@spencer-kit/coder-studio 0.4.3 → 0.4.5

package/dist/esm/bin.mjs

@@ -953,10 +953,10 @@ function resolveSpawnArgv(argv, deps = {}) {
   }
   const restArgs = argv.slice(1);
   const readFileSync10 = deps.readFileSync ?? ((file) => fs2.readFileSync(file, "utf8"));
-  const existsSync15 = deps.existsSync ?? fs2.existsSync;
+  const existsSync16 = deps.existsSync ?? fs2.existsSync;
   const pathEnv = deps.pathEnv ?? process.env.Path ?? process.env.PATH ?? "";
   const pathExt = deps.pathExt ?? process.env.PATHEXT ?? DEFAULT_PATHEXT;
-  const resolved = resolveExecutablePath(command, pathEnv, pathExt, existsSync15);
+  const resolved = resolveExecutablePath(command, pathEnv, pathExt, existsSync16);
   if (!resolved) {
     return [...argv];
   }
@@ -1005,17 +1005,17 @@ function expandShimVars(value, dp0Dir) {
 function parsePathExt(pathExt) {
   return pathExt.split(";").map((entry) => entry.trim().toLowerCase()).filter((entry) => entry.length > 0);
 }
-function resolveExecutablePath(command, pathEnv, pathExt, existsSync15) {
+function resolveExecutablePath(command, pathEnv, pathExt, existsSync16) {
   const hasExt = path3.win32.extname(command).length > 0;
   const extensions = parsePathExt(pathExt);
   if (path3.win32.isAbsolute(command)) {
-    if (existsSync15(command)) {
+    if (existsSync16(command)) {
       return command;
     }
     if (!hasExt) {
       for (const ext of extensions) {
         const candidate = command + ext;
-        if (existsSync15(candidate)) {
+        if (existsSync16(candidate)) {
           return candidate;
         }
       }
@@ -1026,14 +1026,14 @@ function resolveExecutablePath(command, pathEnv, pathExt, existsSync15) {
   for (const dir of dirs) {
     if (hasExt) {
       const candidate = path3.win32.join(dir, command);
-      if (existsSync15(candidate)) {
+      if (existsSync16(candidate)) {
         return candidate;
       }
       continue;
     }
     for (const ext of extensions) {
       const candidate = path3.win32.join(dir, command + ext);
-      if (existsSync15(candidate)) {
+      if (existsSync16(candidate)) {
         return candidate;
       }
     }
@@ -1119,6 +1119,281 @@ var init_session_store = __esm({
   }
 });
 
+// packages/server/src/uploads/paths.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { lstat, mkdir } from "node:fs/promises";
+import path4 from "node:path";
+function sanitizeOriginalName(input2) {
+  let sanitized = "";
+  for (const char of input2.trim()) {
+    sanitized += KEEP_FILENAME_CHAR.test(char) ? char : "_";
+  }
+  sanitized = sanitized.replace(/^\.+/, "");
+  if (sanitized.length === 0 || /^[_\s]*$/.test(sanitized)) {
+    return "file";
+  }
+  if (sanitized.length <= MAX_FILENAME_LENGTH) {
+    return sanitized;
+  }
+  const lastDot = sanitized.lastIndexOf(".");
+  if (lastDot > 0 && sanitized.length - lastDot <= 16) {
+    const ext = sanitized.slice(lastDot);
+    const stem = sanitized.slice(0, MAX_FILENAME_LENGTH - ext.length);
+    return stem + ext;
+  }
+  return sanitized.slice(0, MAX_FILENAME_LENGTH);
+}
+function validateWorkspaceId(id) {
+  if (!WORKSPACE_ID_RE.test(id)) {
+    throw new Error(`invalid workspace id: ${JSON.stringify(id)}`);
+  }
+}
+async function assertDirectorySegmentSafe(segmentPath) {
+  const info = await lstat(segmentPath);
+  if (info.isSymbolicLink()) {
+    throw new Error(`symlinked upload path segment is not allowed: ${segmentPath}`);
+  }
+  if (!info.isDirectory()) {
+    throw new Error(`upload path segment is not a directory: ${segmentPath}`);
+  }
+}
+async function ensureSafeUploadDir(rootDir, targetDir2) {
+  const resolvedRoot = path4.resolve(rootDir);
+  const resolvedTarget = path4.resolve(targetDir2);
+  if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(`${resolvedRoot}${path4.sep}`)) {
+    throw new Error(`target dir escaped uploads root: ${resolvedTarget}`);
+  }
+  try {
+    await assertDirectorySegmentSafe(resolvedRoot);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "ENOENT") {
+      throw error;
+    }
+    await mkdir(resolvedRoot, { recursive: true });
+    await assertDirectorySegmentSafe(resolvedRoot);
+  }
+  const relative5 = path4.relative(resolvedRoot, resolvedTarget);
+  if (!relative5) {
+    return;
+  }
+  let current = resolvedRoot;
+  for (const segment of relative5.split(path4.sep)) {
+    current = path4.join(current, segment);
+    try {
+      await assertDirectorySegmentSafe(current);
+      continue;
+    } catch (error) {
+      const code = error.code;
+      if (code !== "ENOENT") {
+        throw error;
+      }
+    }
+    try {
+      await mkdir(current);
+    } catch (error) {
+      const code = error.code;
+      if (code !== "EEXIST") {
+        throw error;
+      }
+    }
+    await assertDirectorySegmentSafe(current);
+  }
+}
+function generateBucketPath(input2) {
+  validateWorkspaceId(input2.workspaceId);
+  const now = input2.now ?? /* @__PURE__ */ new Date();
+  const dateStr = now.toISOString().slice(0, 10);
+  const dir = path4.join(input2.uploadsDir, input2.workspaceId, dateStr);
+  const sanitizedName = sanitizeOriginalName(input2.originalName);
+  const uuid8 = randomUUID2().replace(/-/g, "").slice(0, 8);
+  const absolutePath = path4.resolve(dir, `${uuid8}-${sanitizedName}`);
+  const uploadsRoot = `${path4.resolve(input2.uploadsDir)}${path4.sep}`;
+  if (!absolutePath.startsWith(uploadsRoot)) {
+    throw new Error(`generated upload path escaped uploads root: ${absolutePath}`);
+  }
+  return {
+    dir,
+    absolutePath,
+    uuid8,
+    sanitizedName
+  };
+}
+var MAX_FILENAME_LENGTH, KEEP_FILENAME_CHAR, WORKSPACE_ID_RE;
+var init_paths = __esm({
+  "packages/server/src/uploads/paths.ts"() {
+    "use strict";
+    MAX_FILENAME_LENGTH = 64;
+    KEEP_FILENAME_CHAR = /[a-zA-Z0-9._一-鿿 \-]/;
+    WORKSPACE_ID_RE = /^[a-zA-Z0-9_-]+$/;
+  }
+});
+
+// packages/server/src/routes/appearance-assets.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { createReadStream, createWriteStream } from "node:fs";
+import { rm, stat } from "node:fs/promises";
+import { isAbsolute, join as join2, relative, resolve as resolve2, sep } from "node:path";
+import { pipeline } from "node:stream/promises";
+function isAllowedAppearanceMime(mime2) {
+  return ALLOWED_APPEARANCE_MIME_TYPES.has(mime2);
+}
+function isPathInsideRoot(rootPath, targetPath) {
+  const rel = relative(rootPath, targetPath);
+  return rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function resolveAssetStoragePath(uploadsDir, storagePath) {
+  const resolvedUploadsDir = resolve2(uploadsDir);
+  const resolvedStoragePath = resolve2(storagePath);
+  return isPathInsideRoot(resolvedUploadsDir, resolvedStoragePath) ? resolvedStoragePath : null;
+}
+async function cleanupWrittenFile(filePath) {
+  if (!filePath) {
+    return;
+  }
+  await rm(filePath, { force: true });
+}
+async function rejectAndCleanup(reply, filePath, statusCode, error) {
+  await cleanupWrittenFile(filePath);
+  return reply.status(statusCode).send({ ok: false, error });
+}
+function registerAppearanceAssetsRoutes(app, deps) {
+  app.post("/api/appearance-assets", async (request, reply) => {
+    if (!request.isMultipart()) {
+      return reply.status(400).send({ ok: false, error: "expected_multipart" });
+    }
+    let writtenPath;
+    let pendingRecord;
+    try {
+      const parts = request.parts();
+      for await (const part of parts) {
+        if (part.type !== "file") {
+          continue;
+        }
+        if (part.fieldname !== "file") {
+          part.file.resume();
+          return rejectAndCleanup(reply, writtenPath, 400, "file_required");
+        }
+        if (pendingRecord) {
+          part.file.resume();
+          return rejectAndCleanup(reply, writtenPath, 400, "too_many_files");
+        }
+        if (!isAllowedAppearanceMime(part.mimetype)) {
+          part.file.resume();
+          return rejectAndCleanup(reply, writtenPath, 400, "invalid_file_type");
+        }
+        const assetId = randomUUID3();
+        const createdAt = Date.now();
+        const dateStr = new Date(createdAt).toISOString().slice(0, 10);
+        const safeName = sanitizeOriginalName(part.filename || "file");
+        const fileName = part.filename?.trim() ? part.filename.trim() : safeName;
+        const dir = join2(deps.uploadsDir, APPEARANCE_ASSET_BUCKET, dateStr);
+        const storagePath = join2(dir, `${assetId}-${safeName}`);
+        try {
+          await ensureSafeUploadDir(deps.uploadsDir, dir);
+          await pipeline(part.file, createWriteStream(storagePath));
+        } catch (error) {
+          request.log.warn({ err: error }, "appearance asset write failed");
+          return rejectAndCleanup(reply, storagePath, 500, "write_failed");
+        }
+        if (part.file.truncated) {
+          return rejectAndCleanup(reply, storagePath, 413, "file_too_large");
+        }
+        let fileSize;
+        try {
+          const fileStat = await stat(storagePath);
+          fileSize = fileStat.size;
+        } catch (error) {
+          request.log.warn({ err: error }, "appearance asset stat failed");
+          return rejectAndCleanup(reply, storagePath, 500, "write_failed");
+        }
+        writtenPath = storagePath;
+        pendingRecord = {
+          id: assetId,
+          fileName,
+          mime: part.mimetype,
+          size: fileSize,
+          storagePath,
+          createdAt
+        };
+      }
+    } catch (error) {
+      if (error.code === "FST_REQ_FILE_TOO_LARGE") {
+        return rejectAndCleanup(reply, writtenPath, 413, "file_too_large");
+      }
+      request.log.warn({ err: error }, "appearance asset parse failed");
+      return rejectAndCleanup(reply, writtenPath, 400, "parse_failed");
+    }
+    if (!pendingRecord) {
+      return rejectAndCleanup(reply, writtenPath, 400, "file_required");
+    }
+    try {
+      deps.repo.set(pendingRecord);
+    } catch (error) {
+      request.log.warn({ err: error }, "appearance asset metadata write failed");
+      return rejectAndCleanup(reply, writtenPath, 500, "write_failed");
+    }
+    return reply.send({
+      ok: true,
+      asset: {
+        assetId: pendingRecord.id,
+        url: `/api/appearance-assets/${pendingRecord.id}`,
+        mime: pendingRecord.mime,
+        size: pendingRecord.size
+      }
+    });
+  });
+  app.get(
+    "/api/appearance-assets/:assetId",
+    async (request, reply) => {
+      const record = deps.repo.get(request.params.assetId);
+      if (!record) {
+        return reply.status(404).send({ ok: false, error: "not_found" });
+      }
+      const storagePath = resolveAssetStoragePath(deps.uploadsDir, record.storagePath);
+      if (!storagePath) {
+        return reply.status(404).send({ ok: false, error: "not_found" });
+      }
+      let fileSize;
+      try {
+        const fileStat = await stat(storagePath);
+        if (!fileStat.isFile()) {
+          return reply.status(404).send({ ok: false, error: "not_found" });
+        }
+        fileSize = fileStat.size;
+      } catch {
+        return reply.status(404).send({ ok: false, error: "not_found" });
+      }
+      reply.header("Content-Type", record.mime).header("Content-Length", String(fileSize)).header("Cache-Control", "no-store").header("X-Content-Type-Options", "nosniff");
+      return reply.send(createReadStream(storagePath));
+    }
+  );
+  app.delete(
+    "/api/appearance-assets/:assetId",
+    async (request, reply) => {
+      const record = deps.repo.get(request.params.assetId);
+      if (!record) {
+        return reply.status(404).send({ ok: false, error: "not_found" });
+      }
+      const storagePath = resolveAssetStoragePath(deps.uploadsDir, record.storagePath);
+      if (storagePath) {
+        await rm(storagePath, { force: true });
+      }
+      deps.repo.delete(request.params.assetId);
+      return reply.send({ ok: true });
+    }
+  );
+}
+var ALLOWED_APPEARANCE_MIME_TYPES, APPEARANCE_ASSET_BUCKET;
+var init_appearance_assets = __esm({
+  "packages/server/src/routes/appearance-assets.ts"() {
+    "use strict";
+    init_paths();
+    ALLOWED_APPEARANCE_MIME_TYPES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp"]);
+    APPEARANCE_ASSET_BUCKET = "appearance/default";
+  }
+});
+
 // packages/server/src/fs/image.ts
 import { extname } from "path";
 function getImageTypeInfo(filePath) {
@@ -1143,8 +1418,8 @@ var init_image = __esm({
 });
 
 // packages/server/src/fs/path-safety.ts
-import path4 from "node:path";
-function isPathInsideRoot(rootPath, targetPath, pathApi = path4) {
+import path5 from "node:path";
+function isPathInsideRoot2(rootPath, targetPath, pathApi = path5) {
   const rel = pathApi.relative(rootPath, targetPath);
   return rel !== ".." && !rel.startsWith(`..${pathApi.sep}`) && !pathApi.isAbsolute(rel);
 }
@@ -1155,19 +1430,19 @@ var init_path_safety = __esm({
 });
 
 // packages/server/src/fs/file-io.ts
-import * as path5 from "node:path";
+import * as path6 from "node:path";
 import { createHash } from "crypto";
 import {
   readFile as fsReadFile,
   rename as fsRename,
   writeFile as fsWriteFile,
-  mkdir,
-  rm,
-  stat
+  mkdir as mkdir2,
+  rm as rm2,
+  stat as stat2
 } from "fs/promises";
 async function statSafe(path14) {
   try {
-    return await stat(path14);
+    return await stat2(path14);
   } catch {
     return null;
   }
@@ -1178,7 +1453,7 @@ async function createFile(rootPath, relPath) {
   if (existing) {
     throw { code: "already_exists", message: "File already exists" };
   }
-  await mkdir(path5.dirname(abs), { recursive: true });
+  await mkdir2(path6.dirname(abs), { recursive: true });
   await fsWriteFile(abs, "", "utf-8");
 }
 async function createDirectory(rootPath, relPath) {
@@ -1187,7 +1462,7 @@ async function createDirectory(rootPath, relPath) {
   if (existing) {
     throw { code: "already_exists", message: "Directory already exists" };
   }
-  await mkdir(abs, { recursive: true });
+  await mkdir2(abs, { recursive: true });
 }
 async function deleteEntry(rootPath, relPath) {
   const abs = resolveSafe(rootPath, relPath);
@@ -1195,15 +1470,15 @@ async function deleteEntry(rootPath, relPath) {
   if (!existing) {
     throw { code: "not_found", message: "Target not found" };
   }
-  await rm(abs, { recursive: true });
+  await rm2(abs, { recursive: true });
 }
 async function renameEntry(rootPath, fromPath, toPath) {
   const fromAbs = resolveSafe(rootPath, fromPath);
   const toAbs = resolveSafe(rootPath, toPath);
   const source = await statSafe(fromAbs);
   const target = await statSafe(toAbs);
-  const fromParent = path5.dirname(fromAbs);
-  const toParent = path5.dirname(toAbs);
+  const fromParent = path6.dirname(fromAbs);
+  const toParent = path6.dirname(toAbs);
   if (!source) {
     throw { code: "not_found", message: "Source not found" };
   }
@@ -1218,10 +1493,10 @@ async function renameEntry(rootPath, fromPath, toPath) {
   }
   await fsRename(fromAbs, toAbs);
 }
-function resolveSafe(root, relPath, pathApi = path5) {
+function resolveSafe(root, relPath, pathApi = path6) {
   const absRoot = pathApi.resolve(root);
   const abs = pathApi.resolve(absRoot, relPath);
-  if (!isPathInsideRoot(absRoot, abs, pathApi)) {
+  if (!isPathInsideRoot2(absRoot, abs, pathApi)) {
     throw { code: "path_escape", message: "Path escapes workspace root" };
   }
   return abs;
@@ -1269,7 +1544,7 @@ async function writeFile(rootPath, relPath, content, baseHash) {
       };
     }
   }
-  await mkdir(path5.dirname(abs), { recursive: true });
+  await mkdir2(path6.dirname(abs), { recursive: true });
   await fsWriteFile(abs, content, "utf-8");
   const newHash = createHash("sha256").update(content).digest("hex");
   return { newHash };
@@ -1433,11 +1708,11 @@ var init_status_parser = __esm({
 
