +14054,9 @@ async function createSignalingHandle(env, log) {
   if (!env.SHIPYARD_SIGNALING_URL) {
     return null;
   }
-  const machineId = env.SHIPYARD_MACHINE_ID ?? hostname();
-  const machineName = env.SHIPYARD_MACHINE_NAME ?? hostname();
+  const devSuffix = env.SHIPYARD_DEV ? "-dev" : "";
+  const machineId = env.SHIPYARD_MACHINE_ID ?? `${hostname()}${devSuffix}`;
+  const machineName = env.SHIPYARD_MACHINE_NAME ?? `${hostname()}${devSuffix}`;
   const wsUrl = new URL(env.SHIPYARD_SIGNALING_URL);
   if (!wsUrl.pathname.includes("/personal/")) {
     if (!env.SHIPYARD_USER_ID) {
@@ -13053,40 +14092,280 @@ async function createSignalingHandle(env, log) {
   return { signaling, connection, capabilities };
 }
 
-// src/serve.ts
-function assertNever(x) {
-  throw new Error(`Unhandled message type: ${JSON.stringify(x)}`);
+// src/worktree-cleanup.ts
+function isPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
 }
-var CONTROL_PREFIX = "\0
\0";
-var TERMINAL_BUFFER_MAX_BYTES = 1048576;
-var TERMINAL_OPEN_TIMEOUT_MS = 1e4;
-var TERMINAL_CWD_TIMEOUT_MS = 5e3;
-function resolveTerminalCwd(activeTasks, watchedTasks, repo) {
-  for (const taskId of activeTasks.keys()) {
-    const epoch = DEFAULT_EPOCH;
-    const taskDocId = buildDocumentId("task", taskId, epoch);
-    try {
-      const handle = repo.get(taskDocId, TaskDocumentSchema);
-      const json = handle.doc.toJSON();
-      const lastUserMsg = [...json.conversation].reverse().find((m) => m.role === "user");
-      if (lastUserMsg?.cwd) return lastUserMsg.cwd;
-    } catch {
+function classifyEntries(entries, localMachineId, cutoff) {
+  const staleKeys = [];
+  const orphanedEntries = [];
+  for (const [path, entry] of Object.entries(entries)) {
+    if (entry.status !== "running") {
+      if (entry.completedAt && entry.completedAt < cutoff) {
+        staleKeys.push(path);
+      }
+      continue;
+    }
+    if (entry.machineId === localMachineId) {
+      const alive = entry.pid != null && isPidAlive(entry.pid);
+      if (!alive) {
+        orphanedEntries.push({ path, entry });
+      }
     }
   }
-  for (const taskId of watchedTasks.keys()) {
-    if (activeTasks.has(taskId)) continue;
-    const epoch = DEFAULT_EPOCH;
-    const taskDocId = buildDocumentId("task", taskId, epoch);
+  return { staleKeys, orphanedEntries };
+}
+function cleanupStaleSetupEntries(roomDoc, localMachineId, log) {
+  const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3;
+  const cutoff = Date.now() - SEVEN_DAYS_MS;
+  try {
+    const json = roomDoc.toJSON();
+    const entries = json.worktreeSetupStatus ?? {};
+    const { staleKeys, orphanedEntries } = classifyEntries(entries, localMachineId, cutoff);
+    if (staleKeys.length === 0 && orphanedEntries.length === 0) return;
+    change(roomDoc, (draft) => {
+      for (const key of staleKeys) {
+        draft.worktreeSetupStatus.delete(key);
+      }
+      for (const { path, entry } of orphanedEntries) {
+        draft.worktreeSetupStatus.set(path, {
+          ...entry,
+          status: "failed",
+          completedAt: Date.now()
+        });
+      }
+    });
+    if (staleKeys.length > 0) {
+      log.info({ count: staleKeys.length }, "Cleaned up stale worktree setup status entries");
+    }
+    if (orphanedEntries.length > 0) {
+      log.info(
+        { count: orphanedEntries.length, paths: orphanedEntries.map((e) => e.path) },
+        "Marked orphaned running setup entries as failed"
+      );
+    }
+  } catch (err) {
+    log.warn({ err }, "Failed to clean up stale worktree setup status entries");
+  }
+}
+
+// src/worktree-command.ts
+import { execFile as execFile2, spawn as spawn2 } from "child_process";
+import { closeSync, openSync } from "fs";
+import { access, chmod, constants, copyFile, mkdir as mkdir2, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join5 } from "path";
+var GIT_TIMEOUT_MS = 3e4;
+function isErrnoException(err) {
+  return err instanceof Error && "code" in err;
+}
+var MAX_BUFFER = 10 * 1024 * 1024;
+function runGit(args, cwd) {
+  return new Promise((resolve3, reject) => {
+    execFile2(
+      "git",
+      args,
+      { timeout: GIT_TIMEOUT_MS, cwd, maxBuffer: MAX_BUFFER },
+      (error, stdout) => {
+        if (error) reject(error);
+        else resolve3(stdout.trim());
+      }
+    );
+  });
+}
+var COPY_EXCLUDE_PATTERNS = [
+  "node_modules",
+  ".turbo",
+  ".data/",
+  "/dist/",
+  "/build/",
+  ".next",
+  ".DS_Store",
+  "*.log",
+  ".eslintcache"
+];
+function matchesPattern(filePath, pattern) {
+  const segments = filePath.split("/");
+  if (pattern.startsWith("*")) return filePath.endsWith(pattern.slice(1));
+  let bare = pattern;
+  if (bare.startsWith("/")) bare = bare.slice(1);
+  if (bare.endsWith("/")) bare = bare.slice(0, -1);
+  return segments.some((seg) => seg === bare);
+}
+function shouldExclude(filePath) {
+  return COPY_EXCLUDE_PATTERNS.some((pattern) => matchesPattern(filePath, pattern));
+}
+async function refExists(ref, cwd) {
+  try {
+    await runGit(["rev-parse", "--verify", ref], cwd);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function assertWorktreeNotExists(worktreePath) {
+  try {
+    await access(worktreePath, constants.F_OK);
+  } catch (err) {
+    if (isErrnoException(err) && err.code === "ENOENT") return;
+    return;
+  }
+  throw new Error(`Worktree already exists at ${worktreePath}`);
+}
+async function addWorktree(worktreePath, branchName, baseRef, cwd) {
+  const remoteExists = await refExists(`origin/${branchName}`, cwd);
+  if (remoteExists) {
     try {
-      const handle = repo.get(taskDocId, TaskDocumentSchema);
-      const json = handle.doc.toJSON();
-      const lastUserMsg = [...json.conversation].reverse().find((m) => m.role === "user");
-      if (lastUserMsg?.cwd) return lastUserMsg.cwd;
+      await runGit(["worktree", "add", worktreePath, branchName], cwd);
+      return;
     } catch {
+      await runGit(
+        ["worktree", "add", worktreePath, "-b", branchName, `origin/${branchName}`],
+        cwd
+      );
+      return;
     }
   }
-  return process.cwd();
+  const localExists = await refExists(branchName, cwd);
+  if (localExists) {
+    await runGit(["worktree", "add", worktreePath, branchName], cwd);
+    return;
+  }
+  const normalizedRef = baseRef.startsWith("origin/") ? baseRef.slice("origin/".length) : baseRef;
+  await runGit(["worktree", "add", worktreePath, "-b", branchName, `origin/${normalizedRef}`], cwd);
 }
+async function copyIgnoredFiles(sourceRepoPath, worktreePath) {
+  const warnings = [];
+  const ignoredOutput = await runGit(
+    ["ls-files", "--others", "--ignored", "--exclude-standard"],
+    sourceRepoPath
+  );
+  if (!ignoredOutput) return warnings;
