@skylandnpm/octopus-proxy 0.1.48 → 0.1.50

package/dist/{chunk-DSAJ4SAH.js → chunk-6NV726RL.js}

@@ -2,19 +2,17 @@
 import {
   DesktopManager,
   PlatformDesktop,
-  PlatformScreenLock,
   REMOTE_DEFAULTS,
   RemoteConfigSchema,
-  ScreenLockError,
+  RemoteQualitySchema,
   SignalSchema,
   __commonJS,
   __toESM,
   assertDirectSignal,
-  ensureHostAuth,
   probeRemote,
-  verifyHostPassword,
+  remoteSessionBudget,
   z
-} from "./chunk-KRNEKDBF.js";
+} from "./chunk-PPH4OB7Y.js";
 
 // ../../node_modules/.pnpm/ajv@8.17.1/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -7646,8 +7644,8 @@ async function ensureHostIdentity(stateDirectory) {
 }
 
 // src/daemon.ts
-import { mkdir as mkdir8 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { mkdir as mkdir9 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 
 // src/workspace-diff.ts
 import { execFile as execFile2 } from "node:child_process";
@@ -8184,8 +8182,6 @@ var Operations = [
   "desktop.list",
   "desktop.capture",
   "desktop.read",
-  "desktop.lockStatus",
-  "desktop.unlock",
   "desktop.remote.status",
   "desktop.remote.start",
   "desktop.remote.signal",
@@ -8240,7 +8236,7 @@ var Journal = class {
       try {
         response = { type: "response", id: command.id, botId: command.botId, status: "completed", data: await action() };
       } catch (error) {
-        response = this.failure(command, command.operation === "desktop.unlock" ? error instanceof ScreenLockError ? error.message : "\u5C4F\u5E55\u89E3\u9501\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u4E3B\u673A\u72B6\u6001\u4E0E\u6743\u9650\u540E\u91CD\u8BD5\u3002" : isAuthentication(command.operation) ? "\u8BA4\u8BC1\u64CD\u4F5C\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u7F16\u7801\u5DE5\u5177\u7684\u767B\u5F55\u72B6\u6001\u540E\u91CD\u8BD5" : error instanceof Error ? error.message : "Operation failed");
+        response = this.failure(command, isAuthentication(command.operation) ? "\u8BA4\u8BC1\u64CD\u4F5C\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u7F16\u7801\u5DE5\u5177\u7684\u767B\u5F55\u72B6\u6001\u540E\u91CD\u8BD5" : error instanceof Error ? error.message : "Operation failed");
         if (!readOnly && error instanceof Error && ["TimeoutError", "AbortError", "UnknownResultError"].includes(error.name)) response.status = "unknown";
       }
       if (!readOnly) await atomicJson(path, { hash, response, finishedAt: (/* @__PURE__ */ new Date()).toISOString() });
@@ -8457,9 +8453,82 @@ var Artifacts = class {
 // src/secure-chat.ts
 import WebSocket from "ws";
 import { Duplex } from "node:stream";
-import { createPublicKey, randomUUID as randomUUID6, verify } from "node:crypto";
-import { userInfo } from "node:os";
+import { createPublicKey, randomUUID as randomUUID7, verify } from "node:crypto";
+import { userInfo as userInfo2 } from "node:os";
 import { TLSSocket, createSecureContext } from "node:tls";
+
+// src/host-auth.ts
+import { spawn } from "node:child_process";
+import { chmod as chmod2, mkdir as mkdir5, rename as rename3, stat as stat6, unlink as unlink4 } from "node:fs/promises";
+import { userInfo, platform as platform2 } from "node:os";
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { join as join6 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function helperPath(stateDirectory) {
+  return join6(stateDirectory, "octopus-host-auth");
+}
+async function ensureHostAuth(stateDirectory) {
+  await mkdir5(stateDirectory, { recursive: true, mode: 448 });
+  const target = helperPath(stateDirectory);
+  const system = platform2();
+  if (system !== "darwin" && system !== "linux") throw new Error("Host authentication is supported only on macOS and Linux");
+  const mac = system === "darwin";
+  const source = fileURLToPath2(new URL(mac ? "../native/auth-macos.m" : "../native/auth-linux.c", import.meta.url));
+  const sourceInfo = await stat6(source);
+  const existing = await stat6(target).catch(() => null);
+  if (existing?.isFile() && existing.mtimeMs >= sourceInfo.mtimeMs && (existing.mode & 63) === 0) return target;
+  const temporary = `${target}.${randomUUID6()}`;
+  const args = mac ? ["-O2", "-framework", "Foundation", "-framework", "OpenDirectory", source, "-o", target] : ["-O2", source, "-o", temporary, "-lpam"];
+  if (mac) args[args.length - 1] = temporary;
+  const compiler = spawn(mac ? "clang" : "cc", args, { stdio: ["ignore", "ignore", "pipe"] });
+  let diagnostics = "";
+  compiler.stderr.on("data", (chunk) => {
+    diagnostics += String(chunk).slice(0, 4096);
+  });
+  const exit = await new Promise((resolve5, reject) => {
+    compiler.on("error", reject);
+    compiler.on("exit", (code) => resolve5(code ?? 1));
+  });
+  if (exit !== 0) {
+    await unlink4(temporary).catch(() => {
+    });
+    throw new Error(`Host authentication helper build failed: ${diagnostics.trim()}`);
+  }
+  try {
+    await chmod2(temporary, 448);
+    await rename3(temporary, target);
+    return target;
+  } finally {
+    await unlink4(temporary).catch(() => {
+    });
+  }
+}
+async function verifyHostPassword(stateDirectory, username, password) {
+  if (username !== userInfo().username || !password || Buffer.byteLength(password) > 1024) return false;
+  const path = await ensureHostAuth(stateDirectory);
+  const child = spawn(path, [], { stdio: ["pipe", "pipe", "ignore"] });
+  const bytes = Buffer.from(password, "utf8");
+  const header2 = Buffer.alloc(2);
+  header2.writeUInt16BE(bytes.length);
+  child.stdin.end(Buffer.concat([header2, bytes]));
+  bytes.fill(0);
+  let output = "";
+  child.stdout.on("data", (chunk) => {
+    output += String(chunk).slice(0, 16);
+  });
+  const timer = setTimeout(() => child.kill("SIGKILL"), 1e4);
+  try {
+    const code = await new Promise((resolve5, reject) => {
+      child.on("error", reject);
+      child.on("exit", (value) => resolve5(value ?? 1));
+    });
+    return code === 0 && output.trim() === "OK";
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/secure-chat.ts
 var OPEN = 1;
 var DATA = 2;
 var CLOSE = 3;
@@ -8517,13 +8586,13 @@ var SecureChat = class {
   }
   outer;
   sessions = /* @__PURE__ */ new Map();
-  epoch = randomUUID6();
+  epoch = randomUUID7();
   sequence = 0;
   events = [];
   eventBytes = 0;
   stopping = false;
   context;
-  serviceAccount = userInfo().username;
+  serviceAccount = userInfo2().username;
   timer;
   start() {
     this.connect();
@@ -8735,7 +8804,7 @@ var SecureChat = class {
 };
 