 // packages/server/src/git/cli.ts
 import { execFile } from "child_process";
-import { mkdir as mkdir2, mkdtemp, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir3, mkdtemp, rm as rm3, writeFile as writeFile2 } from "fs/promises";
 import os2 from "os";
-import path6 from "path";
+import path7 from "path";
 async function runGit(cwd, args, options = {}) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const gitArgs = [
       ...options.config?.flatMap(([key, value]) => ["-c", `${key}=${value}`]) ?? [],
       ...args
@@ -1464,7 +1739,7 @@ async function runGit(cwd, args, options = {}) {
         if (err) {
           reject(new GitError(err.message, stderr));
         } else {
-          resolve4({ stdout, stderr });
+          resolve6({ stdout, stderr });
         }
       }
     );
@@ -1923,10 +2198,10 @@ async function prepareGitAuthExecution(auth, remoteMetadata) {
       }
     };
   }
-  const tempDir = await mkdtemp(path6.join(os2.tmpdir(), "coder-studio-git-auth-"));
-  const hooksDir = path6.join(tempDir, "hooks");
-  const askPassPath = path6.join(tempDir, "askpass.sh");
-  await mkdir2(hooksDir, { recursive: true, mode: 448 });
+  const tempDir = await mkdtemp(path7.join(os2.tmpdir(), "coder-studio-git-auth-"));
+  const hooksDir = path7.join(tempDir, "hooks");
+  const askPassPath = path7.join(tempDir, "askpass.sh");
+  await mkdir3(hooksDir, { recursive: true, mode: 448 });
   await writeFile2(
     askPassPath,
     [
@@ -1955,7 +2230,7 @@ async function prepareGitAuthExecution(auth, remoteMetadata) {
       ["credential.username", auth.username]
     ],
     cleanup: async () => {
-      await rm2(tempDir, { recursive: true, force: true });
+      await rm3(tempDir, { recursive: true, force: true });
     }
   };
 }
@@ -2203,8 +2478,8 @@ var init_image_revision = __esm({
 });
 
 // packages/server/src/routes/file-asset.ts
-import { createReadStream } from "fs";
-import { realpath, stat as stat2 } from "fs/promises";
+import { createReadStream as createReadStream2 } from "fs";
+import { realpath, stat as stat3 } from "fs/promises";
 function registerFileAssetRoutes(app, deps) {
   app.get(
     "/api/file",
@@ -2248,7 +2523,7 @@ function registerFileAssetRoutes(app, deps) {
           realpath(workspace.path),
           realpath(absPath)
         ]);
-        if (!isPathInsideRoot(realWorkspacePath, realAssetPath)) {
+        if (!isPathInsideRoot2(realWorkspacePath, realAssetPath)) {
           return reply.status(400).send({ ok: false, error: "path_escape" });
         }
       } catch {
@@ -2256,7 +2531,7 @@ function registerFileAssetRoutes(app, deps) {
       }
       let fileSize;
       try {
-        const stats = await stat2(absPath);
+        const stats = await stat3(absPath);
         if (!stats.isFile()) {
           return reply.status(404).send({ ok: false, error: "not_a_file" });
         }
@@ -2265,7 +2540,7 @@ function registerFileAssetRoutes(app, deps) {
         return reply.status(404).send({ ok: false, error: "not_found" });
       }
       reply.header("Content-Type", typeInfo.mime).header("Content-Length", String(fileSize)).header("Cache-Control", "no-store").header("X-Content-Type-Options", "nosniff");
-      return reply.send(createReadStream(absPath));
+      return reply.send(createReadStream2(absPath));
     }
   );
 }
@@ -2335,7 +2610,7 @@ var init_render_markdown = __esm({
 });
 
 // packages/server/src/preview/resource-loader.ts
-import { readFile as readFile2, realpath as realpath2, stat as stat3 } from "node:fs/promises";
+import { readFile as readFile2, realpath as realpath2, stat as stat4 } from "node:fs/promises";
 import { posix as posix2 } from "node:path";
 import mime from "mime-types";
 function resolvePreviewResourcePath(entryPath, requestedPath) {
@@ -2353,10 +2628,10 @@ async function loadPreviewResource(workspaceRootPath, workspaceRelativePath) {
     realpath2(workspaceRootPath),
     realpath2(absolutePath)
   ]);
-  if (!isPathInsideRoot(realWorkspacePath, realAssetPath)) {
+  if (!isPathInsideRoot2(realWorkspacePath, realAssetPath)) {
     throw new Error("path_escape");
   }
-  const [bytes, stats] = await Promise.all([readFile2(realAssetPath), stat3(realAssetPath)]);
+  const [bytes, stats] = await Promise.all([readFile2(realAssetPath), stat4(realAssetPath)]);
   if (!stats.isFile()) {
     throw new Error("not_a_file");
   }
@@ -2500,118 +2775,8 @@ var init_constants = __esm({
   }
 });
 
-// packages/server/src/uploads/paths.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { lstat, mkdir as mkdir3 } from "node:fs/promises";
-import path7 from "node:path";
-function sanitizeOriginalName(input2) {
-  let sanitized = "";
-  for (const char of input2.trim()) {
-    sanitized += KEEP_FILENAME_CHAR.test(char) ? char : "_";
-  }
-  sanitized = sanitized.replace(/^\.+/, "");
-  if (sanitized.length === 0 || /^[_\s]*$/.test(sanitized)) {
-    return "file";
-  }
-  if (sanitized.length <= MAX_FILENAME_LENGTH) {
-    return sanitized;
-  }
-  const lastDot = sanitized.lastIndexOf(".");
-  if (lastDot > 0 && sanitized.length - lastDot <= 16) {
-    const ext = sanitized.slice(lastDot);
-    const stem = sanitized.slice(0, MAX_FILENAME_LENGTH - ext.length);
-    return stem + ext;
-  }
-  return sanitized.slice(0, MAX_FILENAME_LENGTH);
-}
-function validateWorkspaceId(id) {
-  if (!WORKSPACE_ID_RE.test(id)) {
-    throw new Error(`invalid workspace id: ${JSON.stringify(id)}`);
-  }
-}
-async function assertDirectorySegmentSafe(segmentPath) {
-  const info = await lstat(segmentPath);
-  if (info.isSymbolicLink()) {
-    throw new Error(`symlinked upload path segment is not allowed: ${segmentPath}`);
-  }
-  if (!info.isDirectory()) {
-    throw new Error(`upload path segment is not a directory: ${segmentPath}`);
-  }
-}
-async function ensureSafeUploadDir(rootDir, targetDir2) {
-  const resolvedRoot = path7.resolve(rootDir);
-  const resolvedTarget = path7.resolve(targetDir2);
-  if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(`${resolvedRoot}${path7.sep}`)) {
-    throw new Error(`target dir escaped uploads root: ${resolvedTarget}`);
-  }
-  try {
-    await assertDirectorySegmentSafe(resolvedRoot);
-  } catch (error) {
-    const code = error.code;
-    if (code !== "ENOENT") {
-      throw error;
-    }
-    await mkdir3(resolvedRoot, { recursive: true });
-    await assertDirectorySegmentSafe(resolvedRoot);
-  }
-  const relative3 = path7.relative(resolvedRoot, resolvedTarget);
-  if (!relative3) {
-    return;
-  }
-  let current = resolvedRoot;
-  for (const segment of relative3.split(path7.sep)) {
-    current = path7.join(current, segment);
-    try {
-      await assertDirectorySegmentSafe(current);
-      continue;
-    } catch (error) {
-      const code = error.code;
-      if (code !== "ENOENT") {
-        throw error;
-      }
-    }
-    try {
-      await mkdir3(current);
-    } catch (error) {
-      const code = error.code;
-      if (code !== "EEXIST") {
-        throw error;
-      }
-    }
-    await assertDirectorySegmentSafe(current);
-  }
-}
-function generateBucketPath(input2) {
-  validateWorkspaceId(input2.workspaceId);
-  const now = input2.now ?? /* @__PURE__ */ new Date();
-  const dateStr = now.toISOString().slice(0, 10);
-  const dir = path7.join(input2.uploadsDir, input2.workspaceId, dateStr);
-  const sanitizedName = sanitizeOriginalName(input2.originalName);
-  const uuid8 = randomUUID2().replace(/-/g, "").slice(0, 8);
-  const absolutePath = path7.resolve(dir, `${uuid8}-${sanitizedName}`);
-  const uploadsRoot = `${path7.resolve(input2.uploadsDir)}${path7.sep}`;
-  if (!absolutePath.startsWith(uploadsRoot)) {
-    throw new Error(`generated upload path escaped uploads root: ${absolutePath}`);
-  }
-  return {
-    dir,
-    absolutePath,
-    uuid8,
-    sanitizedName
-  };
-}
-var MAX_FILENAME_LENGTH, KEEP_FILENAME_CHAR, WORKSPACE_ID_RE;
-var init_paths = __esm({
-  "packages/server/src/uploads/paths.ts"() {
-    "use strict";
-    MAX_FILENAME_LENGTH = 64;
-    KEEP_FILENAME_CHAR = /[a-zA-Z0-9._一-鿿 \-]/;
-    WORKSPACE_ID_RE = /^[a-zA-Z0-9_-]+$/;
-  }
-});
-
 // packages/server/src/uploads/cleanup.ts
-import { readdir, rm as rm3, rmdir, stat as stat4, unlink } from "node:fs/promises";
+import { readdir, rm as rm4, rmdir, stat as stat5, unlink } from "node:fs/promises";
 import path8 from "node:path";
 async function listFilesRecursive(root) {
   let entries;
@@ -2633,7 +2798,7 @@ async function listFilesRecursive(root) {
     if (!entry.isFile()) {
       continue;
     }
-    const fileStat = await stat4(childPath);
+    const fileStat = await stat5(childPath);
     files.push({
       absPath: childPath,
       size: fileStat.size,
@@ -2666,7 +2831,7 @@ async function pruneEmptyDirectories(root) {
 async function deleteWorkspaceUploads(uploadsDir, workspaceId) {
   validateWorkspaceId(workspaceId);
   const bucket = path8.join(uploadsDir, workspaceId);
-  await rm3(bucket, { recursive: true, force: true });
+  await rm4(bucket, { recursive: true, force: true });
 }
 async function enforceBucketCap(uploadsDir, workspaceId, capBytes, logger) {
   validateWorkspaceId(workspaceId);
@@ -2749,9 +2914,9 @@ var init_cleanup = __esm({
 });
 
 // packages/server/src/routes/uploads.ts
-import { createWriteStream } from "node:fs";
-import { rm as rm4, stat as stat5, writeFile as writeFile3 } from "node:fs/promises";
-import { pipeline } from "node:stream/promises";
+import { createWriteStream as createWriteStream2 } from "node:fs";
+import { rm as rm5, stat as stat6, writeFile as writeFile3 } from "node:fs/promises";
+import { pipeline as pipeline2 } from "node:stream/promises";
 function inferClipboardFilename(filename, mimeType, now) {
   const trimmed = filename?.trim();
   if (trimmed) {
@@ -2771,7 +2936,7 @@ function inferClipboardFilename(filename, mimeType, now) {
   return `screenshot-${hhmmss}.${ext}`;
 }
 async function cleanupWrittenFiles(files) {
-  await Promise.all(files.map((file) => rm4(file.path, { force: true })));
+  await Promise.all(files.map((file) => rm5(file.path, { force: true })));
 }
 function getRequestLogger(request) {
   const logger = request.log;
@@ -2780,7 +2945,7 @@ function getRequestLogger(request) {
   }
   return void 0;
 }
-async function rejectAndCleanup(reply, written, statusCode, error) {
+async function rejectAndCleanup2(reply, written, statusCode, error) {
   await cleanupWrittenFiles(written);
   return reply.status(statusCode).send({ ok: false, error });
 }
@@ -2793,7 +2958,7 @@ function getActiveWorkspace(deps, workspaceId) {
 async function ensureWorkspaceStillActive(deps, workspaceId, reply, written) {
   const workspace = getActiveWorkspace(deps, workspaceId);
   if (!workspace) {
-    await rejectAndCleanup(reply, written, 404, "workspace_not_found");
+    await rejectAndCleanup2(reply, written, 404, "workspace_not_found");
     return null;
   }
   return workspace;
@@ -2820,22 +2985,22 @@ function registerUploadsRoute(app, deps) {
         if (part.type === "field" && part.fieldname === "workspaceId") {
           const lockedWorkspaceId = lockWorkspaceId(workspaceId, String(part.value));
           if (lockedWorkspaceId === "mismatch") {
-            return rejectAndCleanup(reply, written, 400, "workspace_mismatch");
+            return rejectAndCleanup2(reply, written, 400, "workspace_mismatch");
           }
           workspaceId = lockedWorkspaceId;
           if (!getActiveWorkspace(deps, workspaceId)) {
-            return rejectAndCleanup(reply, written, 404, "workspace_not_found");
+            return rejectAndCleanup2(reply, written, 404, "workspace_not_found");
           }
           workspaceValidated = true;
           continue;
         }
         if (part.type === "field" && part.fieldname === "files") {
           if (!workspaceId) {
-            return rejectAndCleanup(reply, written, 400, "workspace_required");
+            return rejectAndCleanup2(reply, written, 400, "workspace_required");
           }
           fileCount += 1;
           if (fileCount > MAX_FILES_PER_BATCH) {
-            return rejectAndCleanup(reply, written, 400, "too_many_files");
+            return rejectAndCleanup2(reply, written, 400, "too_many_files");
           }
           const now2 = /* @__PURE__ */ new Date();
           const originalName2 = inferClipboardFilename(void 0, part.mimetype, now2);
@@ -2852,20 +3017,20 @@ function registerUploadsRoute(app, deps) {
             await ensureSafeUploadDir(deps.uploadsDir, target2.dir);
             await writeFile3(target2.absolutePath, String(part.value));
           } catch (error) {
-            await rm4(target2.absolutePath, { force: true });
+            await rm5(target2.absolutePath, { force: true });
             await cleanupWrittenFiles(written);
             logger?.warn({ err: error }, "upload write failed");
             return reply.status(500).send({ ok: false, error: "write_failed" });
           }
           try {
-            const fileStat = await stat5(target2.absolutePath);
+            const fileStat = await stat6(target2.absolutePath);
             written.push({
               path: target2.absolutePath,
               originalName: originalName2,
               size: fileStat.size
             });
           } catch (error) {
-            await rm4(target2.absolutePath, { force: true });
+            await rm5(target2.absolutePath, { force: true });
             await cleanupWrittenFiles(written);
             logger?.warn({ err: error }, "upload stat failed");
             return reply.status(500).send({ ok: false, error: "write_failed" });
@@ -2880,12 +3045,12 @@ function registerUploadsRoute(app, deps) {
         }
         if (!workspaceId) {
           part.file.resume();
-          return rejectAndCleanup(reply, written, 400, "workspace_required");
+          return rejectAndCleanup2(reply, written, 400, "workspace_required");
         }
         fileCount += 1;
         if (fileCount > MAX_FILES_PER_BATCH) {
           part.file.resume();
-          return rejectAndCleanup(reply, written, 400, "too_many_files");
+          return rejectAndCleanup2(reply, written, 400, "too_many_files");
         }
         const now = /* @__PURE__ */ new Date();
         const originalName = inferClipboardFilename(part.filename, part.mimetype, now);
@@ -2901,27 +3066,27 @@ function registerUploadsRoute(app, deps) {
         }
         try {
           await ensureSafeUploadDir(deps.uploadsDir, target.dir);
-          await pipeline(part.file, createWriteStream(target.absolutePath));
+          await pipeline2(part.file, createWriteStream2(target.absolutePath));
         } catch (error) {
-          await rm4(target.absolutePath, { force: true });
+          await rm5(target.absolutePath, { force: true });
           await cleanupWrittenFiles(written);
           logger?.warn({ err: error }, "upload write failed");
           return reply.status(500).send({ ok: false, error: "write_failed" });
         }
         if (part.file.truncated) {
-          await rm4(target.absolutePath, { force: true });
+          await rm5(target.absolutePath, { force: true });
           await cleanupWrittenFiles(written);
           return reply.status(413).send({ ok: false, error: "file_too_large" });
         }
         try {
-          const fileStat = await stat5(target.absolutePath);
+          const fileStat = await stat6(target.absolutePath);
           written.push({
             path: target.absolutePath,
             originalName,
             size: fileStat.size
           });
         } catch (error) {
-          await rm4(target.absolutePath, { force: true });
+          await rm5(target.absolutePath, { force: true });
           await cleanupWrittenFiles(written);
           logger?.warn({ err: error }, "upload stat failed");
           return reply.status(500).send({ ok: false, error: "write_failed" });
@@ -2936,13 +3101,13 @@ function registerUploadsRoute(app, deps) {
       return reply.status(400).send({ ok: false, error: "parse_failed" });
     }
     if (!workspaceId) {
-      return rejectAndCleanup(reply, written, 400, "workspace_required");
+      return rejectAndCleanup2(reply, written, 400, "workspace_required");
     }
     if (!workspaceValidated) {
-      return rejectAndCleanup(reply, written, 404, "workspace_not_found");
+      return rejectAndCleanup2(reply, written, 404, "workspace_not_found");
     }
     if (written.length === 0) {
-      return rejectAndCleanup(reply, written, 400, "no_files");
+      return rejectAndCleanup2(reply, written, 400, "no_files");
     }
     if (!await ensureWorkspaceStillActive(deps, workspaceId, reply, written)) {
       return;
@@ -2962,7 +3127,105 @@ var init_uploads = __esm({
   }
 });
 
