@spencer-kit/coder-studio 0.3.1 → 0.3.2

package/dist/esm/server-runner.mjs

@@ -115,8 +115,8 @@ var init_plugin = __esm({
     init_web_ui_routing();
     init_login_protection();
     AUTH_COOKIE_NAME = "coder_studio_auth";
-    isPublicPath = (path8) => {
-      const pathname = getRequestPathname(path8);
+    isPublicPath = (path9) => {
+      const pathname = getRequestPathname(path9);
       return pathname === "/" || pathname === "/login" || pathname === "/healthz" || pathname === "/auth/status" || pathname === "/auth/login" || pathname === "/auth/logout" || pathname.startsWith("/@") || isPublicStaticPath(pathname);
     };
     parseCookies = (cookieHeader) => {
@@ -307,6 +307,25 @@ function parseLogLevel(value) {
       return void 0;
   }
 }
+function resolveDefaultAppVersion() {
+  if (cachedAppVersion) {
+    return cachedAppVersion;
+  }
+  const packageJsonPath = [new URL("../../cli/package.json", import.meta.url)].find(
+    (candidate) => fs.existsSync(candidate)
+  );
+  if (!packageJsonPath) {
+    cachedAppVersion = "0.0.0";
+    return cachedAppVersion;
+  }
+  try {
+    const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+    cachedAppVersion = typeof pkg.version === "string" ? pkg.version : "0.0.0";
+  } catch {
+    cachedAppVersion = "0.0.0";
+  }
+  return cachedAppVersion;
+}
 function resolveDbPath(explicit) {
   if (explicit) return explicit;
   if (process.env.NODE_ENV !== "production") {
@@ -345,6 +364,7 @@ function parseServerConfig(overrides) {
     uploadsDir,
     logLevel: overrides?.logLevel ?? parseLogLevel(process.env.LOG_LEVEL) ?? "info",
     webRoot: overrides?.webRoot,
+    appVersion: overrides?.appVersion ?? process.env.CODER_STUDIO_APP_VERSION ?? resolveDefaultAppVersion(),
     auth: overrides?.auth || {
       enabled: !noAuth && !!password,
       password
@@ -357,7 +377,7 @@ function ensureDataDir(config) {
   }
   fs.mkdirSync(path.dirname(config.dataDir), { recursive: true });
 }
-var cachedTestUploadsDir;
+var cachedTestUploadsDir, cachedAppVersion;
 var init_config = __esm({
   "packages/server/src/config.ts"() {
     "use strict";
@@ -365,7 +385,7 @@ var init_config = __esm({
 });
 
 // packages/core/src/runtime.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname2, join as join2 } from "node:path";
 function getRuntimeDir() {
@@ -385,14 +405,14 @@ function getRuntimePath() {
 function writeRuntimeConfig(config) {
   const runtimePath = getRuntimePath();
   const runtimeDir = dirname2(runtimePath);
-  if (!existsSync3(runtimeDir)) {
+  if (!existsSync4(runtimeDir)) {
     mkdirSync2(runtimeDir, { recursive: true });
   }
   writeFileSync2(runtimePath, JSON.stringify(config, null, 2), "utf-8");
 }
 function deleteRuntimeConfig() {
   const runtimePath = getRuntimePath();
-  if (existsSync3(runtimePath)) {
+  if (existsSync4(runtimePath)) {
     unlinkSync(runtimePath);
   }
 }
@@ -765,6 +785,190 @@ var init_src = __esm({
   }
 });
 