+  const files = ignoredOutput.split("\n").filter((f) => f && !shouldExclude(f));
+  for (const file of files) {
+    try {
+      const destPath = join5(worktreePath, file);
+      await mkdir2(dirname2(destPath), { recursive: true });
+      await copyFile(join5(sourceRepoPath, file), destPath);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      warnings.push(`Failed to copy ${file}: ${msg}`);
+    }
+  }
+  return warnings;
+}
+async function launchSetupScript(worktreePath, setupScript) {
+  if (!setupScript) return null;
+  const shipyardDir = join5(worktreePath, ".shipyard");
+  const scriptPath = join5(shipyardDir, "worktree-setup.sh");
+  const logPath = join5(shipyardDir, "worktree-setup.log");
+  let fullScript;
+  if (setupScript.startsWith("#!")) {
+    const firstNewline = setupScript.indexOf("\n");
+    const shebang = setupScript.slice(0, firstNewline + 1);
+    const rest = setupScript.slice(firstNewline + 1);
+    fullScript = `${shebang}set -e
+${rest}`;
+  } else {
+    fullScript = `#!/bin/sh
+set -e
+${setupScript}`;
+  }
+  await mkdir2(shipyardDir, { recursive: true });
+  await writeFile3(scriptPath, fullScript, "utf-8");
+  await chmod(scriptPath, 493);
+  const logFd = openSync(logPath, "w");
+  try {
+    const child = spawn2(scriptPath, [], {
+      cwd: worktreePath,
+      stdio: ["ignore", logFd, logFd],
+      detached: true
+    });
+    return child;
+  } finally {
+    closeSync(logFd);
+  }
+}
+async function createWorktree(opts) {
+  const { sourceRepoPath, branchName, baseRef, setupScript, onProgress } = opts;
+  validateWorktreeInputs(sourceRepoPath, branchName, baseRef);
+  const worktreeParent = `${sourceRepoPath}-wt`;
+  const worktreePath = join5(worktreeParent, branchName);
+  onProgress("creating-worktree", `Creating worktree at ${worktreePath}`);
+  await mkdir2(worktreeParent, { recursive: true });
+  await assertWorktreeNotExists(worktreePath);
+  try {
+    await runGit(["fetch", "origin", baseRef], sourceRepoPath);
+  } catch {
+  }
+  await addWorktree(worktreePath, branchName, baseRef, sourceRepoPath);
+  onProgress("copying-files", "Copying ignored files from source repo");
+  let warnings = [];
+  try {
+    warnings = await copyIgnoredFiles(sourceRepoPath, worktreePath);
+    onProgress("copying-files", `Copied ignored files (${warnings.length} warnings)`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    warnings.push(`Failed to list ignored files: ${msg}`);
+  }
+  const setupChild = await launchSetupScript(worktreePath, setupScript);
+  const setupScriptStarted = setupChild !== null;
+  if (setupScriptStarted) {
+    onProgress("running-setup-script", "Launched worktree setup script");
+  }
+  return { worktreePath, branchName, setupScriptStarted, setupChild, warnings };
+}
+var BASE_REF_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9/_.-]*$/;
+function validateWorktreeInputs(sourceRepoPath, branchName, baseRef) {
+  if (!isAbsolute2(sourceRepoPath)) {
+    throw new Error(`sourceRepoPath must be an absolute path, got: ${sourceRepoPath}`);
+  }
+  if (sourceRepoPath.includes("..")) {
+    throw new Error('sourceRepoPath must not contain ".." path traversal segments');
+  }
+  if (branchName.includes("..")) {
+    throw new Error('branchName must not contain ".." path traversal segments');
+  }
+  if (branchName.startsWith("-") || branchName.startsWith(".")) {
+    throw new Error('branchName must not start with "-" or "."');
+  }
+  if (!BRANCH_NAME_PATTERN.test(branchName)) {
+    throw new Error(
+      `branchName contains invalid characters. Must match ${BRANCH_NAME_PATTERN.source}`
+    );
+  }
+  if (baseRef.startsWith("-")) {
+    throw new Error('baseRef must not start with "-"');
+  }
+  if (baseRef.includes("..")) {
+    throw new Error('baseRef must not contain ".." path traversal segments');
+  }
+  if (!BASE_REF_PATTERN.test(baseRef)) {
+    throw new Error(`baseRef contains invalid characters. Must match ${BASE_REF_PATTERN.source}`);
+  }
+}
+
+// src/serve.ts
+function assertNever(x) {
+  throw new Error(`Unhandled message type: ${JSON.stringify(x)}`);
+}
+var processedRequestIds = /* @__PURE__ */ new Set();
+var pendingCleanupTimers = /* @__PURE__ */ new Set();
+function scheduleEphemeralCleanup(fn, delayMs) {
+  const timer = setTimeout(() => {
+    pendingCleanupTimers.delete(timer);
+    fn();
+  }, delayMs);
+  pendingCleanupTimers.add(timer);
+}
+var CONTROL_PREFIX = "\0
\0";
+var TERMINAL_BUFFER_MAX_BYTES = 1048576;
+var TERMINAL_OPEN_TIMEOUT_MS = 1e4;
+var TERMINAL_CWD_TIMEOUT_MS = 5e3;
 var TaskEphemeralDeclarations = {
   permReqs: PermissionRequestEphemeral,
   permResps: PermissionResponseEphemeral
@@ -13097,7 +14376,23 @@ async function serve(env) {
     process.exit(1);
   }
   const log = createChildLogger({ mode: "serve" });
+  if (env.SHIPYARD_USER_TOKEN && env.SHIPYARD_SIGNALING_URL) {
+    const client = new SignalingClient(env.SHIPYARD_SIGNALING_URL);
+    try {
+      const result = await client.verify(env.SHIPYARD_USER_TOKEN);
+      if (!result.valid) {
+        logger.error(
+          `Auth token is no longer valid (${result.reason}). Run \`shipyard login\` to re-authenticate.`
+        );
+        process.exit(1);
+      }
+      log.info("Token verified against session server");
+    } catch {
+      log.warn("Could not verify token with session server, proceeding anyway");
+    }
+  }
   const lifecycle = new LifecycleManager();
+  await lifecycle.acquirePidFile(getShipyardHome());
   const handle = await createSignalingHandle(env, log);
   if (!handle) {
     logger.error("SHIPYARD_SIGNALING_URL is required for serve mode");
@@ -13106,9 +14401,11 @@ async function serve(env) {
   const { signaling, connection, capabilities } = handle;
   const activeTasks = /* @__PURE__ */ new Map();
   const watchedTasks = /* @__PURE__ */ new Map();
-  const machineId = env.SHIPYARD_MACHINE_ID ?? hostname2();
+  const taskHandles = /* @__PURE__ */ new Map();
+  const devSuffix = env.SHIPYARD_DEV ? "-dev" : "";
+  const machineId = env.SHIPYARD_MACHINE_ID ?? `${hostname2()}${devSuffix}`;
   const dataDir = resolve(env.SHIPYARD_DATA_DIR.replace("~", homedir2()));
-  await mkdir2(dataDir, { recursive: true, mode: 448 });
+  await mkdir3(dataDir, { recursive: true, mode: 448 });
   const storage = new FileStorageAdapter(dataDir);
   const webrtcAdapter = new WebRtcDataChannelAdapter();
   const repo = new Repo({
@@ -13132,17 +14429,18 @@ async function serve(env) {
         candidate
       });
     },
-    onTerminalChannel(fromMachineId, rawChannel) {
+    onTerminalChannel(fromMachineId, rawChannel, taskId) {
       const channel = rawChannel;
-      const termLog = createChildLogger({ mode: `terminal:${fromMachineId}` });