+// packages/server/src/storage/repositories/json-file-store.ts
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3 } from "node:path";
+function hasCode(error, code) {
+  return Boolean(
+    error && typeof error === "object" && "code" in error && error.code === code
+  );
+}
+function readJsonFile(filePath) {
+  try {
+    return JSON.parse(readFileSync3(filePath, "utf-8"));
+  } catch (error) {
+    if (hasCode(error, "ENOENT")) {
+      return void 0;
+    }
+    throw error;
+  }
+}
+function writeJsonFileAtomic(filePath, value) {
+  mkdirSync2(dirname3(filePath), { recursive: true });
+  const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  try {
+    writeFileSync2(tempPath, JSON.stringify(value, null, 2) + "\n", "utf-8");
+    renameSync(tempPath, filePath);
+  } catch (error) {
+    rmSync(tempPath, { force: true });
+    throw error;
+  }
+}
+var init_json_file_store = __esm({
+  "packages/server/src/storage/repositories/json-file-store.ts"() {
+    "use strict";
+  }
+});
+
+// packages/server/src/storage/repositories/appearance-asset-repo.ts
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeAppearanceAssetFile(value) {
+  if (isRecord(value) && value.version === 1 && isRecord(value.assets)) {
+    return value.assets;
+  }
+  if (isRecord(value)) {
+    return value;
+  }
+  return {};
+}
+var AppearanceAssetRepo;
+var init_appearance_asset_repo = __esm({
+  "packages/server/src/storage/repositories/appearance-asset-repo.ts"() {
+    "use strict";
+    init_json_file_store();
+    AppearanceAssetRepo = class {
+      constructor(options) {
+        this.options = options;
+      }
+      options;
+      loadFileAssets() {
+        const parsed = readJsonFile(
+          this.options.filePath
+        );
+        if (parsed !== void 0) {
+          return { ...normalizeAppearanceAssetFile(parsed) };
+        }
+        return {};
+      }
+      saveFileAssets(assets) {
+        const payload = {
+          version: 1,
+          assets
+        };
+        writeJsonFileAtomic(this.options.filePath, payload);
+      }
+      get(id) {
+        return this.loadFileAssets()[id];
+      }
+      set(record) {
+        const next = this.loadFileAssets();
+        next[record.id] = record;
+        this.saveFileAssets(next);
+      }
+      delete(id) {
+        const next = this.loadFileAssets();
+        if (!Object.prototype.hasOwnProperty.call(next, id)) {
+          return;
+        }
+        delete next[id];
+        this.saveFileAssets(next);
+      }
+      list() {
+        return Object.values(this.loadFileAssets());
+      }
+    };
+  }
+});
+
 // packages/server/src/app.ts
+import { join as join3, resolve as resolve3 } from "node:path";
 import compress from "@fastify/compress";
 import cors from "@fastify/cors";
 import multipart from "@fastify/multipart";
@@ -2970,6 +3233,10 @@ import staticPlugin from "@fastify/static";
 import websocket from "@fastify/websocket";
 import Fastify from "fastify";
 async function buildFastifyApp(deps) {
+  const stateRoot = deps.config.stateDir === IN_MEMORY_STATE_DIR ? resolve3(deps.config.uploadsDir, "..") : deps.config.stateDir;
+  const appearanceAssetRepo = deps.appearanceAssetRepo ?? new AppearanceAssetRepo({
+    filePath: join3(stateRoot, "state", "appearance-assets.json")
+  });
   const app = Fastify({
     logger: deps.logger ?? {
       level: "info",
@@ -3052,6 +3319,10 @@ async function buildFastifyApp(deps) {
   registerFileAssetRoutes(app, {
     workspaceMgr: deps.workspaceMgr
   });
+  registerAppearanceAssetsRoutes(app, {
+    uploadsDir: deps.config.uploadsDir,
+    repo: appearanceAssetRepo
+  });
   const previewSessions = new PreviewSessionStore();
   registerPreviewRoutes(app, {
     workspaceMgr: deps.workspaceMgr,
@@ -3105,11 +3376,14 @@ async function buildFastifyApp(deps) {
 var init_app = __esm({
   "packages/server/src/app.ts"() {
     "use strict";
+    init_state_paths();
     init_auth();
     init_session_store();
+    init_appearance_assets();
     init_file_asset();
     init_preview();
     init_uploads();
+    init_appearance_asset_repo();
     init_constants();
     init_web_ui_routing();
   }
@@ -3346,12 +3620,12 @@ var init_auto_fetch = __esm({
       }
       acquireWorkspaceOperation(workspaceId) {
         const state = this.getOrCreateState(workspaceId);
-        return new Promise((resolve4) => {
+        return new Promise((resolve6) => {
           const grant = () => {
             state.inFlight = true;
             state.nextFetchAt = void 0;
             let released = false;
-            resolve4(() => {
+            resolve6(() => {
               if (released) {
                 return;
               }
@@ -4354,7 +4628,7 @@ var init_manager = __esm({
 // packages/server/src/provider-runtime/command-runner.ts
 import { spawn as spawn2 } from "node:child_process";
 async function runCommandAsString(file, args, options) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn2(file, args, {
       cwd: options?.cwd,
       env: options?.env,
@@ -4381,7 +4655,7 @@ async function runCommandAsString(file, args, options) {
       const stdout = Buffer.concat(stdoutChunks).toString("utf8");
       const stderr = Buffer.concat(stderrChunks).toString("utf8");
       if (code === 0) {
-        resolve4({ stdout, stderr });
+        resolve6({ stdout, stderr });
         return;
       }
       reject(
@@ -4500,9 +4774,9 @@ var init_definitions = __esm({
 });
 
 // packages/server/src/lsp-tools/install-manager.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname3, join as join2 } from "node:path";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { mkdirSync as mkdirSync3 } from "node:fs";
+import { dirname as dirname4, join as join4 } from "node:path";
 function toSnapshotStep(step) {
   return {
     id: step.id,
@@ -4666,7 +4940,7 @@ var init_install_manager = __esm({
       async prepare(input2) {
         const definition = getLspToolDefinition(input2.serverKind);
         const managed = definition.managed;
-        const jobId = randomUUID3();
+        const jobId = randomUUID4();
         const platform = this.deps.platform ?? process.platform;
         if (!managed || input2.workspace.targetRuntime !== "native") {
           return {
@@ -4735,13 +5009,13 @@ var init_install_manager = __esm({
             }
           };
         }
-        const installRoot = join2(this.deps.manifestStore.getRoot(), input2.serverKind, managed.version);
-        const executablePath = input2.serverKind === "python" ? join2(
+        const installRoot = join4(this.deps.manifestStore.getRoot(), input2.serverKind, managed.version);
+        const executablePath = input2.serverKind === "python" ? join4(
           installRoot,
           "venv",
           platform === "win32" ? "Scripts" : "bin",
           platform === "win32" ? "pylsp.exe" : "pylsp"
-        ) : input2.serverKind === "go" ? join2(installRoot, "bin", platform === "win32" ? "gopls.exe" : "gopls") : join2(installRoot, "bin", platform === "win32" ? "rust-analyzer.exe" : "rust-analyzer");
+        ) : input2.serverKind === "go" ? join4(installRoot, "bin", platform === "win32" ? "gopls.exe" : "gopls") : join4(installRoot, "bin", platform === "win32" ? "rust-analyzer.exe" : "rust-analyzer");
         const plannedSteps = this.planInstallSteps({
           serverKind: input2.serverKind,
           installRoot,
@@ -4768,16 +5042,16 @@ var init_install_manager = __esm({
         const platform = this.deps.platform ?? process.platform;
         job.status = "running";
         this.jobs.set(job.jobId, job);
-        const installRoot = join2(this.deps.manifestStore.getRoot(), serverKind, managed.version);
-        const executablePath = serverKind === "python" ? join2(
+        const installRoot = join4(this.deps.manifestStore.getRoot(), serverKind, managed.version);
+        const executablePath = serverKind === "python" ? join4(
           installRoot,
           "venv",
           platform === "win32" ? "Scripts" : "bin",
           platform === "win32" ? "pylsp.exe" : "pylsp"
-        ) : serverKind === "go" ? join2(installRoot, "bin", platform === "win32" ? "gopls.exe" : "gopls") : join2(installRoot, "bin", platform === "win32" ? "rust-analyzer.exe" : "rust-analyzer");
+        ) : serverKind === "go" ? join4(installRoot, "bin", platform === "win32" ? "gopls.exe" : "gopls") : join4(installRoot, "bin", platform === "win32" ? "rust-analyzer.exe" : "rust-analyzer");
         const commandExists = this.deps.commandExists ?? ((command) => checkCommandAvailable(command, this.deps));
         const pythonCommand = serverKind === "python" ? await resolveManagedPythonCommand(commandExists, platform) : null;
-        mkdirSync2(dirname3(executablePath), { recursive: true });
+        mkdirSync3(dirname4(executablePath), { recursive: true });
         for (const step of job.steps) {
           job.currentStepId = step.id;
           step.status = "running";
@@ -4844,9 +5118,9 @@ var init_install_manager = __esm({
       }
       planInstallSteps(input2) {
         if (input2.serverKind === "python") {
-          const venvRoot = join2(input2.installRoot, "venv");
-          const binDir = join2(venvRoot, input2.platform === "win32" ? "Scripts" : "bin");
-          const pipPath = join2(binDir, input2.platform === "win32" ? "pip.exe" : "pip");
+          const venvRoot = join4(input2.installRoot, "venv");
+          const binDir = join4(venvRoot, input2.platform === "win32" ? "Scripts" : "bin");
+          const pipPath = join4(binDir, input2.platform === "win32" ? "pip.exe" : "pip");
           return [
             {
               id: "create-python-venv",
@@ -4883,7 +5157,7 @@ var init_install_manager = __esm({
               args: ["install", `golang.org/x/tools/gopls@${input2.version}`],
               env: {
                 ...process.env,
-                GOBIN: join2(input2.installRoot, "bin")
+                GOBIN: join4(input2.installRoot, "bin")
               }
             },
             {
@@ -4943,7 +5217,7 @@ var init_install_manager = __esm({
 // packages/server/src/lsp-tools/manager.ts
 import { existsSync as existsSync3 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { join as join3 } from "node:path";
+import { join as join5 } from "node:path";
 function parseOverrideArgs(raw, envVarName) {
   try {
     const parsed = JSON.parse(raw);
@@ -5077,8 +5351,8 @@ var init_manager2 = __esm({
         }
         try {
           const packageJsonPath = require3.resolve(`${definition.bundled.packageName}/package.json`);
-          const packageRoot = join3(packageJsonPath, "..");
-          const entryPath = join3(packageRoot, definition.bundled.entry);
+          const packageRoot = join5(packageJsonPath, "..");
+          const entryPath = join5(packageRoot, definition.bundled.entry);
           if (!existsSync3(entryPath)) {
             return null;
           }
@@ -5130,8 +5404,8 @@ var init_manager2 = __esm({
 });
 
 // packages/server/src/lsp-tools/manifest-store.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join4 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join6 } from "node:path";
 var FileManifestStore;
 var init_manifest_store = __esm({
   "packages/server/src/lsp-tools/manifest-store.ts"() {
@@ -5150,29 +5424,29 @@ var init_manifest_store = __esm({
           return null;
         }
         try {
-          return JSON.parse(readFileSync3(path14, "utf8"));
+          return JSON.parse(readFileSync4(path14, "utf8"));
         } catch {
           return null;
         }
       }
       write(serverKind, manifest) {
         const path14 = this.pathFor(serverKind);
-        mkdirSync3(join4(this.root, serverKind), { recursive: true });
-        writeFileSync2(path14, JSON.stringify(manifest, null, 2));
+        mkdirSync4(join6(this.root, serverKind), { recursive: true });
+        writeFileSync3(path14, JSON.stringify(manifest, null, 2));
       }
       pathFor(serverKind) {
-        return join4(this.root, serverKind, "manifest.json");
+        return join6(this.root, serverKind, "manifest.json");
       }
     };
   }
 });
 
 // packages/server/src/lsp-tools/tool-root.ts
-import { mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join5 } from "node:path";
+import { mkdirSync as mkdirSync5 } from "node:fs";
+import { join as join7 } from "node:path";
 function resolveLspToolRoot(stateDir) {
-  const root = join5(stateDir, "lsp-tools");
-  mkdirSync4(root, { recursive: true });
+  const root = join7(stateDir, "lsp-tools");
+  mkdirSync5(root, { recursive: true });
   return root;
 }
 var init_tool_root = __esm({
@@ -5182,8 +5456,8 @@ var init_tool_root = __esm({
 });
 
 // packages/server/src/provider-runtime/e2e-provider-mock.ts
-import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname4, join as join6 } from "node:path";
+import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname5, join as join8 } from "node:path";
 function createE2EProviderMockOverrides(env = process.env) {
   const statePath = env.CODER_STUDIO_E2E_PROVIDER_STATE_PATH;
   if (!statePath) {
@@ -5268,7 +5542,7 @@ function readMockState(statePath) {
   if (!existsSync5(statePath)) {
     return {};
   }
-  const raw = readFileSync4(statePath, "utf8");
+  const raw = readFileSync5(statePath, "utf8");
   if (!raw.trim()) {
     return {};
   }
@@ -5283,22 +5557,22 @@ function readMockState(statePath) {
 function writeMockState(statePath, updater) {
   const nextState = readMockState(statePath);
   updater(nextState);
-  mkdirSync5(dirname4(statePath), { recursive: true });
-  writeFileSync3(statePath, JSON.stringify(nextState, null, 2));
+  mkdirSync6(dirname5(statePath), { recursive: true });
+  writeFileSync4(statePath, JSON.stringify(nextState, null, 2));
   return nextState;
 }
 function ensureProviderCommand(binDir, providerId) {
-  mkdirSync5(binDir, { recursive: true });
-  const scriptPath = join6(binDir, providerId);
-  writeFileSync3(scriptPath, PROVIDER_COMMAND_SCRIPTS[providerId], "utf8");
+  mkdirSync6(binDir, { recursive: true });
+  const scriptPath = join8(binDir, providerId);
+  writeFileSync4(scriptPath, PROVIDER_COMMAND_SCRIPTS[providerId], "utf8");
   chmodSync(scriptPath, 493);
 }
 function appendDebugLog(path14, line) {
   if (!path14) {
     return;
   }
-  mkdirSync5(dirname4(path14), { recursive: true });
-  writeFileSync3(path14, `${line}
+  mkdirSync6(dirname5(path14), { recursive: true });
+  writeFileSync4(path14, `${line}
 `, { flag: "a" });
 }
 var PROVIDER_INSTALL_PACKAGES, PROVIDER_COMMAND_SCRIPTS;
@@ -5333,7 +5607,7 @@ done
 });
 
 // packages/server/src/provider-runtime/install-manager.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 function getErrorDetails2(error) {
   if (error instanceof Error) {
     const record = error;
@@ -5473,7 +5747,7 @@ var init_install_manager2 = __esm({
         );
         if (missingProviderCommands.length === 0) {
           return {
-            jobId: randomUUID4(),
+            jobId: randomUUID5(),
             providerId: provider.id,
             strategyIds: [],
             status: "succeeded",
@@ -5537,7 +5811,7 @@ var init_install_manager2 = __esm({
             }
           }
         }
-        const jobId = randomUUID4();
+        const jobId = randomUUID5();
         if (remainingPrerequisites.size > 0) {
           const failedStep = this.createCheckStep(
             "prerequisite",
@@ -6108,41 +6382,6 @@ var init_provider_config = __esm({
   }
 });
 