+// packages/utils/src/direct-execution.ts
+import { posix, resolve as resolve2 } from "node:path";
+function isWindowsDrivePath(path9) {
+  return /^[A-Za-z]:\//.test(path9);
+}
+function normalizeComparablePath(path9) {
+  let normalized = path9.replace(/\\/g, "/");
+  if (/^\/[A-Za-z]:\//.test(normalized)) {
+    normalized = normalized.slice(1);
+  }
+  if (normalized.startsWith("//")) {
+    normalized = `//${posix.normalize(normalized.slice(2))}`;
+  } else {
+    normalized = posix.normalize(normalized);
+  }
+  if (isWindowsDrivePath(normalized) || normalized.startsWith("//")) {
+    normalized = normalized.toLowerCase();
+  }
+  return normalized;
+}
+function normalizeModuleUrlPath(moduleUrl) {
+  let url;
+  try {
+    url = new URL(moduleUrl);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "file:") {
+    return null;
+  }
+  const path9 = `${url.host ? `//${url.host}` : ""}${decodeURIComponent(url.pathname)}`;
+  return normalizeComparablePath(path9);
+}
+function normalizeArgvPath(argv1) {
+  const isAbsoluteWindowsPath = /^[A-Za-z]:[\\/]/.test(argv1) || /^\\\\/.test(argv1);
+  return normalizeComparablePath(isAbsoluteWindowsPath ? argv1 : resolve2(argv1));
+}
+function isDirectExecution(moduleUrl, argv1 = process.argv[1]) {
+  if (argv1 === void 0) {
+    return false;
+  }
+  const modulePath = normalizeModuleUrlPath(moduleUrl);
+  if (modulePath === null) {
+    return false;
+  }
+  return modulePath === normalizeArgvPath(argv1);
+}
+var init_direct_execution = __esm({
+  "packages/utils/src/direct-execution.ts"() {
+    "use strict";
+  }
+});
+
+// packages/utils/src/windows-shim.ts
+function shouldUseShellForCommand(command, platform = process.platform) {
+  return platform === "win32" && WINDOWS_CMD_SHIMS.has(command.toLowerCase());
+}
+var WINDOWS_CMD_SHIMS;
+var init_windows_shim = __esm({
+  "packages/utils/src/windows-shim.ts"() {
+    "use strict";
+    WINDOWS_CMD_SHIMS = /* @__PURE__ */ new Set(["pnpm", "npm", "npx"]);
+  }
+});
+
+// packages/utils/src/windows-shim-resolver.ts
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+function resolveSpawnArgv(argv, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "win32") {
+    return [...argv];
+  }
+  const command = argv[0];
+  if (command === void 0) {
+    return [];
+  }
+  const restArgs = argv.slice(1);
+  const readFileSync9 = deps.readFileSync ?? ((file) => fs2.readFileSync(file, "utf8"));
+  const existsSync10 = deps.existsSync ?? fs2.existsSync;
+  const pathEnv = deps.pathEnv ?? process.env.Path ?? process.env.PATH ?? "";
+  const pathExt = deps.pathExt ?? process.env.PATHEXT ?? DEFAULT_PATHEXT;
+  const resolved = resolveExecutablePath(command, pathEnv, pathExt, existsSync10);
+  if (!resolved) {
+    return [...argv];
+  }
+  const ext = path2.win32.extname(resolved).toLowerCase();
+  if (ext === ".exe" || ext === ".com") {
+    return [resolved, ...restArgs];
+  }
+  if (ext === ".cmd" || ext === ".bat") {
+    let content;
+    try {
+      content = readFileSync9(resolved);
+    } catch {
+      return ["cmd.exe", "/d", "/s", "/c", resolved, ...restArgs];
+    }
+    const parsed = parseCmdShim(resolved, content);
+    if (parsed) {
+      return [parsed.node, parsed.entry, ...restArgs];
+    }
+    return ["cmd.exe", "/d", "/s", "/c", resolved, ...restArgs];
+  }
+  return [...argv];
+}
+function parseCmdShim(shimPath, content) {
+  const dp0Dir = path2.win32.dirname(shimPath);
+  const entryMatch = content.match(/"([^"\r\n]+\.js)"\s+%\*/i);
+  const entryRaw = entryMatch?.[1];
+  if (!entryRaw) {
+    return null;
+  }
+  const entry = expandShimVars(entryRaw, dp0Dir);
+  const nodeMatch = content.match(/"([^"\r\n]*node\.exe)"/i) ?? content.match(/"([^"\r\n]*node)"/i);
+  const nodeRaw = nodeMatch?.[1];
+  const node = nodeRaw ? expandShimVars(nodeRaw, dp0Dir) : "node";
+  return { node, entry };
+}
+function expandShimVars(value, dp0Dir) {
+  const dp0WithSlash = dp0Dir.endsWith("\\") ? dp0Dir : `${dp0Dir}\\`;
+  let expanded = value;
+  expanded = expanded.replace(/%~dp0/gi, dp0WithSlash);
+  expanded = expanded.replace(/%dp0%/gi, dp0WithSlash);
+  if (path2.win32.isAbsolute(expanded)) {
+    return path2.win32.normalize(expanded);
+  }
+  return path2.win32.resolve(dp0Dir, expanded);
+}
+function parsePathExt(pathExt) {
+  return pathExt.split(";").map((entry) => entry.trim().toLowerCase()).filter((entry) => entry.length > 0);
+}
+function resolveExecutablePath(command, pathEnv, pathExt, existsSync10) {
+  const hasExt = path2.win32.extname(command).length > 0;
+  const extensions = parsePathExt(pathExt);
+  if (path2.win32.isAbsolute(command)) {
+    if (existsSync10(command)) {
+      return command;
+    }
+    if (!hasExt) {
+      for (const ext of extensions) {
+        const candidate = command + ext;
+        if (existsSync10(candidate)) {
+          return candidate;
+        }
+      }
+    }
+    return null;
+  }
+  const dirs = pathEnv.split(";").map((dir) => dir.trim()).filter((dir) => dir.length > 0);
+  for (const dir of dirs) {
+    if (hasExt) {
+      const candidate = path2.win32.join(dir, command);
+      if (existsSync10(candidate)) {
+        return candidate;
+      }
+      continue;
+    }
+    for (const ext of extensions) {
+      const candidate = path2.win32.join(dir, command + ext);
+      if (existsSync10(candidate)) {
+        return candidate;
+      }
+    }
+  }
+  return null;
+}
+var DEFAULT_PATHEXT;
+var init_windows_shim_resolver = __esm({
+  "packages/utils/src/windows-shim-resolver.ts"() {
+    "use strict";
+    DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC";
+  }
+});
+
+// packages/utils/src/index.ts
+var init_src2 = __esm({
+  "packages/utils/src/index.ts"() {
+    "use strict";
+    init_direct_execution();
+    init_windows_shim();
+    init_windows_shim_resolver();
+  }
+});
+
 // packages/server/src/fs/image.ts
 import { extname } from "path";
 function getImageTypeInfo(filePath) {
@@ -791,10 +995,10 @@ var init_image = __esm({
 // packages/server/src/fs/file-io.ts
 import { createHash } from "crypto";
 import { readFile as fsReadFile, writeFile as fsWriteFile, mkdir, rm, stat } from "fs/promises";
-import { dirname as dirname3, resolve as resolve2 } from "path";
-async function statSafe(path8) {
+import { dirname as dirname3, resolve as resolve3 } from "path";
+async function statSafe(path9) {
   try {
-    return await stat(path8);
+    return await stat(path9);
   } catch {
     return null;
   }
@@ -825,8 +1029,8 @@ async function deleteEntry(rootPath, relPath) {
   await rm(abs, { recursive: true });
 }
 function resolveSafe(root, relPath) {
-  const absRoot = resolve2(root);
-  const abs = resolve2(absRoot, relPath);
+  const absRoot = resolve3(root);
+  const abs = resolve3(absRoot, relPath);
   if (!abs.startsWith(absRoot + "/") && abs !== absRoot) {
     throw { code: "path_escape", message: "Path escapes workspace root" };
   }
@@ -964,7 +1168,7 @@ var init_constants = __esm({
 // packages/server/src/uploads/paths.ts
 import { randomUUID } from "node:crypto";
 import { lstat, mkdir as mkdir2 } from "node:fs/promises";
-import path2 from "node:path";
+import path3 from "node:path";
 function sanitizeOriginalName(input) {
   let sanitized = "";
   for (const char of input.trim()) {
@@ -1000,9 +1204,9 @@ async function assertDirectorySegmentSafe(segmentPath) {
   }
 }
 async function ensureSafeUploadDir(rootDir, targetDir) {
-  const resolvedRoot = path2.resolve(rootDir);
-  const resolvedTarget = path2.resolve(targetDir);
-  if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(`${resolvedRoot}${path2.sep}`)) {
+  const resolvedRoot = path3.resolve(rootDir);
+  const resolvedTarget = path3.resolve(targetDir);
+  if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(`${resolvedRoot}${path3.sep}`)) {
     throw new Error(`target dir escaped uploads root: ${resolvedTarget}`);
   }
   try {
@@ -1015,13 +1219,13 @@ async function ensureSafeUploadDir(rootDir, targetDir) {
     await mkdir2(resolvedRoot, { recursive: true });
     await assertDirectorySegmentSafe(resolvedRoot);
   }
-  const relative3 = path2.relative(resolvedRoot, resolvedTarget);
+  const relative3 = path3.relative(resolvedRoot, resolvedTarget);
   if (!relative3) {
     return;
   }
   let current = resolvedRoot;
-  for (const segment of relative3.split(path2.sep)) {
-    current = path2.join(current, segment);
+  for (const segment of relative3.split(path3.sep)) {
+    current = path3.join(current, segment);
     try {
       await assertDirectorySegmentSafe(current);
       continue;
@@ -1046,11 +1250,11 @@ function generateBucketPath(input) {
   validateWorkspaceId(input.workspaceId);
   const now = input.now ?? /* @__PURE__ */ new Date();
   const dateStr = now.toISOString().slice(0, 10);
-  const dir = path2.join(input.uploadsDir, input.workspaceId, dateStr);
+  const dir = path3.join(input.uploadsDir, input.workspaceId, dateStr);
   const sanitizedName = sanitizeOriginalName(input.originalName);
   const uuid8 = randomUUID().replace(/-/g, "").slice(0, 8);
-  const absolutePath = path2.resolve(dir, `${uuid8}-${sanitizedName}`);
-  const uploadsRoot = `${path2.resolve(input.uploadsDir)}${path2.sep}`;
+  const absolutePath = path3.resolve(dir, `${uuid8}-${sanitizedName}`);
+  const uploadsRoot = `${path3.resolve(input.uploadsDir)}${path3.sep}`;
   if (!absolutePath.startsWith(uploadsRoot)) {
     throw new Error(`generated upload path escaped uploads root: ${absolutePath}`);
   }
@@ -1073,7 +1277,7 @@ var init_paths = __esm({
 
