@sideboard-ai/core 0.1.301 → 0.1.303

package/dist/index.cjs

@@ -65,6 +65,14 @@ function parseMcpList(text7) {
 function sanitizeMcpServerName(name) {
   return name.replace(/[^A-Za-z0-9_-]/g, "_");
 }
+function isClaudeAiConnectorMcp(toolName, serverName, serverSource) {
+  if (!toolName.startsWith("mcp__")) return false;
+  if (serverSource === "claudeai") return true;
+  if (serverName && /^claude\.ai\b/i.test(serverName.trim())) return true;
+  if (/^mcp__claude_ai_/i.test(toolName)) return true;
+  const id = mcpServerIdForPermission(toolName, serverName);
+  return id != null && id.startsWith("claude_ai_");
+}
 function mcpServerIdForPermission(toolName, serverName) {
   if (toolName.startsWith("mcp__")) {
     const rest = toolName.slice("mcp__".length);
@@ -31334,6 +31342,7 @@ __export(index_exports, {
   clipAgentEventForPaint: () => clipAgentEventForPaint,
   clipThinkingForStore: () => clipThinkingForStore,
   cloneRepoIntoSideboard: () => cloneRepoIntoSideboard,
+  closeMcpUiHost: () => closeMcpUiHost,
   codeRefRangeLabel: () => codeRefRangeLabel,
   codexAdapter: () => codexAdapter,
   codexSandboxWritableRootsArgs: () => codexSandboxWritableRootsArgs,
@@ -31556,6 +31565,7 @@ __export(index_exports, {
   getLinearApiKey: () => getLinearApiKey,
   getLinearAuthToken: () => getLinearAuthToken,
   getLinearIssue: () => getLinearIssue,
+  getMcpUiHost: () => getMcpUiHost,
   getOrchestrator: () => getOrchestrator,
   getPr: () => getPr,
   getPrChecks: () => getPrChecks,
@@ -31621,6 +31631,7 @@ __export(index_exports, {
   isBrightsyConnected: () => isBrightsyConnected,
   isBrightsyNdjsonLine: () => isBrightsyNdjsonLine,
   isChatTextScale: () => isChatTextScale,
+  isClaudeAiConnectorMcp: () => isClaudeAiConnectorMcp,
   isCloudCoordinatorThread: () => isCloudCoordinatorThread,
   isCompactToolName: () => isCompactToolName,
   isConductorBundledCli: () => isConductorBundledCli,
@@ -31775,6 +31786,7 @@ __export(index_exports, {
   mcpServerIdForPermission: () => mcpServerIdForPermission,
   mcpServerPermissionUpdate: () => mcpServerPermissionUpdate,
   mcpStatusThinkingFromClaudeInit: () => mcpStatusThinkingFromClaudeInit,
+  mcpUiContentSecurityPolicy: () => mcpUiContentSecurityPolicy,
   mentionsPrGoal: () => mentionsPrGoal,
   mergeAgentGitAuthEnv: () => mergeAgentGitAuthEnv,
   mergePr: () => mergePr,
@@ -38886,6 +38898,362 @@ init_injected_mcp();
 init_user_mcp_config();
 init_orch_mcp_isolation();
 
+// src/mcp-ui/host.ts
+init_orch_mcp_isolation();
+
+// src/mcp-ui/meta.ts
+var HTML_MAX = 15e5;
+function matchClaudeMcpTool(toolName, serverNames) {
+  const name = toolName.trim();
+  if (!name.startsWith("mcp__")) return null;
+  const ranked = [...serverNames].filter((s) => s.trim()).sort((a, b) => b.length - a.length);
+  for (const server of ranked) {
+    const prefix = `mcp__${server}__`;
+    if (!name.startsWith(prefix)) continue;
+    const tool = name.slice(prefix.length).trim();
+    if (!tool) continue;
+    return { server, tool };
+  }
+  return null;
+}
+function parseMcpServerLaunch(entry) {
+  const command = typeof entry.command === "string" ? entry.command.trim() : "";
+  if (command) {
+    const args = Array.isArray(entry.args) ? entry.args.filter((a) => typeof a === "string") : [];
+    const env = stringRecord(entry.env);
+    const cwd = typeof entry.cwd === "string" && entry.cwd.trim() ? entry.cwd.trim() : void 0;
+    return {
+      kind: "stdio",
+      command,
+      args,
+      ...env ? { env } : {},
+      ...cwd ? { cwd } : {}
+    };
+  }
+  const url = typeof entry.url === "string" ? entry.url.trim() : "";
+  if (!url) return null;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+  const type = typeof entry.type === "string" ? entry.type.trim().toLowerCase() : "";
+  const headers = stringRecord(entry.headers);
+  return {
+    kind: type === "sse" ? "sse" : "http",
+    url: parsed.toString(),
+    ...headers ? { headers } : {}
+  };
+}
+function uiResourceUriFromMeta(meta) {
+  const rec = asRecord15(meta);
+  const nested = asRecord15(rec.ui);
+  const fromNested = typeof nested.resourceUri === "string" ? nested.resourceUri.trim() : "";
+  const legacy = typeof rec["ui/resourceUri"] === "string" ? rec["ui/resourceUri"].trim() : "";
+  const uri = fromNested || legacy;
+  return uri.startsWith("ui://") ? uri : null;
+}
+function cspFromMeta(meta) {
+  const ui = asRecord15(asRecord15(meta).ui);
+  const csp = asRecord15(ui.csp);
+  const connectDomains = originList(csp.connectDomains);
+  const resourceDomains = originList(csp.resourceDomains);
+  const frameDomains = originList(csp.frameDomains);
+  const baseUriDomains = originList(csp.baseUriDomains);
+  if (!connectDomains?.length && !resourceDomains?.length && !frameDomains?.length && !baseUriDomains?.length) {
+    return void 0;
+  }
+  return {
+    ...connectDomains?.length ? { connectDomains } : {},
+    ...resourceDomains?.length ? { resourceDomains } : {},
+    ...frameDomains?.length ? { frameDomains } : {},
+    ...baseUriDomains?.length ? { baseUriDomains } : {}
+  };
+}
+function htmlFromResourceContent(content) {
+  const uri = content.uri?.trim() ?? "";
+  if (!uri.startsWith("ui://")) return null;
+  const mimeType = content.mimeType?.trim() || "text/html";
+  if (!isHtmlMime(mimeType)) return null;
+  const html = htmlText(content.text, content.blob);
+  if (!html) return null;
+  return { uri, mimeType, html };
+}
+function mcpUiContentSecurityPolicy(csp) {
+  const resource = (csp?.resourceDomains ?? []).join(" ");
+  const connect = (csp?.connectDomains ?? []).join(" ");
+  const frames = csp?.frameDomains?.length ? csp.frameDomains.join(" ") : "'none'";
+  const base = csp?.baseUriDomains?.length ? csp.baseUriDomains.join(" ") : "'none'";
+  return [
+    "default-src 'none'",
+    `script-src 'self' 'unsafe-inline' 'unsafe-eval' ${resource}`.trim(),
+    `style-src 'self' 'unsafe-inline' ${resource}`.trim(),
+    `img-src 'self' data: blob: ${resource}`.trim(),
+    `font-src 'self' data: ${resource}`.trim(),
+    `connect-src 'self' ${connect}`.trim(),
+    `media-src 'self' data: blob: ${resource}`.trim(),
+    `frame-src ${frames}`,
+    `base-uri ${base}`,
+    "object-src 'none'",
+    "form-action 'self'"
+  ].join("; ");
+}
+function htmlText(text7, blob) {
+  if (typeof text7 === "string" && text7.trim()) {
+    return text7.length <= HTML_MAX ? text7 : null;
+  }
+  if (typeof blob !== "string" || !blob.trim()) return null;
+  try {
+    const decoded = decodeBase64(blob.trim());