-// packages/server/src/storage/repositories/json-file-store.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync5, renameSync, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname5 } from "node:path";
-function hasCode(error, code) {
-  return Boolean(
-    error && typeof error === "object" && "code" in error && error.code === code
-  );
-}
-function readJsonFile(filePath) {
-  try {
-    return JSON.parse(readFileSync5(filePath, "utf-8"));
-  } catch (error) {
-    if (hasCode(error, "ENOENT")) {
-      return void 0;
-    }
-    throw error;
-  }
-}
-function writeJsonFileAtomic(filePath, value) {
-  mkdirSync6(dirname5(filePath), { recursive: true });
-  const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-  try {
-    writeFileSync4(tempPath, JSON.stringify(value, null, 2) + "\n", "utf-8");
-    renameSync(tempPath, filePath);
-  } catch (error) {
-    rmSync(tempPath, { force: true });
-    throw error;
-  }
-}
-var init_json_file_store = __esm({
-  "packages/server/src/storage/repositories/json-file-store.ts"() {
-    "use strict";
-  }
-});
-
 // packages/server/src/storage/repositories/session-repo.ts
 function rowToSession(row) {
   return {
@@ -6179,11 +6418,11 @@ function sessionToRow(session) {
     title: session.title ?? null
   };
 }
-function isRecord(value) {
+function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isSession(value) {
-  if (!isRecord(value)) {
+  if (!isRecord2(value)) {
     return false;
   }
   return typeof value.id === "string" && typeof value.workspaceId === "string" && typeof value.terminalId === "string" && typeof value.providerId === "string" && typeof value.startedAt === "number" && typeof value.lastActiveAt === "number" && (value.capability === "full" || value.capability === "limited" || value.capability === "unsupported") && typeof value.state === "string";
@@ -6195,7 +6434,7 @@ function normalizeStoredSession(session) {
   };
 }
 function normalizeSessionFile(value) {
-  if (isRecord(value) && value.version === 1 && isRecord(value.sessions)) {
+  if (isRecord2(value) && value.version === 1 && isRecord2(value.sessions)) {
     const normalized = {};
     for (const entry of Object.values(value.sessions)) {
       if (isSession(entry)) {
@@ -6213,7 +6452,7 @@ function normalizeSessionFile(value) {
     }
     return normalized;
   }
-  if (isRecord(value)) {
+  if (isRecord2(value)) {
     const normalized = {};
     for (const [sessionId, entry] of Object.entries(value)) {
       if (isSession(entry)) {
@@ -6519,7 +6758,87 @@ var init_state_shadow_comparator = __esm({
 function generateSessionId() {
   return `sess_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 }
-var NOOP_SESSION_LOGGER, SessionManager, ActiveSession;
+function readTerminalEscapeSequence(text, start) {
+  const match = text.slice(start).match(TERMINAL_ESCAPE_SEQUENCE_PATTERN);
+  return match?.[0] ?? null;
+}
+function classifyRecentInputEcho(bytes) {
+  const text = bytes.toString("utf8");
+  let opaque = false;
+  let remainingVisibleText = "";
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (char === "\x1B") {
+      const escape = readTerminalEscapeSequence(text, index);
+      if (escape) {
+        opaque = true;
+        index += escape.length - 1;
+        continue;
+      }
+    }
+    if (char === "\r" || char === "\n" || char === "	") {
+      opaque = true;
+      continue;
+    }
+    if (char === "\x7F" || char === "\b") {
+      opaque = true;
+      continue;
+    }
+    if (char < " ") {
+      opaque = true;
+      continue;
+    }
+    remainingVisibleText += char;
+  }
+  return { opaque, remainingVisibleText };
+}
+function extractVisibleTerminalText(bytes) {
+  const text = bytes.toString("utf8");
+  let visibleText = "";
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (char === "\x1B") {
+      const escape = readTerminalEscapeSequence(text, index);
+      if (escape) {
+        index += escape.length - 1;
+        continue;
+      }
+      continue;
+    }
+    if (char === "\x7F" || char === "\b") {
+      visibleText = visibleText.slice(0, -1);
+      continue;
+    }
+    if (char === "\r" || char === "\n") {
+      visibleText += "\n";
+      continue;
+    }
+    if (char === "	") {
+      visibleText += "	";
+      continue;
+    }
+    if (char < " ") {
+      continue;
+    }
+    visibleText += char;
+  }
+  return visibleText;
+}
+function commonPrefixLength(left, right) {
+  const maxLength = Math.min(left.length, right.length);
+  let index = 0;
+  while (index < maxLength && left[index] === right[index]) {
+    index += 1;
+  }
+  return index;
+}
+function chunkHasLineRepaintControl(text) {
+  return text.includes("\r") || /\x1b\[[0-9;?]*K/.test(text) || /\x1b\[[0-9;?]*[ABCDGHF]/.test(text);
+}
+function visibleOutputHasMultipleLines(visibleOutput) {
+  return visibleOutput.split("\n").map((line) => line.trim()).filter((line) => line.length > 0).length > 1;
+}
+var NOOP_SESSION_LOGGER, RECENT_INPUT_ECHO_WINDOW_MS, RECENT_INPUT_ECHO_MAX_EVENTS, RECENT_INPUT_ECHO_MAX_BYTES, RECENT_OPAQUE_INPUT_ECHO_WINDOW_MS, RESUME_OUTPUT_AGGREGATION_WINDOW_MS, RESUME_OUTPUT_AGGREGATION_MAX_BYTES, TERMINAL_ESCAPE_SEQUENCE_PATTERN, SessionManager, ActiveSession;
 var init_manager3 = __esm({
   "packages/server/src/session/manager.ts"() {
     "use strict";
@@ -6532,6 +6851,13 @@ var init_manager3 = __esm({
       warn: () => {
       }
     };
+    RECENT_INPUT_ECHO_WINDOW_MS = 3e3;
+    RECENT_INPUT_ECHO_MAX_EVENTS = 12;
+    RECENT_INPUT_ECHO_MAX_BYTES = 8192;
+    RECENT_OPAQUE_INPUT_ECHO_WINDOW_MS = 200;
+    RESUME_OUTPUT_AGGREGATION_WINDOW_MS = 75;
+    RESUME_OUTPUT_AGGREGATION_MAX_BYTES = 4096;
+    TERMINAL_ESCAPE_SEQUENCE_PATTERN = /^\x1b(?:\[[0-9;?<>]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|P[\s\S]*?\x1b\\|[@-_])/;
     SessionManager = class {
       constructor(deps) {
         this.deps = deps;
@@ -6708,6 +7034,7 @@ var init_manager3 = __esm({
         this.applyTerminalInputActivity(session, activity, text, { armTurnCompletion: true });
       }
       applyTerminalInputActivity(session, activity, text, options) {
+        const completedSynchronously = !options.armTurnCompletion && session.state === "idle" && !session.awaitingTurnCompletion;
         if (activity === "control" || activity === "typing") {
           return;
         }
@@ -6716,16 +7043,10 @@ var init_manager3 = __esm({
             session.awaitingTurnCompletion = true;
             session.sawOutputSinceTurnStart = false;
           }
-          const prev2 = session.state;
-          if (session.state !== "running") {
-            session.state = "running";
-            session.lastActiveAt = Date.now();
-            this.deps.db.update(session.id, {
-              state: "running",
-              lastActiveAt: session.lastActiveAt
-            });
-            this.emitStateChanged(session, prev2, "running");
+          if (completedSynchronously) {
+            return;
           }
+          this.transitionSessionToRunning(session);
           return;
         }
         if (activity !== "submit") return;
@@ -6738,17 +7059,11 @@ var init_manager3 = __esm({
           session.sawOutputSinceTurnStart = false;
         }
         const titleChanged = this.maybeAssignTitle(session, submittedText);
-        const prev = session.state;
         const shouldResume = session.state === "idle" || session.state === "starting";
-        if (shouldResume) {
-          session.state = "running";
-          session.lastActiveAt = Date.now();
-          this.deps.db.update(session.id, {
-            state: "running",
-            lastActiveAt: session.lastActiveAt
-          });
-          this.emitStateChanged(session, prev, "running");
+        if (shouldResume && !completedSynchronously) {
+          this.transitionSessionToRunning(session);
         } else if (titleChanged) {
+          const prev = session.state;
           this.emitStateChanged(session, prev, session.state);
         }
       }
@@ -6762,9 +7077,11 @@ var init_manager3 = __esm({
         }
         const text = activity === "submit" || activity === "internal_submit" ? submittedText ?? bytes.toString("utf-8") : void 0;
         const rollbackArm = this.armTurnCompletionBeforeWrite(session, activity);
+        const rollbackRecentInput = this.recordRecentInputBeforeWrite(session, bytes, activity);
         try {
           this.deps.terminalMgr.write(session.terminalId, bytes);
         } catch (error) {
+          rollbackRecentInput?.();
           rollbackArm?.();
           throw error;
         }
@@ -6826,6 +7143,19 @@ var init_manager3 = __esm({
         this.deps.db.update(session.id, { title });
         return true;
       }
+      transitionSessionToRunning(session) {
+        if (session.state === "running") {
+          return;
+        }
+        const prev = session.state;
+        session.state = "running";
+        session.lastActiveAt = Date.now();
+        this.deps.db.update(session.id, {
+          state: "running",
+          lastActiveAt: session.lastActiveAt
+        });
+        this.emitStateChanged(session, prev, "running");
+      }
       /**
        * Handle terminal exit event
        */
@@ -6887,6 +7217,197 @@ var init_manager3 = __esm({
           session.sawOutputSinceTurnStart = previousSawOutputSinceTurnStart;
         };
       }
+      recordRecentInputBeforeWrite(session, bytes, activity) {
+        if (activity === "system") {
+          return null;
+        }
+        const { opaque, remainingVisibleText } = classifyRecentInputEcho(bytes);
+        if (!opaque && remainingVisibleText.length === 0) {
+          return null;
+        }
+        const recentInput = {
+          at: Date.now(),
+          activity,
+          byteLength: bytes.byteLength,
+          opaque,
+          remainingVisibleText
+        };
+        session.recentInputEchoes.push(recentInput);
+        this.pruneRecentInputEchoes(session, recentInput.at);
+        return () => {
+          const index = session.recentInputEchoes.indexOf(recentInput);
+          if (index !== -1) {
+            session.recentInputEchoes.splice(index, 1);
+          }
+        };
+      }
+      pruneRecentInputEchoes(session, now = Date.now()) {
+        session.recentInputEchoes = session.recentInputEchoes.filter(
+          (entry) => now - entry.at <= RECENT_INPUT_ECHO_WINDOW_MS && (entry.opaque || entry.remainingVisibleText.length > 0)
+        );
+        let totalBytes = session.recentInputEchoes.reduce((sum, entry) => sum + entry.byteLength, 0);
+        while (session.recentInputEchoes.length > RECENT_INPUT_ECHO_MAX_EVENTS || totalBytes > RECENT_INPUT_ECHO_MAX_BYTES) {
+          const removed = session.recentInputEchoes.shift();
+          if (!removed) {
+            break;
+          }
+          totalBytes -= removed.byteLength;
+        }
+      }
+      clearPendingResumeAggregation(session) {
+        if (session.pendingResumeAggregation?.timer) {
+          clearTimeout(session.pendingResumeAggregation.timer);
+        }
+        session.pendingResumeAggregation = null;
+      }
+      consumeRecentLiteralEcho(session, visibleOutput) {
+        let offset = 0;
+        let matchedLiteralEcho = false;
+        for (const entry of session.recentInputEchoes) {
+          if (offset >= visibleOutput.length) {
+            break;
+          }
+          if (entry.remainingVisibleText.length === 0) {
+            continue;
+          }
+          const currentVisibleText = entry.remainingVisibleText;
+          const matchLength = commonPrefixLength(visibleOutput.slice(offset), currentVisibleText);
+          if (matchLength === 0) {
+            break;
+          }
+          entry.remainingVisibleText = currentVisibleText.slice(matchLength);
+          offset += matchLength;
+          matchedLiteralEcho = true;
+          if (matchLength < currentVisibleText.length) {
+            break;
+          }
+        }
+        return {
+          matchedLiteralEcho,
+          leftoverVisibleOutput: visibleOutput.slice(offset)
+        };
+      }
+      hasRecentNonSubmitInput(session, now) {
+        return session.recentInputEchoes.some(
+          (entry) => entry.activity !== "submit" && entry.activity !== "internal_submit" && now - entry.at <= RECENT_OPAQUE_INPUT_ECHO_WINDOW_MS
+        );
+      }
+      hasRecentOpaqueNonSubmitInput(session, now) {
+        return session.recentInputEchoes.some(
+          (entry) => entry.opaque && entry.activity !== "submit" && entry.activity !== "internal_submit" && now - entry.at <= RECENT_OPAQUE_INPUT_ECHO_WINDOW_MS
+        );
+      }
+      hasRecentControlInput(session, now) {
+        return session.recentInputEchoes.some(
+          (entry) => entry.activity === "control" && now - entry.at <= RECENT_OPAQUE_INPUT_ECHO_WINDOW_MS
+        );
+      }
+      getRecentVisibleInputText(session) {
+        return session.recentInputEchoes.filter((entry) => entry.activity !== "submit" && entry.activity !== "internal_submit").map((entry) => entry.remainingVisibleText).join("");
+      }
+      isLikelyPureInputRepaint(session, chunk, visibleOutput, now) {
+        if (!this.hasRecentNonSubmitInput(session, now)) {
+          return false;
+        }
+        if (!visibleOutput.trim()) {
+          return true;
+        }
+        const chunkText = chunk.toString("utf8");
+        if (chunkText.includes("\n")) {
+          return false;
+        }
+        if (visibleOutputHasMultipleLines(visibleOutput)) {
+          return false;
+        }
+        if (!chunkHasLineRepaintControl(chunkText)) {
+          return false;
+        }
+        if (this.hasRecentOpaqueNonSubmitInput(session, now)) {
+          return true;
+        }
+        const recentVisibleInputText = this.getRecentVisibleInputText(session);
+        const trimmedVisibleOutput = visibleOutput.trim();
+        if (!recentVisibleInputText || !trimmedVisibleOutput) {
+          return false;
+        }
+        return recentVisibleInputText === trimmedVisibleOutput || recentVisibleInputText.startsWith(trimmedVisibleOutput) || trimmedVisibleOutput.endsWith(recentVisibleInputText);
+      }
+      assessTerminalOutput(session, chunk) {
+        const now = Date.now();
+        this.pruneRecentInputEchoes(session, now);
+        if (session.recentInputEchoes.length === 0) {
+          const hasVisibleText = extractVisibleTerminalText(chunk).trim().length > 0;
+          return {
+            shouldResumeRunning: hasVisibleText,
+            countsAsTurnOutput: hasVisibleText,
+            shouldAggregateForResume: false
+          };
+        }
+        const visibleOutput = extractVisibleTerminalText(chunk);
+        const { matchedLiteralEcho, leftoverVisibleOutput } = this.consumeRecentLiteralEcho(
+          session,
+          visibleOutput
+        );
+        const hasRecentNonSubmitInput = this.hasRecentNonSubmitInput(session, now);
+        const hasRecentControlInput = this.hasRecentControlInput(session, now);
+        this.pruneRecentInputEchoes(session, now);
+        const trimmedLeftoverVisibleOutput = leftoverVisibleOutput.trim();
+        const trimmedVisibleOutput = visibleOutput.trim();
+        const suppressImmediateResumeAfterControl = hasRecentControlInput && !matchedLiteralEcho;
+        const chunkText = chunk.toString("utf8");
+        const shouldAggregateForResume = session.state === "idle" && hasRecentNonSubmitInput && !matchedLiteralEcho && trimmedVisibleOutput.length > 0 && chunkHasLineRepaintControl(chunkText) && !visibleOutputHasMultipleLines(visibleOutput);
+        const shouldResumeRunning = suppressImmediateResumeAfterControl ? false : trimmedLeftoverVisibleOutput.length > 0 ? !this.isLikelyPureInputRepaint(session, chunk, leftoverVisibleOutput, now) : !matchedLiteralEcho && trimmedVisibleOutput.length > 0 && !this.isLikelyPureInputRepaint(session, chunk, visibleOutput, now);
+        const countsAsTurnOutput = !suppressImmediateResumeAfterControl && (trimmedLeftoverVisibleOutput.length > 0 ? !this.isLikelyPureInputRepaint(session, chunk, leftoverVisibleOutput, now) : !matchedLiteralEcho && trimmedVisibleOutput.length > 0 && !this.isLikelyPureInputRepaint(session, chunk, visibleOutput, now));
+        return {
+          shouldResumeRunning,
+          countsAsTurnOutput,
+          shouldAggregateForResume
+        };
+      }
+      flushPendingResumeAggregation(session) {
+        const pending = session.pendingResumeAggregation;
+        if (!pending) {
+          return;
+        }
+        this.clearPendingResumeAggregation(session);
+        if (session.state !== "idle") {
+          return;
+        }
+        const combinedChunk = Buffer.concat(pending.chunks, pending.byteLength);
+        const outputAssessment = this.assessTerminalOutput(session, combinedChunk);
+        if (outputAssessment.countsAsTurnOutput) {
+          session.sawOutputSinceTurnStart = true;
+        }
+      }
+      schedulePendingResumeAggregation(session, chunk) {
+        const pending = session.pendingResumeAggregation;
+        if (!pending) {
+          const nextPending = {
+            startedAt: Date.now(),
+            chunks: [chunk],
+            byteLength: chunk.byteLength,
+            timer: null
+          };
+          nextPending.timer = setTimeout(() => {
+            const activeSession = this.sessions.get(session.id);
+            if (!activeSession) {
+              return;
+            }
+            this.flushPendingResumeAggregation(activeSession);
+          }, RESUME_OUTPUT_AGGREGATION_WINDOW_MS);
+          session.pendingResumeAggregation = nextPending;
+          return;
+        }
+        pending.chunks.push(chunk);
+        pending.byteLength += chunk.byteLength;
+        const combinedChunk = Buffer.concat(pending.chunks, pending.byteLength);
+        const visibleOutput = extractVisibleTerminalText(combinedChunk);
+        const combinedText = combinedChunk.toString("utf8");
+        const shouldFlushNow = pending.byteLength >= RESUME_OUTPUT_AGGREGATION_MAX_BYTES || combinedText.includes("\n") || visibleOutputHasMultipleLines(visibleOutput);
+        if (shouldFlushNow) {
+          this.flushPendingResumeAggregation(session);
+        }
+      }
       flushPendingPtyIdle(session) {
         const ptyState = this.comparators.get(session.id)?.snapshot().ptyState;
         if (ptyState !== "idle") {
@@ -6895,6 +7416,7 @@ var init_manager3 = __esm({
         this.transitionSessionToIdle(session);
       }
       transitionSessionToIdle(activeSession) {
+        this.clearPendingResumeAggregation(activeSession);
         const prev = activeSession.state;
         if (prev !== "running" && prev !== "starting") {
           return;
@@ -6957,7 +7479,24 @@ var init_manager3 = __esm({
             return;
           }
           const activeSession = this.sessions.get(session.id);
-          if (activeSession?.awaitingTurnCompletion) {
+          if (!activeSession) {
+            return;
+          }
+          if (activeSession.pendingResumeAggregation && activeSession.state !== "idle") {
+            this.clearPendingResumeAggregation(activeSession);
+          }
+          if (activeSession.pendingResumeAggregation) {
+            this.schedulePendingResumeAggregation(activeSession, event.chunk);
+            detector.feed(event.chunk);
+            return;
+          }
+          const outputAssessment = this.assessTerminalOutput(activeSession, event.chunk);
+          if (outputAssessment.shouldAggregateForResume) {
+            this.schedulePendingResumeAggregation(activeSession, event.chunk);
+            detector.feed(event.chunk);
+            return;
+          }
+          if (outputAssessment.countsAsTurnOutput) {
             activeSession.sawOutputSinceTurnStart = true;
           }
           detector.feed(event.chunk);
@@ -6974,6 +7513,7 @@ var init_manager3 = __esm({
         this.comparators.delete(sessionId);
       }
       finishSession(session, exitCode) {
+        this.clearPendingResumeAggregation(session);
         const prev = session.state;
         session.state = "ended";
         session.endedAt = Date.now();
@@ -7005,6 +7545,8 @@ var init_manager3 = __esm({
       latestSubmittedUserInput;
       awaitingTurnCompletion = false;
       sawOutputSinceTurnStart = false;
+      recentInputEchoes = [];
+      pendingResumeAggregation = null;
       constructor(data) {
         this.id = data.id;
         this.workspaceId = data.workspaceId;
@@ -7047,17 +7589,17 @@ var init_manager3 = __esm({
 });
 