 // packages/server/src/uploads/cleanup.ts
 import { readdir, rm as rm2, rmdir, stat as stat3, unlink } from "node:fs/promises";
-import path3 from "node:path";
+import path4 from "node:path";
 async function listFilesRecursive(root) {
   let entries;
   try {
@@ -1086,7 +1290,7 @@ async function listFilesRecursive(root) {
   }
   const files = [];
   for (const entry of entries) {
-    const childPath = path3.join(root, entry.name);
+    const childPath = path4.join(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listFilesRecursive(childPath));
       continue;
@@ -1117,7 +1321,7 @@ async function pruneEmptyDirectories(root) {
     if (!entry.isDirectory()) {
       continue;
     }
-    await pruneEmptyDirectories(path3.join(root, entry.name));
+    await pruneEmptyDirectories(path4.join(root, entry.name));
   }
   const remainingEntries = await readdir(root).catch(() => []);
   if (remainingEntries.length === 0) {
@@ -1126,12 +1330,12 @@ async function pruneEmptyDirectories(root) {
 }
 async function deleteWorkspaceUploads(uploadsDir, workspaceId) {
   validateWorkspaceId(workspaceId);
-  const bucket = path3.join(uploadsDir, workspaceId);
+  const bucket = path4.join(uploadsDir, workspaceId);
   await rm2(bucket, { recursive: true, force: true });
 }
 async function enforceBucketCap(uploadsDir, workspaceId, capBytes, logger) {
   validateWorkspaceId(workspaceId);
-  const bucket = path3.join(uploadsDir, workspaceId);
+  const bucket = path4.join(uploadsDir, workspaceId);
   const files = await listFilesRecursive(bucket);
   const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
   if (totalBytes <= capBytes) {
@@ -1171,7 +1375,7 @@ async function runStartupGc(uploadsDir, logger) {
     if (!workspaceEntry.isDirectory()) {
       continue;
     }
-    const workspaceDir = path3.join(uploadsDir, workspaceEntry.name);
+    const workspaceDir = path4.join(uploadsDir, workspaceEntry.name);
     const dateEntries = await readdir(workspaceDir, { withFileTypes: true }).catch(
       () => []
     );
@@ -1179,7 +1383,7 @@ async function runStartupGc(uploadsDir, logger) {
       if (!dateEntry.isDirectory()) {
         continue;
       }
-      const dateDir = path3.join(workspaceDir, dateEntry.name);
+      const dateDir = path4.join(workspaceDir, dateEntry.name);
       const files = await listFilesRecursive(dateDir);
       for (const file of files) {
         if (file.mtimeMs >= cutoffMs) {
@@ -1570,7 +1774,7 @@ var init_app = __esm({
 });
 
 // packages/server/src/config/codex-config-audit.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync5, renameSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { dirname as dirname4, join as join3 } from "node:path";
 function resolveCodexConfigPath() {
@@ -1581,15 +1785,15 @@ function resolveCodexConfigPath() {
   return join3(homedir3(), ".codex", "config.toml");
 }
 function auditCodexConfigToml(configPath) {
-  const path8 = configPath ?? resolveCodexConfigPath();
-  if (!existsSync4(path8)) {
-    return { configPath: path8, exists: false, findings: [] };
+  const path9 = configPath ?? resolveCodexConfigPath();
+  if (!existsSync6(path9)) {
+    return { configPath: path9, exists: false, findings: [] };
   }
   let content;
   try {
-    content = readFileSync3(path8, "utf-8");
+    content = readFileSync5(path9, "utf-8");
   } catch {
-    return { configPath: path8, exists: false, findings: [] };
+    return { configPath: path9, exists: false, findings: [] };
   }
   const lines = content.split(/\r?\n/);
   const findings = [];
@@ -1597,13 +1801,13 @@ function auditCodexConfigToml(configPath) {
   if (notifyFinding) findings.push(notifyFinding);
   const codexHooksFinding = detectCodexHooksFlag(lines);
   if (codexHooksFinding) findings.push(codexHooksFinding);
-  return { configPath: path8, exists: true, findings };
+  return { configPath: path9, exists: true, findings };
 }
 function cleanupCodexConfigToml(configPath, opts) {
   if (opts.removeIds.length === 0) {
     return { removed: [], backupPath: null, noop: true };
   }
-  if (!existsSync4(configPath)) {
+  if (!existsSync6(configPath)) {
     return { removed: [], backupPath: null, noop: true };
   }
   const audit = auditCodexConfigToml(configPath);
@@ -1611,7 +1815,7 @@ function cleanupCodexConfigToml(configPath, opts) {
   if (selected.length === 0) {
     return { removed: [], backupPath: null, noop: true };
   }
-  const original = readFileSync3(configPath, "utf-8");
+  const original = readFileSync5(configPath, "utf-8");
   const backupPath = writeBackup(configPath, original, opts.backupDir);
   const linesToDrop = /* @__PURE__ */ new Set();
   for (const finding of selected) {
@@ -1713,7 +1917,7 @@ function countBrackets(s) {
 }
 function writeBackup(configPath, original, backupDir) {
   const dir = backupDir ?? dirname4(configPath);
-  if (!existsSync4(dir)) {
+  if (!existsSync6(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
   const ts = formatTimestamp(/* @__PURE__ */ new Date());
@@ -1754,35 +1958,78 @@ var init_codex_config_audit = __esm({
   }
 });
 