 // src/proxy-snapshot.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 var execute2 = promisify3(execFile3);
@@ -8789,7 +8858,7 @@ async function buildProxySnapshot(config, runtime, adapter, requestedProjectId)
   let modelCatalogStatus = capabilities.includes("configuration.models") ? "unavailable" : "unsupported";
   if (status.healthy === true && projectId && capabilities.includes("configuration.models")) {
     try {
-      const command = { type: "command", id: randomUUID7(), botId: config.botId, operation: "configuration.models", projectId, payload: {} };
+      const command = { type: "command", id: randomUUID8(), botId: config.botId, operation: "configuration.models", projectId, payload: {} };
       models.push(...publicModels(await adapter.dispatch(command)));
       modelCatalogStatus = models.length ? "available" : "unavailable";
     } catch {
@@ -8816,11 +8885,11 @@ async function buildProxySnapshot(config, runtime, adapter, requestedProjectId)
 }
 
 // src/media.ts
-import { createHash as createHash6, randomUUID as randomUUID8 } from "node:crypto";
+import { createHash as createHash6, randomUUID as randomUUID9 } from "node:crypto";
 import { constants as constants3 } from "node:fs";
-import { open as open4, unlink as unlink4, realpath as realpath3 } from "node:fs/promises";
+import { open as open4, unlink as unlink5, realpath as realpath3 } from "node:fs/promises";
 import { basename as basename3, isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3, sep as sep2 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/screenshot-delivery.ts
 var instructions = "\n\n[Octopus screenshot delivery]\nFor requested UI tests/screenshots, run the real application with the available test tools. Save each requested key-step or failure screenshot under the authorized project (prefer test-results/screenshots/ with a unique filename). After saving, immediately report it as ![step and result](relative/project/path.png) in your progress or final response. Octopus Proxy will attach the actual file to Claw. Never claim a screenshot or test succeeded without producing it; explain environment/tool blockers. Do not substitute generated mockups for test screenshots.\n[/Octopus screenshot delivery]";
@@ -8937,7 +9006,7 @@ var RemoteMedia = class {
       } else {
         let path = value.path ?? value.localPath ?? value.artifactUri ?? source.path ?? source.localPath ?? url;
         if (typeof path !== "string") throw new Error("Image has no readable data or project path");
-        if (path.startsWith("file:")) path = fileURLToPath2(path);
+        if (path.startsWith("file:")) path = fileURLToPath3(path);
         if (/^[a-z][a-z0-9+.-]*:/i.test(path)) throw new Error("Only images inside the authorized project can be returned");
         if (isAbsolute3(path)) {
           const root = await this.workspace.root(project);
@@ -9033,7 +9102,7 @@ var RemoteMedia = class {
     if (bytes.length === 0 || bytes.length > this.imageLimit()) throw new Error("Image is empty or exceeds size limit");
     const extension = { "image/png": "png", "image/jpeg": "jpg", "image/gif": "gif", "image/webp": "webp", "application/pdf": "pdf" }[mime] ?? "bin";
     const directory = await this.workspace.attachmentDirectory(project, "media", sha256), path = directory + "/asset." + extension;
-    const temp = await this.workspace.path(project, directory + "/.octopus-media-" + randomUUID8(), true);
+    const temp = await this.workspace.path(project, directory + "/.octopus-media-" + randomUUID9(), true);
     const file = await open4(temp, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
     try {
       await file.writeFile(bytes);
@@ -9044,7 +9113,7 @@ var RemoteMedia = class {
     try {
       await this.workspace.publish(project, temp, path);
     } catch (error) {
-      await unlink4(temp).catch(() => {
+      await unlink5(temp).catch(() => {
       });
       if (error.code !== "EEXIST") throw error;
       const existing = await open4(await this.workspace.path(project, path), constants3.O_RDONLY | constants3.O_NOFOLLOW);
@@ -10450,8 +10519,8 @@ function applyEdits(text, edits) {
 }
 
 // src/project-config.ts
-import { readFile as readFile5, writeFile as writeFile3, unlink as unlink5 } from "node:fs/promises";
-import { createHash as createHash7, randomUUID as randomUUID9 } from "node:crypto";
+import { readFile as readFile5, writeFile as writeFile3, unlink as unlink6 } from "node:fs/promises";
+import { createHash as createHash7, randomUUID as randomUUID10 } from "node:crypto";
 var ProjectConfig = class {
   constructor(workspace, request) {
     this.workspace = workspace;
@@ -10502,12 +10571,12 @@ var ProjectConfig = class {
     if (!this.validator(parse2(updated))) throw new Error("Merged OpenCode configuration is invalid: " + JSON.stringify(this.validator.errors));
     if (exists) await this.workspace.write(project, name, updated, createHash7("sha256").update(original).digest("hex"));
     else {
-      const temporary = await this.workspace.path(project, `.octopus-config-${randomUUID9()}.tmp`, true);
+      const temporary = await this.workspace.path(project, `.octopus-config-${randomUUID10()}.tmp`, true);
       try {
         await writeFile3(temporary, updated, { mode: 384, flag: "wx" });
         await this.workspace.publish(project, temporary, name);
       } finally {
-        await unlink5(temporary).catch(() => {
+        await unlink6(temporary).catch(() => {
         });
       }
     }
@@ -10963,11 +11032,11 @@ function redact(value) {
 }
 