 // packages/server/src/storage/repositories/auth-login-block-repo.ts
-function isRecord2(value) {
+function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isAuthLoginBlockRecord(value) {
-  if (!isRecord2(value)) {
+  if (!isRecord3(value)) {
     return false;
   }
   return typeof value.ip === "string" && typeof value.failedCount === "number" && typeof value.firstFailedAt === "number" && typeof value.lastFailedAt === "number" && (typeof value.blockedUntil === "number" || value.blockedUntil === null);
 }
 function normalizeFailures(value) {
-  if (!isRecord2(value)) {
+  if (!isRecord3(value)) {
     return {};
   }
   const normalized = {};
@@ -7071,9 +7613,9 @@ function normalizeFailures(value) {
   return normalized;
 }
 function normalizeState(value) {
-  if (isRecord2(value) && value.version === 1) {
+  if (isRecord3(value) && value.version === 1) {
     const blocks = {};
-    if (isRecord2(value.blocks)) {
+    if (isRecord3(value.blocks)) {
       for (const entry of Object.values(value.blocks)) {
         if (isAuthLoginBlockRecord(entry)) {
           blocks[entry.ip] = entry;
@@ -7086,7 +7628,7 @@ function normalizeState(value) {
       failures: normalizeFailures(value.failures)
     };
   }
-  if (isRecord2(value)) {
+  if (isRecord3(value)) {
     const blocks = {};
     for (const [ip, entry] of Object.entries(value)) {
       if (isAuthLoginBlockRecord(entry)) {
@@ -7192,17 +7734,17 @@ var init_auth_login_block_repo = __esm({
 });
 
 // packages/server/src/storage/repositories/auth-session-repo.ts
-function isRecord3(value) {
+function isRecord4(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isAuthSession(value) {
-  if (!isRecord3(value)) {
+  if (!isRecord4(value)) {
     return false;
   }
   return typeof value.token === "string" && typeof value.createdAt === "number" && typeof value.lastSeenAt === "number";
 }
 function normalizeSessionFile2(value) {
-  if (isRecord3(value) && value.version === 1 && isRecord3(value.sessions)) {
+  if (isRecord4(value) && value.version === 1 && isRecord4(value.sessions)) {
     const normalized = {};
     for (const entry of Object.values(value.sessions)) {
       if (isAuthSession(entry)) {
@@ -7220,7 +7762,7 @@ function normalizeSessionFile2(value) {
     }
     return normalized;
   }
-  if (isRecord3(value)) {
+  if (isRecord4(value)) {
     const normalized = {};
     for (const [token, entry] of Object.entries(value)) {
       if (isAuthSession(entry)) {
@@ -7295,14 +7837,14 @@ var init_auth_session_repo = __esm({
 });
 
 // packages/server/src/storage/repositories/provider-config-repo.ts
-function isRecord4(value) {
+function isRecord5(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function normalizeProviderConfigFile(value) {
-  if (isRecord4(value) && value.version === 1 && isRecord4(value.providers)) {
+  if (isRecord5(value) && value.version === 1 && isRecord5(value.providers)) {
     return value.providers;
   }
-  if (isRecord4(value)) {
+  if (isRecord5(value)) {
     return value;
   }
   return {};
@@ -7376,14 +7918,14 @@ var init_provider_config_repo = __esm({
 });
 
 // packages/server/src/storage/repositories/settings-repo.ts
-function isRecord5(value) {
+function isRecord6(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function normalizeSettingsFile(value) {
-  if (isRecord5(value) && value.version === 1 && isRecord5(value.settings)) {
+  if (isRecord6(value) && value.version === 1 && isRecord6(value.settings)) {
     return { ...value.settings };
   }
-  if (isRecord5(value)) {
+  if (isRecord6(value)) {
     return { ...value };
   }
   return {};
@@ -7534,11 +8076,11 @@ var init_supervisor_repo = __esm({
 });
 
 // packages/server/src/storage/repositories/terminal-repo.ts
-function isRecord6(value) {
+function isRecord7(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isTerminal(value) {
-  if (!isRecord6(value)) {
+  if (!isRecord7(value)) {
     return false;
   }
   return typeof value.id === "string" && typeof value.workspaceId === "string" && (value.kind === "agent" || value.kind === "shell") && typeof value.cwd === "string" && Array.isArray(value.argv) && typeof value.cols === "number" && typeof value.rows === "number" && typeof value.alive === "boolean" && typeof value.createdAt === "number";
@@ -7550,7 +8092,7 @@ function normalizeTerminal(value) {
   };
 }
 function normalizeTerminalFile(value) {
-  if (isRecord6(value) && value.version === 1 && isRecord6(value.terminals)) {
+  if (isRecord7(value) && value.version === 1 && isRecord7(value.terminals)) {
     const normalized = {};
     for (const entry of Object.values(value.terminals)) {
       if (isTerminal(entry)) {
@@ -7568,7 +8110,7 @@ function normalizeTerminalFile(value) {
     }
     return normalized;
   }
-  if (isRecord6(value)) {
+  if (isRecord7(value)) {
     const normalized = {};
     for (const [terminalId, entry] of Object.entries(value)) {
       if (isTerminal(entry)) {
@@ -7734,12 +8276,12 @@ var init_terminal_repo = __esm({
 });
 
 // packages/server/src/storage/repositories/update-state-repo.ts
-function isRecord7(value) {
+function isRecord8(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function normalizeUpdateState(value, currentVersion) {
   const defaults = createDefaultUpdateState(currentVersion);
-  if (!isRecord7(value)) {
+  if (!isRecord8(value)) {
     return defaults;
   }
   return {
@@ -7802,17 +8344,17 @@ var init_update_state_repo = __esm({
 });
 
 // packages/server/src/storage/repositories/workspace-repo.ts
-function isRecord8(value) {
+function isRecord9(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isWorkspace(value) {
-  if (!isRecord8(value)) {
+  if (!isRecord9(value)) {
     return false;
   }
-  return typeof value.id === "string" && typeof value.path === "string" && (value.targetRuntime === "native" || value.targetRuntime === "wsl") && typeof value.openedAt === "number" && typeof value.lastActiveAt === "number" && isRecord8(value.uiState);
+  return typeof value.id === "string" && typeof value.path === "string" && (value.targetRuntime === "native" || value.targetRuntime === "wsl") && typeof value.openedAt === "number" && typeof value.lastActiveAt === "number" && isRecord9(value.uiState);
 }
 function normalizeWorkspaceFile(value) {
-  if (isRecord8(value) && value.version === 1 && isRecord8(value.workspaces)) {
+  if (isRecord9(value) && value.version === 1 && isRecord9(value.workspaces)) {
     const normalized = {};
     for (const entry of Object.values(value.workspaces)) {
       if (isWorkspace(entry)) {
@@ -7830,7 +8372,7 @@ function normalizeWorkspaceFile(value) {
     }
     return normalized;
   }
-  if (isRecord8(value)) {
+  if (isRecord9(value)) {
     const normalized = {};
     for (const [workspaceId, entry] of Object.entries(value)) {
       if (isWorkspace(entry)) {
@@ -8075,13 +8617,13 @@ function ensureNodePtySpawnHelperExecutable(deps = {}) {
     return;
   }
   const arch = deps.arch ?? process.arch;
-  const resolve4 = deps.resolve ?? ((id) => require4.resolve(id));
+  const resolve6 = deps.resolve ?? ((id) => require4.resolve(id));
   const fileExists = deps.existsSync ?? existsSync6;
-  const stat9 = deps.statSync ?? statSync;
+  const stat11 = deps.statSync ?? statSync;
   const chmod = deps.chmodSync ?? chmodSync2;
   let packageJsonPath;
   try {
-    packageJsonPath = resolve4(NODE_PTY_PKG);
+    packageJsonPath = resolve6(NODE_PTY_PKG);
   } catch {
     return;
   }
@@ -8095,7 +8637,7 @@ function ensureNodePtySpawnHelperExecutable(deps = {}) {
     if (!fileExists(helperPath)) {
       return;
     }
-    const currentMode = stat9(helperPath).mode;
+    const currentMode = stat11(helperPath).mode;
     const executableMode = currentMode | 73;
     if (executableMode === currentMode) {
       return;
@@ -8146,7 +8688,7 @@ async function escalateKillWithPolling(pid, signal, options) {
   const startTime = Date.now();
   const deadline = startTime + timeoutMs;
   while (Date.now() < deadline) {
-    await new Promise((resolve4) => setTimeout(resolve4, pollIntervalMs));
+    await new Promise((resolve6) => setTimeout(resolve6, pollIntervalMs));
     if (!isProcessAlive(pid)) {
       return true;
     }
@@ -8301,13 +8843,19 @@ import { spawn as spawn3 } from "node:child_process";
 function buildPrompt(context, mode) {
   if (mode === "decompose") {
     return [
-      "You are an autonomous supervisor for a target-scoped software task.",
+      "You are an autonomous planner-supervisor for this target-scoped software task.",
+      "Your purpose is to drive the work from objective to high-quality delivery with minimal babysitting.",
+      'Do not optimize for merely reaching "done"; optimize for a result that is correct, verified, coherent, and not obviously low-quality or rushed.',
       "Your first job is to decompose the target into a supervision structure before evaluation begins.",
       "",
       "Return JSON only.",
       "No prose before or after the JSON.",
       "",
       "Decomposition policy:",
+      "- Create an execution plan, not just a task list.",
+      "- Break the objective into the smallest reasonable set of milestones that maximize clarity, reduce uncertainty, and preserve steady forward progress.",
+      "- Order milestones by dependency, risk reduction, and delivery leverage.",
+      "- Prefer a plan structure that makes execution easier, verification clearer, and replanning cheaper.",
       "- Do not ask the user any questions.",
       "- Do not ask for clarification, confirmation, or approval.",
       "- Do not propose options for the user to choose from.",
@@ -8321,6 +8869,30 @@ function buildPrompt(context, mode) {
       "- Each item must be concrete, milestone-sized, and useful for subsequent evaluation.",
       "- Do not leave the structure empty.",
       "",
+      "Decomposition principles:",
+      "- Prefer milestones that produce a concrete artifact, observable behavior change, test result, or verification result.",
+      "- Make dependencies explicit.",
+      "- Separate implementation, verification, integration, and cleanup when that improves delivery reliability.",
+      "- If a step is too vague to verify independently, split it further.",
+      "- Prefer plans that keep the agent moving with minimal ambiguity between milestones.",
+      "- Use stage-based planning by default unless there are clearly independent deliverables that justify subtargets.",
+      "- Build the plan so it can recover from failed attempts: prefer decompositions that allow narrowing scope, isolating failures, checking assumptions, and restoring a working baseline when needed.",
+      "- Keep the decomposition practical for execution, not merely neat on paper.",
+      "",
+      "Planning quality bar:",
+      "- Prefer fewer, stronger milestones over many thin or vague ones.",
+      "- Every item should imply a concrete deliverable and observable acceptance criteria.",
+      '- Avoid vague items such as "improve", "clean up", or "refactor" unless tied to a specific delivery or verification target.',
+      "- Include quality and verification checkpoints where they materially improve the final result.",
+      "- Do not decompose in a way that encourages superficial completion.",
+      "",
+      "Planning boundary:",
+      "- You are responsible for execution structure, sequencing, quality control, and verification structure.",
+      "- Do not hard-code unnecessary implementation detail too early.",
+      "- If multiple implementation paths exist, prefer a plan that keeps execution adaptable until evidence makes one path clearly better.",
+      "- Do not hide assumptions inside the plan.",
+      "- Do not create a brittle plan that depends on perfect execution.",
+      "",
       "Item requirements:",
       '- Each item must include "id", "kind", "title", "objective", "deliverable", "acceptanceCriteria", and "status".',
       '- "kind" must match the selected decompositionMode: all "stage" or all "subtarget".',
@@ -8353,8 +8925,13 @@ function buildPrompt(context, mode) {
     ].join("\n");
   }
   const lines = [
-    "You are an autonomous supervisor for a target-scoped software task.",
-    "Your job is to keep the agent moving toward the objective until the objective is complete.",
+    "You are an autonomous planner-supervisor for this target-scoped software task.",
+    "Your purpose is to drive the work from objective to high-quality delivery with minimal babysitting.",
+    'Do not optimize for merely reaching "done"; optimize for a result that is correct, verified, coherent, and not obviously low-quality or rushed.',
+    "Act as an autonomous execution supervisor.",
+    "Your job is to keep the agent moving toward the objective, maintain delivery quality, detect low-yield paths early, and redirect work when needed.",
+    "Do not passively observe progress; actively steer it toward successful, high-quality completion.",
+    "Drive execution through the supervised agent rather than by independently performing the work yourself.",
     "",
     "Return JSON only.",
     "No prose before or after the JSON.",
@@ -8385,7 +8962,12 @@ function buildPrompt(context, mode) {
     '- When advancing to the next item, mark the previous item as "done" and set activeItemId to the next item explicitly.',
     "- If the active item is blocked, give guidance that is most likely to unblock it.",
     "- If the active item is obsolete, explain the reason briefly and move to the next useful item.",
-    "- If the agent appears stuck or repeated the same action, give a different concrete next action.",
+    "- If the current path is low-yield, brittle, repetitive, or producing low-quality output, redirect early.",
+    "- Diagnose stalls precisely: implementation failure, verification failure, environment failure, scope misframing, weak solution quality, or missing evidence.",
+    "- Choose the next action that most improves objective-level progress, not merely the most local continuation.",
+    "- Do not repeat the same tactic after failure unless new evidence justifies retrying it.",
+    "- Maintain commitment to the objective, not blind commitment to the current tactic.",
+    "- Replan locally when needed, but keep the overall execution coherent and objective-driven.",
     "- Do not rewrite the decomposition structure during normal evaluation cycles.",
     "",
     "Allowed statuses:",
@@ -8410,6 +8992,21 @@ function buildPrompt(context, mode) {
     "- If implementation is needed, point to the likely area, behavior, or file/module based on available evidence.",
     "- If the agent asked a question, answer it directly in the guidance and continue with a concrete next action.",
     "",
+    "Delivery quality bar:",
+    "- Do not accept shallow, brittle, or obviously rushed solutions.",
+    "- Do not optimize for the smallest change if it leads to poor maintainability, weak verification, or fragile behavior.",
+    "- Prefer solutions that are robust, coherent with the existing codebase, and likely to hold up beyond the happy path.",
+    "- Require appropriate verification for the kind of work being done.",
+    "- Consider edge cases, integration impact, regressions, and maintainability where relevant.",
+    "- If a solution technically works but is low-quality, incomplete, poorly verified, or obviously a shortcut, treat the milestone as not yet complete.",
+    "- Do not let superficial progress masquerade as real delivery.",
+    "",
+    "Completion standard:",
+    "- A milestone is complete only when its deliverable and acceptanceCriteria are supported by observable evidence and the result meets a reasonable quality bar.",
+    "- The objective is complete only when the final result is implemented, verified, and not obviously compromised in quality.",
+    "- Do not mark work complete merely because code was changed, a command passed once, or a minimal patch exists.",
+    "- Optimize for finished, verified, and defensible delivery.",
+    "",
     "Evaluation policy:",
     "- Update progress incrementally against the existing decomposition.",
     "- Use itemUpdates to reflect evidence-backed status changes only.",
@@ -8455,7 +9052,7 @@ async function runCommand(command, timeoutMs, options = {}) {
   if (options.signal?.aborted) {
     throw createSupervisorEvalAbortedError();
   }
-  return await new Promise((resolve4, reject) => {
+  return await new Promise((resolve6, reject) => {
     const child = spawn3(command.argv[0], command.argv.slice(1), {
       cwd: command.cwd,
       detached: process.platform !== "win32",
@@ -8485,7 +9082,7 @@ async function runCommand(command, timeoutMs, options = {}) {
       }
       settled = true;
       cleanup();
-      resolve4(value);
+      resolve6(value);
     };
     const terminate = (error) => {
       if (terminationError) {
@@ -9313,12 +9910,12 @@ var init_scheduler = __esm({
 