+// packages/server/src/provider-runtime/command-runner.ts
+import { spawn } from "node:child_process";
+async function runCommandAsString(file, args, options) {
+  return new Promise((resolve4, reject) => {
+    const child = spawn(file, args, {
+      shell: shouldUseShellForCommand(file, process.platform),
+      windowsHide: options?.windowsHide ?? true
+    });
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    child.stdout?.on("data", (chunk) => {
+      stdoutChunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderrChunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    });
+    child.on("error", (error) => {
+      reject(
+        Object.assign(error, {
+          stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+          stderr: Buffer.concat(stderrChunks).toString("utf8")
+        })
+      );
+    });
+    child.on("close", (code) => {
+      const stdout = Buffer.concat(stdoutChunks).toString("utf8");
+      const stderr = Buffer.concat(stderrChunks).toString("utf8");
+      if (code === 0) {
+        resolve4({ stdout, stderr });
+        return;
+      }
+      reject(
+        Object.assign(new Error(`Command failed with exit code ${code ?? "unknown"}`), {
+          exitCode: code ?? void 0,
+          stdout,
+          stderr
+        })
+      );
+    });
+  });
+}
+var init_command_runner = __esm({
+  "packages/server/src/provider-runtime/command-runner.ts"() {
+    "use strict";
+    init_src2();
+  }
+});
+
 // packages/server/src/provider-runtime/command-check.ts
-import { execFile as nodeExecFile } from "node:child_process";
-import { promisify } from "node:util";
 function getCommandLookupExecutable(platform) {
   return platform === "win32" ? "where" : "which";
 }
 async function checkCommandAvailable(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const execFile2 = deps.execFile ?? ((file, args) => execFileAsync(file, args));
+  const runCommand2 = deps.runCommand ?? runCommandAsString;
   const lookup = getCommandLookupExecutable(platform);
   try {
-    await execFile2(lookup, [command]);
-    return true;
+    const { stdout } = await runCommand2(lookup, [command], { windowsHide: true });
+    return stdout.trim().length > 0;
   } catch {
     return false;
   }
 }
-var execFileAsync;
 var init_command_check = __esm({
   "packages/server/src/provider-runtime/command-check.ts"() {
     "use strict";
-    execFileAsync = promisify(nodeExecFile);
+    init_command_runner();
   }
 });
 
 // packages/server/src/provider-runtime/install-manager.ts
-import { execFile as nodeExecFile2 } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { promisify as promisify2 } from "node:util";
 function getErrorDetails(error) {
   if (error instanceof Error) {
     const record = error;
@@ -1857,12 +2104,12 @@ function cloneFailure(failure) {
     }
   };
 }
-var execFileAsync2, EXCERPT_LIMIT, ProviderInstallManager;
+var EXCERPT_LIMIT, ProviderInstallManager;
 var init_install_manager = __esm({
   "packages/server/src/provider-runtime/install-manager.ts"() {
     "use strict";
     init_command_check();
-    execFileAsync2 = promisify2(nodeExecFile2);
+    init_command_runner();
     EXCERPT_LIMIT = 400;
     ProviderInstallManager = class {
       providers = /* @__PURE__ */ new Map();
@@ -2047,7 +2294,7 @@ var init_install_manager = __esm({
         };
       }
       async runPreparedJob(provider, job) {
-        const execFile2 = this.deps.execFile ?? ((file, args) => execFileAsync2(file, args));
+        const runCommand2 = this.deps.runCommand ?? runCommandAsString;
         job.status = "running";
         this.jobs.set(job.jobId, job);
         for (const step of job.steps) {
@@ -2074,7 +2321,7 @@ var init_install_manager = __esm({
                 return;
               }
             } else {
-              const result = await execFile2(step.command, step.args);
+              const result = await runCommand2(step.command, step.args, { windowsHide: true });
               step.stdoutExcerpt = excerpt(result.stdout);
               step.stderrExcerpt = excerpt(result.stderr);
             }
@@ -2410,7 +2657,7 @@ var init_idle_heuristics2 = __esm({
 });
 
 // packages/core/src/index.ts
-var init_src2 = __esm({
+var init_src3 = __esm({
   "packages/core/src/index.ts"() {
     "use strict";
     init_events();
@@ -2447,14 +2694,16 @@ var init_provider_config = __esm({
     SUPPORTED_PROVIDER_IDS = ["claude", "codex"];
     supportedProviderIds = new Set(SUPPORTED_PROVIDER_IDS);
     ProviderLaunchConfigInputSchema = z4.object({
-      additionalArgs: z4.array(z4.string()).optional()
+      additionalArgs: z4.array(z4.string()).optional(),
+      envVars: z4.record(z4.string(), z4.string()).optional()
     }).strict();
     ProviderSettingsSchema = z4.object({
       claude: ProviderLaunchConfigInputSchema.optional(),
       codex: ProviderLaunchConfigInputSchema.optional()
     }).strict();
     ProviderLaunchConfigSchema = z4.object({
-      additionalArgs: z4.array(z4.string()).default([])
+      additionalArgs: z4.array(z4.string()).default([]),
+      envVars: z4.record(z4.string(), z4.string()).optional()
     });
   }
 });
@@ -2720,7 +2969,7 @@ var NOOP_SESSION_LOGGER, SessionManager, ActiveSession;
 var init_manager = __esm({
   "packages/server/src/session/manager.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     init_provider_config();
     init_session_repo();
     init_pty_state_detector();
@@ -3261,7 +3510,7 @@ var init_database = __esm({
 
 // packages/server/src/storage/db.ts
 import { DatabaseSync } from "node:sqlite";
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { join as join4 } from "path";
 function normalizeSql(sql) {
   return (sql ?? "").replace(/\s+/g, " ").trim();
@@ -3410,7 +3659,7 @@ var init_db = __esm({
     "use strict";
     init_database();
     SCHEMA_PATH = join4(import.meta.dirname, "migrations", "001_init.sql");
-    SCHEMA_SQL = readFileSync4(SCHEMA_PATH, "utf-8");
+    SCHEMA_SQL = readFileSync6(SCHEMA_PATH, "utf-8");
     LEGACY_TABLES = ["hook_registrations", "_migrations"];
     LEGACY_SESSION_COLUMNS = ["resume_id", "transcript_path"];
     EXPECTED_SCHEMA_ENTRIES = buildExpectedSchemaEntries();
@@ -3960,11 +4209,11 @@ function parseOrdinaryChangedEntry(record, staged, modified, deleted) {
   if (!xy) {
     return;
   }
-  const path8 = parts.slice(8).join(" ");
-  if (!path8) {
+  const path9 = parts.slice(8).join(" ");
+  if (!path9) {
     return;
   }
-  pushChange({ path: path8 }, xy, staged, modified, deleted);
+  pushChange({ path: path9 }, xy, staged, modified, deleted);
 }
 function parseRenamedEntry(record, oldPathRecord, staged, modified, deleted) {
   const parts = record.split(" ");
@@ -3976,12 +4225,12 @@ function parseRenamedEntry(record, oldPathRecord, staged, modified, deleted) {
   const pathAndMaybeOldPath = pathTokens.join(" ");
   const inlinePathParts = pathAndMaybeOldPath.split("	");
   const fallbackPath = !oldPathRecord && inlinePathParts.length === 1 && pathTokens.length > 1 ? pathTokens.slice(0, -1).join(" ") : void 0;
-  const path8 = fallbackPath ?? inlinePathParts[0];
-  if (!path8) {
+  const path9 = fallbackPath ?? inlinePathParts[0];
+  if (!path9) {
     return;
   }
   const oldPath = (oldPathRecord && !oldPathRecord.startsWith("#") ? oldPathRecord : void 0) ?? inlinePathParts[1] ?? (pathTokens.length > 1 ? pathTokens[pathTokens.length - 1] : void 0);
-  pushChange({ path: path8, oldPath }, xy, staged, modified, deleted);
+  pushChange({ path: path9, oldPath }, xy, staged, modified, deleted);
 }
 function pushChange(change, xy, staged, modified, deleted) {
   const indexStatus = xy[0];
@@ -4008,9 +4257,9 @@ var init_status_parser = __esm({
 import { execFile } from "child_process";
 import { mkdir as mkdir3, mkdtemp, rm as rm4, writeFile as writeFile3 } from "fs/promises";
 import os2 from "os";
-import path4 from "path";
+import path5 from "path";
 async function runGit(cwd, args, options = {}) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const gitArgs = [
       ...options.config?.flatMap(([key, value]) => ["-c", `${key}=${value}`]) ?? [],
       ...args
@@ -4030,13 +4279,14 @@ async function runGit(cwd, args, options = {}) {
           ...options.env
         },
         maxBuffer: 10 * 1024 * 1024,
-        timeout: options.timeoutMs
+        timeout: options.timeoutMs,
+        windowsHide: true
       },
       (err, stdout, stderr) => {
         if (err) {
           reject(new GitError(err.message, stderr));
         } else {
-          resolve3({ stdout, stderr });
+          resolve4({ stdout, stderr });
         }
       }
     );
@@ -4085,12 +4335,12 @@ async function discardChanges(cwd, paths) {
   if (paths.length === 0) return;
   const trackedPaths = [];
   const untrackedPaths = [];
-  for (const path8 of paths) {
+  for (const path9 of paths) {
     try {
-      await runGit(cwd, ["ls-files", "--error-unmatch", "--", path8]);
-      trackedPaths.push(path8);
+      await runGit(cwd, ["ls-files", "--error-unmatch", "--", path9]);
+      trackedPaths.push(path9);
     } catch {
-      untrackedPaths.push(path8);
+      untrackedPaths.push(path9);
     }
   }
   if (trackedPaths.length > 0) {
@@ -4358,9 +4608,9 @@ async function prepareGitAuthExecution(auth, remoteMetadata) {
       }
     };
   }
-  const tempDir = await mkdtemp(path4.join(os2.tmpdir(), "coder-studio-git-auth-"));
-  const hooksDir = path4.join(tempDir, "hooks");
-  const askPassPath = path4.join(tempDir, "askpass.sh");
+  const tempDir = await mkdtemp(path5.join(os2.tmpdir(), "coder-studio-git-auth-"));
+  const hooksDir = path5.join(tempDir, "hooks");
+  const askPassPath = path5.join(tempDir, "askpass.sh");
   await mkdir3(hooksDir, { recursive: true, mode: 448 });
   await writeFile3(
     askPassPath,
@@ -4714,31 +4964,31 @@ var init_context_builder = __esm({
 });
 