+    if (!decoded.trim() || decoded.length > HTML_MAX) return null;
+    return decoded;
+  } catch {
+    return null;
+  }
+}
+function decodeBase64(blob) {
+  if (typeof Buffer !== "undefined") return Buffer.from(blob, "base64").toString("utf8");
+  const bin = atob(blob);
+  const bytes = Uint8Array.from(bin, (c) => c.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}
+function isHtmlMime(mime) {
+  const base = mime.split(";")[0]?.trim().toLowerCase() ?? "";
+  return base === "text/html";
+}
+function originList(value) {
+  if (!Array.isArray(value)) return void 0;
+  const out = [];
+  for (const item of value) {
+    if (typeof item !== "string") continue;
+    const origin = originToken(item);
+    if (origin && !out.includes(origin)) out.push(origin);
+  }
+  return out;
+}
+function originToken(value) {
+  try {
+    const url = new URL(value.trim());
+    if (url.protocol !== "https:" && url.protocol !== "http:" && url.protocol !== "wss:" && url.protocol !== "ws:") {
+      return null;
+    }
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+function stringRecord(value) {
+  const rec = asRecord15(value);
+  const out = {};
+  for (const [key, item] of Object.entries(rec)) {
+    if (typeof item === "string") out[key] = item;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function asRecord15(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+
+// src/mcp-ui/session.ts
+var import_client3 = require("@modelcontextprotocol/sdk/client/index.js");
+var import_sse = require("@modelcontextprotocol/sdk/client/sse.js");
+var import_stdio2 = require("@modelcontextprotocol/sdk/client/stdio.js");
+var import_streamableHttp = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+var REQUEST_TIMEOUT_MS = 2e4;
+var UI_CAPABILITIES = {
+  extensions: {
+    "io.modelcontextprotocol/ui": {
+      mimeTypes: ["text/html;profile=mcp-app"]
+    }
+  }
+};
+async function openMcpUiSession(launch) {
+  return openMcpUiSessionFromTransport(transportForLaunch(launch));
+}
+async function openMcpUiSessionFromTransport(transport) {
+  const client = new import_client3.Client(
+    { name: "sideboard", version: "1.0.0" },
+    { capabilities: UI_CAPABILITIES }
+  );
+  await client.connect(transport, { timeout: REQUEST_TIMEOUT_MS });
+  return {
+    async listTools() {
+      const listed = await client.listTools(void 0, { timeout: REQUEST_TIMEOUT_MS });
+      return listed.tools.map((tool) => {
+        const meta = tool._meta;
+        return {
+          name: tool.name,
+          ...tool.description ? { description: tool.description } : {},
+          ...tool.inputSchema ? { inputSchema: tool.inputSchema } : {},
+          resourceUri: uiResourceUriFromMeta(meta),
+          ...cspFromMeta(meta) ? { csp: cspFromMeta(meta) } : {}
+        };
+      });
+    },
+    async readResource(uri) {
+      const result = await client.readResource({ uri }, { timeout: REQUEST_TIMEOUT_MS });
+      const content = result.contents?.[0];
+      if (!content) return null;
+      const text7 = "text" in content && typeof content.text === "string" ? content.text : void 0;
+      const blob = "blob" in content && typeof content.blob === "string" ? content.blob : void 0;
+      return {
+        uri: content.uri,
+        ...content.mimeType ? { mimeType: content.mimeType } : {},
+        ...text7 != null ? { text: text7 } : {},
+        ...blob != null ? { blob } : {},
+        ...cspFromMeta(content._meta) ? { csp: cspFromMeta(content._meta) } : {}
+      };
+    },
+    async callTool(name, args) {
+      return client.callTool({ name, arguments: args }, void 0, { timeout: REQUEST_TIMEOUT_MS });
+    },
+    async close() {
+      await client.close();
+    }
+  };
+}
+function transportForLaunch(launch) {
+  if (launch.kind === "stdio") {
+    return new import_stdio2.StdioClientTransport({
+      command: launch.command,
+      args: launch.args,
+      env: { ...(0, import_stdio2.getDefaultEnvironment)(), ...launch.env },
+      stderr: "ignore",
+      ...launch.cwd ? { cwd: launch.cwd } : {}
+    });
+  }
+  const url = new URL(launch.url);
+  const requestInit = launch.headers ? { headers: launch.headers } : void 0;
+  if (launch.kind === "sse") {
+    return new import_sse.SSEClientTransport(url, requestInit ? { requestInit } : void 0);
+  }
+  return new import_streamableHttp.StreamableHTTPClientTransport(url, requestInit ? { requestInit } : void 0);
+}
+
+// src/mcp-ui/host.ts
+var TOOL_TTL_MS = 5 * 60 * 1e3;
+var McpUiHost = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  opts;
+  sessions = /* @__PURE__ */ new Map();
+  toolLists = /* @__PURE__ */ new Map();
+  async viewForClaudeTool(toolName) {
+    const entries = this.userEntries();
+    const match = matchClaudeMcpTool(toolName, Object.keys(entries));
+    if (!match) return null;
+    const launch = parseMcpServerLaunch(entries[match.server] ?? {});
+    if (!launch) return null;
+    try {
+      const session = await this.sessionFor(match.server, launch);
+      const tools = await this.toolsFor(match.server, launch, session);
+      const tool = tools.find((item) => item.name === match.tool);
+      if (!tool?.resourceUri) return null;
+      const resource = await session.readResource(tool.resourceUri);
+      if (!resource) return null;
+      const html = htmlFromResourceContent(resource);
+      if (!html) return null;
+      const csp = resource.csp ?? tool.csp;
+      return {
+        server: match.server,
+        tool: match.tool,
+        uri: html.uri,
+        mimeType: html.mimeType,
+        html: html.html,
+        csp: mcpUiContentSecurityPolicy(csp)
+      };
+    } catch (err) {
+      console.error(
+        `[mcp-ui] ${match.server}/${match.tool}:`,
+        err instanceof Error ? err.message : err
+      );
+      return null;
+    }
+  }
+  async callTool(server, tool, args) {
+    const session = await this.sessionForName(server);
+    if (!session) throw new Error(`MCP server ${server} is not available`);
+    return session.callTool(tool, args);
+  }
+  async readResource(server, uri) {
+    const session = await this.sessionForName(server);
+    if (!session) throw new Error(`MCP server ${server} is not available`);
+    const resource = await session.readResource(uri);
+    if (!resource) throw new Error(`Resource ${uri} was empty`);
+    return {
+      contents: [
+        {
+          uri: resource.uri,
+          ...resource.mimeType ? { mimeType: resource.mimeType } : {},