 // packages/server/src/supervisor/manager.ts
 function createDeferredCompletion() {
-  let resolve4 = () => {
+  let resolve6 = () => {
   };
   const promise = new Promise((innerResolve) => {
-    resolve4 = innerResolve;
+    resolve6 = innerResolve;
   });
-  return { promise, resolve: resolve4 };
+  return { promise, resolve: resolve6 };
 }
 function generateSupervisorId() {
   return `sup_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
@@ -10673,10 +11270,10 @@ var init_manager4 = __esm({
         if (signal?.aborted) {
           throw { code: "supervisor_eval_aborted", message: "Supervisor evaluator aborted" };
         }
-        await new Promise((resolve4, reject) => {
+        await new Promise((resolve6, reject) => {
           const timer = setTimeout(() => {
             signal?.removeEventListener("abort", onAbort);
-            resolve4();
+            resolve6();
           }, delayMs);
           timer.unref?.();
           const onAbort = () => {
@@ -10707,31 +11304,31 @@ __export(target_store_exports, {
   saveTargetMemory: () => saveTargetMemory,
   saveTargetMeta: () => saveTargetMeta
 });
-import { mkdir as mkdir4, mkdtemp as mkdtemp2, readdir as readdir2, readFile as readFile3, rename, rm as rm5, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname6, join as join7 } from "node:path";
+import { mkdir as mkdir4, mkdtemp as mkdtemp2, readdir as readdir2, readFile as readFile3, rename, rm as rm6, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname6, join as join9 } from "node:path";
 function targetDir(workspacePath, targetId) {
-  return join7(workspacePath, ".coder-studio", "supervisor", "targets", targetId);
+  return join9(workspacePath, ".coder-studio", "supervisor", "targets", targetId);
 }
 function metaPath(workspacePath, targetId) {
-  return join7(targetDir(workspacePath, targetId), "meta.json");
+  return join9(targetDir(workspacePath, targetId), "meta.json");
 }
 function memoryPath(workspacePath, targetId) {
-  return join7(targetDir(workspacePath, targetId), "memory.json");
+  return join9(targetDir(workspacePath, targetId), "memory.json");
 }
 function cyclesPath(workspacePath, targetId) {
-  return join7(targetDir(workspacePath, targetId), "cycles.jsonl");
+  return join9(targetDir(workspacePath, targetId), "cycles.jsonl");
 }
 function targetsRoot(workspacePath) {
-  return join7(workspacePath, ".coder-studio", "supervisor", "targets");
+  return join9(workspacePath, ".coder-studio", "supervisor", "targets");
 }
 function metaFilePath(dirPath) {
-  return join7(dirPath, "meta.json");
+  return join9(dirPath, "meta.json");
 }
 function memoryFilePath(dirPath) {
-  return join7(dirPath, "memory.json");
+  return join9(dirPath, "memory.json");
 }
 function cyclesFilePath(dirPath) {
-  return join7(dirPath, "cycles.jsonl");
+  return join9(dirPath, "cycles.jsonl");
 }
 function hasCode2(error, code) {
   return Boolean(
@@ -10750,7 +11347,7 @@ function errorMessage(error, fallback) {
   }
   return fallback;
 }
-function isRecord9(value) {
+function isRecord10(value) {
   return Boolean(value) && typeof value === "object";
 }
 function readNonEmptyString(value) {
@@ -10794,7 +11391,7 @@ function fallbackAcceptanceCriteria(title) {
   return [`${title} is complete`];
 }
 function normalizeItem(value, fallbackKind) {
-  if (!isRecord9(value)) {
+  if (!isRecord10(value)) {
     return null;
   }
   const id = readNonEmptyString(value.id);
@@ -10825,7 +11422,7 @@ function normalizeLegacyPlanItems(plan) {
   }
   return plan.flatMap((value) => {
     const item = normalizeItem(
-      isRecord9(value) ? {
+      isRecord10(value) ? {
         id: value.id,
         kind: "stage",
         title: value.title,
@@ -10849,7 +11446,7 @@ function resolveActiveItemId(items, candidate) {
   return items.find((item) => item.status === "in_progress")?.id ?? items.find((item) => item.status === "pending")?.id ?? items[0]?.id;
 }
 function normalizeTargetMemory(raw, targetId) {
-  if (!isRecord9(raw)) {
+  if (!isRecord10(raw)) {
     return buildTargetMemory(targetId, 0);
   }
   const updatedAt = readTimestamp(raw.updatedAt, 0);
@@ -10876,7 +11473,7 @@ function normalizeTargetMemory(raw, targetId) {
   };
 }
 function normalizePersistedSupervisor(raw, fallback) {
-  if (!isRecord9(raw)) {
+  if (!isRecord10(raw)) {
     return void 0;
   }
   const id = readNonEmptyString(raw.id) ?? fallback.targetId;
@@ -10912,7 +11509,7 @@ function normalizePersistedSupervisor(raw, fallback) {
   };
 }
 function normalizeTargetMeta(raw, fallbackTargetId) {
-  if (!isRecord9(raw)) {
+  if (!isRecord10(raw)) {
     const targetId2 = fallbackTargetId ?? "";
     return {
       targetId: targetId2,
@@ -11033,7 +11630,7 @@ async function resetTargetFiles(workspacePath, input2) {
   const parentDir = dirname6(dir);
   const backupDir = `${dir}.backup-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
   await mkdir4(parentDir, { recursive: true });
-  const stagingDir = await mkdtemp2(join7(parentDir, `${input2.targetId}.reset-`));
+  const stagingDir = await mkdtemp2(join9(parentDir, `${input2.targetId}.reset-`));
   let backupCreated = false;
   let promoted = false;
   let restored = false;
@@ -11069,17 +11666,17 @@ async function resetTargetFiles(workspacePath, input2) {
     }
   } catch (error) {
     if (restored || !backupCreated) {
-      await rm5(stagingDir, { recursive: true, force: true }).catch(() => {
+      await rm6(stagingDir, { recursive: true, force: true }).catch(() => {
       });
     }
     throw error;
   }
   if (backupCreated) {
-    await rm5(backupDir, { recursive: true, force: true }).catch(() => {
+    await rm6(backupDir, { recursive: true, force: true }).catch(() => {
     });
   }
   if (!promoted) {
-    await rm5(stagingDir, { recursive: true, force: true }).catch(() => {
+    await rm6(stagingDir, { recursive: true, force: true }).catch(() => {
     });
   }
 }
@@ -11177,7 +11774,7 @@ async function cloneTargetFiles(workspacePath, input2) {
   return nextCycles.filter(countsTowardCycleTotal).length;
 }
 async function deleteTarget(workspacePath, targetId) {
-  await rm5(targetDir(workspacePath, targetId), { recursive: true, force: true });
+  await rm6(targetDir(workspacePath, targetId), { recursive: true, force: true });
 }
 async function markTargetSuperseded(workspacePath, targetId, nextTargetId, updatedAt) {
   const meta = await readTargetMeta(workspacePath, targetId);
@@ -11490,8 +12087,8 @@ var init_terminal_snapshot_buffer = __esm({
         if (this.pendingWriteCount === 0) {
           return Promise.resolve();
         }
-        return new Promise((resolve4) => {
-          this.drainResolvers.push(resolve4);
+        return new Promise((resolve6) => {
+          this.drainResolvers.push(resolve6);
         });
       }
       resolveDrainIfIdle() {
@@ -11500,8 +12097,8 @@ var init_terminal_snapshot_buffer = __esm({
         }
         const resolvers = this.drainResolvers;
         this.drainResolvers = [];
-        for (const resolve4 of resolvers) {
-          resolve4();
+        for (const resolve6 of resolvers) {
+          resolve6();
         }
       }
       requireTerminal() {
@@ -11820,10 +12417,10 @@ var init_manager5 = __esm({
           }
           return existing.promise;
         }
-        let resolve4 = () => {
+        let resolve6 = () => {
         };
         const promise = new Promise((innerResolve) => {
-          resolve4 = innerResolve;
+          resolve6 = innerResolve;
         });
         let markKillCompleted = () => {
         };
@@ -11836,7 +12433,7 @@ var init_manager5 = __esm({
           markKillCompleted,
           finalized: false,
           promise,
-          resolve: resolve4
+          resolve: resolve6
         });
         void terminal.pty.kill(signal).finally(() => {
           const waiter = this.explicitCloseWaiters.get(terminalId);
@@ -12312,10 +12909,10 @@ var init_update_service = __esm({
 
 // packages/server/src/workspace/validator.ts
 import { constants } from "fs";
-import { access, stat as stat6 } from "fs/promises";
+import { access, stat as stat7 } from "fs/promises";
 async function validatePath(path14) {
   try {
-    const stats = await stat6(path14);
+    const stats = await stat7(path14);
     if (!stats.isDirectory()) {
       return { valid: false, error: "Path is not a directory" };
     }
@@ -12350,12 +12947,12 @@ var init_validator = __esm({
 // packages/server/src/fs/gitignore.ts
 import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
 import ignore from "ignore";
-import { join as join8, relative } from "path";
+import { join as join10, relative as relative2 } from "path";
 function normalizePath(path14) {
   return path14.replace(/\\/g, "/");
 }
 function relativeToRoot(rootPath, path14) {
-  return normalizePath(relative(rootPath, path14));
+  return normalizePath(relative2(rootPath, path14));
 }
 function isDefaultTreeIgnored(name) {
   return name.startsWith(".") || name === "node_modules" || name === ".git";
@@ -12373,7 +12970,7 @@ function isIgnoredByGitignore(ig, path14) {
   return ig.ignores(path14) || ig.ignores(`${path14}/`);
 }
 function createGitignoreFilter(rootPath, dirPath) {
-  const gitignorePath = join8(rootPath, ".gitignore");
+  const gitignorePath = join10(rootPath, ".gitignore");
   if (!existsSync7(gitignorePath)) {
     return (name) => !isDefaultTreeIgnored(name);
   }
@@ -12383,7 +12980,7 @@ function createGitignoreFilter(rootPath, dirPath) {
     if (isAlwaysTreeIgnored(name)) {
       return false;
     }
-    const relativePath = relativeToRoot(rootPath, join8(dirPath, name));
+    const relativePath = relativeToRoot(rootPath, join10(dirPath, name));
     return !isIgnoredByGitignore(ig, relativePath);
   };
 }
@@ -13054,8 +13651,8 @@ var init_fencing = __esm({
 });
 
 // packages/server/src/commands/terminal.ts
-import { stat as stat7 } from "node:fs/promises";
-import { basename, isAbsolute } from "node:path";
+import { stat as stat8 } from "node:fs/promises";
+import { basename, isAbsolute as isAbsolute2 } from "node:path";
 import { z as z6 } from "zod";
 function decodeTerminalInput(args) {
   if ("bytes" in args) {
@@ -13171,7 +13768,7 @@ var init_terminal = __esm({
         }
         let cwd = workspace.path;
         if (args.cwdPath && args.cwdPath !== ".") {
-          if (isAbsolute(args.cwdPath)) {
+          if (isAbsolute2(args.cwdPath)) {
             throw { code: "invalid_cwd_path", message: "cwdPath must be workspace-relative" };
           }
           let resolvedCwd;
@@ -13183,7 +13780,7 @@ var init_terminal = __esm({
             }
             throw error;
           }
-          const cwdStats = await stat7(resolvedCwd).catch(() => null);
+          const cwdStats = await stat8(resolvedCwd).catch(() => null);
           if (!cwdStats) {
             throw { code: "cwd_not_found", message: `Directory not found: ${args.cwdPath}` };
           }
@@ -13912,7 +14509,7 @@ var init_hub = __esm({
         }
       }
       awaitBinaryPayload(clientId) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve6, reject) => {
           const timer = setTimeout(() => {
             const waiters = this.pendingBinaryWaiters.get(clientId);
             if (!waiters) return;
@@ -13924,7 +14521,7 @@ var init_hub = __esm({
             }
             reject(new Error("Timeout waiting for terminal input binary payload"));
           }, BINARY_PAYLOAD_TIMEOUT_MS);
-          const waiter = { resolve: resolve4, reject, timer };
+          const waiter = { resolve: resolve6, reject, timer };
           const queue = this.pendingBinaryWaiters.get(clientId);
           if (queue) {
             queue.push(waiter);
@@ -14231,7 +14828,7 @@ var init_hub = __esm({
 // packages/server/src/commands/workspace.ts
 import { readdir as readdir3, realpath as realpath3 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { isAbsolute as isAbsolute2, join as join9, resolve as resolve2 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join11, resolve as resolve4 } from "node:path";
 import { z as z7 } from "zod";
 function resolveBrowsePath(path14) {
   const home = homedir2();
@@ -14239,9 +14836,9 @@ function resolveBrowsePath(path14) {
     return home;
   }
   if (path14.startsWith("~/")) {
-    return join9(home, path14.slice(2));
+    return join11(home, path14.slice(2));
   }
-  return isAbsolute2(path14) ? path14 : resolve2(home, path14);
+  return isAbsolute3(path14) ? path14 : resolve4(home, path14);
 }
 async function buildRootPaths(currentPath) {
   const roots = /* @__PURE__ */ new Set(["/"]);
@@ -14274,11 +14871,11 @@ var init_workspace = __esm({
         const entries = await readdir3(basePath, { withFileTypes: true });
         const directories = entries.filter((entry) => entry.isDirectory()).map((entry) => ({
           name: entry.name,
-          path: join9(basePath, entry.name)
+          path: join11(basePath, entry.name)
         })).sort((a, b) => a.name.localeCompare(b.name));
         return {
           currentPath: basePath,
-          parentPath: basePath !== "/" ? join9(basePath, "..") : null,
+          parentPath: basePath !== "/" ? join11(basePath, "..") : null,
           directories,
           rootPaths: await buildRootPaths(basePath)
         };
@@ -14742,8 +15339,8 @@ var init_pane_layout = __esm({
 // packages/server/src/commands/session.ts
 import { z as z12 } from "zod";
 function delay(ms) {
-  return new Promise((resolve4) => {
-    setTimeout(resolve4, ms);
+  return new Promise((resolve6) => {
+    setTimeout(resolve6, ms);
   });
 }
 function getProviderFromRegistry(providerId, registry) {
@@ -14894,20 +15491,260 @@ var init_session2 = __esm({
   }
 });
 