 // packages/server/src/terminal/pty-host.ts
-import { chmodSync, existsSync as existsSync5, statSync } from "node:fs";
+import { chmodSync, existsSync as existsSync7, statSync } from "node:fs";
 import { createRequire } from "node:module";
-import path5 from "node:path";
+import path6 from "node:path";
 function ensureNodePtySpawnHelperExecutable(deps = {}) {
   const platform = deps.platform ?? process.platform;
   if (platform !== "darwin") {
     return;
   }
   const arch = deps.arch ?? process.arch;
-  const resolve3 = deps.resolve ?? ((id) => require2.resolve(id));
-  const fileExists = deps.existsSync ?? existsSync5;
+  const resolve4 = deps.resolve ?? ((id) => require2.resolve(id));
+  const fileExists = deps.existsSync ?? existsSync7;
   const stat7 = deps.statSync ?? statSync;
   const chmod = deps.chmodSync ?? chmodSync;
   let packageJsonPath;
   try {
-    packageJsonPath = resolve3(NODE_PTY_PKG);
+    packageJsonPath = resolve4(NODE_PTY_PKG);
   } catch {
     return;
   }
-  const packageDir = path5.dirname(packageJsonPath);
+  const packageDir = path6.dirname(packageJsonPath);
   const helperDir = arch === "arm64" ? "darwin-arm64" : arch === "x64" ? "darwin-x64" : null;
   if (!helperDir) {
     return;
   }
-  const helperPath = path5.join(packageDir, "prebuilds", helperDir, "spawn-helper");
+  const helperPath = path6.join(packageDir, "prebuilds", helperDir, "spawn-helper");
   try {
     if (!fileExists(helperPath)) {
       return;
@@ -4794,7 +5044,7 @@ async function escalateKillWithPolling(pid, signal, options) {
   const startTime = Date.now();
   const deadline = startTime + timeoutMs;
   while (Date.now() < deadline) {
-    await new Promise((resolve3) => setTimeout(resolve3, pollIntervalMs));
+    await new Promise((resolve4) => setTimeout(resolve4, pollIntervalMs));
     if (!isProcessAlive(pid)) {
       return true;
     }
@@ -4806,6 +5056,7 @@ var require2, NODE_PTY_PKG, DEFAULT_POLL_INTERVAL_MS, DEFAULT_TIMEOUT_MS, NodePt
 var init_pty_host = __esm({
   "packages/server/src/terminal/pty-host.ts"() {
     "use strict";
+    init_src2();
     require2 = createRequire(import.meta.url);
     NODE_PTY_PKG = "node-pty/package.json";
     DEFAULT_POLL_INTERVAL_MS = 50;
@@ -4820,7 +5071,13 @@ var init_pty_host = __esm({
           const message = err instanceof Error ? err.message : String(err);
           throw new Error(`node-pty native module not available. ${message}`);
         }
-        const [command, ...args] = argv;
+        if (argv.length === 0) {
+          throw new Error("PTY spawn requires a command");
+        }
+        const [command, ...args] = resolveSpawnArgv(argv, {
+          pathEnv: options.env.Path ?? options.env.PATH,
+          pathExt: options.env.PATHEXT
+        });
         if (command === void 0) {
           throw new Error("PTY spawn requires a command");
         }
@@ -4881,13 +5138,13 @@ var SUPERVISOR_EVALUATION_TIMEOUT_SETTING_KEY;
 var init_settings = __esm({
   "packages/server/src/supervisor/settings.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     SUPERVISOR_EVALUATION_TIMEOUT_SETTING_KEY = "supervisor.evaluationTimeoutSec";
   }
 });
 
 // packages/server/src/supervisor/evaluator.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 function buildPrompt(context) {
   const agentOutput = context.transcriptExcerpt ?? context.terminalExcerpt ?? "";
   const userInput = context.latestUserInput?.trim() ?? "";
@@ -4918,12 +5175,13 @@ async function runCommand(command, timeoutMs, options = {}) {
   if (options.signal?.aborted) {
     throw createSupervisorEvalAbortedError();
   }
-  return await new Promise((resolve3, reject) => {
-    const child = spawn(command.argv[0], command.argv.slice(1), {
+  return await new Promise((resolve4, reject) => {
+    const child = spawn2(command.argv[0], command.argv.slice(1), {
       cwd: command.cwd,
       detached: process.platform !== "win32",
       env: { ...process.env, ...command.env },
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true
     });
     const stdout = [];
     const stderr = [];
@@ -4947,7 +5205,7 @@ async function runCommand(command, timeoutMs, options = {}) {
       }
       settled = true;
       cleanup();
-      resolve3(value);
+      resolve4(value);
     };
     const terminate = (error) => {
       if (terminationError) {
@@ -5154,7 +5412,7 @@ var NOOP_LOGGER2, SupervisorEvaluator;
 var init_evaluator = __esm({
   "packages/server/src/supervisor/evaluator.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     init_provider_config();
     init_pty_host();
     init_settings();
@@ -5257,7 +5515,7 @@ var INJECTABLE_SESSION_STATES, SupervisorInjector;
 var init_injector = __esm({
   "packages/server/src/supervisor/injector.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     INJECTABLE_SESSION_STATES = /* @__PURE__ */ new Set([
       "idle",
       "running"
@@ -5334,12 +5592,12 @@ var init_scheduler = __esm({
 
