@spotpatch/dev-server 0.8.0 → 0.9.0

package/dist/index.cjs

@@ -30,10 +30,15 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ContextualAskError: () => ContextualAskError,
   DEFAULT_EXCLUDE: () => DEFAULT_EXCLUDE,
   DEFAULT_OPTIONS: () => DEFAULT_OPTIONS,
   applyIntegrationPlan: () => applyIntegrationPlan,
+  captureAskReadSnapshot: () => captureAskReadSnapshot,
+  composeContextualAskExecutors: () => composeContextualAskExecutors,
   createAgentJobManager: () => createAgentJobManager,
+  createConfiguredKeyAskExecutors: () => createConfiguredKeyAskExecutors,
+  createContextualAskManager: () => createContextualAskManager,
   createExternalHandoffService: () => createExternalHandoffService,
   createIntegrationFileChange: () => createIntegrationFileChange,
   createRuntimeAiConfig: () => createRuntimeAiConfig,
@@ -42,9 +47,12 @@ __export(index_exports, {
   createSourceRegistrationService: () => createSourceRegistrationService,
   createSourceRegistry: () => createSourceRegistry,
   createSpotPatchMiddleware: () => createSpotPatchMiddleware,
+  createWorkspaceActivityCoordinator: () => createWorkspaceActivityCoordinator,
   discoverProjectValidationCheck: () => discoverProjectValidationCheck,
+  handleContextualAskRequest: () => handleContextualAskRequest,
   integrationPathExists: () => integrationPathExists,
   isLoopbackHostname: () => isLoopbackHostname,
+  matchContextualAskPath: () => matchContextualAskPath,
   parseSerializedSpotPatchOptions: () => parseSerializedSpotPatchOptions,
   readIntegrationFile: () => readIntegrationFile,
   readJsonRequestBody: () => readJsonRequestBody,
@@ -221,6 +229,10 @@ function createAgentJobManager(options) {
     job.updatedAt = dependencies.now();
     emitSnapshot(job);
     emitPhase(job, phaseMessage);
+    if (!isActive(status)) {
+      job.lease?.release();
+      job.lease = void 0;
+    }
   };
   const probeResolved = async (selection, signal) => {
     const key = capabilityCacheKey(selection.provider, selection.model);
@@ -410,6 +422,7 @@ function createAgentJobManager(options) {
         [...jobs.values()].map((job) => job.runPromise).filter((promise) => promise !== void 0)
       );
       capabilityCache.clear();
+      for (const job of jobs.values()) job.lease?.release();
       jobs.clear();
     },
     create(request) {
@@ -434,8 +447,13 @@ function createAgentJobManager(options) {
         request.providerProfileId,
         request.modelProfileId
       );
+      const lease = options.coordinator?.acquire("change");
+      if (options.coordinator !== void 0 && lease === void 0) {
+        throw new import_shared.SpotPatchError(import_shared.ERROR_CODES.AGENT_BUSY);
+      }
       const id = dependencies.createJobId();
       if (!JOB_ID_PATTERN.test(id) || jobs.has(id)) {
+        lease?.release();
         throw new import_shared.SpotPatchError(import_shared.ERROR_CODES.INTERNAL_ERROR);
       }
       const timestamp = dependencies.now();
@@ -449,6 +467,7 @@ function createAgentJobManager(options) {
         events: [],
         id,
         listeners: /* @__PURE__ */ new Set(),
+        lease,
         model: selection.model,
         phaseMessage: "Agent job queued.",
         preparedChange: void 0,
@@ -491,6 +510,11 @@ function createAgentJobManager(options) {
           hasActiveJob(job.id) ? import_shared.ERROR_CODES.AGENT_BUSY : import_shared.ERROR_CODES.APPLY_CONFLICT
         );
       }
+      const lease = options.coordinator?.acquire("change");
+      if (options.coordinator !== void 0 && lease === void 0) {
+        throw new import_shared.SpotPatchError(import_shared.ERROR_CODES.AGENT_BUSY);
+      }
+      job.lease = lease;
       transition(job, "reverting", "Reverting the applied Agent change.");
       try {