+          ...resource.text != null ? { text: resource.text } : {},
+          ...resource.blob != null ? { blob: resource.blob } : {}
+        }
+      ]
+    };
+  }
+  async closeAll() {
+    const pending = [...this.sessions.values()];
+    this.sessions.clear();
+    this.toolLists.clear();
+    await Promise.all(
+      pending.map((session) => session.then((open) => open.close()).catch(() => void 0))
+    );
+  }
+  userEntries() {
+    const out = {};
+    for (const [name, entry] of Object.entries(this.opts.entries())) {
+      if (!name.trim() || isInjectedOrchMcpName(name) || !entry) continue;
+      out[name] = entry;
+    }
+    return out;
+  }
+  async sessionForName(server) {
+    const entry = this.userEntries()[server];
+    if (!entry) return null;
+    const launch = parseMcpServerLaunch(entry);
+    if (!launch) return null;
+    return this.sessionFor(server, launch);
+  }
+  sessionFor(server, launch) {
+    const key = `${server}
+${JSON.stringify(launch)}`;
+    const existing = this.sessions.get(key);
+    if (existing) return existing;
+    const open = this.opts.openSession ?? openMcpUiSession;
+    const pending = open(launch).catch((err) => {
+      this.sessions.delete(key);
+      throw err;
+    });
+    this.sessions.set(key, pending);
+    return pending;
+  }
+  async toolsFor(server, launch, session) {
+    const key = `${server}
+${JSON.stringify(launch)}`;
+    const cached2 = this.toolLists.get(key);
+    if (cached2 && cached2.key === key && Date.now() - cached2.at < TOOL_TTL_MS) return cached2.tools;
+    const tools = await session.listTools();
+    this.toolLists.set(key, { at: Date.now(), key, tools });
+    return tools;
+  }
+};
+var singleton2;
+function getMcpUiHost() {
+  if (!singleton2) {
+    singleton2 = new McpUiHost({ entries: () => listUserClaudeMcpServerEntries() });
+  }
+  return singleton2;
+}
+function closeMcpUiHost() {
+  const host = singleton2;
+  singleton2 = void 0;
+  if (host) void host.closeAll();
+}
+
 // src/slack/workspaces.ts
 var import_node_path69 = require("path");
 init_paths();
@@ -40972,132 +41340,21 @@ var import_ws5 = require("ws");
 init_orchestrator_capable();
 init_stage_files();
 init_orchestrator();
-init_app_settings();
-init_implied_first_prompt();
-init_message_parts();
-init_turn_live();
 
-// src/remote/phone-media.ts
-var import_node_fs71 = require("fs");
-var import_node_path71 = require("path");
-init_diff();
-var PHONE_IMAGE_MAX_BYTES = 15e5;
-var PHONE_TEXT_MAX_BYTES = 18e4;
-var PHONE_DIR_MAX = 200;
-var IMAGE_MIME = {
-  png: "image/png",
-  jpg: "image/jpeg",
-  jpeg: "image/jpeg",
-  gif: "image/gif",
-  webp: "image/webp",
-  bmp: "image/bmp"
-};
-function phoneWorktreeRelative(worktreePath, raw) {
-  let text7 = raw.trim();
-  if (!text7) return null;
-  if (/^file:\/\//i.test(text7)) {
-    try {
-      text7 = decodeURIComponent(new URL(text7).pathname);
-    } catch {
-      return null;
-    }
-  }
-  text7 = (text7.split("#")[0] ?? text7).replace(/\\/g, "/");
-  if (!text7 || text7.includes("\0") || text7.split("/").includes("..")) return null;
-  const root = worktreePath.replace(/\/+$/, "");
-  if (!root || root === "/") return null;
-  if (text7.startsWith("/")) {
-    if (text7 !== root && !text7.startsWith(`${root}/`)) return null;
-    text7 = text7 === root ? "" : text7.slice(root.length + 1);
-  }
-  text7 = text7.replace(/^\.\//, "").replace(/\/+$/, "");
-  if (!text7 || text7 === "." || text7.startsWith("/")) return null;
-  return text7;
-}
-function phoneImageMime(relativePath) {
-  const ext = relativePath.split(".").pop()?.toLowerCase() ?? "";
-  return IMAGE_MIME[ext] ?? null;
-}
-function phoneImageDataUrl(worktreePath, raw) {
-  const relative = phoneWorktreeRelative(worktreePath, raw);
-  if (!relative) return null;
-  const mime = phoneImageMime(relative);
-  if (!mime) return null;
-  try {
-    const file = readWorktreeFileForUpload(worktreePath, relative, { maxBytes: PHONE_IMAGE_MAX_BYTES });
-    return `data:${mime};base64,${file.contentBase64}`;
-  } catch {
-    return null;
-  }
-}
-function phoneDirectoryListing(worktreePath, relative) {
-  try {
-    const entries = (0, import_node_fs71.readdirSync)((0, import_node_path71.join)(worktreePath, relative), { withFileTypes: true });
-    const dirs = new Set(entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name));
-    const names = entries.map((entry) => entry.name).filter((name) => name && !name.includes("/") && !name.includes("\0")).sort((a, b) => a.localeCompare(b));
-    const shown = names.slice(0, PHONE_DIR_MAX);
-    const lines = shown.map((name) => dirs.has(name) ? `${name}/` : name);
-    const truncated = names.length > shown.length;
-    if (truncated) lines.push(`\u2026 ${names.length - shown.length} more`);
-    return { content: lines.join("\n"), truncated };
-  } catch {
-    return null;
-  }
-}
-function phoneFilePreview(worktreePath, relative, kind) {
-  if (kind === "dir") {
-    const listing = phoneDirectoryListing(worktreePath, relative);
-    if (!listing) return null;
-    return {
-      content: listing.content,
-      encoding: "utf8",
-      binary: false,
-      directory: true,
-      truncated: listing.truncated
-    };
-  }
-  if (relative.toLowerCase().endsWith(".svg")) {
-    try {
-      const buf = (0, import_node_fs71.readFileSync)((0, import_node_path71.join)(worktreePath, relative));
-      const truncated = buf.length > PHONE_TEXT_MAX_BYTES;
-      return {
-        content: buf.subarray(0, PHONE_TEXT_MAX_BYTES).toString("utf8"),
-        encoding: "utf8",
-        binary: false,
-        directory: false,
-        truncated,
-        mime: "image/svg+xml"
-      };
-    } catch {
-      return null;
-    }
-  }
-  const mime = phoneImageMime(relative);
-  if (mime) {
-    const dataUrl = phoneImageDataUrl(worktreePath, relative);
-    if (!dataUrl) return null;
-    return {
-      content: dataUrl,
-      encoding: "base64",
-      binary: true,
-      directory: false,
-      truncated: false,
-      mime
-    };
-  }
-  try {
-    const file = readWorktreeFile(worktreePath, relative, { maxBytes: PHONE_TEXT_MAX_BYTES });
-    return {
-      content: file.content,
-      encoding: file.encoding,
-      binary: file.binary,
-      directory: false,
-      truncated: file.truncated
-    };
-  } catch {
-    return null;
-  }
-}
+// src/remote/phone-chats.ts
+var import_node_crypto27 = require("crypto");
+init_list_models();
+init_home_board();
+init_stage_files();
+init_worktree_labels();