 // packages/server/src/supervisor/manager.ts
 function createDeferredCompletion() {
-  let resolve3 = () => {
+  let resolve4 = () => {
   };
   const promise = new Promise((innerResolve) => {
-    resolve3 = innerResolve;
+    resolve4 = innerResolve;
   });
-  return { promise, resolve: resolve3 };
+  return { promise, resolve: resolve4 };
 }
 function generateSupervisorId() {
   return `sup_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
@@ -5369,7 +5627,7 @@ var NOOP_LOGGER3, SupervisorManager;
 var init_manager2 = __esm({
   "packages/server/src/supervisor/manager.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     init_context_builder();
     init_evaluator();
     init_injector();
@@ -6278,8 +6536,8 @@ var init_terminal_snapshot_buffer = __esm({
         if (this.pendingWriteCount === 0) {
           return Promise.resolve();
         }
-        return new Promise((resolve3) => {
-          this.drainResolvers.push(resolve3);
+        return new Promise((resolve4) => {
+          this.drainResolvers.push(resolve4);
         });
       }
       resolveDrainIfIdle() {
@@ -6288,8 +6546,8 @@ var init_terminal_snapshot_buffer = __esm({
         }
         const resolvers = this.drainResolvers;
         this.drainResolvers = [];
-        for (const resolve3 of resolvers) {
-          resolve3();
+        for (const resolve4 of resolvers) {
+          resolve4();
         }
       }
       requireTerminal() {
@@ -6608,10 +6866,10 @@ var init_manager3 = __esm({
           }
           return existing.promise;
         }
-        let resolve3 = () => {
+        let resolve4 = () => {
         };
         const promise = new Promise((innerResolve) => {
-          resolve3 = innerResolve;
+          resolve4 = innerResolve;
         });
         let markKillCompleted = () => {
         };
@@ -6624,7 +6882,7 @@ var init_manager3 = __esm({
           markKillCompleted,
           finalized: false,
           promise,
-          resolve: resolve3
+          resolve: resolve4
         });
         void terminal.pty.kill(signal).finally(() => {
           const waiter = this.explicitCloseWaiters.get(terminalId);
@@ -6753,14 +7011,14 @@ var init_manager3 = __esm({
 // packages/server/src/workspace/validator.ts
 import { constants } from "fs";
 import { access, stat as stat5 } from "fs/promises";
-async function validatePath(path8) {
+async function validatePath(path9) {
   try {
-    const stats = await stat5(path8);
+    const stats = await stat5(path9);
     if (!stats.isDirectory()) {
       return { valid: false, error: "Path is not a directory" };
     }
-    await access(path8, constants.R_OK);
-    await access(path8, constants.W_OK);
+    await access(path9, constants.R_OK);
+    await access(path9, constants.W_OK);
     return { valid: true };
   } catch (error) {
     if (error.code === "ENOENT") {
@@ -6777,8 +7035,8 @@ var init_validator = __esm({
   "packages/server/src/workspace/validator.ts"() {
     "use strict";
     WorkspaceValidator = class {
-      async validate(path8) {
-        const result = await validatePath(path8);
+      async validate(path9) {
+        const result = await validatePath(path9);
         if (!result.valid) {
           throw new Error(`Invalid workspace path: ${result.error}`);
         }
@@ -6788,14 +7046,14 @@ var init_validator = __esm({
 });
 