 // src/runtime.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { mkdir as mkdir5, open as open5, readFile as readFile6, rm, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir6, open as open5, readFile as readFile6, rm, writeFile as writeFile4 } from "node:fs/promises";
 import { createServer } from "node:net";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 var Runtime = class {
   constructor(config) {
     this.config = config;
@@ -10983,7 +11052,7 @@ var Runtime = class {
     return this.endpoint;
   }
   get endpointStatePath() {
-    return join6(this.config.stateDirectory, "opencode-endpoint.json");
+    return join7(this.config.stateDirectory, "opencode-endpoint.json");
   }
   get passwordHash() {
     return createHash8("sha256").update(this.config.tool.password).digest("hex");
@@ -11045,13 +11114,13 @@ var Runtime = class {
         throw new Error(`OpenCode \u5730\u5740 ${url.origin} \u5DF2\u6709 HTTP \u670D\u52A1\uFF0C\u4F46\u5065\u5EB7\u68C0\u67E5\u5931\u8D25\uFF08HTTP ${response.status}\uFF09\uFF1B\u8BF7\u68C0\u67E5\u670D\u52A1\u5BC6\u7801\u6216\u7AEF\u53E3`);
       }
     }
-    await mkdir5(this.config.stateDirectory, { recursive: true, mode: 448 });
-    const logPath = join6(this.config.stateDirectory, "opencode-serve.log");
+    await mkdir6(this.config.stateDirectory, { recursive: true, mode: 448 });
+    const logPath = join7(this.config.stateDirectory, "opencode-serve.log");
     const log = await open5(logPath, "a", 384);
     const env = { ...process.env, OPENCODE_SERVER_PASSWORD: this.config.tool.password, OPENCODE_SERVER_USERNAME: "opencode" };
     let child;
     try {
-      child = spawn(this.config.tool.command, ["serve", "--hostname", url.hostname === "[::1]" ? "::1" : url.hostname, "--port", url.port || "80"], {
+      child = spawn2(this.config.tool.command, ["serve", "--hostname", url.hostname === "[::1]" ? "::1" : url.hostname, "--port", url.port || "80"], {
         cwd: this.config.projects[0].directory,
         env,
         detached: true,
@@ -11138,24 +11207,24 @@ var Runtime = class {
 
 // src/tools/zcode-env.ts
 import { existsSync } from "node:fs";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { dirname as dirname4, join as join8 } from "node:path";
 function zcodeEnvironment(command) {
   const env = { ...process.env };
   if (!env.ZCODE_BUILTIN_PROVIDER_CONFIG_FILE) {
-    const bundled = join7(dirname4(command), "..", "config", "provider", "zcode-builtin.json");
+    const bundled = join8(dirname4(command), "..", "config", "provider", "zcode-builtin.json");
     if (existsSync(bundled)) env.ZCODE_BUILTIN_PROVIDER_CONFIG_FILE = bundled;
   }
   return env;
 }
 
 // src/tools/stdio-runtime.ts
-import { spawn as spawn2, execFile as execFile4 } from "node:child_process";
+import { spawn as spawn3, execFile as execFile4 } from "node:child_process";
 import { promisify as promisify4 } from "node:util";
-import { mkdir as mkdir6, open as open6 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { mkdir as mkdir7, open as open6 } from "node:fs/promises";
+import { join as join9 } from "node:path";
 
 // src/tools/line-rpc.ts
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 import { crc32 } from "node:zlib";
 import { StringDecoder } from "node:string_decoder";
 function interrupted(message) {
@@ -11340,7 +11409,7 @@ var LineRpc = class {
   }
 };
 function wrapEnvelope(frame) {
-  return { wireVersion: 3, kind: "complete", deliveryKind: "desktop-continuous", logicalFrameId: randomUUID10(), logicalFrameOrdinal: 1, topic: "outbound", subscriptionId: "outbound", frame };
+  return { wireVersion: 3, kind: "complete", deliveryKind: "desktop-continuous", logicalFrameId: randomUUID11(), logicalFrameOrdinal: 1, topic: "outbound", subscriptionId: "outbound", frame };
 }
 
 // src/tools/stdio-runtime.ts
@@ -11516,12 +11585,12 @@ ${bytes.toString("utf8")}`);
     if (inFlight) return inFlight;
     if (this.children.has(projectId)) return;
     const spawnOnce = (async () => {
-      const logPath = join8(this.config.stateDirectory, `${this.kind}-${projectId}.log`);
-      await mkdir6(this.config.stateDirectory, { recursive: true, mode: 448 });
+      const logPath = join9(this.config.stateDirectory, `${this.kind}-${projectId}.log`);
+      await mkdir7(this.config.stateDirectory, { recursive: true, mode: 448 });
       const log = await open6(logPath, "a", 384);
       let child;
       try {
-        child = spawn2(this.config.tool.command, [...this.descriptor.serverArgs], { cwd: directory, env: this.kind === "zcode" ? zcodeEnvironment(this.config.tool.command) : { ...process.env }, stdio: ["pipe", "pipe", log.fd] });
+        child = spawn3(this.config.tool.command, [...this.descriptor.serverArgs], { cwd: directory, env: this.kind === "zcode" ? zcodeEnvironment(this.config.tool.command) : { ...process.env }, stdio: ["pipe", "pipe", log.fd] });
       } catch (error) {
         await log.close();
         throw error;
@@ -11596,7 +11665,7 @@ ${bytes.toString("utf8")}`);
 };
 
 // src/tools/codex.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 
 // src/adapter.ts
 var DAEMON_OPERATIONS = [
@@ -11635,8 +11704,6 @@ var DAEMON_OPERATIONS = [
   "desktop.list",
   "desktop.capture",
   "desktop.read",
-  "desktop.lockStatus",
-  "desktop.unlock",
   "desktop.remote.status",
   "desktop.remote.start",
   "desktop.remote.signal",
@@ -11647,7 +11714,7 @@ function unsupportedOperation(kind, operation) {
 }
 
 // src/tools/codex.ts
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 var OPERATIONS = [
   ...DAEMON_OPERATIONS,
   ...AUTH_OPERATIONS,
@@ -11742,7 +11809,7 @@ var CodexAdapter = class {
   }
   onServerRequest(project, id, method, params, respond) {
     const detail = params ?? {};
-    const requestId = randomUUID11();
+    const requestId = randomUUID12();
     const threadId = String(detail.threadId ?? "");
     if (["item/permissions/requestApproval", "item/commandExecution/requestApproval", "item/fileChange/requestApproval"].includes(method)) {
       this.approvals.set(requestId, { project, method, requestId, threadId, detail, respond });
@@ -11757,21 +11824,21 @@ var CodexAdapter = class {
     respond({ decision: "decline" });
   }
   async index(project) {
-    const stored = await readJson(join9(this.runtime.config.stateDirectory, `codex-${project}.json`));
+    const stored = await readJson(join10(this.runtime.config.stateDirectory, `codex-${project}.json`));
     return { threadIds: stored?.threadIds ?? [] };
   }
   async remember(project, threadId) {
     const index = await this.index(project);
     if (!index.threadIds.includes(threadId)) {
       index.threadIds.push(threadId);
-      await atomicJson(join9(this.runtime.config.stateDirectory, `codex-${project}.json`), index);
+      await atomicJson(join10(this.runtime.config.stateDirectory, `codex-${project}.json`), index);
     }
   }
   async forget(project, threadId) {
     const index = await this.index(project);
     if (index.threadIds.includes(threadId)) {
       index.threadIds = index.threadIds.filter((entry) => entry !== threadId);
-      await atomicJson(join9(this.runtime.config.stateDirectory, `codex-${project}.json`), index);
+      await atomicJson(join10(this.runtime.config.stateDirectory, `codex-${project}.json`), index);
     }
   }
   async resume(project, threadId, rpc) {
@@ -12142,8 +12209,8 @@ var CodexAdapter = class {
 };
 