+// packages/server/src/fs/content-search.ts
+import { spawn as spawn5 } from "child_process";
+import { existsSync as existsSync8 } from "fs";
+import { readdir as readdir4, readFile as readFile4, stat as stat9 } from "fs/promises";
+import { basename as basename2, join as join12, relative as relative3 } from "path";
+import { createInterface } from "readline";
+async function searchFileContents(rootPath, options) {
+  const query = options.query.trim();
+  if (!query) {
+    return {
+      files: [],
+      totalMatchCount: 0,
+      hasMoreFiles: false,
+      truncatedMatchFileCount: 0
+    };
+  }
+  const result = await searchWithRipgrep(rootPath, query, options.maxFiles).catch(
+    async (error) => {
+      if (error.code === "ENOENT") {
+        return searchWithNode(rootPath, query, options.maxFiles);
+      }
+      throw error;
+    }
+  );
+  return finalizeResults(result, options.maxFiles, options.maxMatchesPerFile);
+}
+async function searchWithRipgrep(rootPath, query, maxFiles) {
+  const hasGitignore = existsSync8(join12(rootPath, ".gitignore"));
+  const args = [
+    "--json",
+    "--line-number",
+    "--column",
+    "--fixed-strings",
+    "--sort",
+    "path",
+    "--with-filename",
+    "--glob",
+    "!**/.git/**",
+    "--glob",
+    "!**/node_modules/**"
+  ];
+  if (hasGitignore) {
+    args.push("--hidden");
+    args.push("--no-require-git");
+  }
+  args.push(query, ".");
+  return new Promise((resolve6, reject) => {
+    const child = spawn5("rg", args, { cwd: rootPath, stdio: ["ignore", "pipe", "pipe"] });
+    const stdout = createInterface({ input: child.stdout });
+    const files = /* @__PURE__ */ new Map();
+    let totalMatchCount = 0;
+    let hasMoreFiles = false;
+    let stderr = "";
+    stdout.on("line", (line) => {
+      if (!line.trim()) {
+        return;
+      }
+      const event = JSON.parse(line);
+      if (event.type !== "match") {
+        return;
+      }
+      const rawPath = event.data?.path?.text;
+      if (!rawPath) {
+        return;
+      }
+      const relativePath = normalizeRelativePath(relative3(rootPath, join12(rootPath, rawPath)));
+      const preview = (event.data?.lines?.text ?? "").replace(/\r?\n$/, "");
+      const lineNumber = event.data?.line_number ?? 1;
+      const submatches = event.data?.submatches ?? [];
+      totalMatchCount += submatches.length;
+      if (!files.has(relativePath) && files.size >= maxFiles) {
+        hasMoreFiles = true;
+        return;
+      }
+      for (const submatch of submatches) {
+        pushMatch(files, relativePath, {
+          line: lineNumber,
+          column: byteOffsetToColumn(preview, submatch.start),
+          endColumn: byteOffsetToColumn(preview, submatch.end),
+          preview,
+          previewColumnStart: byteOffsetToColumn(preview, submatch.start),
+          previewColumnEnd: byteOffsetToColumn(preview, submatch.end)
+        });
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (error) => {
+      void stdout.close();
+      reject(error);
+    });
+    child.on("close", (code) => {
+      void stdout.close();
+      if (code === 0 || code === 1) {
+        resolve6({
+          files: sortAccumulators(files),
+          totalMatchCount,
+          hasMoreFiles
+        });
+        return;
+      }
+      reject(
+        Object.assign(new Error(stderr || `rg exited with code ${code ?? "unknown"}`), { code })
+      );
+    });
+  });
+}
+async function searchWithNode(rootPath, query, maxFiles) {
+  const files = /* @__PURE__ */ new Map();
+  let totalMatchCount = 0;
+  let hasMoreFiles = false;
+  async function walk(dirPath) {
+    const filter = createGitignoreFilter(rootPath, dirPath);
+    const entries = await readdir4(dirPath, { withFileTypes: true });
+    const filteredEntries = entries.filter((entry) => filter(entry.name));
+    filteredEntries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of filteredEntries) {
+      const fullPath = join12(dirPath, entry.name);
+      if (entry.isDirectory()) {
+        await walk(fullPath);
+        continue;
+      }
+      if (!entry.isFile()) {
+        continue;
+      }
+      const fileStat = await stat9(fullPath);
+      if (fileStat.size > FALLBACK_MAX_FILE_BYTES) {
+        continue;
+      }
+      const buffer = await readFile4(fullPath);
+      if (isBinaryFile(buffer)) {
+        continue;
+      }
+      const relativePath = normalizeRelativePath(relative3(rootPath, fullPath));
+      const file = collectMatchesFromText(relativePath, buffer.toString("utf-8"), query);
+      if (!file) {
+        continue;
+      }
+      totalMatchCount += file.matchCount;
+      if (files.size >= maxFiles) {
+        hasMoreFiles = true;
+        continue;
+      }
+      files.set(relativePath, file);
+    }
+  }
+  await walk(rootPath);
+  return {
+    files: sortAccumulators(files),
+    totalMatchCount,
+    hasMoreFiles
+  };
+}
+function collectMatchesFromText(relativePath, content, query) {
+  const file = {
+    path: relativePath,
+    name: basename2(relativePath),
+    matches: [],
+    matchCount: 0
+  };
+  const lines = content.split(/\r?\n/);
+  for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+    const preview = lines[lineIndex] ?? "";
+    if (!preview) {
+      continue;
+    }
+    let fromIndex = 0;
+    while (fromIndex <= preview.length) {
+      const matchIndex = preview.indexOf(query, fromIndex);
+      if (matchIndex === -1) {
+        break;
+      }
+      const startColumn = matchIndex + 1;
+      const endColumn = startColumn + query.length;
+      file.matches.push({
+        line: lineIndex + 1,
+        column: startColumn,
+        endColumn,
+        preview,
+        previewColumnStart: startColumn,
+        previewColumnEnd: endColumn
+      });
+      file.matchCount += 1;
+      fromIndex = matchIndex + Math.max(query.length, 1);
+    }
+  }
+  return file.matchCount > 0 ? file : null;
+}
+function pushMatch(files, relativePath, match) {
+  let file = files.get(relativePath);
+  if (!file) {
+    file = {
+      path: relativePath,
+      name: basename2(relativePath),
+      matches: [],
+      matchCount: 0
+    };
+    files.set(relativePath, file);
+  }
+  file.matches.push(match);
+  file.matchCount += 1;
+}
+function sortAccumulators(files) {
+  return Array.from(files.values()).sort((a, b) => a.path.localeCompare(b.path));
+}
+function finalizeResults(result, maxFiles, maxMatchesPerFile) {
+  const visibleFiles = result.files.slice(0, maxFiles).map((file) => ({
+    path: file.path,
+    name: file.name,
+    matchCount: file.matchCount,
+    hasMoreMatches: file.matchCount > maxMatchesPerFile,
+    matches: file.matches.slice(0, maxMatchesPerFile)
+  }));
+  return {
+    files: visibleFiles,
+    totalMatchCount: result.totalMatchCount,
+    hasMoreFiles: result.hasMoreFiles || result.files.length > maxFiles,
+    truncatedMatchFileCount: visibleFiles.filter((file) => file.hasMoreMatches).length
+  };
+}
+function normalizeRelativePath(path14) {
+  return path14.replace(/\\/g, "/");
+}
+function byteOffsetToColumn(preview, byteOffset) {
+  return Buffer.from(preview, "utf8").subarray(0, byteOffset).toString("utf8").length + 1;
+}
+function isBinaryFile(buffer) {
+  const sample = buffer.subarray(0, 8e3);
+  return sample.includes(0);
+}
+var FALLBACK_MAX_FILE_BYTES;
+var init_content_search = __esm({
+  "packages/server/src/fs/content-search.ts"() {
+    "use strict";
+    init_gitignore();
+    FALLBACK_MAX_FILE_BYTES = 1e6;
+  }
+});
+
 // packages/server/src/fs/tree.ts
-import { readdir as readdir4, stat as stat8 } from "fs/promises";
-import { join as join10, relative as relative2 } from "path";
+import { readdir as readdir5, stat as stat10 } from "fs/promises";
+import { join as join13, relative as relative4 } from "path";
 async function readTree(rootPath, subdir) {
-  const targetPath = subdir ? join10(rootPath, subdir) : rootPath;
+  const targetPath = subdir ? join13(rootPath, subdir) : rootPath;
   const filter = createTreeVisibilityFilter();
-  const entries = await readdir4(targetPath, { withFileTypes: true });
+  const entries = await readdir5(targetPath, { withFileTypes: true });
   const nodes = [];
   for (const entry of entries) {
     if (!filter(entry.name)) {
       continue;
     }
-    const fullPath = join10(targetPath, entry.name);
-    const relPath = relative2(rootPath, fullPath);
+    const fullPath = join13(targetPath, entry.name);
+    const relPath = relative4(rootPath, fullPath);
     if (entry.isDirectory()) {
       nodes.push({
         name: entry.name,
@@ -14917,7 +15754,7 @@ async function readTree(rootPath, subdir) {
         // Not loaded yet - client will request on expand
       });
     } else if (entry.isFile()) {
-      const stats = await stat8(fullPath);
+      const stats = await stat10(fullPath);
       nodes.push({
         name: entry.name,
         path: relPath,
@@ -14946,18 +15783,18 @@ async function searchFiles(rootPath, query, limit = 10) {
   const matches = [];
   async function walk(dirPath) {
     const filter = createGitignoreFilter(rootPath, dirPath);
-    const entries = await readdir4(dirPath, { withFileTypes: true });
+    const entries = await readdir5(dirPath, { withFileTypes: true });
     const filteredEntries = entries.filter((entry) => filter(entry.name));
     filteredEntries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of filteredEntries) {
-      const fullPath = join10(dirPath, entry.name);
-      const relPath = relative2(rootPath, fullPath);
+      const fullPath = join13(dirPath, entry.name);
+      const relPath = relative4(rootPath, fullPath);
       if (entry.isDirectory()) {
         await walk(fullPath);
         continue;
       }
       if (entry.isFile()) {
-        const rank = scoreFilenameMatch(entry.name, normalizedQuery);
+        const rank = scoreFileMatch(relPath, entry.name, normalizedQuery);
         if (rank === null) {
           continue;
         }
@@ -14986,7 +15823,7 @@ async function searchFiles(rootPath, query, limit = 10) {
     }
     return a.path.toLowerCase().localeCompare(b.path.toLowerCase());
   }).slice(0, limit)) {
-    const stats = await stat8(match.fullPath);
+    const stats = await stat10(match.fullPath);
     files.push({
       name: match.name,
       path: match.path,
@@ -14997,6 +15834,13 @@ async function searchFiles(rootPath, query, limit = 10) {
   }
   return { files };
 }
+function scoreFileMatch(path14, name, query) {
+  const filenameRank = scoreFilenameMatch(name, query);
+  if (filenameRank !== null) {
+    return filenameRank;
+  }
+  return scorePathMatch(path14, query);
+}
 function scoreFilenameMatch(name, query) {
   const normalizedName = name.toLowerCase();
   const baseName = normalizedName.replace(/\.[^.]+$/, "");
@@ -15023,6 +15867,22 @@ function scoreFilenameMatch(name, query) {
   }
   return null;
 }
+function scorePathMatch(path14, query) {
+  const normalizedPath = path14.toLowerCase();
+  if (normalizedPath === query) {
+    return 7;
+  }
+  if (normalizedPath.startsWith(query)) {
+    return 8;
+  }
+  if (normalizedPath.includes(query)) {
+    return 9;
+  }
+  if (isSubsequence(query, normalizedPath)) {
+    return 10;
+  }
+  return null;
+}
 function isSubsequence(query, candidate) {
   let index = 0;
   for (const char of candidate) {
@@ -15047,6 +15907,7 @@ import { z as z13 } from "zod";
 var init_file = __esm({
   "packages/server/src/commands/file.ts"() {
     "use strict";
+    init_content_search();
     init_file_io();
     init_tree();
     init_dispatch();
@@ -15079,6 +15940,26 @@ var init_file = __esm({
         return searchFiles(workspace.path, args.query, args.limit ?? 10);
       }
     );
+    registerCommand(
+      "file.searchContent",
+      z13.object({
+        workspaceId: z13.string(),
+        query: z13.string(),
+        maxFiles: z13.number().int().positive().max(100),
+        maxMatchesPerFile: z13.number().int().positive().max(100)
+      }),
+      async (args, ctx) => {
+        const workspace = ctx.workspaceMgr.get(args.workspaceId);
+        if (!workspace) {
+          throw { code: "workspace_not_found", message: `Workspace not found: ${args.workspaceId}` };
+        }
+        return searchFileContents(workspace.path, {
+          query: args.query,
+          maxFiles: args.maxFiles,
+          maxMatchesPerFile: args.maxMatchesPerFile
+        });
+      }
+    );
     registerCommand(
       "file.read",
       z13.object({
@@ -15201,7 +16082,7 @@ var init_file = __esm({
 });
 
 // packages/server/src/git/diff.ts
-import { mkdtemp as mkdtemp3, readFile as readFile4, rm as rm6 } from "fs/promises";
+import { mkdtemp as mkdtemp3, readFile as readFile5, rm as rm7 } from "fs/promises";
 import os3 from "os";
 import path11 from "path";
 async function isTrackedPath(cwd, filePath) {
@@ -15236,12 +16117,12 @@ async function getUntrackedFileDiff(cwd, filePath) {
     });
     return result.stdout;
   } finally {
-    await rm6(tempDir, { recursive: true, force: true });
+    await rm7(tempDir, { recursive: true, force: true });
   }
 }
 async function pathExists(cwd, filePath) {
   try {
-    await readFile4(resolveSafe(cwd, filePath));
+    await readFile5(resolveSafe(cwd, filePath));
     return true;
   } catch {
     return false;
@@ -15249,7 +16130,7 @@ async function pathExists(cwd, filePath) {
 }
 async function readTextAtRevision(cwd, revision, filePath) {
   if (revision === "WORKTREE") {
-    return readFile4(resolveSafe(cwd, filePath), "utf-8");
+    return readFile5(resolveSafe(cwd, filePath), "utf-8");
   }
   try {
     const gitSpec = revision === "INDEX" ? `:${filePath}` : `${revision}:${filePath}`;
@@ -15667,33 +16548,33 @@ var init_git2 = __esm({
 });
 
 // packages/server/src/config/config-io.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync7, renameSync as renameSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync7, renameSync as renameSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { basename as basename2, dirname as dirname7, join as join11 } from "node:path";
+import { basename as basename3, dirname as dirname7, join as join14 } from "node:path";
 function resolveConfigPath(configType) {
   if (configType === "codex") {
     const testHome = process.env.CODER_STUDIO_CODEX_HOME;
     if (testHome && testHome.trim()) {
-      return join11(testHome, "config.toml");
+      return join14(testHome, "config.toml");
     }
     const codexHome = process.env.CODEX_HOME;
     if (codexHome && codexHome.trim()) {
-      return join11(codexHome, "config.toml");
+      return join14(codexHome, "config.toml");
     }
-    return join11(homedir3(), ".codex", "config.toml");
+    return join14(homedir3(), ".codex", "config.toml");
   }
   if (configType === "claude") {
     const testHome = process.env.CODER_STUDIO_CLAUDE_HOME;
     if (testHome && testHome.trim()) {
-      return join11(testHome, "settings.json");
+      return join14(testHome, "settings.json");
     }
-    return join11(homedir3(), ".claude", "settings.json");
+    return join14(homedir3(), ".claude", "settings.json");
   }
   throw new Error(`Unknown config type: ${configType}`);
 }
 function readConfigFile(configType) {
   const configPath = resolveConfigPath(configType);
-  if (!existsSync8(configPath)) {
+  if (!existsSync9(configPath)) {
     return { configPath, content: "", exists: false };
   }
   try {
@@ -15707,11 +16588,11 @@ function writeConfigFile(configType, content) {
   try {
     const configPath = resolveConfigPath(configType);
     const parentDir = dirname7(configPath);
-    if (!existsSync8(parentDir)) {
+    if (!existsSync9(parentDir)) {
       mkdirSync7(parentDir, { recursive: true });
     }
     let backupPath = null;
-    if (existsSync8(configPath)) {
+    if (existsSync9(configPath)) {
       backupPath = createBackup(configPath);
     }
     const tempPath = `${configPath}.tmp`;
@@ -15729,10 +16610,10 @@ function writeConfigFile(configType, content) {
 function createBackup(filePath) {
   const original = readFileSync7(filePath, "utf-8");
   const ext = filePath.split(".").pop() ?? "";
-  const base = basename2(filePath, `.${ext}`);
+  const base = basename3(filePath, `.${ext}`);
   const dir = dirname7(filePath);
   const ts = formatTimestamp(/* @__PURE__ */ new Date());
-  const backupPath = join11(dir, `${base}.bak.${ts}.${ext}`);
+  const backupPath = join14(dir, `${base}.bak.${ts}.${ext}`);
   writeFileSync5(backupPath, original, "utf-8");
   return backupPath;
 }
@@ -15760,7 +16641,36 @@ function flattenSettings(obj, prefix = "") {
   }
   return result;
 }
-var SettingsSchema;
+function resolveAppearancePersonalizationOverrideKeysToDelete(settings) {
+  const appearance = settings.appearance;
+  if (!appearance || typeof appearance !== "object" || Array.isArray(appearance)) {
+    return [];
+  }
+  const personalization = appearance.personalization;
+  if (!personalization || typeof personalization !== "object" || Array.isArray(personalization)) {
+    return [];
+  }
+  if (!isFullAppearancePersonalizationSnapshot(personalization)) {
+    return [];
+  }
+  const keysToDelete = [];
+  for (const branch of PERSONALIZATION_OVERRIDE_BRANCHES) {
+    const overrides = personalization[branch];
+    if (!overrides || typeof overrides !== "object" || Array.isArray(overrides)) {
+      continue;
+    }
+    for (const field of PERSONALIZATION_OVERRIDE_FIELDS) {
+      if (!Object.prototype.hasOwnProperty.call(overrides, field)) {
+        keysToDelete.push(`appearance.personalization.${branch}.${field}`);
+      }
+    }
+  }
+  return keysToDelete;
+}
+function isFullAppearancePersonalizationSnapshot(personalization) {
+  return Object.prototype.hasOwnProperty.call(personalization, "version") && Object.prototype.hasOwnProperty.call(personalization, "common") && Object.prototype.hasOwnProperty.call(personalization, "desktop") && Object.prototype.hasOwnProperty.call(personalization, "mobile");
+}
+var PersonalizationOverridesSchema, PERSONALIZATION_OVERRIDE_BRANCHES, PERSONALIZATION_OVERRIDE_FIELDS, SettingsSchema;
 var init_settings2 = __esm({
   "packages/server/src/commands/settings.ts"() {
     "use strict";
@@ -15769,6 +16679,23 @@ var init_settings2 = __esm({
     init_provider_config();
     init_settings();
     init_dispatch();
+    PersonalizationOverridesSchema = z15.object({
+      backgroundAssetId: z15.string().min(1).nullable().optional(),
+      backgroundDimness: z15.number().int().min(0).max(100).optional(),
+      backgroundBlur: z15.number().int().min(0).max(40).optional(),
+      glassEnabled: z15.boolean().optional(),
+      glassIntensity: z15.number().int().min(0).max(100).optional(),
+      surfaceOpacity: z15.number().int().min(0).max(100).optional()
+    });
+    PERSONALIZATION_OVERRIDE_BRANCHES = ["desktop", "mobile"];
+    PERSONALIZATION_OVERRIDE_FIELDS = [
+      "backgroundAssetId",
+      "backgroundDimness",
+      "backgroundBlur",
+      "glassEnabled",
+      "glassIntensity",
+      "surfaceOpacity"
+    ];
     SettingsSchema = z15.object({
       defaultProviderId: z15.string().optional(),
       notifications: z15.object({
@@ -15795,7 +16722,22 @@ var init_settings2 = __esm({
         terminalFontSize: z15.number().int().min(10).max(18).optional(),
         desktopTerminalFontSize: z15.number().int().min(10).max(18).optional(),
         mobileTerminalFontSize: z15.number().int().min(10).max(18).optional(),
-        locale: z15.enum(["zh", "en"]).optional()
+        locale: z15.enum(["zh", "en"]).optional(),
+        personalization: z15.object({
+          version: z15.literal(1).optional(),
+          common: z15.object({
+            backgroundMode: z15.enum(["none", "image"]).optional(),
+            backgroundAssetId: z15.string().min(1).nullable().optional(),
+            backgroundFit: z15.enum(["cover", "contain"]).optional(),
+            backgroundDimness: z15.number().int().min(0).max(100).optional(),
+            backgroundBlur: z15.number().int().min(0).max(40).optional(),
+            glassEnabled: z15.boolean().optional(),
+            glassIntensity: z15.number().int().min(0).max(100).optional(),
+            surfaceOpacity: z15.number().int().min(0).max(100).optional()
+          }).optional(),
+          desktop: PersonalizationOverridesSchema.optional(),
+          mobile: PersonalizationOverridesSchema.optional()
+        }).optional()
       }).optional(),
       lsp: z15.object({
         mode: z15.enum(["auto", "off"]).optional()
@@ -15865,7 +16807,11 @@ var init_settings2 = __esm({
         const nextSettings = args.settings;
         const providers = nextSettings.providers && typeof nextSettings.providers === "object" && !Array.isArray(nextSettings.providers) ? nextSettings.providers : void 0;
         const { providers: _providers, ...nonProviderSettings } = nextSettings;
+        const overrideKeysToDelete = resolveAppearancePersonalizationOverrideKeysToDelete(nextSettings);
         const flatSettings = flattenSettings(nonProviderSettings);
+        for (const key of overrideKeysToDelete) {
+          ctx.settingsRepo.delete(key);
+        }
         for (const [key, value] of Object.entries(flatSettings)) {
           ctx.settingsRepo.set(key, value);
         }
@@ -16511,6 +17457,7 @@ async function listWorktrees(repoPath) {
         current.name = branch.split("/").pop() || branch;
       } else if (line === "detached") {
         current.branch = "detached HEAD";
+        current.name = path12.basename(current.path ?? "") || "detached";
       } else if (line === "") {
         if (current.path) {
           worktrees.push(current);
@@ -17092,12 +18039,12 @@ var init_commands = __esm({
 // packages/server/src/server.ts
 import { mkdtempSync, rmSync as rmSync2 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join15 } from "node:path";
 async function createServer(configOverrides) {
   const config = parseServerConfig(configOverrides);
   const configuredStateDir = resolveConfiguredStateDir(config);
   const shouldCleanupStateRoot = configuredStateDir === IN_MEMORY_STATE_DIR;
-  const stateRoot = shouldCleanupStateRoot ? mkdtempSync(join12(tmpdir(), "coder-studio-state-")) : configuredStateDir;
+  const stateRoot = shouldCleanupStateRoot ? mkdtempSync(join15(tmpdir(), "coder-studio-state-")) : configuredStateDir;
   ensureStateDir(config);
   const eventBus = new EventBus();
   const activationMgr = new ActivationManager();
@@ -17107,10 +18054,10 @@ async function createServer(configOverrides) {
   let commandContext;
   let lspMgr = null;
   const terminalRepo = new TerminalRepo({
-    filePath: join12(stateRoot, "state", "terminals.json")
+    filePath: join15(stateRoot, "state", "terminals.json")
   });
   const sessionRepo = new SessionRepo({
-    filePath: join12(stateRoot, "state", "sessions.json")
+    filePath: join15(stateRoot, "state", "sessions.json")
   });
   const terminalMgr = new TerminalManager({
     ptyHost: createPtyHost(),
@@ -17118,10 +18065,10 @@ async function createServer(configOverrides) {
     db: terminalRepo
   });
   const settingsRepo = new SettingsRepo({
-    filePath: join12(stateRoot, "state", "settings.json")
+    filePath: join15(stateRoot, "state", "settings.json")
   });
   const updateStateRepo = new UpdateStateRepo({
-    filePath: join12(stateRoot, "state", "update-state.json"),
+    filePath: join15(stateRoot, "state", "update-state.json"),
     currentVersion: config.appVersion ?? "0.0.0"
   });
   const autoFetch = new AutoFetchScheduler({
@@ -17154,10 +18101,10 @@ async function createServer(configOverrides) {
     }
   });
   const providerConfigRepo = new ProviderConfigRepo({
-    filePath: join12(stateRoot, "state", "provider-configs.json")
+    filePath: join15(stateRoot, "state", "provider-configs.json")
   });
   const workspaceRepo = new WorkspaceRepo({
-    filePath: join12(stateRoot, "state", "workspaces.json")
+    filePath: join15(stateRoot, "state", "workspaces.json")
   });
   const sessionMgr = new SessionManager({
     terminalMgr,
@@ -17192,10 +18139,13 @@ async function createServer(configOverrides) {
     )
   });
   const authSessionRepo = new AuthSessionRepo({
-    filePath: join12(stateRoot, "state", "auth-sessions.json")
+    filePath: join15(stateRoot, "state", "auth-sessions.json")
   });
   const authLoginBlockRepo = new AuthLoginBlockRepo({
-    filePath: join12(stateRoot, "state", "auth-login-blocks.json")
+    filePath: join15(stateRoot, "state", "auth-login-blocks.json")
+  });
+  const appearanceAssetRepo = new AppearanceAssetRepo({
+    filePath: join15(stateRoot, "state", "appearance-assets.json")
   });
   const app = await buildFastifyApp({
     wsHub,
@@ -17204,6 +18154,7 @@ async function createServer(configOverrides) {
     config,
     authSessionRepo,
     authLoginBlockRepo,
+    appearanceAssetRepo,
     logger: {
       level: "info",
       transport: {
@@ -17270,7 +18221,7 @@ async function createServer(configOverrides) {
       ...config.update,
       currentVersion: config.appVersion ?? "0.0.0"
     },
-    updateWorkerLogFilePath: join12(stateRoot, "logs", "update-worker.log"),
+    updateWorkerLogFilePath: join15(stateRoot, "logs", "update-worker.log"),
     countRunningTerminals: () => terminalMgr.getAll().filter((terminal) => terminal.alive).length,
     countRunningSessions: () => sessionMgr.getAll().filter((session) => session.state === "starting" || session.state === "running").length,
     countActiveSupervisors: () => supervisorMgr?.countActive() ?? 0
@@ -17382,6 +18333,7 @@ var init_server = __esm({
     init_e2e_provider_mock();
     init_install_manager2();
     init_manager3();
+    init_appearance_asset_repo();
     init_auth_login_block_repo();
     init_auth_session_repo();
     init_provider_config_repo();
@@ -17492,28 +18444,28 @@ var init_src4 = __esm({
 });
 