 // packages/server/src/fs/gitignore.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
 import ignore from "ignore";
 import { join as join5, relative } from "path";
-function normalizePath(path8) {
-  return path8.replace(/\\/g, "/");
+function normalizePath(path9) {
+  return path9.replace(/\\/g, "/");
 }
-function relativeToRoot(rootPath, path8) {
-  return normalizePath(relative(rootPath, path8));
+function relativeToRoot(rootPath, path9) {
+  return normalizePath(relative(rootPath, path9));
 }
 function isDefaultTreeIgnored(name) {
   return name.startsWith(".") || name === "node_modules" || name === ".git";
@@ -6803,18 +7061,18 @@ function isDefaultTreeIgnored(name) {
 function isAlwaysTreeIgnored(name) {
   return name === "node_modules" || name === ".git";
 }
-function isIgnoredByGitignore(ig, path8) {
-  if (!path8 || path8.startsWith("..")) {
+function isIgnoredByGitignore(ig, path9) {
+  if (!path9 || path9.startsWith("..")) {
     return false;
   }
-  return ig.ignores(path8) || ig.ignores(`${path8}/`);
+  return ig.ignores(path9) || ig.ignores(`${path9}/`);
 }
 function createGitignoreFilter(rootPath, dirPath) {
   const gitignorePath = join5(rootPath, ".gitignore");
-  if (!existsSync6(gitignorePath)) {
+  if (!existsSync8(gitignorePath)) {
     return (name) => !isDefaultTreeIgnored(name);
   }
-  const gitignoreContent = readFileSync5(gitignorePath, "utf-8");
+  const gitignoreContent = readFileSync7(gitignorePath, "utf-8");
   const ig = ignore().add(gitignoreContent);
   return (name) => {
     if (isAlwaysTreeIgnored(name)) {
@@ -6826,17 +7084,17 @@ function createGitignoreFilter(rootPath, dirPath) {
 }
 function createWatcherIgnoreFilter(rootPath) {
   const gitignorePath = join5(rootPath, ".gitignore");
-  if (!existsSync6(gitignorePath)) {
-    return (path8) => DEFAULT_WATCHER_IGNORED_PATTERNS.some((p) => p.test(normalizePath(path8)));
+  if (!existsSync8(gitignorePath)) {
+    return (path9) => DEFAULT_WATCHER_IGNORED_PATTERNS.some((p) => p.test(normalizePath(path9)));
   }
-  const gitignoreContent = readFileSync5(gitignorePath, "utf-8");
+  const gitignoreContent = readFileSync7(gitignorePath, "utf-8");
   const ig = ignore().add(gitignoreContent);
-  return (path8) => {
-    const normalizedPath = normalizePath(path8);
+  return (path9) => {
+    const normalizedPath = normalizePath(path9);
     if (DEFAULT_WATCHER_IGNORED_PATTERNS.some((p) => p.test(normalizedPath))) {
       return true;
     }
-    const relativePath = relativeToRoot(rootPath, path8);
+    const relativePath = relativeToRoot(rootPath, path9);
     return isIgnoredByGitignore(ig, relativePath);
   };
 }
@@ -6859,7 +7117,7 @@ var WorkspaceWatcher;
 var init_watcher = __esm({
   "packages/server/src/fs/watcher.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     init_gitignore();
     WorkspaceWatcher = class {
       constructor(workspaceId, rootPath, broadcaster) {
@@ -7111,12 +7369,12 @@ var init_manager4 = __esm({
        * @param path - Workspace path
        * @returns Workspace or undefined
        */
-      getByPath(path8) {
+      getByPath(path9) {
         const row = this.deps.db.prepare(
           `SELECT id, path, target_runtime, wsl_distro, opened_at, last_active_at, ui_state
          FROM workspaces
          WHERE path = ?`
-        ).get(path8);
+        ).get(path9);
         if (!row) return void 0;
         return {
           id: row.id,
@@ -7320,16 +7578,16 @@ async function debounce(key, op, windowMs) {
     clearTimeout(entry.timer);
     entry.op = op;
   } else {
-    let resolve3;
+    let resolve4;
     let reject;
     const promise = new Promise((res, rej) => {
-      resolve3 = res;
+      resolve4 = res;
       reject = rej;
     });
     entry = {
       timer: void 0,
       promise,
-      resolve: resolve3,
+      resolve: resolve4,
       reject,
       op
     };
@@ -7505,7 +7763,7 @@ var TerminalInputActivitySchema, TerminalInputSchema, pendingTerminalInput, next
 var init_terminal = __esm({
   "packages/server/src/commands/terminal.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     init_dispatch();
     TerminalInputActivitySchema = z5.enum(TERMINAL_INPUT_ACTIVITIES).optional();
     TerminalInputSchema = z5.union([
@@ -8113,7 +8371,7 @@ var BINARY_PAYLOAD_TIMEOUT_MS, isBinaryTerminalInputArgs, WsHub;
 var init_hub = __esm({
   "packages/server/src/ws/hub.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     init_terminal();
     init_client();
     init_dispatch();
@@ -8152,7 +8410,10 @@ var init_hub = __esm({
           status: "connected",
           clientId: client.id,
           authEnabled: this.deps.config.auth.enabled,
-          binaryTerminalTransport: true
+          binaryTerminalTransport: true,
+          version: this.deps.config.appVersion ?? "0.0.0",
+          serverInstanceId: `server-${process.pid}`,
+          isWriter: false
         });
         client.onMessage((msg) => this.routeMessage(client, msg));
         client.onClose(() => this.handleClose(client));
@@ -8206,7 +8467,7 @@ var init_hub = __esm({
         }
       }
       awaitBinaryPayload(clientId) {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           const timer = setTimeout(() => {
             const waiters = this.pendingBinaryWaiters.get(clientId);
             if (!waiters) return;
@@ -8218,7 +8479,7 @@ var init_hub = __esm({
             }
             reject(new Error("Timeout waiting for terminal input binary payload"));
           }, BINARY_PAYLOAD_TIMEOUT_MS);
-          const waiter = { resolve: resolve3, reject, timer };
+          const waiter = { resolve: resolve4, reject, timer };
           const queue = this.pendingBinaryWaiters.get(clientId);
           if (queue) {
             queue.push(waiter);
@@ -9025,7 +9286,7 @@ var init_file = __esm({
 // packages/server/src/git/diff.ts
 import { mkdtemp as mkdtemp2, rm as rm5 } from "fs/promises";
 import os3 from "os";
-import path6 from "path";
+import path7 from "path";
 async function isTrackedPath(cwd, filePath) {
   try {
     await runGit(cwd, ["ls-files", "--error-unmatch", "--", filePath]);
@@ -9035,8 +9296,8 @@ async function isTrackedPath(cwd, filePath) {
   }
 }
 async function getUntrackedFileDiff(cwd, filePath) {
-  const tempDir = await mkdtemp2(path6.join(os3.tmpdir(), "coder-studio-git-diff-"));
-  const tempIndex = path6.join(tempDir, "index");
+  const tempDir = await mkdtemp2(path7.join(os3.tmpdir(), "coder-studio-git-diff-"));
+  const tempIndex = path7.join(tempDir, "index");
   try {
     try {
       await runGit(cwd, ["read-tree", "HEAD"], {
@@ -9061,11 +9322,11 @@ async function getUntrackedFileDiff(cwd, filePath) {
     await rm5(tempDir, { recursive: true, force: true });
   }
 }
-async function getFileDiff(cwd, path8, staged = false) {
-  if (!staged && !await isTrackedPath(cwd, path8)) {
-    return getUntrackedFileDiff(cwd, path8);
+async function getFileDiff(cwd, path9, staged = false) {
+  if (!staged && !await isTrackedPath(cwd, path9)) {
+    return getUntrackedFileDiff(cwd, path9);
   }
-  const args = staged ? ["diff", "--staged", "--", path8] : ["diff", "--", path8];
+  const args = staged ? ["diff", "--staged", "--", path9] : ["diff", "--", path9];
   const result = await runGit(cwd, args);
   return result.stdout;
 }
@@ -9314,7 +9575,7 @@ var init_git2 = __esm({
 });
 
 // packages/server/src/config/config-io.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync6, renameSync as renameSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync8, renameSync as renameSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { basename as basename3, dirname as dirname5, join as join8 } from "node:path";
 function resolveConfigPath(configType) {
@@ -9336,11 +9597,11 @@ function resolveConfigPath(configType) {
 }
 function readConfigFile(configType) {
   const configPath = resolveConfigPath(configType);
-  if (!existsSync7(configPath)) {
+  if (!existsSync9(configPath)) {
     return { configPath, content: "", exists: false };
   }
   try {
-    const content = readFileSync6(configPath, "utf-8");
+    const content = readFileSync8(configPath, "utf-8");
     return { configPath, content, exists: true };
   } catch {
     return { configPath, content: "", exists: false };
@@ -9350,11 +9611,11 @@ function writeConfigFile(configType, content) {
   try {
     const configPath = resolveConfigPath(configType);
     const parentDir = dirname5(configPath);
-    if (!existsSync7(parentDir)) {
+    if (!existsSync9(parentDir)) {
       mkdirSync4(parentDir, { recursive: true });
     }
     let backupPath = null;
-    if (existsSync7(configPath)) {
+    if (existsSync9(configPath)) {
       backupPath = createBackup(configPath);
     }
     const tempPath = `${configPath}.tmp`;
@@ -9370,7 +9631,7 @@ function writeConfigFile(configType, content) {
   }
 }
 function createBackup(filePath) {
-  const original = readFileSync6(filePath, "utf-8");
+  const original = readFileSync8(filePath, "utf-8");
   const ext = filePath.split(".").pop() ?? "";
   const base = basename3(filePath, `.${ext}`);
   const dir = dirname5(filePath);
@@ -9408,7 +9669,7 @@ var EMPTY_CODEX_AUDIT, SettingsSchema;
 var init_settings2 = __esm({
   "packages/server/src/commands/settings.ts"() {
     "use strict";
-    init_src2();
+    init_src3();
     init_config_io();
     init_provider_config();
     init_provider_config_repo();
@@ -9688,9 +9949,9 @@ var init_supervisor2 = __esm({
 });
 