         await dependencies.revertChange(job.preparedChange);
@@ -1262,12 +1286,12 @@ function createExternalHandoffStore(options) {
     }
     return current.snapshot;
   };
-  const findReplay = (requestId, fingerprint) => {
+  const findReplay = (requestId, fingerprint2) => {
     requireOpen();
     sweep();
     const record = idempotency.get(requestId);
     if (record === void 0) return void 0;
-    if (record.fingerprint !== fingerprint) {
+    if (record.fingerprint !== fingerprint2) {
       throw new import_shared6.SpotPatchError(import_shared6.ERROR_CODES.HANDOFF_VALIDATION_FAILED);
     }
     return replayResult(record);
@@ -1512,12 +1536,12 @@ function createExternalHandoffService(options) {
     },
     async publish(request, authorize) {
       requireReady();
-      const fingerprint = fingerprintExternalHandoffAnnotation(request.annotation);
-      const replayed = store.replay(request.requestId, fingerprint);
+      const fingerprint2 = fingerprintExternalHandoffAnnotation(request.annotation);
+      const replayed = store.replay(request.requestId, fingerprint2);
       if (replayed !== void 0) return replayed;
       const pending = inFlight.get(request.requestId);
       if (pending !== void 0) {
-        if (pending.fingerprint !== fingerprint) {
+        if (pending.fingerprint !== fingerprint2) {
           throw new import_shared7.SpotPatchError(import_shared7.ERROR_CODES.HANDOFF_VALIDATION_FAILED);
         }
         return asReplay(await pending.promise);
@@ -1527,12 +1551,12 @@ function createExternalHandoffService(options) {
         const annotation = await authorize(request.annotation);
         return store.publish({
           annotation,
-          fingerprint,
+          fingerprint: fingerprint2,
           requestId: request.requestId,
           reserve: activeRegistry.reserve
         });
       })();
-      const activePublish = Object.freeze({ fingerprint, promise });
+      const activePublish = Object.freeze({ fingerprint: fingerprint2, promise });
       inFlight.set(request.requestId, activePublish);
       try {
         return await promise;
@@ -1874,7 +1898,8 @@ var DEFAULT_OPTIONS = Object.freeze({
     runtime: "dispatch",
     limits: import_shared8.DEFAULT_DATA_FLOW_LIMITS
   }),
-  externalAgent: Object.freeze({ enabled: false })
+  externalAgent: Object.freeze({ enabled: false }),
+  contextualAsk: Object.freeze({ enabled: false })
 });
 var PROFILE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 var ENV_NAME_PATTERN = /^[A-Z][A-Z0-9_]{1,127}$/;
@@ -2184,6 +2209,35 @@ function resolveDataFlowOptions(options) {
     limits: import_shared8.DEFAULT_DATA_FLOW_LIMITS
   });
 }
+function resolveContextualAskOptions(value, ai) {
+  if (value === void 0 || value === false) return DEFAULT_OPTIONS.contextualAsk;
+  const parsed = import_shared8.contextualAskOptionsSchema.safeParse(value);
+  if (!parsed.success) {
+    throw new RangeError("SpotPatch contextualAsk configuration is invalid.");
+  }
+  const configured = typeof parsed.data === "boolean" ? {} : parsed.data;
+  const preference = configured.defaultExecutor;
+  if (preference?.kind === "configured-key") {
+    const provider = ai === false ? void 0 : ai.providers[preference.providerProfileId];
+    if (provider?.models[preference.modelProfileId] === void 0) {
+      throw new RangeError(
+        "SpotPatch contextualAsk default Key executor must reference a configured AI model."
+      );
+    }
+  }
+  if (ai !== false && Object.values(ai.providers).reduce(
+    (total, provider) => total + Object.keys(provider.models).length,
+    0
+  ) >= import_shared8.CONTEXTUAL_ASK_LIMITS.maximumExecutors) {
+    throw new RangeError(
+      "SpotPatch contextualAsk configuration exceeds the executor limit."