 // src/tools/zcode.ts
-import { spawn as spawn3 } from "node:child_process";
-import { randomUUID as randomUUID12 } from "node:crypto";
+import { spawn as spawn4 } from "node:child_process";
+import { randomUUID as randomUUID13 } from "node:crypto";
 import { realpath as realpath5 } from "node:fs/promises";
 var OPERATIONS2 = [
   ...DAEMON_OPERATIONS,
@@ -12198,7 +12265,7 @@ var ZcodeAdapter = class {
   }
   onServerRequest(project, id, method, params, respond, respondError) {
     const detail = params ?? {};
-    const requestId = randomUUID12();
+    const requestId = randomUUID13();
     const sessionId = String(detail.sessionId ?? "");
     if (method === "session/requestRuntimePreferences") {
       respond({ nativeSearchEnhancementsEnabled: false });
@@ -12335,7 +12402,7 @@ var ZcodeAdapter = class {
       const flow = this.auth.create(project, () => {
         child?.kill("SIGTERM");
       });
-      child = spawn3(this.runtime.config.tool.command, ["login", "--no-browser", "--json"], { cwd: await this.workspace.root(project), env: zcodeEnvironment(this.runtime.config.tool.command), stdio: ["ignore", "pipe", "pipe"] });
+      child = spawn4(this.runtime.config.tool.command, ["login", "--no-browser", "--json"], { cwd: await this.workspace.root(project), env: zcodeEnvironment(this.runtime.config.tool.command), stdio: ["ignore", "pipe", "pipe"] });
       let output = "", diagnostic = "";
       child.stdout?.on("data", (data) => {
         output = (output + data.toString()).slice(-65536);
@@ -12473,7 +12540,7 @@ var ZcodeAdapter = class {
 };
 
 // src/tools/pi.ts
-import { randomUUID as randomUUID13 } from "node:crypto";
+import { randomUUID as randomUUID14 } from "node:crypto";
 import { readFile as readFile7, readdir as readdir3, rm as rm2 } from "node:fs/promises";
 import { dirname as dirname5 } from "node:path";
 var OPERATIONS3 = [
@@ -12568,7 +12635,7 @@ var PiAdapter = class {
   }
   onQuestion(project, sessionId, detail) {
     if (!["select", "confirm", "input", "editor"].includes(String(detail.method))) return;
-    const id = randomUUID13();
+    const id = randomUUID14();
     void this.rpc(project, sessionId).then((rpc) => {
       if (rpc.exited) return;
       const question = { id, project, sessionId, detail, rpc };
@@ -12674,7 +12741,7 @@ var PiAdapter = class {
       return sessions.sort((a, b) => b.time.updated - a.time.updated);
     }
     if (op === "sessions.create") {
-      const session2 = { id: randomUUID13(), title: typeof p.title === "string" && p.title.trim() ? p.title : "\u65B0\u4EFB\u52A1", directory: await this.workspace.root(project), time: { created: Date.now(), updated: Date.now() } };
+      const session2 = { id: randomUUID14(), title: typeof p.title === "string" && p.title.trim() ? p.title : "\u65B0\u4EFB\u52A1", directory: await this.workspace.root(project), time: { created: Date.now(), updated: Date.now() } };
       try {
         const rpc2 = await this.rpc(project, session2.id);
         await rpc2.request("set_session_name", { name: session2.title });
@@ -12772,9 +12839,9 @@ var PiAdapter = class {
 };
 
 // src/tools/pi-runtime.ts
-import { execFile as execFile5, spawn as spawn4 } from "node:child_process";
-import { mkdir as mkdir7, open as open7 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { execFile as execFile5, spawn as spawn5 } from "node:child_process";
+import { mkdir as mkdir8, open as open7 } from "node:fs/promises";
+import { join as join11 } from "node:path";
 import { promisify as promisify5 } from "node:util";
 var run3 = promisify5(execFile5);
 var PiRuntime = class {
@@ -12860,7 +12927,7 @@ ${bytes.toString("utf8")}`);
   sessionFile(projectId, sessionId) {
     this.project(projectId);
     if (!describeTool("pi").sessionPattern.test(sessionId)) throw new Error("Invalid session id");
-    return join10(this.config.stateDirectory, "pi-sessions", projectId, `${sessionId}.jsonl`);
+    return join11(this.config.stateDirectory, "pi-sessions", projectId, `${sessionId}.jsonl`);
   }
   project(id) {
     const project = this.config.projects.find((entry) => entry.id === id);
@@ -12891,15 +12958,15 @@ ${bytes.toString("utf8")}`);
   async launch(key, projectId, sessionId, handlers, generation) {
     await this.kill(key);
     const directory = this.project(projectId).directory;
-    await mkdir7(join10(this.config.stateDirectory, "pi-sessions", projectId), { recursive: true, mode: 448 });
-    const logPath = join10(this.config.stateDirectory, `pi-${key}.log`);
+    await mkdir8(join11(this.config.stateDirectory, "pi-sessions", projectId), { recursive: true, mode: 448 });
+    const logPath = join11(this.config.stateDirectory, `pi-${key}.log`);
     const log = await open7(logPath, "a", 384);
     if (generation !== this.generation) {
       await log.close();
       throw new Error("Pi runtime stopped during startup");
     }
     const args = [...describeTool("pi").serverArgs, ...sessionId ? ["--session", this.sessionFile(projectId, sessionId)] : ["--no-session"]];
-    const child = spawn4(this.config.tool.command, args, { cwd: directory, env: { ...process.env }, stdio: ["pipe", "pipe", log.fd] });
+    const child = spawn5(this.config.tool.command, args, { cwd: directory, env: { ...process.env }, stdio: ["pipe", "pipe", log.fd] });
     child.once("close", () => {
       void log.close();
     });
@@ -12954,7 +13021,7 @@ function createAdapter(runtime, workspace, uploads, emit) {
 }
 