-      const existingPty = terminalPtys.get(fromMachineId);
+      const terminalKey = `${fromMachineId}:${taskId}`;
+      const termLog = createChildLogger({ mode: `terminal:${fromMachineId}:${taskId}` });
+      const existingPty = terminalPtys.get(terminalKey);
       if (existingPty) {
         termLog.info("Disposing existing PTY for reconnecting machine");
         existingPty.dispose();
-        terminalPtys.delete(fromMachineId);
+        terminalPtys.delete(terminalKey);
       }
       const ptyManager = createPtyManager();
-      terminalPtys.set(fromMachineId, ptyManager);
+      terminalPtys.set(terminalKey, ptyManager);
       let ptySpawned = false;
       let channelOpen = channel.readyState === "open";
       const pendingBuffer = [];
@@ -13153,7 +14451,7 @@ async function serve(env) {
         clearTimeout(openTimeout);
         clearTimeout(cwdTimeout);
         ptyManager.dispose();
-        terminalPtys.delete(fromMachineId);
+        terminalPtys.delete(terminalKey);
         if (channel.readyState === "open") {
           channel.close();
         }
@@ -13205,7 +14503,7 @@ async function serve(env) {
         } catch (err) {
           termLog.error({ err }, "Failed to spawn terminal PTY");
           channel.close();
-          terminalPtys.delete(fromMachineId);
+          terminalPtys.delete(terminalKey);
           return;
         }
         ptyManager.onData((data) => {
@@ -13216,7 +14514,7 @@ async function serve(env) {
           if (channel.readyState === "open") {
             channel.close();
           }
-          terminalPtys.delete(fromMachineId);
+          terminalPtys.delete(terminalKey);
         });
         for (const input of preSpawnInputBuffer) {
           try {
@@ -13232,8 +14530,8 @@ async function serve(env) {
       }
       const cwdTimeout = setTimeout(() => {
         if (!ptySpawned) {
-          termLog.info("No cwd control message received, falling back to heuristic");
-          const fallbackCwd = resolveTerminalCwd(activeTasks, watchedTasks, repo);
+          termLog.info("No cwd control message received, falling back to $HOME");
+          const fallbackCwd = process.env.HOME ?? process.cwd();
           spawnPty(fallbackCwd);
         }
       }, TERMINAL_CWD_TIMEOUT_MS);
@@ -13273,7 +14571,9 @@ async function serve(env) {
         clearTimeout(openTimeout);
         clearTimeout(cwdTimeout);
         ptyManager.dispose();
-        terminalPtys.delete(fromMachineId);
+        if (terminalPtys.get(terminalKey) === ptyManager) {
+          terminalPtys.delete(terminalKey);
+        }
       };
     }
   });
@@ -13294,7 +14594,12 @@ async function serve(env) {
         remote: e.remote ?? null
       })),
       permissionModes: caps.permissionModes,
-      homeDir: caps.homeDir ?? null
+      homeDir: caps.homeDir ?? null,
+      anthropicAuth: caps.anthropicAuth ? {
+        status: caps.anthropicAuth.status,
+        method: caps.anthropicAuth.method,
+        email: caps.anthropicAuth.email ?? null
+      } : null
     };
     roomHandle.capabilities.set(machineId, value);
     log.info({ machineId }, "Published capabilities to room ephemeral");
@@ -13307,6 +14612,165 @@ async function serve(env) {
       publishCapabilities(capabilities);
     }
   });
+  const typedRoomHandle = roomHandle;
+  const typedRoomDoc = roomHandle.doc;
+  cleanupStaleSetupEntries(typedRoomDoc, machineId, log);
+  typedRoomHandle.enhancePromptReqs.subscribe(({ key: requestId, value, source }) => {
+    if (source !== "remote") return;
+    if (!value) return;
+    if (value.machineId !== machineId) return;
+    if (processedRequestIds.has(requestId)) return;
+    processedRequestIds.add(requestId);
+    const enhLog = createChildLogger({ mode: `enhance-prompt-ephemeral:${requestId}` });
+    enhLog.info(
+      { promptLen: value.prompt.length },
+      "Received enhance-prompt request via ephemeral"
+    );
+    if (capabilities.anthropicAuth?.status !== "authenticated") {
+      enhLog.error("Not authenticated with Anthropic");
+      typedRoomHandle.enhancePromptResps.set(requestId, {
+        status: "error",
+        text: "",
+        error: "Not authenticated with Anthropic. Run 'claude auth login' or set ANTHROPIC_API_KEY."
+      });
+      scheduleEphemeralCleanup(() => {
+        typedRoomHandle.enhancePromptReqs.delete(requestId);
+        typedRoomHandle.enhancePromptResps.delete(requestId);
+      }, EPHEMERAL_CLEANUP_DELAY_MS);
+      processedRequestIds.delete(requestId);
+      return;
+    }
+    const abortController = lifecycle.createAbortController();
+    const timeout = setTimeout(() => abortController.abort(), ENHANCE_PROMPT_TIMEOUT_MS);
+    runEnhancePromptEphemeral(value.prompt, requestId, abortController, typedRoomHandle, enhLog).catch((err) => {
+      enhLog.error({ err }, "Enhance prompt ephemeral failed");
+    }).finally(() => {
+      clearTimeout(timeout);
+      abortController.abort();
+      processedRequestIds.delete(requestId);
+    });
+  });
+  typedRoomHandle.worktreeCreateReqs.subscribe(({ key: requestId, value, source }) => {
+    if (source !== "remote") return;
+    if (!value) return;
+    if (value.machineId !== machineId) return;
+    if (processedRequestIds.has(requestId)) return;
+    processedRequestIds.add(requestId);
+    const wtLog = createChildLogger({ mode: `worktree-create-ephemeral:${requestId}` });
+    wtLog.info(
+      {
+        sourceRepoPath: value.sourceRepoPath,
+        branchName: value.branchName,
+        baseRef: value.baseRef
+      },
+      "Received worktree-create request via ephemeral"
+    );
+    const roomJson = typedRoomDoc.toJSON();
+    const crdtScriptEntry = roomJson?.userSettings?.worktreeScripts?.[value.sourceRepoPath];
+    const resolvedSetupScript = value.setupScript ?? crdtScriptEntry?.script ?? null;
+    runWorktreeCreateEphemeral(
+      requestId,
+      value.sourceRepoPath,
+      value.branchName,
+      value.baseRef,
+      resolvedSetupScript,
+      typedRoomHandle,
+      typedRoomDoc,
+      machineId,
+      capabilities,
+      publishCapabilities,
+      branchWatcher,
+      wtLog
+    ).catch((err) => {
+      wtLog.error({ err }, "Worktree create ephemeral handler failed");
+    }).finally(() => {
+      processedRequestIds.delete(requestId);
+    });
+  });
+  typedRoomHandle.anthropicLoginReqs.subscribe(({ key: requestId, value, source }) => {
+    if (source !== "remote") return;
+    if (!value) return;
+    if (value.machineId !== machineId) return;
+    if (processedRequestIds.has(requestId)) return;
+    processedRequestIds.add(requestId);
+    const loginLog = createChildLogger({ mode: `anthropic-login:${requestId}` });