+init_thinking_effort();
+init_app_settings();
+init_global_workspace();
+init_thread_store();
+init_workspaces();
+init_chat_tabs();
+init_create();
+init_orchestrator();
 
 // src/remote/phone-artifact.ts
 var FENCE_RE = /```([a-zA-Z0-9_+-]*)[^\n]*\n([\s\S]*?)(?:```|$)/g;
@@ -41107,10 +41364,10 @@ var MIN_MD_CHARS = 120;
 function oneLine2(value, max) {
   return value.replace(/[`\r\n]/g, " ").replace(/\s+/g, " ").trim().slice(0, max);
 }
-function asRecord15(value) {
+function asRecord16(value) {
   if (typeof value === "string") {
     try {
-      return asRecord15(JSON.parse(value));
+      return asRecord16(JSON.parse(value));
     } catch {
       return void 0;
     }
@@ -41185,7 +41442,7 @@ function toolContent(input) {
   if (!input) return "";
   const direct = input.content;
   if (typeof direct === "string") return direct;
-  const nested = asRecord15(direct);
+  const nested = asRecord16(direct);
   if (!nested) return "";
   for (const key of ["html", "markup", "text", "source", "content", "code"]) {
     if (typeof nested[key] === "string") return nested[key];
@@ -41208,7 +41465,7 @@ function phoneArtifactText(text7, parts, limit = Number.POSITIVE_INFINITY) {
   const extras = [];
   for (const part of parts ?? []) {
     if (part.type !== "tool" || part.parentId || !isArtifactTool(part.name)) continue;
-    const input = asRecord15(part.input);
+    const input = asRecord16(part.input);
     const content = toolContent(input);
     const hint = artifactHint(content);
     if (hint && hints.has(hint)) continue;
@@ -41227,7 +41484,7 @@ function phoneArtifactText(text7, parts, limit = Number.POSITIVE_INFINITY) {
 ${tail}` : tail;
 }
 function parseOpenArtifact(value, chatId) {
-  const record = asRecord15(value);
+  const record = asRecord16(value);
   if (!record) return "invalid";
   const title = oneLine2(str7(record.title), 200);
   if (!title) return "invalid";
@@ -41250,7 +41507,7 @@ function phoneArtifactDocuments(sources) {
     }
     for (const part of source.parts ?? []) {
       if (part.type !== "tool" || part.parentId || !isArtifactTool(part.name)) continue;
-      const input = asRecord15(part.input);
+      const input = asRecord16(part.input);
       const content = toolContent(input);
       const hint = artifactHint(content);
       if (hint && hints.has(hint)) continue;
@@ -41300,137 +41557,6 @@ function pickArtifactMatch(items, request) {
   return null;
 }
 
-// src/remote/phone-panes.ts
-init_orchestrator();
-var PHONE_CHANGE_SCOPES = ["last_turn", "uncommitted", "staged", "unstaged", "commits"];
-var PHONE_CHANGE_SCOPE_DEFAULT = "commits";
-function phoneChangeScope(value) {
-  return typeof value === "string" && PHONE_CHANGE_SCOPES.includes(value) ? value : void 0;
-}
-function phoneCommitSha(value) {
-  return typeof value === "string" && /^[0-9a-f]{4,40}$/i.test(value) ? value : void 0;
-}
-var MAX_ROWS = 200;
-var MAX_QUERY = 200;
-function parsePhonePane(value, chatId) {
-  const pane = value && typeof value === "object" ? value.pane : void 0;
-  if (pane !== "files" && pane !== "changes" && pane !== "checks") return "invalid";
-  const scope = phoneChangeScope(value.scope);
-  const commitSha = phoneCommitSha(value.commitSha);
-  const queryRaw = value.query;
-  const query = typeof queryRaw === "string" ? queryRaw.trim().slice(0, MAX_QUERY) : "";
-  return {
-    op: "pane",
-    chatId,
-    pane,
-    ...scope && pane === "changes" ? { scope } : {},
-    ...commitSha && pane === "changes" && scope === "commits" ? { commitSha } : {},
-    ...query && pane === "files" ? { query } : {}
-  };
-}
-function filterPhoneFiles(paths, query) {
-  const q = query.trim().toLowerCase();
-  if (!q) return paths;
-  return paths.filter((path2) => path2.toLowerCase().includes(q));
-}
-async function readPhonePane(thread, pane, scope, query, commitSha) {
-  try {
-    if (pane === "files") return await readFiles(thread.id, query);
-    if (pane === "changes") return await readChanges(thread.id, scope ?? PHONE_CHANGE_SCOPE_DEFAULT, commitSha);
-    return await readChecks(thread.id);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { rows: [], note: message };
-  }
-}
-async function readFiles(threadId, query) {
-  const paths = filterPhoneFiles(await getOrchestrator().listFiles(threadId), query ?? "");
-  const shown = paths.slice(0, MAX_ROWS);
-  const extra = paths.length - shown.length;
-  const note = extra > 0 ? query?.trim() ? `${extra} more matching files` : `${extra} more files on the Mac` : void 0;
-  return {
-    rows: shown.map((path2) => ({ label: path2, path: path2 })),
-    ...note ? { note } : {}
-  };
-}
-async function readChanges(threadId, scope, commitSha) {
-  const diff = await getOrchestrator().diff(threadId, {
-    includePatches: false,
-    scope,
-    commitSha: scope === "commits" ? commitSha ?? null : null
-  });
-  const shown = diff.files.slice(0, MAX_ROWS);
-  const selected = diff.commits.find((commit) => commit.sha === commitSha || commit.shortSha === commitSha);
-  return {
-    rows: shown.map((file) => {
-      const detail = changeDetail(file.additions, file.deletions);
-      return {
-        label: file.path,
-        path: file.path,
-        ...file.status ? { status: file.status } : {},
-        ...detail ? { detail } : {}
-      };
-    }),
-    ...diff.files.length > shown.length ? { note: `${diff.files.length - shown.length} more changed files` } : {},
-    scope: diff.scope,
-    commitSha: selected?.sha ?? null,
-    ...diff.base ? { base: diff.base } : {},
-    hasLastTurnBase: diff.hasLastTurnBase,
-    commits: diff.commits.slice(0, 40),
-    scopeStats: diff.scopeStats
-  };
-}
-function changeDetail(additions, deletions) {
-  const add = additions ?? 0;
-  const del = deletions ?? 0;
-  if (add === 0 && del === 0) return void 0;
-  return `+${add} \u2212${del}`;
-}
-async function readPhoneChangePatch(threadId, path2, scope = PHONE_CHANGE_SCOPE_DEFAULT, commitSha) {
-  const diff = await getOrchestrator().diff(threadId, {
-    path: path2,
-    scope,
-    commitSha: scope === "commits" ? commitSha ?? null : null,
-    includePatches: true,
-    includeMeta: false,
-    includeUntracked: scope === "uncommitted" || scope === "unstaged" || scope === "last_turn" || scope === "commits" && !commitSha
-  });
-  const file = diff.files.find((row2) => row2.path === path2) ?? diff.files[0];
-  if (!file) return null;
-  const content = file.patch ?? "";
-  return { content, truncated: content.includes("\u2026 truncated") };