 // src/project-registry.ts
-import { realpath as realpath6, readFile as readFile8, stat as stat6 } from "node:fs/promises";
+import { realpath as realpath6, readFile as readFile8, stat as stat7 } from "node:fs/promises";
 import { isAbsolute as isAbsolute4 } from "node:path";
 var ProjectMutationSchema = ProjectSchema.extend({
   name: ProjectSchema.shape.name.trim().max(120),
@@ -13014,7 +13081,7 @@ var ProjectRegistry = class {
     const parsed = ProjectMutationSchema.parse(payload);
     const directory = expandHome(parsed.directory);
     if (!isAbsolute4(directory)) throw new Error("\u9879\u76EE\u76EE\u5F55\u5FC5\u987B\u662F Proxy \u4E3B\u673A\u4E0A\u7684\u7EDD\u5BF9\u8DEF\u5F84");
-    const info = await stat6(directory).catch(() => void 0);
+    const info = await stat7(directory).catch(() => void 0);
     if (!info?.isDirectory()) throw new Error(`\u9879\u76EE\u76EE\u5F55\u4E0D\u5B58\u5728\u6216\u4E0D\u662F\u76EE\u5F55\uFF1A${directory}`);
     const canonical = await realpath6(directory);
     if (this.config.projects.some((project2) => project2.id === parsed.id)) throw new Error(`\u9879\u76EE ID \u5DF2\u5B58\u5728\uFF1A${parsed.id}`);
@@ -13034,7 +13101,7 @@ var ProjectRegistry = class {
     if (index < 0) throw new Error(`\u672A\u77E5\u6388\u6743\u9879\u76EE\uFF1A${parsed.id}`);
     const directory = expandHome(parsed.directory);
     if (!isAbsolute4(directory)) throw new Error("\u9879\u76EE\u76EE\u5F55\u5FC5\u987B\u662F Proxy \u4E3B\u673A\u4E0A\u7684\u7EDD\u5BF9\u8DEF\u5F84");
-    const info = await stat6(directory).catch(() => void 0);
+    const info = await stat7(directory).catch(() => void 0);
     if (!info?.isDirectory()) throw new Error(`\u9879\u76EE\u76EE\u5F55\u4E0D\u5B58\u5728\u6216\u4E0D\u662F\u76EE\u5F55\uFF1A${directory}`);
     const canonical = await realpath6(directory);
     for (const project of this.config.projects) {
@@ -13081,15 +13148,16 @@ var ProjectRegistry = class {
 };
 
 // src/terminal.ts
-import { randomUUID as randomUUID14 } from "node:crypto";
-import { access as access2, stat as stat8 } from "node:fs/promises";
+import { randomUUID as randomUUID15 } from "node:crypto";
+import { access as access2, stat as stat9 } from "node:fs/promises";
 import { constants as constants5 } from "node:fs";
-import { platform as platform2, userInfo as userInfo2 } from "node:os";
+import { platform as platform3, userInfo as userInfo3 } from "node:os";
+import { delimiter } from "node:path";
 import * as pty from "node-pty";
 
 // src/terminal-support.ts
 import { createRequire } from "node:module";
-import { access, chmod as chmod2, stat as stat7 } from "node:fs/promises";
+import { access, chmod as chmod3, stat as stat8 } from "node:fs/promises";
 import { constants as constants4 } from "node:fs";
 import { dirname as dirname6, resolve as resolve4 } from "node:path";
 var require2 = createRequire(import.meta.url);
@@ -13099,7 +13167,7 @@ function terminalHelperPath() {
   return resolve4(dirname6(utilsPath), native.dir, "spawn-helper");
 }
 async function prepareTerminalHelper(path, fix) {
-  const info = await stat7(path);
+  const info = await stat8(path);
   if (!info.isFile()) throw new Error(`\u7EC8\u7AEF\u8F85\u52A9\u7A0B\u5E8F\u4E0D\u662F\u666E\u901A\u6587\u4EF6\uFF1A${path}`);
   try {
     await access(path, constants4.X_OK);
@@ -13107,7 +13175,7 @@ async function prepareTerminalHelper(path, fix) {
   } catch {
     if (!fix) throw new Error(`\u7EC8\u7AEF\u8F85\u52A9\u7A0B\u5E8F\u7F3A\u5C11\u6267\u884C\u6743\u9650\uFF1A${path}\uFF1B\u8FD0\u884C octopus-proxy doctor --fix \u4FEE\u590D`);
     try {
-      await chmod2(path, info.mode & 511 | 73);
+      await chmod3(path, info.mode & 511 | 73);
       await access(path, constants4.X_OK);
       return true;
     } catch (error) {
@@ -13158,15 +13226,24 @@ var TerminalManager = class {
       const count = [...this.terminals.values()].filter((t) => t.owner === owner).length;
       if (count >= 8) throw new Error("Terminal limit reached");
       const cwd = await this.workspace.path(project, typeof p.cwd === "string" ? p.cwd : ".");
-      if (!(await stat8(cwd)).isDirectory()) throw new Error(`\u7EC8\u7AEF\u5DE5\u4F5C\u76EE\u5F55\u4E0D\u662F\u76EE\u5F55\uFF1A${cwd}`);
-      const shell = process.env.SHELL || (platform2() === "darwin" ? "/bin/zsh" : "/bin/sh");
+      if (!(await stat9(cwd)).isDirectory()) throw new Error(`\u7EC8\u7AEF\u5DE5\u4F5C\u76EE\u5F55\u4E0D\u662F\u76EE\u5F55\uFF1A${cwd}`);
+      const shell = process.env.SHELL || (platform3() === "darwin" ? "/bin/zsh" : "/bin/sh");
       try {
         await access2(shell, constants5.X_OK);
       } catch {
         throw new Error(`\u7EC8\u7AEF Shell \u4E0D\u5B58\u5728\u6216\u4E0D\u53EF\u6267\u884C\uFF1A${shell}\uFF1B\u8BF7\u4FEE\u6B63 Proxy \u670D\u52A1\u7684 SHELL \u73AF\u5883\u53D8\u91CF`);
       }
       const { helper } = await ensureTerminalSupport();
-      const id = randomUUID14();
+      const id = randomUUID15();
+      const path = [
+        process.env.PATH,
+        "/usr/bin",
+        "/bin",
+        "/usr/sbin",
+        "/sbin",
+        "/usr/local/bin",
+        ...platform3() === "darwin" ? ["/opt/homebrew/bin"] : []
+      ].filter(Boolean).join(delimiter);
       let terminalProcess;
       try {
         terminalProcess = pty.spawn(shell, [], {
@@ -13174,7 +13251,7 @@ var TerminalManager = class {
           cols: 80,
           rows: 24,
           cwd,
-          env: { PATH: process.env.PATH || "/usr/bin:/bin", HOME: userInfo2().homedir, TERM: "xterm-256color", USER: userInfo2().username }
+          env: { PATH: path, HOME: userInfo3().homedir, TERM: "xterm-256color", USER: userInfo3().username }
         });
       } catch (error) {
         throw new Error(`\u7EC8\u7AEF\u542F\u52A8\u5931\u8D25\uFF1A${error instanceof Error ? error.message : String(error)}\uFF08shell=${shell}\uFF0Ccwd=${cwd}${helper ? `\uFF0Chelper=${helper}` : ""}\uFF0C${process.platform}/${process.arch}\uFF0CNode ${process.version}\uFF09\uFF1B\u8BF7\u5728 Proxy \u4E3B\u673A\u8FD0\u884C octopus-proxy doctor --fix \u68C0\u67E5`);
@@ -13227,21 +13304,48 @@ var TerminalManager = class {
   }
 };
 