+    );
+  }
+  return Object.freeze({
+    enabled: true,
+    ...preference === void 0 ? {} : { defaultExecutor: Object.freeze({ ...preference }) }
+  });
+}
 function createRuntimeDataFlowConfig(options) {
   return Object.freeze({
     enabled: options.enabled,
@@ -2222,6 +2276,7 @@ function resolveOptions(options = {}, environmentAi) {
       `SpotPatch maxTargets must be an integer between 1 and ${String(import_shared8.MAX_ANNOTATION_TARGETS)}.`
     );
   }
+  const ai = resolveAiOptions(options.ai ?? environmentAi);
   const resolved = {
     enabled: options.enabled ?? DEFAULT_OPTIONS.enabled,
     include: Object.freeze([...options.include ?? DEFAULT_OPTIONS.include]),
@@ -2234,11 +2289,12 @@ function resolveOptions(options = {}, environmentAi) {
     debug: options.debug ?? DEFAULT_OPTIONS.debug,
     locale,
     maxTargets,
-    ai: resolveAiOptions(options.ai ?? environmentAi),
+    ai,
     dataFlow: resolveDataFlowOptions(options.dataFlow),
     externalAgent: Object.freeze({
       enabled: options.externalAgent ?? DEFAULT_OPTIONS.externalAgent.enabled
-    })
+    }),
+    contextualAsk: resolveContextualAskOptions(options.contextualAsk, ai)
   };
   if (resolved.shortcut.trim().length === 0 || resolved.shortcut.length > 128 || resolved.shortcut.includes("\0")) {
     throw new RangeError("SpotPatch shortcut is invalid.");
@@ -2477,6 +2533,9 @@ function createSourceRegistry(options = {}) {
     resolve(fileId) {
       return idToPath.get(fileId);
     },
+    findRegisteredId(absolutePath) {
+      return pathToId.get(normalizeAbsolutePath(absolutePath));
+    },
     resolveDataFlowComponent(componentSourceId) {
       return componentAnchors.get(componentSourceId);
     },
@@ -2489,179 +2548,1478 @@ function createSourceRegistry(options = {}) {
   });
 }
 
-// src/server/middleware.ts
-var import_shared20 = require("@spotpatch/shared");
-
-// src/external-handoff/browser-http.ts
-var import_shared13 = require("@spotpatch/shared");
-
-// src/server/annotation-authorizer.ts
-var import_promises6 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
-var import_shared12 = require("@spotpatch/shared");
-
-// src/server/source-context.ts
-var import_promises5 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+// src/contextual-ask/manager.ts
+var import_node_crypto10 = require("crypto");
 var import_shared11 = require("@spotpatch/shared");
 
-// src/server/extract-code-context.ts
-var import_oxc_parser = require("oxc-parser");
-function isComponentName(name) {
-  return /^[A-Z]/u.test(name);
-}
-function unwrapTypeExpression(expression) {
-  switch (expression.type) {
-    case "TSAsExpression":
-    case "TSSatisfiesExpression":
-    case "TSTypeAssertion":
-    case "TSNonNullExpression":
-    case "TSInstantiationExpression":
-      return unwrapTypeExpression(expression.expression);
-    default:
-      return expression;
-  }
-}
-function calleeName(expression) {
-  const unwrapped = unwrapTypeExpression(expression);
-  if (unwrapped.type === "Identifier") {
-    return unwrapped.name;
+// src/contextual-ask/error.ts
+var import_agent2 = require("@spotpatch/agent");
+var ContextualAskError = class extends Error {
+  code;
+  constructor(code, options = {}) {
+    super(code, options.cause === void 0 ? void 0 : { cause: options.cause });
+    this.name = "ContextualAskError";
+    this.code = code;
   }
-  if (unwrapped.type === "MemberExpression" && !unwrapped.computed) {
-    return unwrapped.property.type === "Identifier" ? unwrapped.property.name : void 0;
+};
+function asContextualAskError(error) {
+  if (error instanceof ContextualAskError) return error;
+  if (error instanceof import_agent2.ContextualAskExecutorError) {
+    return new ContextualAskError(error.code, { cause: error });
   }
-  return void 0;
+  return new ContextualAskError("ASK_EXECUTOR_UNAVAILABLE", { cause: error });
 }
-function isFunctionExpression(expression) {
-  const unwrapped = unwrapTypeExpression(expression);