-}
-async function readChecks(threadId) {
-  const checks = await getOrchestrator().getPrChecks(threadId);
-  if (!checks) return { rows: [], note: "No pull request on this branch." };
-  const shown = checks.slice(0, MAX_ROWS);
-  return {
-    rows: shown.map((check) => ({
-      label: check.name,
-      detail: check.bucket || check.state,
-      ...check.link ? { href: check.link } : {}
-    }))
-  };
-}
-
-// src/remote/phone-workspace-ops.ts
-init_orchestrator();
-
-// src/remote/phone-chats.ts
-var import_node_crypto27 = require("crypto");
-init_list_models();
-init_home_board();
-init_stage_files();
-init_worktree_labels();
-init_thinking_effort();
-init_app_settings();
-init_global_workspace();
-init_thread_store();
-init_workspaces();
-init_chat_tabs();
-init_create();
-init_orchestrator();
-
 // src/remote/phone-header.ts
 init_orchestrator();
 init_global_workspace();
@@ -41594,6 +41720,119 @@ function parsePhoneCodeRefs(value) {
   return refs;
 }
 
+// src/remote/phone-panes.ts
+init_orchestrator();
+var PHONE_CHANGE_SCOPES = ["last_turn", "uncommitted", "staged", "unstaged", "commits"];
+var PHONE_CHANGE_SCOPE_DEFAULT = "commits";
+function phoneChangeScope(value) {
+  return typeof value === "string" && PHONE_CHANGE_SCOPES.includes(value) ? value : void 0;
+}
+function phoneCommitSha(value) {
+  return typeof value === "string" && /^[0-9a-f]{4,40}$/i.test(value) ? value : void 0;
+}
+var MAX_ROWS = 200;
+var MAX_QUERY = 200;
+function parsePhonePane(value, chatId) {
+  const pane = value && typeof value === "object" ? value.pane : void 0;
+  if (pane !== "files" && pane !== "changes" && pane !== "checks") return "invalid";
+  const scope = phoneChangeScope(value.scope);
+  const commitSha = phoneCommitSha(value.commitSha);
+  const queryRaw = value.query;
+  const query = typeof queryRaw === "string" ? queryRaw.trim().slice(0, MAX_QUERY) : "";
+  return {
+    op: "pane",
+    chatId,
+    pane,
+    ...scope && pane === "changes" ? { scope } : {},
+    ...commitSha && pane === "changes" && scope === "commits" ? { commitSha } : {},
+    ...query && pane === "files" ? { query } : {}
+  };
+}
+function filterPhoneFiles(paths, query) {
+  const q = query.trim().toLowerCase();
+  if (!q) return paths;
+  return paths.filter((path2) => path2.toLowerCase().includes(q));
+}
+async function readPhonePane(thread, pane, scope, query, commitSha) {
+  try {
+    if (pane === "files") return await readFiles(thread.id, query);
+    if (pane === "changes") return await readChanges(thread.id, scope ?? PHONE_CHANGE_SCOPE_DEFAULT, commitSha);
+    return await readChecks(thread.id);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { rows: [], note: message };
+  }
+}
+async function readFiles(threadId, query) {
+  const paths = filterPhoneFiles(await getOrchestrator().listFiles(threadId), query ?? "");
+  const shown = paths.slice(0, MAX_ROWS);
+  const extra = paths.length - shown.length;
+  const note = extra > 0 ? query?.trim() ? `${extra} more matching files` : `${extra} more files on the Mac` : void 0;
+  return {
+    rows: shown.map((path2) => ({ label: path2, path: path2 })),
+    ...note ? { note } : {}
+  };
+}
+async function readChanges(threadId, scope, commitSha) {
+  const diff = await getOrchestrator().diff(threadId, {
+    includePatches: false,
+    scope,
+    commitSha: scope === "commits" ? commitSha ?? null : null
+  });
+  const shown = diff.files.slice(0, MAX_ROWS);
+  const selected = diff.commits.find((commit) => commit.sha === commitSha || commit.shortSha === commitSha);
+  return {
+    rows: shown.map((file) => {
+      const detail = changeDetail(file.additions, file.deletions);
+      return {
+        label: file.path,
+        path: file.path,
+        ...file.status ? { status: file.status } : {},
+        ...detail ? { detail } : {}
+      };
+    }),
+    ...diff.files.length > shown.length ? { note: `${diff.files.length - shown.length} more changed files` } : {},
+    scope: diff.scope,
+    commitSha: selected?.sha ?? null,
+    ...diff.base ? { base: diff.base } : {},
+    hasLastTurnBase: diff.hasLastTurnBase,
+    commits: diff.commits.slice(0, 40),
+    scopeStats: diff.scopeStats
+  };
+}
+function changeDetail(additions, deletions) {
+  const add = additions ?? 0;
+  const del = deletions ?? 0;
+  if (add === 0 && del === 0) return void 0;
+  return `+${add} \u2212${del}`;
+}
+async function readPhoneChangePatch(threadId, path2, scope = PHONE_CHANGE_SCOPE_DEFAULT, commitSha) {
+  const diff = await getOrchestrator().diff(threadId, {
+    path: path2,
+    scope,
+    commitSha: scope === "commits" ? commitSha ?? null : null,
+    includePatches: true,
+    includeMeta: false,
+    includeUntracked: scope === "uncommitted" || scope === "unstaged" || scope === "last_turn" || scope === "commits" && !commitSha
+  });
+  const file = diff.files.find((row2) => row2.path === path2) ?? diff.files[0];
+  if (!file) return null;
+  const content = file.patch ?? "";
+  return { content, truncated: content.includes("\u2026 truncated") };
+}
+async function readChecks(threadId) {
+  const checks = await getOrchestrator().getPrChecks(threadId);
+  if (!checks) return { rows: [], note: "No pull request on this branch." };
+  const shown = checks.slice(0, MAX_ROWS);
+  return {
+    rows: shown.map((check) => ({
+      label: check.name,
+      detail: check.bucket || check.state,
+      ...check.link ? { href: check.link } : {}
+    }))
+  };
+}
+
 // src/remote/phone-defaults.ts
 init_app_settings();
 function row(resolved) {
@@ -41638,6 +41877,63 @@ function refreshPhoneViewerLogin(force = false) {
 init_wait_for_job();
 init_turn_live();
 
+// src/remote/phone-mcp-ui.ts
+var MAX_APPS = 4;
+function phoneMcpApps(agent, parts) {
+  if (agent !== "claude" || !parts?.length) return [];
+  const out = [];
+  for (const part of parts) {
+    if (part.type !== "tool" || part.parentId || part.status === "running") continue;
+    if (!part.name.startsWith("mcp__") || part.name.startsWith("mcp__sideboard")) continue;
+    out.push({ id: part.id, tool: part.name });
+    if (out.length >= MAX_APPS) break;
+  }
+  return out;
+}
+function controlText(value, key) {
+  const raw = value[key];
+  return typeof raw === "string" ? raw.trim() : "";
+}
+function parsePhoneMcpUi(value, op, chatId) {
+  if (op === "mcp-ui") {
+    const tool2 = controlText(value, "tool");
+    const callId = controlText(value, "callId");
+    const reqId2 = controlText(value, "reqId");