+// src/desktop-session.ts
+import { execFile as execFile6 } from "node:child_process";
+import { promisify as promisify6 } from "node:util";
+import { userInfo as userInfo4 } from "node:os";
+var exec = promisify6(execFile6);
+var PlatformDesktopSession = class {
+  constructor(system = process.platform, environment = process.env, execute3 = async (args) => (await exec("loginctl", ["--no-ask-password", ...args], { timeout: 5e3, maxBuffer: 16384 })).stdout, account = userInfo4()) {
+    this.system = system;
+    this.environment = environment;
+    this.execute = execute3;
+    this.account = account;
+  }
+  async sessionIdentity() {
+    if (this.system === "darwin") return String(this.account.uid);
+    if (this.system !== "linux") throw new Error("\u6B64\u5E73\u53F0\u4E0D\u652F\u6301\u8FDC\u7A0B\u684C\u9762\u4F1A\u8BDD");
+    const ids = this.environment.XDG_SESSION_ID ? [this.environment.XDG_SESSION_ID] : (await this.execute(["list-sessions", "--no-legend"])).trim().split("\n").map((line) => line.trim().split(/\s+/)[0]).filter(Boolean);
+    const sessions = [];
+    for (const id of ids) {
+      if (!/^[a-zA-Z0-9_-]+$/.test(id)) continue;
+      const properties = Object.fromEntries((await this.execute(["show-session", id, "-p", "User", "-p", "Type", "-p", "Active"])).trim().split("\n").map((line) => line.split("=")));
+      if (properties.User === String(this.account.uid) && properties.Type === "x11" && properties.Active === "yes") sessions.push(id);
+    }
+    if (sessions.length !== 1) throw new Error("\u65E0\u6CD5\u786E\u5B9A Proxy \u7528\u6237\u7684\u552F\u4E00\u6D3B\u52A8 X11 \u4F1A\u8BDD\uFF0C\u8BF7\u68C0\u67E5 XDG_SESSION_ID");
+    return sessions[0];
+  }
+};
+
 // src/remote-manager.ts
 import { fork } from "node:child_process";
-import { randomBytes as randomBytes2, randomUUID as randomUUID15 } from "node:crypto";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { randomBytes as randomBytes2, randomUUID as randomUUID16 } from "node:crypto";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 function spawnWorker(message) {
-  const worker = fileURLToPath3(new URL(import.meta.url.endsWith(".ts") ? "./remote-worker.ts" : "./remote-worker.js", import.meta.url));
+  const worker = fileURLToPath4(new URL(import.meta.url.endsWith(".ts") ? "./remote-worker.ts" : "./remote-worker.js", import.meta.url));
   const child = fork(worker, [], { stdio: ["ignore", "ignore", "ignore", "ipc"], execArgv: import.meta.url.endsWith(".ts") ? ["--import", "tsx"] : [] });
   child.send({ kind: "init", ...message });
   return child;
 }
 var RemoteManager = class {
-  constructor(host, desktop, lock, send, touch, workerFactory = spawnWorker, probe = probeRemote) {
+  constructor(host, desktop, desktopSession, send, touch, workerFactory = spawnWorker, probe = probeRemote) {
     this.host = host;
     this.desktop = desktop;
-    this.lock = lock;
+    this.desktopSession = desktopSession;
     this.send = send;
     this.touch = touch;
     this.workerFactory = workerFactory;
@@ -13255,12 +13359,13 @@ var RemoteManager = class {
     return this.config.stunUrls ?? [`stun:${new URL(this.host.hubUrl).hostname}:3478`];
   }
   async status() {
-    const base = { platform: process.platform, enabled: this.config.enabled, busy: !!this.current, stunUrls: this.stunUrls(), budget: { ...REMOTE_DEFAULTS, totalBitrate: this.config.totalBitrate, videoMaxBitrate: this.config.videoMaxBitrate } };
+    const base = { qualityModes: RemoteQualitySchema.options, platform: process.platform, passwordInput: process.platform === "darwin", enabled: this.config.enabled, busy: !!this.current, stunUrls: this.stunUrls(), budget: { ...REMOTE_DEFAULTS, totalBitrate: this.config.totalBitrate, videoMaxBitrate: this.config.videoMaxBitrate } };
     if (!this.config.enabled) return { ...base, available: false, message: "\u4E3B\u673A\u5DF2\u5173\u95ED\u8FDC\u7A0B\u63A7\u5236" };
     try {
       const permissions = await this.probe(this.host.stateDirectory, this.config);
-      const available = permissions.session && permissions.capture && permissions.input;
-      return { ...base, available, permissions, ...!available ? { message: "\u8BF7\u68C0\u67E5\u4E3B\u673A\u56FE\u5F62\u4F1A\u8BDD\uFF0C\u5E76\u4E3A\u5B9E\u9645\u8FD0\u884C Proxy \u7684\u7A0B\u5E8F\u6388\u6743\u5C4F\u5E55\u5F55\u5236\u548C\u8F85\u52A9\u529F\u80FD" } : {} };
+      const lockUnsupported = permissions.locked === true && permissions.lockCapture === false;
+      const available = permissions.session && permissions.capture && permissions.input && !lockUnsupported;
+      return { ...base, available, permissions, ...!available ? { message: lockUnsupported ? "\u9501\u5C4F\u8FDC\u63A7\u9700\u8981 macOS 14 \u53CA\u4EE5\u4E0A\u53CA\u65B0\u7248 Xcode Command Line Tools\uFF1B\u5F53\u524D\u4E3B\u673A\u8BF7\u5148\u672C\u5730\u89E3\u9501" : "\u8BF7\u68C0\u67E5\u4E3B\u673A\u56FE\u5F62\u4F1A\u8BDD\uFF0C\u5E76\u4E3A\u5B9E\u9645\u8FD0\u884C Proxy \u7684\u7A0B\u5E8F\u6388\u6743\u5C4F\u5E55\u5F55\u5236\u548C\u8F85\u52A9\u529F\u80FD" } : {} };