+    loginLog.info("Received Anthropic login request via ephemeral");
+    typedRoomHandle.anthropicLoginResps.set(requestId, {
+      status: "starting",
+      loginUrl: null,
+      error: null
+    });
+    const child = spawn3("claude", ["auth", "login"], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    child.stdout?.on("data", (chunk) => {
+      const text = chunk.toString();
+      stdout += text;
+      const urlMatch = text.match(/https:\/\/\S+/);
+      if (urlMatch) {
+        typedRoomHandle.anthropicLoginResps.set(requestId, {
+          status: "waiting",
+          loginUrl: urlMatch[0],
+          error: null
+        });
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      const text = chunk.toString();
+      stdout += text;
+      const urlMatch = text.match(/https:\/\/\S+/);
+      if (urlMatch) {
+        typedRoomHandle.anthropicLoginResps.set(requestId, {
+          status: "waiting",
+          loginUrl: urlMatch[0],
+          error: null
+        });
+      }
+    });
+    child.on("exit", (exitCode) => {
+      if (exitCode === 0) {
+        loginLog.info("Anthropic login completed successfully");
+        detectAnthropicAuth().then((authStatus) => {
+          capabilities.anthropicAuth = authStatus;
+          publishCapabilities(capabilities);
+          loginLog.info({ authStatus }, "Re-detected auth after login");
+        }).catch((err) => {
+          loginLog.warn({ err }, "Failed to re-detect auth after login");
+        });
+        typedRoomHandle.anthropicLoginResps.set(requestId, {
+          status: "done",
+          loginUrl: null,
+          error: null
+        });
+      } else {
+        loginLog.error({ exitCode, stdout }, "Anthropic login failed");
+        typedRoomHandle.anthropicLoginResps.set(requestId, {
+          status: "error",
+          loginUrl: null,
+          error: `Login failed (exit code ${exitCode})`
+        });
+      }
+      scheduleEphemeralCleanup(() => {
+        typedRoomHandle.anthropicLoginReqs.delete(requestId);
+        typedRoomHandle.anthropicLoginResps.delete(requestId);
+      }, EPHEMERAL_CLEANUP_DELAY_MS);
+      processedRequestIds.delete(requestId);
+    });
+    child.on("error", (err) => {
+      loginLog.error({ err: err.message }, "Failed to spawn claude auth login");
+      typedRoomHandle.anthropicLoginResps.set(requestId, {
+        status: "error",
+        loginUrl: null,
+        error: `Failed to start login: ${err.message}`
+      });
+      scheduleEphemeralCleanup(() => {
+        typedRoomHandle.anthropicLoginReqs.delete(requestId);
+        typedRoomHandle.anthropicLoginResps.delete(requestId);
+      }, EPHEMERAL_CLEANUP_DELAY_MS);
+      processedRequestIds.delete(requestId);
+    });
+  });
   connection.onStateChange((state) => {
     log.info({ state }, "Connection state changed");
   });
@@ -13316,13 +14780,18 @@ async function serve(env) {
       signaling,
       connection,
       repo,
-      roomDoc: roomHandle.doc,
+      roomDoc: typedRoomDoc,
+      roomHandle: typedRoomHandle,
       lifecycle,
       activeTasks,
       watchedTasks,
+      taskHandles,
       peerManager,
       env,
-      machineId
+      machineId,
+      capabilities,
+      publishCapabilities,
+      branchWatcher
     });
   });
   connection.connect();
@@ -13347,6 +14816,9 @@ async function serve(env) {
       unsub();
     }
     watchedTasks.clear();
+    taskHandles.clear();
+    for (const timer of pendingCleanupTimers) clearTimeout(timer);
+    pendingCleanupTimers.clear();
     for (const [id, ptyMgr] of terminalPtys) {
       ptyMgr.dispose();
       terminalPtys.delete(id);
@@ -13504,6 +14976,21 @@ function handleMessage(msg, ctx) {
       });
       break;
     }
+    case "enhance-prompt-request":
+      handleEnhancePrompt(msg, ctx);
+      break;
+    case "enhance-prompt-chunk":
+    case "enhance-prompt-done":
+      ctx.log.debug({ type: msg.type }, "Enhance prompt echo");
+      break;
+    case "worktree-create-request":
+      handleWorktreeCreate(msg, ctx);
+      break;
+    case "worktree-create-progress":
+    case "worktree-create-done":
+    case "worktree-create-error":
+      ctx.log.debug({ type: msg.type }, "Worktree create echo");
+      break;
     case "authenticated":
     case "agent-joined":
     case "agent-left":
@@ -13518,25 +15005,29 @@ function handleMessage(msg, ctx) {
 function handleNotifyTask(msg, ctx) {
   const { taskId, requestId } = msg;
   const taskLog = createChildLogger({ mode: "serve", taskId });
-  if (!ctx.env.ANTHROPIC_API_KEY) {
-    taskLog.error("ANTHROPIC_API_KEY is required to run agents");
+  if (ctx.capabilities.anthropicAuth?.status !== "authenticated") {
+    taskLog.error("Not authenticated with Anthropic");
     ctx.connection.send({
       type: "task-ack",
       requestId,
       taskId,
       accepted: false,
-      error: "ANTHROPIC_API_KEY not configured on daemon"
+      error: "Not authenticated with Anthropic. Run 'claude auth login' or set ANTHROPIC_API_KEY."
     });
     return;
   }
   if (ctx.watchedTasks.has(taskId)) {
-    taskLog.debug("Task already watched, sending ack");
+    taskLog.debug("Task already watched, re-checking for new work");
     ctx.connection.send({
       type: "task-ack",
       requestId,
       taskId,
       accepted: true
     });
+    const taskHandle = ctx.taskHandles.get(taskId);
+    if (taskHandle) {
+      onTaskDocChanged(taskId, taskHandle, taskLog, ctx);
+    }
     return;
   }
   taskLog.info("Received notify-task, starting watch");
@@ -13551,6 +15042,424 @@ function handleNotifyTask(msg, ctx) {
     taskLog.error({ err: errMsg }, "Failed to start watching task document");
   });
 }
+var ENHANCE_PROMPT_TIMEOUT_MS = 3e4;
+var ENHANCE_SYSTEM_PROMPT = `You are a prompt rewriter that transforms rough user requests into clear, specific instructions for an AI coding assistant (Claude Code). The enhanced prompt will be sent AS the user's message to that assistant.
+
+RULES:
+- Write in imperative/request form ("Build...", "Create...", "Add...") \u2014 NEVER first person ("I'll...", "Let me...")
+- Return ONLY the rewritten prompt. No preamble, explanation, or markdown formatting.
+- Keep the user's core intent intact. Do not add features they didn't imply.
+- Expand vague ideas into concrete specifics: name technologies, list features, set constraints.
+- If the user names a technology, keep it. If they don't, pick sensible defaults.
+- Target 2-5x the input length. Be concise and direct \u2014 no filler, hype, or superlatives.
+- Do NOT add project setup boilerplate (e.g., "initialize a git repo", "set up CI/CD") unless asked.
+- Structure as a single paragraph or short bullet list, whichever is clearer.