-  return unwrapped.type === "ArrowFunctionExpression" || unwrapped.type === "FunctionExpression";
+
+// src/contextual-ask/read-snapshot.ts
+var import_node_crypto9 = require("crypto");
+var import_node_fs = require("fs");
+var import_promises4 = require("fs/promises");
+var import_node_path5 = __toESM(require("path"), 1);
+var import_shared10 = require("@spotpatch/shared");
+var import_oxc_parser = require("oxc-parser");
+var SOURCE_EXTENSIONS = Object.freeze([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".css",
+  ".scss",
+  ".sass",
+  ".less"
+]);
+var PROTECTED_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".git",
+  ".ssh",
+  ".spotpatch",
+  "coverage",
+  "dist",
+  "node_modules"
+]);
+var PROTECTED_FILES = /* @__PURE__ */ new Set([
+  ".gitmodules",
+  ".git-credentials",
+  ".netrc",
+  ".npmrc",
+  ".pnpmrc",
+  ".pypirc",
+  ".yarnrc",
+  "bun.lock",
+  "bun.lockb",
+  "npm-shrinkwrap.json",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock"
+]);
+var decoder = new TextDecoder("utf-8", { fatal: true });
+function deny(code) {
+  throw new ContextualAskError(code);
 }
-function isSupportedComponentInitializer(expression) {
-  const unwrapped = unwrapTypeExpression(expression);
-  if (isFunctionExpression(unwrapped)) {
-    return true;
-  }
-  if (unwrapped.type !== "CallExpression") {
-    return false;
+function toPosixRelative(realRoot, absolutePath) {
+  const relative = import_node_path5.default.relative(realRoot, absolutePath);
+  if (relative.length === 0 || relative === ".." || relative.startsWith(`..${import_node_path5.default.sep}`) || import_node_path5.default.isAbsolute(relative)) {
+    return deny("ASK_SOURCE_SCOPE_DENIED");
   }
-  const name = calleeName(unwrapped.callee);
-  if (name !== "memo" && name !== "forwardRef") {
-    return false;
+  const normalized = relative.split(import_node_path5.default.sep).join("/");
+  const segments = normalized.toLowerCase().split("/");
+  const fileName = segments.at(-1) ?? "";
+  if (segments.some((segment) => PROTECTED_DIRECTORIES.has(segment)) || PROTECTED_FILES.has(fileName) || fileName === ".env" || fileName === ".envrc" || fileName === ".dev.vars" || fileName.startsWith(".env.") || fileName.endsWith(".pem") || fileName.endsWith(".key") || fileName.endsWith(".p12") || fileName.endsWith(".pfx") || fileName.startsWith("id_rsa")) {
+    return deny("ASK_SOURCE_SCOPE_DENIED");
   }
-  const firstArgument = unwrapped.arguments[0];
-  return firstArgument !== void 0 && firstArgument.type !== "SpreadElement" && (isFunctionExpression(firstArgument) || isSupportedComponentInitializer(firstArgument));
+  return normalized;
 }
-function variableComponent(node) {
-  if (node.id.type !== "Identifier" || !isComponentName(node.id.name) || node.init === null || !isSupportedComponentInitializer(node.init)) {
-    return void 0;
+async function assertNoSymlinkPath(realRoot, absolutePath) {
+  const relative = toPosixRelative(realRoot, absolutePath);
+  let current = realRoot;
+  for (const segment of relative.split("/")) {
+    current = import_node_path5.default.join(current, segment);
+    const metadata = await (0, import_promises4.lstat)(current).catch(() => void 0);
+    if (metadata === void 0 || metadata.isSymbolicLink()) {
+      deny("ASK_SOURCE_SCOPE_DENIED");
+    }
   }
-  return Object.freeze({ start: node.start, end: node.end, name: node.id.name });
-}
-function functionComponent(node) {
-  return node.id !== null && isComponentName(node.id.name) && node.body !== null ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
 }
-function isReactComponentSuperclass(expression) {
-  if (expression === null) {
-    return false;
+async function readSecureSource(realRoot, absolutePath) {
+  const normalizedAbsolute = import_node_path5.default.normalize(import_node_path5.default.resolve(absolutePath));
+  const relativePath = toPosixRelative(realRoot, normalizedAbsolute);