+    if (!tool2.startsWith("mcp__") || tool2.length > 200 || !callId || !reqId2 || reqId2.length > 40) {
+      return "invalid";
+    }
+    return { op: "mcp-ui", chatId, tool: tool2, callId, reqId: reqId2 };
+  }
+  if (op !== "mcp-ui-call" && op !== "mcp-ui-read") return "invalid";
+  const reqId = controlText(value, "reqId");
+  const server = controlText(value, "server");
+  if (!reqId || reqId.length > 40 || !server || server.length > 120) return "invalid";
+  if (op === "mcp-ui-read") {
+    const uri = controlText(value, "uri");
+    if (!uri.startsWith("ui://") || uri.length > 500) return "invalid";
+    return { op, chatId, reqId, server, uri };
+  }
+  const tool = controlText(value, "tool");
+  const args = value.args;
+  if (!tool || tool.length > 200 || !args || typeof args !== "object" || Array.isArray(args)) {
+    return "invalid";
+  }
+  return { op, chatId, reqId, server, tool, args };
+}
+function phoneMcpToolPayload(parts, tool, callId) {
+  if (!parts) return null;
+  const matches = parts.filter(
+    (part2) => part2.type === "tool" && part2.name === tool && !part2.parentId
+  );
+  const part = matches.find((row2) => row2.id === callId) ?? matches[matches.length - 1];
+  if (!part) return null;
+  return {
+    input: part.input ?? {},
+    resultText: part.result ?? "",
+    isError: part.status === "error"
+  };
+}
+
 // src/remote/phone-stream.ts
 init_message_parts();
 var PHONE_STREAM_FLUSH_MS = 80;
@@ -41697,7 +41993,8 @@ function listPhoneMessages(thread) {
     const visible = [phoneVisibleText(message.role, message.text), names.length ? names.join(", ") : ""].filter(Boolean).join("\n");
     const text7 = message.role === "agent" ? phoneArtifactText(visible, message.parts, MESSAGE_LIMIT) : clip(visible, MESSAGE_LIMIT);
     if (!text7) continue;
-    out.push({ role: message.role, text: text7 });
+    const apps = message.role === "agent" ? phoneMcpApps(thread.agent, message.parts) : [];
+    out.push({ role: message.role, text: text7, ...apps.length ? { apps } : {} });
   }
   const live = withLiveTail(thread, out);
   for (const prompt of thread.queue) {
@@ -41827,6 +42124,7 @@ function parsePhoneControl(value) {
   }
   if (op === "pane") return parsePhonePane(value, chatId);
   if (op === "open-artifact") return parseOpenArtifact(value, chatId);
+  if (op === "mcp-ui" || op === "mcp-ui-call" || op === "mcp-ui-read") return parsePhoneMcpUi(value, op, chatId);
   if (op === "open-file" || op === "media") {
     const path2 = textField2(value, "path");
     if (!path2 || path2.length > 2e3) return "invalid";
@@ -42242,109 +42540,6 @@ function archivePhoneChat(chatId) {
   return true;
 }
 
-// src/remote/phone-workspace-ops.ts
-function dispatchPhoneWorkspace(cmd, emit, publishOpened) {
-  if (cmd.op === "pane") {
-    const thread = readPhoneThread(cmd.chatId);
-    if (!thread) {
-      emit({ op: "error", chatId: cmd.chatId, message: "That agent is not on this Mac." });
-      return;
-    }
-    void readPhonePane(thread, cmd.pane, cmd.scope, cmd.query, cmd.commitSha).then((body) => {
-      emit({
-        op: "pane",
-        chatId: cmd.chatId,
-        pane: cmd.pane,
-        rows: body.rows,
-        ...body.note ? { note: body.note } : {},
-        ...cmd.pane === "files" ? { query: cmd.query ?? "" } : {},
-        ...cmd.pane === "changes" ? {
-          scope: body.scope,
-          commitSha: body.commitSha ?? null,
-          ...body.base ? { base: body.base } : {},
-          hasLastTurnBase: body.hasLastTurnBase,
-          commits: body.commits ?? [],
-          ...body.scopeStats ? { scopeStats: body.scopeStats } : {}
-        } : {}
-      });
-    });
-    return;
-  }
-  if (cmd.op === "header") {
-    const thread = readPhoneThread(cmd.chatId);
-    if (!thread) {
-      emit({ op: "error", chatId: cmd.chatId, message: "That agent is not on this Mac." });
-      return;
-    }
-    void readPhoneHeader(thread).then((header) => {
-      emit({ op: "header", chatId: cmd.chatId, ...header });
-    });
-    return;
-  }
-  if (cmd.op === "git") {
-    void getOrchestrator().askGit(cmd.chatId, cmd.action).then((tab) => publishOpened(tab.id)).catch((err) => {
-      emit({
-        op: "error",
-        chatId: cmd.chatId,
-        message: err instanceof Error ? err.message : String(err)
-      });
-    });
-    return;
-  }
-  void getOrchestrator().requestReview(cmd.chatId).then((tab) => publishOpened(tab.id)).catch((err) => {
-    emit({
-      op: "error",
-      chatId: cmd.chatId,
-      message: err instanceof Error ? err.message : String(err)
-    });
-  });
-}
-
-// src/remote/phone-sources.ts
-init_worktree();
-function sourceWarning(label, err) {
-  const message = err instanceof Error ? err.message : String(err);
-  return message ? `${label}: ${message}` : `${label} failed.`;
-}
-async function listPhoneSources(repoPath, query) {
-  const path2 = assertKnownProject(repoPath);
-  const q = query?.trim() ?? "";
-  const warnings = [];
-  const [prs, branches, issues] = await Promise.all([
-    listPrs(path2, { state: "open", limit: 40, ...q ? { query: q } : {} }).catch((err) => {
-      warnings.push(sourceWarning("Pull requests", err));
-      return [];
-    }),
-    listBranches(path2).catch((err) => {
-      warnings.push(sourceWarning("Branches", err));
-      return [];
-    }),
-    listIssues(path2, { limit: 40, ...q ? { query: q } : {} }).catch((err) => {
-      warnings.push(sourceWarning("Issues", err));
-      return { issues: [] };
-    })
-  ]);
-  const needle = q.toLowerCase();
-  const branchRows = branches.filter((branch) => !needle || branch.name.toLowerCase().includes(needle)).slice(0, 50).map((branch) => ({
-    ref: branch.name,
-    title: branch.current ? `${branch.name} (current)` : branch.name
-  }));
-  return {
-    prs: prs.slice(0, 40).map((pr) => ({
-      ref: String(pr.number),
-      title: clip(pr.title || `PR #${pr.number}`, 140),
-      ...pr.url ? { url: pr.url } : {}
-    })),
-    branches: branchRows,
-    issues: (issues.issues ?? []).slice(0, 40).map((issue) => ({
-      ref: issue.identifier,
-      title: clip(issue.title || issue.identifier, 140),
-      ...issue.url ? { url: issue.url } : {}
-    })),
-    ...warnings.length ? { warnings } : {}
-  };
-}
-
 // src/remote/phone-live.ts
 init_orchestrator();
 init_ask_user();
@@ -42475,10 +42670,12 @@ function emitChatTurn(opts, chatId, threadId) {
     failed: (detail) => detail ? `Sideboard failed: ${detail}` : "Sideboard failed before producing a result."