+
+WHAT TO ADD:
+- Specific features the request implies but doesn't list
+- Technology choices when unspecified (framework, API, library)
+- Concrete parameters (sizes, ranges, counts) instead of vague adjectives
+- UI/UX details when building something visual
+- Scope boundaries to prevent over-building
+
+EXAMPLES:
+
+Input: "make a cool hello world beat app"
+Output: "Build a browser-based beat maker with a 4x4 pad grid that plays drum sounds on click. Include kick, snare, hi-hat, and clap samples using the Web Audio API. Add a step sequencer with play/pause, a tempo slider (60-200 BPM), and visual feedback on active pads. Keep it to a single page with a dark theme."
+
+Input: "fix the login bug"
+Output: "Investigate and fix the login bug. Check the authentication flow for common issues: expired tokens, incorrect credential validation, session handling errors, or CORS misconfigurations. Add error logging if missing and verify the fix works for both valid and invalid credential cases."
+
+Input: "add dark mode"
+Output: "Add a dark mode toggle to the app. Use CSS custom properties for theme colors, persist the user's preference in localStorage, and respect the system prefers-color-scheme setting as the default. Ensure all existing components have adequate contrast in both themes."
+
+Input: "make a landing page for my saas"
+Output: "Build a responsive landing page with: hero section with headline, subheadline, and CTA button; features grid (3-4 cards with icons); pricing section with 2-3 tier cards; FAQ accordion; and a footer with links. Use a clean, modern design with consistent spacing. Make it mobile-first with a sticky header."`;
+function handleEnhancePrompt(msg, ctx) {
+  const { requestId, prompt } = msg;
+  if (processedRequestIds.has(requestId)) return;
+  processedRequestIds.add(requestId);
+  const enhanceLog = createChildLogger({ mode: "enhance-prompt" });
+  if (ctx.capabilities.anthropicAuth?.status !== "authenticated") {
+    enhanceLog.error("Not authenticated with Anthropic");
+    ctx.connection.send({
+      type: "error",
+      code: "not_authenticated",
+      message: "Not authenticated with Anthropic. Run 'claude auth login' or set ANTHROPIC_API_KEY.",
+      requestId
+    });
+    processedRequestIds.delete(requestId);
+    return;
+  }
+  const abortController = ctx.lifecycle.createAbortController();
+  const timeout = setTimeout(() => abortController.abort(), ENHANCE_PROMPT_TIMEOUT_MS);
+  runEnhancePrompt(prompt, requestId, abortController, ctx, enhanceLog).catch((err) => {
+    enhanceLog.error({ err }, "Enhance prompt failed");
+  }).finally(() => {
+    clearTimeout(timeout);
+    abortController.abort();
+    processedRequestIds.delete(requestId);
+  });
+}
+function extractTextChunks(rawContent) {
+  if (!Array.isArray(rawContent)) return [];
+  const chunks = [];
+  for (const block of rawContent) {
+    const b = block;
+    if (b.type === "text" && typeof b.text === "string") {
+      chunks.push(b.text);
+    }
+  }
+  return chunks;
+}
+async function runEnhancePrompt(prompt, requestId, abortController, ctx, log) {
+  let fullText = "";
+  try {
+    const response = query2({
+      prompt,
+      options: {
+        maxTurns: 1,
+        allowedTools: [],
+        systemPrompt: ENHANCE_SYSTEM_PROMPT,
+        abortController
+      }
+    });
+    for await (const message of response) {
+      if (message.type !== "assistant") continue;
+      for (const text of extractTextChunks(message.message.content)) {
+        fullText += text;
+        ctx.connection.send({
+          type: "enhance-prompt-chunk",
+          requestId,
+          text
+        });
+      }
+    }
+    ctx.connection.send({
+      type: "enhance-prompt-done",
+      requestId,
+      fullText
+    });
+    log.info({ promptLen: prompt.length, resultLen: fullText.length }, "Prompt enhanced");
+  } catch (err) {
+    if (abortController.signal.aborted) {
+      log.warn("Prompt enhancement aborted");
+    } else {
+      log.error({ err }, "Prompt enhancement failed");
+    }
+    ctx.connection.send({
+      type: "error",
+      code: "enhance_failed",
+      message: err instanceof Error ? err.message : "Prompt enhancement failed",
+      requestId
+    });
+  }
+}
+function handleWorktreeCreate(msg, ctx) {
+  const { requestId, sourceRepoPath, branchName, baseRef } = msg;
+  if (processedRequestIds.has(requestId)) return;
+  processedRequestIds.add(requestId);
+  const wtLog = createChildLogger({ mode: "worktree-create" });
+  const roomJson = ctx.roomDoc.toJSON();
+  const scriptEntry = roomJson?.userSettings?.worktreeScripts?.[sourceRepoPath];
+  const setupScript = scriptEntry?.script ?? null;
+  wtLog.info({ sourceRepoPath, branchName, baseRef }, "Starting worktree creation");
+  runWorktreeCreate(requestId, sourceRepoPath, branchName, baseRef, setupScript, ctx, wtLog).catch(
+    (err) => {
+      wtLog.error({ err }, "Worktree create handler failed");
+    }
+  );
+}
+function monitorSetupChild(child, requestId, worktreePath, machineId, roomHandle, roomDoc, startedAt, log) {
+  child.on("exit", (exitCode, signal) => {
+    const status = exitCode === 0 ? "done" : "failed";
+    log.info({ worktreePath, exitCode, signal, status }, "Setup script exited");
+    change(roomDoc, (draft) => {
+      draft.worktreeSetupStatus.set(worktreePath, {
+        status,
+        machineId,
+        startedAt,
+        completedAt: Date.now(),
+        exitCode: exitCode ?? null,
+        signal: signal ?? null,
+        pid: child.pid ?? null
+      });
+    });
+    try {
+      roomHandle.worktreeSetupResps.set(requestId, {
+        exitCode: exitCode ?? null,
+        signal: signal ?? null,
+        worktreePath
+      });
+    } catch (err) {
+      log.warn({ err }, "Failed to publish setup result to ephemeral");
+    }
+    scheduleEphemeralCleanup(() => {
+      roomHandle.worktreeSetupResps.delete(requestId);
+    }, EPHEMERAL_CLEANUP_DELAY_MS);
+  });
+  child.on("error", (err) => {
+    log.warn({ err: err.message }, "Setup script spawn error");
+    change(roomDoc, (draft) => {
+      draft.worktreeSetupStatus.set(worktreePath, {
+        status: "failed",
+        machineId,
+        startedAt,
+        completedAt: Date.now(),
+        exitCode: null,
+        signal: null,
+        pid: child.pid ?? null
+      });
+    });
+    roomHandle.worktreeSetupResps.set(requestId, {
+      exitCode: null,
+      signal: null,
+      worktreePath
+    });
+    scheduleEphemeralCleanup(() => {
+      roomHandle.worktreeSetupResps.delete(requestId);
+    }, EPHEMERAL_CLEANUP_DELAY_MS);
+  });
+  child.unref();
+}
+async function runWorktreeCreate(requestId, sourceRepoPath, branchName, baseRef, setupScript, ctx, log) {
+  try {
+    const result = await createWorktree({
+      sourceRepoPath,
+      branchName,
+      baseRef,
+      setupScript,
+      onProgress(step, detail) {
+        ctx.connection.send({
+          type: "worktree-create-progress",
+          requestId,