+  await assertNoSymlinkPath(realRoot, normalizedAbsolute);
+  const canonical = await (0, import_promises4.realpath)(normalizedAbsolute).catch(() => void 0);
+  if (canonical === void 0 || canonical !== normalizedAbsolute) {
+    return deny("ASK_SOURCE_SCOPE_DENIED");
   }
-  const unwrapped = unwrapTypeExpression(expression);
-  if (unwrapped.type === "Identifier") {
-    return unwrapped.name === "Component" || unwrapped.name === "PureComponent";
+  let handle;
+  try {
+    handle = await (0, import_promises4.open)(normalizedAbsolute, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NOFOLLOW);
+    const before = await handle.stat();
+    if (!before.isFile() || before.nlink !== 1) {
+      return deny("ASK_SOURCE_SCOPE_DENIED");
+    }
+    if (before.size > import_shared10.CONTEXTUAL_ASK_LIMITS.maximumReadBytesPerFile) {
+      throw new ContextualAskError("ASK_LIMIT_EXCEEDED");
+    }
+    const bytes = await handle.readFile();
+    const after = await handle.stat();
+    if (bytes.byteLength !== before.size || before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || bytes.includes(0)) {
+      return deny("ASK_SOURCE_SCOPE_DENIED");
+    }
+    let content;
+    try {
+      content = decoder.decode(bytes);
+    } catch (error) {
+      throw new ContextualAskError("ASK_SOURCE_SCOPE_DENIED", { cause: error });
+    }
+    return Object.freeze({
+      content,
+      contentHash: (0, import_node_crypto9.createHash)("sha256").update(bytes).digest("hex"),
+      relativePath,
+      size: bytes.byteLength
+    });
+  } finally {
+    await handle?.close().catch(() => void 0);
   }
-  return unwrapped.type === "MemberExpression" && !unwrapped.computed && unwrapped.object.type === "Identifier" && unwrapped.object.name === "React" && (unwrapped.property.name === "Component" || unwrapped.property.name === "PureComponent");
 }
-function classComponent(node) {
-  return node.id !== null && isComponentName(node.id.name) && isReactComponentSuperclass(node.superClass) ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
+function confidence(value) {
+  return value === "exact" || value === "probable" ? value : "approximate";
 }
-function selectedOffset(source, line, column) {
-  const lines = source.split(/\r?\n/u);
-  if (line < 1 || line > lines.length) {
-    return void 0;
+async function authorizeSeeds(selection, registry, root, realRoot) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const target of selection.targets) {
+    let fileId = target.react.source?.fileId ?? target.source.fileId;
+    let sourceVersion;
+    if (target.react.componentSourceId !== void 0) {
+      const anchor = registry.resolveDataFlowComponent(target.react.componentSourceId);
+      if (anchor === void 0 || target.react.sourceVersion !== anchor.sourceVersion) {
+        deny("ASK_SELECTION_STALE");
+      }
+      fileId = anchor.fileId;
+      sourceVersion = anchor.sourceVersion;
+    }
+    if (fileId === void 0) continue;
+    const registered = registry.resolve(fileId);
+    if (registered === void 0) deny("ASK_SELECTION_STALE");
+    const canonical = await (0, import_promises4.realpath)(registered).catch(() => void 0);
+    if (canonical === void 0) deny("ASK_SELECTION_STALE");
+    const absolutePath = import_node_path5.default.normalize(canonical);
+    const registeredRelative = toPosixRelative(realRoot, absolutePath);
+    const claimedRelative = target.react.source?.relativePath ?? target.source.relativePath;
+    if (claimedRelative !== void 0 && claimedRelative.split("\\").join("/") !== registeredRelative) {
+      deny("ASK_SELECTION_STALE");
+    }
+    const existing = byPath.get(absolutePath);
+    const targetIds = Object.freeze([
+      ...existing?.targetIds ?? [],
+      ...existing?.targetIds.includes(target.targetId) === true ? [] : [target.targetId]
+    ]);
+    byPath.set(
+      absolutePath,
+      Object.freeze({
+        absolutePath,
+        fileId,
+        confidence: confidence(