   });
   const agent = [...thread.messages].reverse().find((m) => m.role === "agent");
+  const apps = phoneMcpApps(thread.agent, agent?.parts);
   emitControl(opts, {
     op: "assistant",
     chatId,
-    text: phoneArtifactText(reply.trim(), agent?.parts)
+    text: phoneArtifactText(reply.trim(), agent?.parts),
+    ...apps.length ? { apps } : {}
   });
 }
 function phoneError(err) {
@@ -42511,6 +42708,288 @@ function deliverPhoneTurn(opts, chatId) {
   });
 }
 
+// src/remote/phone-mcp-ui-listen.ts
+var PHONE_HTML_CAP = 7e5;
+function dispatchPhoneMcpUi(cmd, opts) {
+  if (cmd.op !== "mcp-ui" && cmd.op !== "mcp-ui-call" && cmd.op !== "mcp-ui-read") return false;
+  const thread = readPhoneThread(cmd.chatId);
+  const reqId = cmd.reqId;
+  const chatId = cmd.chatId;
+  if (!thread || thread.agent !== "claude") {
+    if (cmd.op === "mcp-ui") emitControl(opts, { op: "mcp-ui", chatId, reqId, view: null });
+    else emitControl(opts, { op: cmd.op, chatId, reqId, error: "This chat is not using Claude." });
+    return true;
+  }
+  if (cmd.op === "mcp-ui-call") {
+    void getMcpUiHost().callTool(cmd.server, cmd.tool, cmd.args).then((result) => emitControl(opts, { op: "mcp-ui-call", chatId, reqId, result })).catch(
+      (err) => emitControl(opts, { op: "mcp-ui-call", chatId, reqId, error: phoneError(err) })
+    );
+    return true;
+  }
+  if (cmd.op === "mcp-ui-read") {
+    void getMcpUiHost().readResource(cmd.server, cmd.uri).then((result) => emitControl(opts, { op: "mcp-ui-read", chatId, reqId, result })).catch(
+      (err) => emitControl(opts, { op: "mcp-ui-read", chatId, reqId, error: phoneError(err) })
+    );
+    return true;
+  }
+  const agentMessage = [...thread.messages].reverse().find((message) => message.role === "agent");
+  const payload = phoneMcpToolPayload(agentMessage?.parts, cmd.tool, cmd.callId);
+  void getMcpUiHost().viewForClaudeTool(cmd.tool).then((view) => {
+    if (!view || view.html.length > PHONE_HTML_CAP) {
+      emitControl(opts, { op: "mcp-ui", chatId, reqId, view: null });
+      return;
+    }
+    emitControl(opts, {
+      op: "mcp-ui",
+      chatId,
+      reqId,
+      view: {
+        server: view.server,
+        tool: view.tool,
+        html: view.html,
+        csp: view.csp,
+        uri: view.uri,
+        input: payload?.input ?? {},
+        resultText: payload?.resultText ?? "",
+        isError: payload?.isError ?? false
+      }
+    });
+  }).catch((err) => emitControl(opts, { op: "error", chatId, message: phoneError(err) }));
+  return true;
+}
+
+// src/remote/listen.ts
+init_app_settings();
+init_implied_first_prompt();
+init_message_parts();
+init_turn_live();
+
+// src/remote/phone-media.ts
+var import_node_fs71 = require("fs");
+var import_node_path71 = require("path");
+init_diff();
+var PHONE_IMAGE_MAX_BYTES = 15e5;
+var PHONE_TEXT_MAX_BYTES = 18e4;
+var PHONE_DIR_MAX = 200;
+var IMAGE_MIME = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  bmp: "image/bmp"
+};
+function phoneWorktreeRelative(worktreePath, raw) {
+  let text7 = raw.trim();
+  if (!text7) return null;
+  if (/^file:\/\//i.test(text7)) {
+    try {
+      text7 = decodeURIComponent(new URL(text7).pathname);
+    } catch {
+      return null;
+    }
+  }
+  text7 = (text7.split("#")[0] ?? text7).replace(/\\/g, "/");
+  if (!text7 || text7.includes("\0") || text7.split("/").includes("..")) return null;
+  const root = worktreePath.replace(/\/+$/, "");
+  if (!root || root === "/") return null;
+  if (text7.startsWith("/")) {
+    if (text7 !== root && !text7.startsWith(`${root}/`)) return null;
+    text7 = text7 === root ? "" : text7.slice(root.length + 1);
+  }
+  text7 = text7.replace(/^\.\//, "").replace(/\/+$/, "");
+  if (!text7 || text7 === "." || text7.startsWith("/")) return null;
+  return text7;
+}
+function phoneImageMime(relativePath) {
+  const ext = relativePath.split(".").pop()?.toLowerCase() ?? "";
+  return IMAGE_MIME[ext] ?? null;
+}
+function phoneImageDataUrl(worktreePath, raw) {
+  const relative = phoneWorktreeRelative(worktreePath, raw);
+  if (!relative) return null;
+  const mime = phoneImageMime(relative);
+  if (!mime) return null;
+  try {
+    const file = readWorktreeFileForUpload(worktreePath, relative, { maxBytes: PHONE_IMAGE_MAX_BYTES });
+    return `data:${mime};base64,${file.contentBase64}`;
+  } catch {
+    return null;
+  }
+}
+function phoneDirectoryListing(worktreePath, relative) {
+  try {
+    const entries = (0, import_node_fs71.readdirSync)((0, import_node_path71.join)(worktreePath, relative), { withFileTypes: true });
+    const dirs = new Set(entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name));
+    const names = entries.map((entry) => entry.name).filter((name) => name && !name.includes("/") && !name.includes("\0")).sort((a, b) => a.localeCompare(b));
+    const shown = names.slice(0, PHONE_DIR_MAX);
+    const lines = shown.map((name) => dirs.has(name) ? `${name}/` : name);
+    const truncated = names.length > shown.length;
+    if (truncated) lines.push(`\u2026 ${names.length - shown.length} more`);
+    return { content: lines.join("\n"), truncated };
+  } catch {
+    return null;
+  }
+}
+function phoneFilePreview(worktreePath, relative, kind) {
+  if (kind === "dir") {
+    const listing = phoneDirectoryListing(worktreePath, relative);
+    if (!listing) return null;
+    return {
+      content: listing.content,
+      encoding: "utf8",
+      binary: false,
+      directory: true,
+      truncated: listing.truncated
+    };
+  }
+  if (relative.toLowerCase().endsWith(".svg")) {
+    try {
+      const buf = (0, import_node_fs71.readFileSync)((0, import_node_path71.join)(worktreePath, relative));
+      const truncated = buf.length > PHONE_TEXT_MAX_BYTES;
+      return {