     } catch (error) {
       return { ...base, available: false, message: error instanceof Error ? error.message : "\u8FDC\u63A7\u4F9D\u8D56\u4E0D\u53EF\u7528" };
     }
@@ -13294,20 +13399,21 @@ var RemoteManager = class {
   async start(payload, owner) {
     if (!this.config.enabled) throw new Error("\u4E3B\u673A\u5DF2\u5173\u95ED\u8FDC\u7A0B\u63A7\u5236");
     if (this.current) throw new Error("\u4E3B\u673A\u6B63\u5728\u88AB\u63A7\u5236");
-    const session = { remoteId: randomUUID15(), owner, closed: false, signaling: Promise.resolve(), signals: 0, signalWindow: Date.now(), candidates: 0 };
+    const quality = RemoteQualitySchema.parse(payload.quality ?? "hd");
+    const budget = remoteSessionBudget(this.config, quality, payload.quality === void 0);
+    const session = { remoteId: randomUUID16(), owner, closed: false, signaling: Promise.resolve(), signals: 0, signalWindow: Date.now(), candidates: 0 };
     this.current = session;
     try {
       const permissions = await this.probe(this.host.stateDirectory, this.config);
       if (!permissions.session || !permissions.capture || !permissions.input) throw new Error("\u8FDC\u63A7\u9700\u8981\u4E3B\u673A\u56FE\u5F62\u4F1A\u8BDD\u3001\u5C4F\u5E55\u5F55\u5236\u53CA\u8F85\u52A9\u529F\u80FD\u6743\u9650");
-      const lock = await this.lock.status();
-      if (lock.locked) throw new Error("\u4E3B\u673A\u5C4F\u5E55\u5DF2\u9501\u5B9A\uFF0C\u8BF7\u5728\u88AB\u63A7\u4E3B\u673A\u4E0A\u89E3\u9501\u540E\u91CD\u8BD5");
-      const identity = await this.lock.sessionIdentity?.();
+      if (permissions.locked === true && permissions.lockCapture === false) throw new Error("\u9501\u5C4F\u8FDC\u63A7\u9700\u8981 macOS 14 \u53CA\u4EE5\u4E0A\u53CA\u65B0\u7248 Xcode Command Line Tools\uFF1B\u5F53\u524D\u4E3B\u673A\u8BF7\u5148\u672C\u5730\u89E3\u9501");
+      const identity = await this.desktopSession.sessionIdentity();
       const display = (await this.desktop.list()).find((d) => d.id === payload.displayId);
       if (!display) throw new Error("\u663E\u793A\u5668\u5DF2\u65AD\u5F00\uFF0C\u8BF7\u5237\u65B0\u663E\u793A\u5668\u5217\u8868");
       const layout = await this.desktop.layoutIdentity?.(display.id);
       if (session.closed || this.current !== session) throw new Error("\u5DE5\u4F5C\u533A\u8FDE\u63A5\u5DF2\u5173\u95ED\uFF0C\u8FDC\u63A7\u5DF2\u53D6\u6D88");
       const bindToken = randomBytes2(32).toString("base64url"), expiresAt = Date.now() + 2e4;
-      const child = this.workerFactory({ remoteId: session.remoteId, bindToken, expiresAt, display, helper: permissions.helper, config: this.config, stunUrls: this.stunUrls() });
+      const child = this.workerFactory({ remoteId: session.remoteId, bindToken, expiresAt, display, helper: permissions.helper, quality, legacy: payload.quality === void 0, config: this.config, stunUrls: this.stunUrls() });
       session.child = child;
       child.on("message", (message) => {
         if (this.current !== session || session.closed || !message || typeof message !== "object") return;
@@ -13330,8 +13436,7 @@ var RemoteManager = class {
         if (checking || session.closed) return;
         checking = true;
         try {
-          if ((await this.lock.status()).locked) this.finish(session, "\u4E3B\u673A\u5C4F\u5E55\u5DF2\u9501\u5B9A\uFF0C\u8FDC\u63A7\u5DF2\u505C\u6B62");
-          if (identity !== void 0 && await this.lock.sessionIdentity?.() !== identity) this.finish(session, "\u4E3B\u673A\u56FE\u5F62\u4F1A\u8BDD\u5DF2\u53D8\u5316\uFF0C\u8FDC\u63A7\u5DF2\u505C\u6B62");
+          if (await this.desktopSession.sessionIdentity() !== identity) this.finish(session, "\u4E3B\u673A\u56FE\u5F62\u4F1A\u8BDD\u5DF2\u53D8\u5316\uFF0C\u8FDC\u63A7\u5DF2\u505C\u6B62");
           const current = (await this.desktop.list()).find((d) => d.id === display.id);
           if (!current || current.width !== display.width || current.height !== display.height) this.finish(session, "\u663E\u793A\u5668\u5DF2\u53D8\u5316\uFF0C\u8FDC\u63A7\u5DF2\u505C\u6B62");
           if (layout !== void 0 && await this.desktop.layoutIdentity?.(display.id) !== layout) this.finish(session, "\u663E\u793A\u5668\u5E03\u5C40\u5DF2\u53D8\u5316\uFF0C\u8FDC\u63A7\u5DF2\u505C\u6B62");
@@ -13342,7 +13447,7 @@ var RemoteManager = class {
         }
       }, 1e3);
       session.monitor.unref();
-      return { remoteId: session.remoteId, bindToken, expiresAt: new Date(expiresAt).toISOString(), display, revision: 1, stunUrls: this.stunUrls(), budget: { ...REMOTE_DEFAULTS, totalBitrate: this.config.totalBitrate, videoMaxBitrate: this.config.videoMaxBitrate }, protocolVersion: 1, heartbeatAck: true };
+      return { remoteId: session.remoteId, bindToken, expiresAt: new Date(expiresAt).toISOString(), display, revision: 1, stunUrls: this.stunUrls(), budget, quality, qualityModes: RemoteQualitySchema.options, protocolVersion: 1, heartbeatAck: true };
     } catch (error) {
       this.finish(session);
       throw error;
@@ -13372,18 +13477,18 @@ var RemoteManager = class {
 };
 