+          target.react.source?.confidence ?? target.source.confidence
+        ),
+        targetIds,
+        ...sourceVersion === void 0 ? {} : { sourceVersion }
+      })
+    );
   }
-  const lineStart = lines.slice(0, line - 1).reduce((total, value) => total + value.length + 1, 0);
-  const lineLength = lines[line - 1]?.length ?? 0;
-  return lineStart + Math.min(Math.max(0, column - 1), lineLength);
+  for (const target of selection.targets) {
+    for (const rule of target.styles.matchedRules) {
+      const claimed = rule.source;
+      if (claimed === void 0 || claimed.startsWith("/") || claimed.includes("\\") || claimed.includes("\0") || claimed.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+        continue;
+      }
+      const registeredPath = import_node_path5.default.resolve(root, ...claimed.split("/"));
+      const fileId = registry.findRegisteredId(registeredPath);
+      if (fileId === void 0) continue;
+      const canonical = await (0, import_promises4.realpath)(registeredPath).catch(() => void 0);
+      if (canonical === void 0) continue;
+      const absolutePath = import_node_path5.default.normalize(canonical);
+      toPosixRelative(realRoot, absolutePath);
+      const existing = byPath.get(absolutePath);
+      const targetIds = Object.freeze([
+        ...existing?.targetIds ?? [],
+        ...existing?.targetIds.includes(target.targetId) === true ? [] : [target.targetId]
+      ]);
+      byPath.set(
+        absolutePath,
+        Object.freeze({
+          absolutePath,
+          fileId,
+          confidence: existing?.confidence ?? "probable",
+          targetIds,
+          ...existing?.sourceVersion === void 0 ? {} : { sourceVersion: existing.sourceVersion }
+        })
+      );
+    }
+  }
+  if (byPath.size === 0) deny("ASK_SELECTION_REQUIRED");
+  return [...byPath.values()];
 }
-function findComponentSpan(options) {
-  const offset = selectedOffset(options.source, options.line, options.column);
-  if (offset === void 0) {
-    return void 0;
+function localSpecifiers(filePath, content) {
+  const found = /* @__PURE__ */ new Set();
+  if (/\.(?:css|scss|sass|less)$/iu.test(filePath)) {
+    const pattern = /@import\s+(?:url\(\s*)?["']([^"']+)["']/gu;
+    for (const match of content.matchAll(pattern)) {
+      if (match[1]?.startsWith(".")) found.add(match[1]);
+    }
+    return [...found].sort();
   }
-  let parseResult;
   try {
-    parseResult = (0, import_oxc_parser.parseSync)(options.sourcePath, options.source, {
-      sourceType: "module"
+    const parsed = (0, import_oxc_parser.parseSync)(filePath, content, { sourceType: "module" });
+    if (parsed.errors.length > 0) return [];
+    const add = (value) => {
+      if (typeof value === "string" && value.startsWith(".")) found.add(value);
+    };
+    const visitor = new import_oxc_parser.Visitor({
+      ImportDeclaration(node) {
+        add(node.source.value);
+      },
+      ExportNamedDeclaration(node) {
+        add(node.source?.value);
+      },
+      ExportAllDeclaration(node) {
+        add(node.source.value);
+      },
+      ImportExpression(node) {
+        if ("value" in node.source) add(node.source.value);
+      }
     });
+    visitor.visit(parsed.program);
   } catch {
-    return void 0;
+    return [];
   }
-  if (parseResult.errors.length > 0) {
-    return void 0;
+  return [...found].sort();
+}
+function importCandidates(importer, specifier) {
+  const base = import_node_path5.default.resolve(import_node_path5.default.dirname(importer), specifier);
+  if (import_node_path5.default.extname(base) !== "") return Object.freeze([base]);
+  return Object.freeze([
+    ...SOURCE_EXTENSIONS.map((extension) => `${base}${extension}`),
+    ...SOURCE_EXTENSIONS.map((extension) => import_node_path5.default.join(base, `index${extension}`))
+  ]);
+}
+function countLines(content) {
+  return content.length === 0 ? 1 : content.split("\n").length;
+}
+function publicSourceEntry(source) {