+        content: buf.subarray(0, PHONE_TEXT_MAX_BYTES).toString("utf8"),
+        encoding: "utf8",
+        binary: false,
+        directory: false,
+        truncated,
+        mime: "image/svg+xml"
+      };
+    } catch {
+      return null;
+    }
+  }
+  const mime = phoneImageMime(relative);
+  if (mime) {
+    const dataUrl = phoneImageDataUrl(worktreePath, relative);
+    if (!dataUrl) return null;
+    return {
+      content: dataUrl,
+      encoding: "base64",
+      binary: true,
+      directory: false,
+      truncated: false,
+      mime
+    };
+  }
+  try {
+    const file = readWorktreeFile(worktreePath, relative, { maxBytes: PHONE_TEXT_MAX_BYTES });
+    return {
+      content: file.content,
+      encoding: file.encoding,
+      binary: file.binary,
+      directory: false,
+      truncated: file.truncated
+    };
+  } catch {
+    return null;
+  }
+}
+
+// src/remote/phone-workspace-ops.ts
+init_orchestrator();
+function dispatchPhoneWorkspace(cmd, emit, publishOpened) {
+  if (cmd.op === "pane") {
+    const thread = readPhoneThread(cmd.chatId);
+    if (!thread) {
+      emit({ op: "error", chatId: cmd.chatId, message: "That agent is not on this Mac." });
+      return;
+    }
+    void readPhonePane(thread, cmd.pane, cmd.scope, cmd.query, cmd.commitSha).then((body) => {
+      emit({
+        op: "pane",
+        chatId: cmd.chatId,
+        pane: cmd.pane,
+        rows: body.rows,
+        ...body.note ? { note: body.note } : {},
+        ...cmd.pane === "files" ? { query: cmd.query ?? "" } : {},
+        ...cmd.pane === "changes" ? {
+          scope: body.scope,
+          commitSha: body.commitSha ?? null,
+          ...body.base ? { base: body.base } : {},
+          hasLastTurnBase: body.hasLastTurnBase,
+          commits: body.commits ?? [],
+          ...body.scopeStats ? { scopeStats: body.scopeStats } : {}
+        } : {}
+      });
+    });
+    return;
+  }
+  if (cmd.op === "header") {
+    const thread = readPhoneThread(cmd.chatId);
+    if (!thread) {
+      emit({ op: "error", chatId: cmd.chatId, message: "That agent is not on this Mac." });
+      return;
+    }
+    void readPhoneHeader(thread).then((header) => {
+      emit({ op: "header", chatId: cmd.chatId, ...header });
+    });
+    return;
+  }
+  if (cmd.op === "git") {
+    void getOrchestrator().askGit(cmd.chatId, cmd.action).then((tab) => publishOpened(tab.id)).catch((err) => {
+      emit({
+        op: "error",
+        chatId: cmd.chatId,
+        message: err instanceof Error ? err.message : String(err)
+      });
+    });
+    return;
+  }
+  void getOrchestrator().requestReview(cmd.chatId).then((tab) => publishOpened(tab.id)).catch((err) => {
+    emit({
+      op: "error",
+      chatId: cmd.chatId,
+      message: err instanceof Error ? err.message : String(err)
+    });
+  });
+}
+
+// src/remote/phone-sources.ts
+init_worktree();
+function sourceWarning(label, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return message ? `${label}: ${message}` : `${label} failed.`;
+}
+async function listPhoneSources(repoPath, query) {
+  const path2 = assertKnownProject(repoPath);
+  const q = query?.trim() ?? "";
+  const warnings = [];
+  const [prs, branches, issues] = await Promise.all([
+    listPrs(path2, { state: "open", limit: 40, ...q ? { query: q } : {} }).catch((err) => {
+      warnings.push(sourceWarning("Pull requests", err));
+      return [];
+    }),
+    listBranches(path2).catch((err) => {
+      warnings.push(sourceWarning("Branches", err));
+      return [];
+    }),
+    listIssues(path2, { limit: 40, ...q ? { query: q } : {} }).catch((err) => {
+      warnings.push(sourceWarning("Issues", err));
+      return { issues: [] };
+    })
+  ]);
+  const needle = q.toLowerCase();
+  const branchRows = branches.filter((branch) => !needle || branch.name.toLowerCase().includes(needle)).slice(0, 50).map((branch) => ({
+    ref: branch.name,
+    title: branch.current ? `${branch.name} (current)` : branch.name
+  }));
+  return {
+    prs: prs.slice(0, 40).map((pr) => ({
+      ref: String(pr.number),
+      title: clip(pr.title || `PR #${pr.number}`, 140),
+      ...pr.url ? { url: pr.url } : {}
+    })),
+    branches: branchRows,
+    issues: (issues.issues ?? []).slice(0, 40).map((issue) => ({
+      ref: issue.identifier,
+      title: clip(issue.title || issue.identifier, 140),
+      ...issue.url ? { url: issue.url } : {}
+    })),
+    ...warnings.length ? { warnings } : {}
+  };
+}
+
 // src/remote/phone-turn.ts
 init_orchestrator_capable();
 init_orchestrator();
@@ -42865,6 +43344,7 @@ function handlePhoneControl(cmd, opts) {
     });
     return;
   }
+  if (dispatchPhoneMcpUi(cmd, opts)) return;
   if (cmd.op === "open-file") {
     const thread = readPhoneThread(cmd.chatId);
     const relative = thread ? phoneWorktreeRelative(thread.worktreePath, cmd.path) : null;
@@ -45538,6 +46018,7 @@ async function pollSlackOutboundWatches(opts) {
   clipAgentEventForPaint,
   clipThinkingForStore,
   cloneRepoIntoSideboard,
+  closeMcpUiHost,
   codeRefRangeLabel,
   codexAdapter,
   codexSandboxWritableRootsArgs,
@@ -45760,6 +46241,7 @@ async function pollSlackOutboundWatches(opts) {
   getLinearApiKey,
   getLinearAuthToken,
   getLinearIssue,
+  getMcpUiHost,
   getOrchestrator,
   getPr,
   getPrChecks,
@@ -45825,6 +46307,7 @@ async function pollSlackOutboundWatches(opts) {
   isBrightsyConnected,
   isBrightsyNdjsonLine,
   isChatTextScale,
+  isClaudeAiConnectorMcp,
   isCloudCoordinatorThread,
   isCompactToolName,
   isConductorBundledCli,
@@ -45979,6 +46462,7 @@ async function pollSlackOutboundWatches(opts) {
   mcpServerIdForPermission,
   mcpServerPermissionUpdate,
   mcpStatusThinkingFromClaudeInit,
+  mcpUiContentSecurityPolicy,
   mentionsPrGoal,
   mergeAgentGitAuthEnv,
   mergePr,