+          // eslint-disable-next-line no-restricted-syntax -- step string from createWorktree matches the schema enum
+          step,
+          detail
+        });
+      }
+    });
+    ctx.connection.send({
+      type: "worktree-create-progress",
+      requestId,
+      step: "refreshing-environments",
+      detail: "Re-detecting git environments"
+    });
+    try {
+      const newEnvs = await detectEnvironments();
+      ctx.capabilities.environments = newEnvs;
+      ctx.publishCapabilities(ctx.capabilities);
+      const repoMeta = await getRepoMetadata(result.worktreePath);
+      if (repoMeta) {
+        ctx.branchWatcher.addEnvironment(result.worktreePath, repoMeta.branch);
+      }
+    } catch (err) {
+      log.warn({ err }, "Failed to refresh environments after worktree creation");
+    }
+    ctx.connection.send({
+      type: "worktree-create-done",
+      requestId,
+      worktreePath: result.worktreePath,
+      branchName: result.branchName,
+      setupScriptStarted: result.setupScriptStarted,
+      warnings: result.warnings.length > 0 ? result.warnings : void 0
+    });
+    if (result.setupChild) {
+      const startedAt = Date.now();
+      change(ctx.roomDoc, (draft) => {
+        draft.worktreeSetupStatus.set(result.worktreePath, {
+          status: "running",
+          machineId: ctx.machineId,
+          startedAt,
+          completedAt: null,
+          exitCode: null,
+          signal: null,
+          pid: result.setupChild?.pid ?? null
+        });
+      });
+      monitorSetupChild(
+        result.setupChild,
+        requestId,
+        result.worktreePath,
+        ctx.machineId,
+        ctx.roomHandle,
+        ctx.roomDoc,
+        startedAt,
+        log
+      );
+    }
+    log.info(
+      {
+        worktreePath: result.worktreePath,
+        setupScriptStarted: result.setupScriptStarted,
+        warningCount: result.warnings.length
+      },
+      "Worktree created successfully"
+    );
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log.error({ err: message }, "Worktree creation failed");
+    ctx.connection.send({
+      type: "worktree-create-error",
+      requestId,
+      message
+    });
+  } finally {
+    processedRequestIds.delete(requestId);
+  }
+}
+var EPHEMERAL_CLEANUP_DELAY_MS = 5e3;
+async function runEnhancePromptEphemeral(prompt, requestId, abortController, roomHandle, log) {
+  let fullText = "";
+  try {
+    const response = query2({
+      prompt,
+      options: {
+        maxTurns: 1,
+        allowedTools: [],
+        systemPrompt: ENHANCE_SYSTEM_PROMPT,
+        abortController
+      }
+    });
+    for await (const message of response) {
+      if (message.type !== "assistant") continue;
+      for (const text of extractTextChunks(message.message.content)) {
+        fullText += text;
+        roomHandle.enhancePromptResps.set(requestId, {
+          status: "streaming",
+          text: fullText,
+          error: null
+        });
+      }
+    }
+    roomHandle.enhancePromptResps.set(requestId, {
+      status: "done",
+      text: fullText,
+      error: null
+    });
+    log.info(
+      { promptLen: prompt.length, resultLen: fullText.length },
+      "Prompt enhanced via ephemeral"
+    );
+  } catch (err) {
+    if (abortController.signal.aborted) {
+      log.warn("Prompt enhancement aborted (ephemeral)");
+    } else {
+      log.error({ err }, "Prompt enhancement failed (ephemeral)");
+    }
+    const errorMessage = err instanceof Error ? err.message : "Prompt enhancement failed";
+    roomHandle.enhancePromptResps.set(requestId, {
+      status: "error",
+      text: "",
+      error: errorMessage
+    });
+  } finally {
+    scheduleEphemeralCleanup(() => {
+      roomHandle.enhancePromptReqs.delete(requestId);
+      roomHandle.enhancePromptResps.delete(requestId);
+    }, EPHEMERAL_CLEANUP_DELAY_MS);
+  }
+}
+async function runWorktreeCreateEphemeral(requestId, sourceRepoPath, branchName, baseRef, setupScript, roomHandle, roomDoc, localMachineId, caps, publishCaps, watcher, log) {
+  try {
+    const result = await createWorktree({
+      sourceRepoPath,
+      branchName,
+      baseRef,
+      setupScript,
+      onProgress(step, detail) {
+        roomHandle.worktreeCreateResps.set(requestId, {
+          // eslint-disable-next-line no-restricted-syntax -- step string from createWorktree matches the schema enum
+          status: step,
+          detail: detail ?? null,
+          worktreePath: null,
+          branchName: null,
+          setupScriptStarted: null,
+          warnings: null,
+          error: null
+        });
+      }
+    });
+    roomHandle.worktreeCreateResps.set(requestId, {
+      status: "refreshing-environments",
+      detail: "Re-detecting git environments",
+      worktreePath: null,
+      branchName: null,
+      setupScriptStarted: null,
+      warnings: null,
+      error: null
+    });
+    try {
+      const newEnvs = await detectEnvironments();
+      caps.environments = newEnvs;
+      publishCaps(caps);
+      const repoMeta = await getRepoMetadata(result.worktreePath);
+      if (repoMeta) {
+        watcher.addEnvironment(result.worktreePath, repoMeta.branch);
+      }
+    } catch (err) {
+      log.warn({ err }, "Failed to refresh environments after worktree creation (ephemeral)");
+    }
+    roomHandle.worktreeCreateResps.set(requestId, {
+      status: "done",
+      detail: null,
+      worktreePath: result.worktreePath,
+      branchName: result.branchName,
+      setupScriptStarted: result.setupScriptStarted,
+      warnings: result.warnings.length > 0 ? result.warnings : null,
+      error: null
+    });
+    if (result.setupChild) {
+      const startedAt = Date.now();
+      change(roomDoc, (draft) => {
+        draft.worktreeSetupStatus.set(result.worktreePath, {
+          status: "running",
+          machineId: localMachineId,
+          startedAt,
+          completedAt: null,
+          exitCode: null,
+          signal: null,
+          pid: result.setupChild?.pid ?? null
+        });
+      });
+      monitorSetupChild(
+        result.setupChild,
+        requestId,
+        result.worktreePath,
+        localMachineId,
+        roomHandle,
+        roomDoc,
+        startedAt,
+        log
+      );
+    }
+    log.info(
+      {
+        worktreePath: result.worktreePath,
+        setupScriptStarted: result.setupScriptStarted,
+        warningCount: result.warnings.length
+      },
+      "Worktree created successfully via ephemeral"
+    );
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log.error({ err: message }, "Worktree creation failed (ephemeral)");
+    roomHandle.worktreeCreateResps.set(requestId, {
+      status: "error",
+      detail: null,
+      worktreePath: null,
+      branchName: null,
+      setupScriptStarted: null,
+      warnings: null,
+      error: message
+    });
+  } finally {
+    scheduleEphemeralCleanup(() => {
+      roomHandle.worktreeCreateReqs.delete(requestId);
+      roomHandle.worktreeCreateResps.delete(requestId);