+  return Object.freeze({
+    handleId: source.handleId,
+    fileId: source.fileId,
+    relativePath: source.relativePath,
+    label: source.label,
+    lineCount: source.lineCount,
+    size: source.size,
+    contentHash: source.contentHash,
+    confidence: source.confidence,
+    targetIds: source.targetIds,
+    ...source.sourceVersion === void 0 ? {} : { sourceVersion: source.sourceVersion }
+  });
+}
+function assertSelectionEvidenceCurrent(selection, captured) {
+  for (const target of selection.targets) {
+    if (target.code === void 0) continue;
+    const source = captured.find(
+      (candidate) => candidate.relativePath === target.code?.relativePath
+    );
+    if (source === void 0) deny("ASK_SELECTION_STALE");
+    const lines = source.content.split(/\r?\n/u);
+    if (target.code.endLine > lines.length) deny("ASK_SELECTION_STALE");
+    const currentExcerpt = lines.slice(target.code.startLine - 1, target.code.endLine).join("\n");
+    if (currentExcerpt !== target.code.excerpt) deny("ASK_SELECTION_STALE");
+  }
+}
+async function captureAskReadSnapshot(options) {
+  options.signal?.throwIfAborted();
+  const realRoot = await (0, import_promises4.realpath)(options.root).catch(() => void 0);
+  if (realRoot === void 0) deny("ASK_SOURCE_SCOPE_DENIED");
+  const seeds = await authorizeSeeds(
+    options.selection,
+    options.registry,
+    options.root,
+    realRoot
+  );
+  const createHandleId = options.createHandleId ?? (() => (0, import_node_crypto9.randomBytes)(16).toString("base64url"));
+  const captured = [];
+  const capturedPaths = /* @__PURE__ */ new Set();
+  const queue = [...seeds];
+  let totalBytes = 0;
+  let truncated = false;
+  while (queue.length > 0) {
+    options.signal?.throwIfAborted();
+    const candidate = queue.shift();
+    if (candidate === void 0 || capturedPaths.has(candidate.absolutePath)) continue;
+    if (captured.length >= import_shared10.CONTEXTUAL_ASK_LIMITS.maximumReadFiles) {
+      truncated = true;
+      break;
+    }
+    let read;
+    try {
+      read = await readSecureSource(realRoot, candidate.absolutePath);
+      options.signal?.throwIfAborted();
+    } catch (error) {
+      if (captured.length < seeds.length) throw error;
+      truncated = true;
+      continue;
+    }
+    if (totalBytes + read.size > import_shared10.CONTEXTUAL_ASK_LIMITS.maximumReadBytesTotal) {
+      if (captured.length < seeds.length)
+        throw new ContextualAskError("ASK_LIMIT_EXCEEDED");
+      truncated = true;
+      continue;
+    }
+    capturedPaths.add(candidate.absolutePath);
+    totalBytes += read.size;
+    const entry = Object.freeze({
+      handleId: createHandleId(),
+      fileId: candidate.fileId,
+      relativePath: read.relativePath,
+      label: import_node_path5.default.basename(read.relativePath),
+      lineCount: countLines(read.content),
+      size: read.size,
+      contentHash: read.contentHash,
+      confidence: candidate.confidence,
+      targetIds: Object.freeze([...candidate.targetIds]),
+      ...candidate.sourceVersion === void 0 ? {} : { sourceVersion: candidate.sourceVersion },
+      absolutePath: candidate.absolutePath,
+      content: read.content
+    });
+    captured.push(entry);
+    for (const specifier of localSpecifiers(candidate.absolutePath, read.content)) {
+      options.signal?.throwIfAborted();
+      for (const importPath of importCandidates(candidate.absolutePath, specifier)) {
+        if (capturedPaths.has(importPath)) continue;
+        const metadata = await (0, import_promises4.lstat)(importPath).catch(() => void 0);
+        if (metadata?.isFile() !== true || metadata.isSymbolicLink()) continue;
+        const fileId = options.registry.findRegisteredId(importPath) ?? options.registry.register(importPath);
+        queue.push(
+          Object.freeze({
+            absolutePath: import_node_path5.default.normalize(importPath),
+            fileId,