 // packages/cli/src/cli.ts
-import { existsSync as existsSync14 } from "fs";
-import { dirname as dirname10, join as join17 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { dirname as dirname10, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
 // packages/cli/src/auth-control.ts
 await init_src4();
-import { join as join14 } from "node:path";
+import { join as join17 } from "node:path";
 
 // packages/cli/src/config-store.ts
 init_state_paths();
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join13 } from "path";
+import { join as join16 } from "path";
 function getCliConfigPath() {
-  return join13(homedir4(), ".coder-studio", "config.json");
+  return join16(homedir4(), ".coder-studio", "config.json");
 }
 function normalizeLegacyDataDir(input2) {
   return normalizeLegacyStateDir(input2);
 }
 function readCliConfig() {
   const path14 = getCliConfigPath();
-  if (!existsSync9(path14)) {
+  if (!existsSync10(path14)) {
     return null;
   }
   try {
@@ -17533,14 +18485,14 @@ function readCliConfig() {
 }
 function writeCliConfig(config) {
   const path14 = getCliConfigPath();
-  const dir = join13(homedir4(), ".coder-studio");
+  const dir = join16(homedir4(), ".coder-studio");
   const normalizedConfig = {
     ...config.host !== void 0 ? { host: config.host } : {},
     ...config.port !== void 0 && config.port > 0 ? { port: config.port } : {},
     ...config.stateDir !== void 0 ? { stateDir: normalizeStateDir(config.stateDir) } : {},
     ...config.password !== void 0 ? { password: config.password } : {}
   };
-  if (!existsSync9(dir)) {
+  if (!existsSync10(dir)) {
     mkdirSync8(dir, { recursive: true });
   }
   writeFileSync6(path14, JSON.stringify(normalizedConfig, null, 2), "utf-8");
@@ -17555,7 +18507,7 @@ function resolveStateDir() {
 }
 async function listAuthBlocks(now = Date.now()) {
   const repo = new AuthLoginBlockRepo({
-    filePath: join14(resolveStateDir(), "state", "auth-login-blocks.json")
+    filePath: join17(resolveStateDir(), "state", "auth-login-blocks.json")
   });
   return repo.listActiveBlocks(now).map((record) => ({
     ip: record.ip,
@@ -17567,13 +18519,13 @@ async function listAuthBlocks(now = Date.now()) {
 }
 async function clearAuthBlockByIp(ip) {
   const repo = new AuthLoginBlockRepo({
-    filePath: join14(resolveStateDir(), "state", "auth-login-blocks.json")
+    filePath: join17(resolveStateDir(), "state", "auth-login-blocks.json")
   });
   return repo.delete(ip);
 }
 
 // packages/cli/src/browser.ts
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn6 } from "node:child_process";
 function getOpenCommand(url) {
   switch (process.platform) {
     case "darwin":
@@ -17586,8 +18538,8 @@ function getOpenCommand(url) {
 }
 async function openBrowser(url) {
   const { command, args } = getOpenCommand(url);
-  await new Promise((resolve4, reject) => {
-    const child = spawn5(command, args, {
+  await new Promise((resolve6, reject) => {
+    const child = spawn6(command, args, {
       detached: true,
       stdio: "ignore",
       windowsHide: true
@@ -17595,18 +18547,18 @@ async function openBrowser(url) {
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
-      resolve4();
+      resolve6();
     });
   });
 }
 
 // packages/cli/src/log-excerpt.ts
-import { closeSync, existsSync as existsSync10, openSync, readSync, statSync as statSync2 } from "fs";
+import { closeSync, existsSync as existsSync11, openSync, readSync, statSync as statSync2 } from "fs";
 var DEFAULT_MAX_LINES = 40;
 var DEFAULT_MAX_CHARS = 4e3;
 var DEFAULT_MAX_BYTES = 16 * 1024;
 var getFileSize = (path14) => {
-  if (!existsSync10(path14)) {
+  if (!existsSync11(path14)) {
     return 0;
   }
   try {
@@ -17621,7 +18573,7 @@ var readLogExcerpt = (path14, {
   maxLines = DEFAULT_MAX_LINES,
   maxChars = DEFAULT_MAX_CHARS
 } = {}) => {
-  if (!existsSync10(path14)) {
+  if (!existsSync11(path14)) {
     return null;
   }
   const fileSize = getFileSize(path14);
@@ -17700,12 +18652,12 @@ function assertSupportedNodeVersion(version = process.versions.node) {
 }
 
 // packages/cli/src/package-manifest.ts
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
 function resolveCliPackageManifestUrl(importMetaUrl) {
   const manifestUrl = [
     new URL("../package.json", importMetaUrl),
     new URL("../../package.json", importMetaUrl)
-  ].find((candidate) => existsSync11(candidate));
+  ].find((candidate) => existsSync12(candidate));
   if (!manifestUrl) {
     throw new Error("Unable to locate CLI package.json");
   }
@@ -17928,7 +18880,7 @@ function parseArgs(argv) {
 init_runtime();
 import { mkdirSync as mkdirSync9 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join15 } from "path";
+import { join as join18 } from "path";
 var MANAGED_SERVER_NAME = "coder-studio-server";
 var PM2_RESTART_DELAY_MS = 2e3;
 var PM2_MIN_UPTIME = "5s";
@@ -17968,29 +18920,29 @@ async function loadPm2() {
 }
 var connectPm2 = async () => {
   const pm2 = await loadPm2();
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     pm2.connect((error) => {
       if (error) {
         reject(error);
         return;
       }
-      resolve4();
+      resolve6();
     });
   });
 };
-var sleep = async (ms) => new Promise((resolve4) => {
-  setTimeout(resolve4, ms);
+var sleep = async (ms) => new Promise((resolve6) => {
+  setTimeout(resolve6, ms);
 });
 var disconnectPm2 = async () => {
   const pm2 = await loadPm2();
-  await new Promise((resolve4) => {
+  await new Promise((resolve6) => {
     let settled = false;
     const finish = () => {
       if (settled) {
         return;
       }
       settled = true;
-      resolve4();
+      resolve6();
     };
     const timer = setTimeout(finish, PM2_DISCONNECT_WAIT_MS);
     try {
@@ -18004,29 +18956,29 @@ var disconnectPm2 = async () => {
     }
   });
 };
-var describeManagedServer = async (pm2) => new Promise((resolve4, reject) => {
+var describeManagedServer = async (pm2) => new Promise((resolve6, reject) => {
   pm2.describe(MANAGED_SERVER_NAME, (error, result) => {
     if (error) {
       reject(error);
       return;
     }
-    resolve4(result ?? []);
+    resolve6(result ?? []);
   });
 });
-var removeManagedServer = async (pm2) => new Promise((resolve4, reject) => {
+var removeManagedServer = async (pm2) => new Promise((resolve6, reject) => {
   pm2.delete(MANAGED_SERVER_NAME, (error) => {
     if (error) {
       reject(error);
       return;
     }
-    resolve4();
+    resolve6();
   });
 });
 var killPm2Daemon = async () => {
   const pm2 = await loadPm2();
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     pm2.kill(() => {
-      resolve4();
+      resolve6();
     });
   });
 };
@@ -18149,11 +19101,11 @@ var deleteManagedServerInSession = async (pm2, {
   return true;
 };
 var ensureLogDirectory = () => {
-  mkdirSync9(join15(homedir5(), ".coder-studio", "logs"), { recursive: true });
+  mkdirSync9(join18(homedir5(), ".coder-studio", "logs"), { recursive: true });
 };
 var getLogPaths = () => ({
-  outFile: join15(homedir5(), ".coder-studio", "logs", "server.out.log"),
-  errFile: join15(homedir5(), ".coder-studio", "logs", "server.err.log")
+  outFile: join18(homedir5(), ".coder-studio", "logs", "server.out.log"),
+  errFile: join18(homedir5(), ".coder-studio", "logs", "server.err.log")
 });
 var captureStartupLogOffsets = () => {
   const { outFile, errFile } = getLogPaths();
@@ -18202,7 +19154,7 @@ var startManagedServer = async ({
   ensureLogDirectory();
   const { outFile, errFile } = getLogPaths();
   const logOffsets = captureStartupLogOffsets();
-  await new Promise((resolve4, reject) => {
+  await new Promise((resolve6, reject) => {
     pm2.start(
       {
         name: MANAGED_SERVER_NAME,
@@ -18225,7 +19177,7 @@ var startManagedServer = async ({
           reject(error);
           return;
         }
-        resolve4();
+        resolve6();
       }
     );
   });
@@ -18281,12 +19233,12 @@ var getManagedServerStatus = async () => withPm2Connection(async (pm2) => {
 
 // packages/cli/src/prompts.ts
 import { stdin as input, stdout as output } from "node:process";
-import { createInterface } from "node:readline/promises";
+import { createInterface as createInterface2 } from "node:readline/promises";
 function isInteractiveSession() {
   return Boolean(input.isTTY && output.isTTY);
 }
 async function confirmYesNo(prompt) {
-  const rl = createInterface({ input, output });
+  const rl = createInterface2({ input, output });
   try {
     const answer = (await rl.question(prompt)).trim().toLowerCase();
     return answer === "y" || answer === "yes";
@@ -18341,30 +19293,30 @@ import { mkdirSync as mkdirSync10 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
 // packages/cli/src/embed.ts
-import { existsSync as existsSync12 } from "fs";
-import { dirname as dirname8, resolve as resolve3 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { dirname as dirname8, resolve as resolve5 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var __filename = fileURLToPath2(import.meta.url);
 var __dirname = dirname8(__filename);
-var WEB_ASSETS_DIR = resolve3(__dirname, "../web");
+var WEB_ASSETS_DIR = resolve5(__dirname, "../web");
 function getStaticAssetsDir() {
   return WEB_ASSETS_DIR;
 }
 function hasWebAssets() {
-  return existsSync12(WEB_ASSETS_DIR);
+  return existsSync13(WEB_ASSETS_DIR);
 }
 
 // packages/cli/src/update-runtime.ts
-import { existsSync as existsSync13 } from "node:fs";
-import { dirname as dirname9, join as join16 } from "node:path";
+import { existsSync as existsSync14 } from "node:fs";
+import { dirname as dirname9, join as join19 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveWorkerEntryPath(importMetaUrl) {
   const currentDir = dirname9(fileURLToPath3(importMetaUrl));
   const candidates = [
-    join16(currentDir, "update-worker.mjs"),
-    join16(currentDir, "../src/update-worker.ts")
+    join19(currentDir, "update-worker.mjs"),
+    join19(currentDir, "../src/update-worker.ts")
   ];
-  return candidates.find((candidate) => existsSync13(candidate));
+  return candidates.find((candidate) => existsSync14(candidate));
 }
 function getUpdateRuntimeInfo(importMetaUrl) {
   const workerEntryPath = resolveWorkerEntryPath(importMetaUrl);
@@ -18591,11 +19543,11 @@ function resolveManagedScriptPath() {
   const currentFile = fileURLToPath5(import.meta.url);
   const currentDir = dirname10(currentFile);
   const candidates = [
-    join17(currentDir, "server-runner.js"),
-    join17(currentDir, "server-runner.mjs"),
-    join17(currentDir, "../src/server-runner.ts")
+    join20(currentDir, "server-runner.js"),
+    join20(currentDir, "server-runner.mjs"),
+    join20(currentDir, "../src/server-runner.ts")
   ];
-  const scriptPath = candidates.find((candidate) => existsSync14(candidate));
+  const scriptPath = candidates.find((candidate) => existsSync15(candidate));
   if (!scriptPath) {
     throw new Error("Unable to locate the managed server entry script");
   }