 // packages/server/src/git/worktree.ts
-import path7 from "node:path";
+import path8 from "node:path";
 function normalizeWorktreePath(worktreePath) {
-  return path7.resolve(worktreePath);
+  return path8.resolve(worktreePath);
 }
 async function resolveWorktreePath(repoPath, worktreePath) {
   const normalizedRequested = normalizeWorktreePath(worktreePath);
@@ -9777,19 +10038,19 @@ async function getWorktreeTree(worktreePath) {
   for (const line of lines) {
     const isDir = line.endsWith("/");
     const name = isDir ? line.slice(0, -1) : line;
-    const path8 = `${worktreePath}/${name}`;
+    const path9 = `${worktreePath}/${name}`;
     nodes.push({
       name,
-      path: path8,
+      path: path9,
       kind: isDir ? "dir" : "file"
     });
   }
   return nodes;
 }
-async function createWorktree(repoPath, branch, path8) {
-  await runGit(repoPath, ["worktree", "add", path8, branch]);
+async function createWorktree(repoPath, branch, path9) {
+  await runGit(repoPath, ["worktree", "add", path9, branch]);
   const worktrees = await listWorktrees(repoPath);
-  const created = worktrees.find((wt) => wt.path === path8);
+  const created = worktrees.find((wt) => wt.path === path9);
   if (!created) {
     throw new Error("Failed to find created worktree");
   }
@@ -9987,8 +10248,6 @@ var init_commands = __esm({
 });
 
 // packages/server/src/server.ts
-import { execFile as nodeExecFile3 } from "node:child_process";
-import { promisify as promisify3 } from "node:util";
 function createCodexConfigAuditApi() {
   return {
     audit: () => ({ codex: auditCodexConfigToml() }),
@@ -10016,7 +10275,6 @@ async function logCodexConfigFindings(auditApi, logger) {
   }
 }
 async function createServer(configOverrides) {
-  const execFileAsync3 = promisify3(nodeExecFile3);
   const config = parseServerConfig(configOverrides);
   ensureDataDir(config);
   const db = openDatabase(config.dataDir);
@@ -10098,7 +10356,7 @@ async function createServer(configOverrides) {
   const providerRuntimeDeps = {};
   const providerInstallMgr = new ProviderInstallManager(providerRegistry, {
     ...providerRuntimeDeps,
-    execFile: (file, args) => execFileAsync3(file, args)
+    runCommand: runCommandAsString
   });
   const commandContext = {
     workspaceMgr,
@@ -10261,10 +10519,12 @@ var init_server = __esm({
     "use strict";
     init_runtime();
     init_src();
+    init_src2();
     init_app();
     init_event_bus();
     init_codex_config_audit();
     init_config();
+    init_command_runner();
     init_install_manager();
     init_manager();
     init_db();
@@ -10284,7 +10544,7 @@ var init_server = __esm({
     init_fencing();
     init_hub();
     init_commands();
-    if (import.meta.url === `file://${process.argv[1]}`) {
+    if (isDirectExecution(import.meta.url)) {
       const server = await createServer();
       process.on("SIGINT", async () => {
         console.log("\nShutting down...");
@@ -10434,8 +10694,8 @@ var init_workspace_repo = __esm({
       /**
        * Finds a workspace by path
        */
-      findByPath(path8) {
-        const row = this.db.prepare("SELECT * FROM workspaces WHERE path = ?").get(path8);
+      findByPath(path9) {
+        const row = this.db.prepare("SELECT * FROM workspaces WHERE path = ?").get(path9);
         return row ? this.rowToWorkspace(row) : void 0;
       }
       /**
@@ -10556,7 +10816,7 @@ __export(src_exports, {
   sessionToRow: () => sessionToRow,
   withTransaction: () => withTransaction
 });
-var init_src3 = __esm({
+var init_src4 = __esm({
   async "packages/server/src/index.ts"() {
     "use strict";
     init_auth();
@@ -10580,12 +10840,12 @@ function getCliConfigPath() {
   return join(homedir(), ".coder-studio", "config.json");
 }
 function readCliConfig() {
-  const path8 = getCliConfigPath();
-  if (!existsSync(path8)) {
+  const path9 = getCliConfigPath();
+  if (!existsSync(path9)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync(path8, "utf-8"));
+    const parsed = JSON.parse(readFileSync(path9, "utf-8"));
     if (parsed.host !== void 0 && typeof parsed.host !== "string" || parsed.port !== void 0 && typeof parsed.port !== "number" || parsed.dataDir !== void 0 && typeof parsed.dataDir !== "string" || parsed.password !== void 0 && typeof parsed.password !== "string") {
       return null;
     }
@@ -10639,11 +10899,33 @@ function assertSupportedNodeVersion(version = process.versions.node) {
   );
 }
 
+// packages/cli/src/package-manifest.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+function resolveCliPackageManifestUrl(importMetaUrl) {
+  const manifestUrl = [
+    new URL("../package.json", importMetaUrl),
+    new URL("../../package.json", importMetaUrl)
+  ].find((candidate) => existsSync3(candidate));
+  if (!manifestUrl) {
+    throw new Error("Unable to locate CLI package.json");
+  }
+  return manifestUrl;
+}
+function getCliPackageManifest(importMetaUrl) {
+  return JSON.parse(
+    readFileSync2(resolveCliPackageManifestUrl(importMetaUrl), "utf-8")
+  );
+}
+function getCliVersion(importMetaUrl) {
+  return getCliPackageManifest(importMetaUrl).version ?? "0.0.0";
+}
+
 // packages/cli/src/server-runner.ts
 var MISSING_WEB_ASSETS_WARNING = "Warning: Web assets not found. Frontend will not be available.";
 var buildServerConfig = () => {
   const savedConfig = readCliConfig();
   const config = {
+    appVersion: getCliVersion(import.meta.url),
     ...savedConfig?.host !== void 0 ? { host: savedConfig.host } : {},
     ...savedConfig?.port !== void 0 && savedConfig.port > 0 ? { port: savedConfig.port } : {},
     ...savedConfig?.dataDir !== void 0 ? { dataDir: savedConfig.dataDir } : {},
@@ -10686,7 +10968,7 @@ var runServerEntrypoint = async (moduleUrl, argvEntry) => {
 };
 var startServer = async () => {
   assertSupportedNodeVersion();
-  const { createServer: createServer2 } = await init_src3().then(() => src_exports);
+  const { createServer: createServer2 } = await init_src4().then(() => src_exports);
   const server = await createServer2(buildServerConfig());
   const shutdown = createShutdownHandler(server);
   process.on("SIGINT", shutdown);