+    }, EPHEMERAL_CLEANUP_DELAY_MS);
+  }
+}
 async function watchTaskDocument(taskId, taskLog, ctx) {
   const epoch = DEFAULT_EPOCH;
   const taskDocId = buildDocumentId("task", taskId, epoch);
@@ -13561,6 +15470,14 @@ async function watchTaskDocument(taskId, taskLog, ctx) {
   } catch {
     taskLog.debug({ taskDocId }, "No existing task data in storage");
   }
+  try {
+    await taskHandle.waitForSync({ kind: "network", timeout: 3e3 });
+  } catch {
+    taskLog.debug({ taskDocId }, "Network sync timed out (browser may not be connected yet)");
+  }
+  if (recoverOrphanedTask(taskHandle.doc, taskLog)) {
+    updateTaskInIndex(ctx.roomDoc, taskId, { status: "failed", updatedAt: Date.now() });
+  }
   const json = taskHandle.doc.toJSON();
   const lastUserMsg = [...json.conversation].reverse().find((m) => m.role === "user");
   const initialCwd = lastUserMsg?.cwd ?? process.cwd();
@@ -13571,10 +15488,10 @@ async function watchTaskDocument(taskId, taskLog, ctx) {
   taskLog.info({ taskDocId, opCount: opCountBefore }, "Doc state before subscribe");
   const unsubscribe = taskHandle.subscribe((event) => {
     taskLog.info({ taskDocId, eventBy: event.by }, "Subscription event received");
-    if (event.by === "local") return;
     onTaskDocChanged(taskId, taskHandle, taskLog, ctx);
   });
   ctx.watchedTasks.set(taskId, unsubscribe);
+  ctx.taskHandles.set(taskId, taskHandle);
   taskLog.info({ taskDocId }, "Subscribed to task document changes");
   const opCountAfter = taskHandle.loroDoc.opCount();
   taskLog.info({ taskDocId, opCount: opCountAfter }, "Doc state after subscribe");
@@ -13587,17 +15504,25 @@ async function watchTaskDocument(taskId, taskLog, ctx) {
     onTaskDocChanged(taskId, taskHandle, taskLog, ctx);
   }
 }
-function handleFollowUp(activeTask, taskLog) {
+function handleFollowUp(activeTask, conversationLen, taskLog) {
   if (!activeTask) return;
+  if (conversationLen <= activeTask.lastDispatchedConvLen) {
+    taskLog.debug(
+      { conversationLen, lastDispatched: activeTask.lastDispatchedConvLen },
+      "Conversation unchanged since last dispatch, skipping duplicate"
+    );
+    return;
+  }
   if (!activeTask.sessionManager.isStreaming) {
     taskLog.debug("Task already running but not streaming, skipping");
     return;
   }
-  const prompt = activeTask.sessionManager.getLatestUserPrompt();
-  if (prompt) {
+  const contentBlocks = activeTask.sessionManager.getLatestUserContentBlocks();
+  if (contentBlocks && contentBlocks.length > 0) {
     try {
       taskLog.info("Sending follow-up to active streaming session");
-      activeTask.sessionManager.sendFollowUp(prompt);
+      activeTask.lastDispatchedConvLen = conversationLen;
+      activeTask.sessionManager.sendFollowUp(contentBlocks);
     } catch (err) {
       taskLog.warn({ err }, "Failed to send follow-up to streaming session");
     }
@@ -13619,7 +15544,7 @@ function onTaskDocChanged(taskId, taskHandle, taskLog, ctx) {
     const conversation2 = json.conversation;
     const lastMessage2 = conversation2[conversation2.length - 1];
     if (lastMessage2?.role === "user") {
-      handleFollowUp(ctx.activeTasks.get(taskId), taskLog);
+      handleFollowUp(ctx.activeTasks.get(taskId), conversation2.length, taskLog);
     }
     const activeLastUserMsg = [...conversation2].reverse().find((m) => m.role === "user");
     const activeCwd = activeLastUserMsg?.cwd ?? process.cwd();
@@ -13650,7 +15575,12 @@ function onTaskDocChanged(taskId, taskHandle, taskLog, ctx) {
     updateTaskInIndex(ctx.roomDoc, taskId, { status, updatedAt: Date.now() });
   };
   const manager = new SessionManager(doc, onStatusChange);
-  const activeTask = { taskId, abortController, sessionManager: manager };
+  const activeTask = {
+    taskId,
+    abortController,
+    sessionManager: manager,
+    lastDispatchedConvLen: conversation.length
+  };
   ctx.activeTasks.set(taskId, activeTask);
   ctx.signaling.updateStatus("running", taskId);
   const turnStartRefPromise = captureTreeSnapshot(cwd);
@@ -13689,6 +15619,8 @@ function onTaskDocChanged(taskId, taskHandle, taskLog, ctx) {
       turnStartRefPromise,
       abortController,
       ctx
+    }).catch((cleanupErr) => {
+      taskLog.warn({ err: cleanupErr }, "cleanupTaskRun failed");
     })
   );
 }
@@ -13722,11 +15654,6 @@ async function cleanupTaskRun(opts) {
     taskHandle.permResps.delete(key);
   }
   ctx.activeTasks.delete(taskId);
-  const unsub = ctx.watchedTasks.get(taskId);
-  if (unsub) {
-    unsub();
-    ctx.watchedTasks.delete(taskId);
-  }
   ctx.signaling.updateStatus("idle");
 }
 function clearDebouncedTimer(timers, taskId) {
@@ -13763,6 +15690,44 @@ function toPermissionResult(decision, input, suggestions, message) {
     message: message ?? "User denied permission"
   };
 }
+function resolveExitPlanMode(taskHandle, taskLog, toolUseID, value) {
+  const plans = taskHandle.doc.toJSON().plans;
+  const planIndex = plans.findIndex((p) => p.toolUseId === toolUseID);
+  if (planIndex < 0) return;
+  const plan = plans[planIndex];
+  if (!plan) return;
+  const reviewStatus = value.decision === "approved" ? "approved" : "changes-requested";
+  const editedMarkdown = serializePlanEditorDoc(taskHandle.loroDoc, plan.planId);
+  const allComments = taskHandle.doc.toJSON().planComments;
+  const planComments = Object.values(allComments).filter(
+    (c) => c.planId === plan.planId && c.resolvedAt === null
+  );
+  const richFeedback = formatPlanFeedbackForClaudeCode(
+    plan.markdown,
+    editedMarkdown || plan.markdown,
+    planComments,
+    value.message ?? null
+  );
+  change(taskHandle.doc, (draft) => {
+    const draftPlan = draft.plans.get(planIndex);
+    if (draftPlan) {
+      draftPlan.reviewStatus = reviewStatus;
+      draftPlan.reviewFeedback = (richFeedback || value.message) ?? null;
+    }
+  });
+  if (richFeedback) {
+    value.message = richFeedback;
+  }
+  taskLog.info(
+    {
+      toolUseID,
+      reviewStatus,
+      hasFeedback: !!richFeedback,
+      hasEdits: editedMarkdown !== plan.markdown
+    },
+    "Updated plan reviewStatus in CRDT with rich feedback"
+  );
+}
 function resolvePermissionResponse(ctx) {
   const { taskHandle, roomDoc, taskId, taskLog, toolName, toolUseID, input, suggestions, value } = ctx;
   taskHandle.permReqs.delete(toolUseID);
@@ -13773,22 +15738,7 @@ function resolvePermissionResponse(ctx) {
   });
   updateTaskInIndex(roomDoc, taskId, { status: "working", updatedAt: Date.now() });
   if (toolName === "ExitPlanMode") {
-    const plans = taskHandle.doc.toJSON().plans;
-    const planIndex = plans.findIndex((p) => p.toolUseId === toolUseID);
-    if (planIndex >= 0) {
-      const reviewStatus = value.decision === "approved" ? "approved" : "changes-requested";
-      change(taskHandle.doc, (draft) => {
-        const plan = draft.plans.get(planIndex);
-        if (plan) {
-          plan.reviewStatus = reviewStatus;
-          plan.reviewFeedback = value.message ?? null;
-        }
-      });
-      taskLog.info(