 // src/tool-selection.ts
-import { randomBytes as randomBytes3, randomUUID as randomUUID16 } from "node:crypto";
+import { randomBytes as randomBytes3, randomUUID as randomUUID17 } from "node:crypto";
 import { access as access3, constants as constants6, readFile as readFile9 } from "node:fs/promises";
-import { platform as platform4 } from "node:os";
+import { platform as platform5 } from "node:os";
 import { isDeepStrictEqual } from "node:util";
 
 // src/node-resolution.ts
-import { realpath as realpath7, stat as stat9 } from "node:fs/promises";
-import { execFile as execFile6 } from "node:child_process";
-import { promisify as promisify6 } from "node:util";
-import { join as join11 } from "node:path";
-import { homedir as homedir2, platform as platform3 } from "node:os";
-var run4 = promisify6(execFile6);
+import { realpath as realpath7, stat as stat10 } from "node:fs/promises";
+import { execFile as execFile7 } from "node:child_process";
+import { promisify as promisify7 } from "node:util";
+import { join as join12 } from "node:path";
+import { homedir as homedir2, platform as platform4 } from "node:os";
+var run4 = promisify7(execFile7);
 var VERSION_MANAGED_SEGMENTS = /* @__PURE__ */ new Set([".nvm", "nvm", ".volta", "volta", ".fnm", "fnm", ".asdf", "asdf", ".mise", "mise"]);
 var execProbe = async (path) => {
   try {
@@ -13397,7 +13502,7 @@ function isVersionManagedPath(path) {
   return path.split("/").some((segment) => VERSION_MANAGED_SEGMENTS.has(segment));
 }
 function nodeCandidates() {
-  return platform3() === "darwin" ? ["/opt/homebrew/bin/node", "/opt/homebrew/opt/node/bin/node", "/usr/local/bin/node", "/usr/bin/node"] : ["/usr/local/bin/node", "/usr/bin/node", "/snap/bin/node"];
+  return platform4() === "darwin" ? ["/opt/homebrew/bin/node", "/opt/homebrew/opt/node/bin/node", "/usr/local/bin/node", "/usr/bin/node"] : ["/usr/local/bin/node", "/usr/bin/node", "/snap/bin/node"];
 }
 async function resolveNodePath(options = {}) {
   const probe = options.probe ?? execProbe;
@@ -13405,26 +13510,26 @@ async function resolveNodePath(options = {}) {
     if (!await probe(options.pinned)) throw new Error(`--node-path ${options.pinned} is not a working node executable`);
     return { nodePath: options.pinned, source: "pinned" };
   }
-  let exec = options.execPath ?? process.execPath;
+  let exec2 = options.execPath ?? process.execPath;
   try {
-    exec = await realpath7(exec);
+    exec2 = await realpath7(exec2);
   } catch {
   }
-  if (!isVersionManagedPath(exec) && await probe(exec)) return { nodePath: exec, source: "exec" };
+  if (!isVersionManagedPath(exec2) && await probe(exec2)) return { nodePath: exec2, source: "exec" };
   for (const candidate of nodeCandidates()) if (!isVersionManagedPath(candidate) && await probe(candidate)) return { nodePath: candidate, source: "candidate" };
-  if (await probe(exec)) return { nodePath: exec, source: "exec", warning: `only a version-manager node was found (${exec}); install node with the system package manager or pass --node-path, otherwise the service breaks when that node is upgraded` };
+  if (await probe(exec2)) return { nodePath: exec2, source: "exec", warning: `only a version-manager node was found (${exec2}); install node with the system package manager or pass --node-path, otherwise the service breaks when that node is upgraded` };
   return { nodePath: null, source: "exec" };
 }
 function toolSearchDirs(kind) {
-  const dirs = [...describeTool(kind).searchDirs, join11(homedir2(), ".local", "bin"), join11(homedir2(), ".opencode", "bin"), join11(homedir2(), ".codex", "bin")];
+  const dirs = [...describeTool(kind).searchDirs, join12(homedir2(), ".local", "bin"), join12(homedir2(), ".opencode", "bin"), join12(homedir2(), ".codex", "bin")];
   return [...new Set(dirs)];
 }
 async function resolveCommandOnPath(name, extraDirs = []) {
   const dirs = [...(process.env.PATH ?? "").split(":"), ...extraDirs].filter(Boolean);
   for (const dir of new Set(dirs)) {
-    const full = join11(dir, name);
+    const full = join12(dir, name);
     try {
-      const info = await stat9(full);
+      const info = await stat10(full);
       if (info.isFile() && info.mode & 73) return full;
     } catch {
     }
@@ -13507,7 +13612,7 @@ var ToolSelection = class {
     });
   }
   modelCommand(projectId) {
-    return { type: "command", id: randomUUID16(), botId: this.config.botId, operation: "configuration.models", projectId, payload: {} };
+    return { type: "command", id: randomUUID17(), botId: this.config.botId, operation: "configuration.models", projectId, payload: {} };
   }
   profiles(raw) {
     return raw.toolProfiles && typeof raw.toolProfiles === "object" && !Array.isArray(raw.toolProfiles) ? raw.toolProfiles : {};
@@ -13522,7 +13627,7 @@ var ToolSelection = class {
     const discovered = this.discovered.get(kind);
     if (discovered) return discovered;
     let command = await resolveCommandOnPath(kind, toolSearchDirs(kind));
-    if (!command && platform4() === "darwin") {
+    if (!command && platform5() === "darwin") {
       const candidates = kind === "codex" ? [
         "/Applications/ChatGPT.app/Contents/Resources/codex-cli/CodexCLI.app/Contents/MacOS/codex",
         "/Applications/ChatGPT.app/Contents/Resources/codex"
@@ -13566,19 +13671,19 @@ var ToolSelection = class {
 // src/daemon.ts
 async function runDaemon(configPath, authenticate = verifyHostPassword) {
   const config = await loadConfig(configPath);
-  await mkdir8(config.stateDirectory, { recursive: true, mode: 448 });
-  const workspace = new Workspace(config.projects), uploads = new Uploads(workspace, join12(config.stateDirectory, "uploads")), journal = new Journal(join12(config.stateDirectory, "journal"));
+  await mkdir9(config.stateDirectory, { recursive: true, mode: 448 });
+  const workspace = new Workspace(config.projects), uploads = new Uploads(workspace, join13(config.stateDirectory, "uploads")), journal = new Journal(join13(config.stateDirectory, "journal"));
   let secureChat;
   function emit(projectId, event, data) {
     secureChat?.publish(projectId, event, data);
   }
   const terminals = new TerminalManager(workspace, (owner, project, event, data) => secureChat?.sendTo(owner, project, event, data));
-  const desktopBackend = new PlatformDesktop(config.stateDirectory), screenLock = new PlatformScreenLock(config.stateDirectory);
-  const desktop = new DesktopManager(desktopBackend, screenLock);
+  const desktopBackend = new PlatformDesktop(config.stateDirectory), desktopSession = new PlatformDesktopSession();
+  const desktop = new DesktopManager(desktopBackend);
   const remote = new RemoteManager(
     config,
     desktopBackend,
-    screenLock,
+    desktopSession,
     (owner, event, data) => secureChat?.sendTo(owner, "", event, data),
     (owner) => secureChat?.touchUserActivity(owner) ?? false
   );
@@ -13589,7 +13694,7 @@ async function runDaemon(configPath, authenticate = verifyHostPassword) {
     });
     return { runtime, adapter };
   });
-  const artifacts = new Artifacts(workspace, join12(config.stateDirectory, "artifacts"), emit);
+  const artifacts = new Artifacts(workspace, join13(config.stateDirectory, "artifacts"), emit);
   async function dispatch(c, secureSessionId) {
     if (c.operation.startsWith("desktop.remote.")) return remote.dispatch(c, secureSessionId);
     if (c.operation.startsWith("desktop.")) return desktop.dispatch(c, secureSessionId);
@@ -13712,11 +13817,13 @@ export {
   Workspace,
   atomicJson,
   Uploads,
+  ensureHostAuth,
   proxyVersion,
   ensureHostIdentity,
   createRuntime,
   createAdapter,
   checkTerminalSupport,
+  PlatformDesktopSession,
   RemoteManager,
   isVersionManagedPath,
   resolveNodePath,