-        { toolUseID, reviewStatus, hasFeedback: !!value.message },
-        "Updated plan reviewStatus in CRDT"
-      );
-    }
+    resolveExitPlanMode(taskHandle, taskLog, toolUseID, value);
   }
   taskLog.info(
     {
@@ -13837,19 +15787,35 @@ function buildCanUseTool(taskHandle, taskLog, roomDoc, taskId) {
       "Permission request sent to browser"
     );
     return new Promise((resolve3) => {
+      const PERMISSION_TIMEOUT_MS = 5 * 60 * 1e3;
+      let settled = false;
       let unsub;
-      const onAbort = () => {
+      const settle = (result) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timeout);
         unsub?.();
+        signal.removeEventListener("abort", onAbort);
         taskHandle.permReqs.delete(toolUseID);
-        resolve3({ behavior: "deny", message: "Task was aborted" });
+        change(taskHandle.doc, (draft) => {
+          draft.meta.status = "working";
+          draft.meta.updatedAt = Date.now();
+        });
+        updateTaskInIndex(roomDoc, taskId, { status: "working", updatedAt: Date.now() });
+        resolve3(result);
+      };
+      const timeout = setTimeout(() => {
+        taskLog.warn({ toolName, toolUseID }, "Permission request timed out");
+        settle({ behavior: "deny", message: "Permission request timed out" });
+      }, PERMISSION_TIMEOUT_MS);
+      const onAbort = () => {
+        settle({ behavior: "deny", message: "Task was aborted" });
       };
       signal.addEventListener("abort", onAbort, { once: true });
       unsub = taskHandle.permResps.subscribe(({ key, value, source }) => {
         if (source === "local") return;
         if (key !== toolUseID || !value) return;
-        unsub?.();
-        signal.removeEventListener("abort", onAbort);
-        resolve3(
+        settle(
           resolvePermissionResponse({
             taskHandle,
             roomDoc,
@@ -13880,11 +15846,16 @@ async function runTask(opts) {
     abortController,
     log
   } = opts;
-  const prompt = manager.getLatestUserPrompt();
-  if (!prompt) {
+  const contentBlocks = manager.getLatestUserContentBlocks();
+  if (!contentBlocks || contentBlocks.length === 0) {
     throw new Error(`No user message found in task ${taskId}`);
   }
-  log.info({ prompt: prompt.slice(0, 100) }, "Running task with prompt from CRDT");
+  const textPreview = contentBlocks.filter((b) => b.type === "text").map((b) => b.text).join(" ").slice(0, 100);
+  const imageCount = contentBlocks.filter((b) => b.type === "image").length;
+  log.info(
+    { prompt: textPreview || "(images only)", imageCount },
+    "Running task with prompt from CRDT"
+  );
   const canUseTool = permissionMode === "bypassPermissions" ? void 0 : buildCanUseTool(taskHandle, log, roomDoc, taskId);
   const stderr = (data) => {
     const trimmed = data.trim();
@@ -13898,7 +15869,7 @@ async function runTask(opts) {
   const resumeInfo = manager.shouldResume();
   if (resumeInfo.resume && resumeInfo.sessionId) {
     log.info({ sessionId: resumeInfo.sessionId }, "Resuming existing session");
-    return manager.resumeSession(resumeInfo.sessionId, prompt, {
+    return manager.resumeSession(resumeInfo.sessionId, contentBlocks, {
       abortController,
       machineId,
       model,
@@ -13910,7 +15881,7 @@ async function runTask(opts) {
     });
   }
   return manager.createSession({
-    prompt,
+    prompt: contentBlocks,
     cwd,
     machineId,
     model,
@@ -13962,8 +15933,12 @@ function parseCliArgs() {
         "  -s, --serve              Run in serve mode (signaling + spawn-agent)",
         "  -h, --help               Show this help",
         "",
+        "Authentication:",
+        "  Run `claude auth login` to authenticate with Anthropic (primary method).",
+        "  Alternatively, set ANTHROPIC_API_KEY for CI/headless environments.",
+        "",
         "Environment:",
-        "  ANTHROPIC_API_KEY         API key for Claude (required for task mode)",
+        "  ANTHROPIC_API_KEY         API key for Claude (optional, overrides OAuth)",
         "  SHIPYARD_DEV              Set to 1 for dev mode (uses ~/.shipyard-dev/)",
         "  SHIPYARD_DATA_DIR         Data directory (overridden by --data-dir)",
         "  LOG_LEVEL                 Log level: debug, info, warn, error (default: info)",
@@ -13994,7 +15969,7 @@ async function setupSignaling(env, log) {
   return handle;
 }
 async function setupRepo(dataDir) {
-  await mkdir3(dataDir, { recursive: true, mode: 448 });
+  await mkdir4(dataDir, { recursive: true, mode: 448 });
   const storage = new FileStorageAdapter(dataDir);
   const repo = new Repo({
     identity: { name: "shipyard-daemon" },
@@ -14061,13 +16036,13 @@ function handleResult(log, result, startTime) {
 async function handleSubcommand() {
   const subcommand = process.argv[2];
   if (subcommand === "login") {
-    const { loginCommand } = await import("./login-YE3CJW2C.js");
+    const { loginCommand } = await import("./login-625HP2EN.js");
     const hasCheck = process.argv.includes("--check");
     await loginCommand({ check: hasCheck });
     return true;
   }
   if (subcommand === "logout") {
-    const { logoutCommand } = await import("./logout-5JRAQEQC.js");
+    const { logoutCommand } = await import("./logout-L6EMSGQU.js");
     await logoutCommand();
     return true;
   }
@@ -14075,7 +16050,7 @@ async function handleSubcommand() {
 }
 async function loadAuthFromConfig(env) {
   if (env.SHIPYARD_USER_TOKEN) return;
-  const { loadAuthToken } = await import("./auth-BJMJG73E.js");
+  const { loadAuthToken } = await import("./auth-YRHZ3SMD.js");
   const auth = await loadAuthToken();
   if (auth.status === "ok") {
     env.SHIPYARD_USER_TOKEN = auth.token;
@@ -14091,15 +16066,11 @@ async function loadAuthFromConfig(env) {
   }
   logger.warn("No auth token found. Run `shipyard login` to authenticate.");
 }
-function validateTaskArgs(args, env) {
+function validateTaskArgs(args) {
   if (!args.prompt && !args.resume) {
     logger.error("Either --prompt, --resume, or --serve is required. Use --help for usage.");
     process.exit(1);
   }
-  if (!env.ANTHROPIC_API_KEY) {
-    logger.error("ANTHROPIC_API_KEY is required when running tasks. Use --help for usage.");
-    process.exit(1);
-  }
 }
 function createCleanup(signalingHandle, lifecycle, repo) {
   let cleanedUp = false;
@@ -14126,13 +16097,14 @@ async function main() {
   if (args.serve) {
     return serve(env);
   }
-  validateTaskArgs(args, env);
+  validateTaskArgs(args);
   const dataDir = resolve2(args.dataDir ?? env.SHIPYARD_DATA_DIR.replace("~", homedir3()));
   const taskId = args.taskId ?? generateTaskId();
   const log = createChildLogger({ taskId });
   log.info({ dataDir, prompt: args.prompt, resume: args.resume }, "Starting daemon");
   const repo = await setupRepo(dataDir);
   const lifecycle = new LifecycleManager();
+  await lifecycle.acquirePidFile(getShipyardHome());
   const signalingHandle = await setupSignaling(env, log);
   const cleanup = createCleanup(signalingHandle, lifecycle, repo);
   lifecycle.onShutdown(async () => {