+            confidence: "probable",
+            targetIds: candidate.targetIds
+          })
+        );
+        break;
+      }
+    }
   }
-  const jsxNodes = [];
-  const components = [];
-  const visitor = new import_oxc_parser.Visitor({
-    JSXElement(node) {
-      jsxNodes.push(node);
+  assertSelectionEvidenceCurrent(options.selection, captured);
+  const sourceByHandle = new Map(captured.map((source) => [source.handleId, source]));
+  const publicEntries = Object.freeze(
+    captured.map((source) => publicSourceEntry(source))
+  );
+  const contextHash = (0, import_node_crypto9.createHash)("sha256").update(
+    JSON.stringify({
+      selectionId: options.selection.selectionId,
+      sources: publicEntries.map((source) => ({
+        relativePath: source.relativePath,
+        contentHash: source.contentHash,
+        targetIds: source.targetIds,
+        sourceVersion: source.sourceVersion ?? null
+      }))
+    })
+  ).digest("hex");
+  let disposed = false;
+  const requireSource = (handleId) => {
+    if (disposed) throw new ContextualAskError("ASK_RESULT_EXPIRED");
+    const source = sourceByHandle.get(handleId);
+    if (source === void 0) throw new ContextualAskError("ASK_SOURCE_SCOPE_DENIED");
+    return source;
+  };
+  const snapshot2 = Object.freeze({
+    manifest: () => {
+      if (disposed) throw new ContextualAskError("ASK_RESULT_EXPIRED");
+      return publicEntries;
     },
-    JSXFragment(node) {
-      jsxNodes.push(node);
+    read(handleId, range = {}) {
+      const source = requireSource(handleId);
+      const startLine = range.startLine ?? 1;
+      const endLine = range.endLine ?? source.lineCount;
+      if (!Number.isSafeInteger(startLine) || !Number.isSafeInteger(endLine) || startLine < 1 || endLine < startLine || endLine > source.lineCount) {
+        throw new ContextualAskError("ASK_SOURCE_SCOPE_DENIED");
+      }
+      return Object.freeze({
+        handleId,
+        startLine,
+        endLine,
+        content: source.content.split("\n").slice(startLine - 1, endLine).join("\n")
+      });
     },
-    FunctionDeclaration(node) {
-      const candidate = functionComponent(node);
-      if (candidate !== void 0) {
-        components.push(candidate);
+    search(query) {
+      if (query.length === 0 || query.length > import_shared10.CONTEXTUAL_ASK_LIMITS.maximumSearchQueryCharacters || query.includes("\0")) {
+        throw new ContextualAskError("ASK_SOURCE_SCOPE_DENIED");
+      }
+      const normalized = query.toLocaleLowerCase("en-US");
+      const matches = [];
+      for (const source of captured) {
+        for (const [index, line] of source.content.split("\n").entries()) {
+          if (line.toLocaleLowerCase("en-US").includes(normalized)) {
+            matches.push(
+              Object.freeze({
+                handleId: source.handleId,
+                line: index + 1,
+                preview: line.slice(
+                  0,
+                  import_shared10.CONTEXTUAL_ASK_LIMITS.maximumSearchPreviewCharacters
+                )
+              })
+            );
+            if (matches.length >= import_shared10.CONTEXTUAL_ASK_LIMITS.maximumSearchResults) {
+              return Object.freeze(matches);
+            }
+          }
+        }
       }
+      return Object.freeze(matches);
+    }
+  });
+  return Object.freeze({
+    grant: Object.freeze({ contextHash, truncated, sources: publicEntries }),
+    snapshot: snapshot2,
+    dispose() {
+      disposed = true;
+      sourceByHandle.clear();
+      captured.splice(0, captured.length);
     },
-    VariableDeclarator(node) {
-      const candidate = variableComponent(node);
-      if (candidate !== void 0) {
-        components.push(candidate);
+    async isStale() {
+      for (const source of captured) {
+        try {
+          const current = await readSecureSource(realRoot, source.absolutePath);
+          if (current.contentHash !== source.contentHash) return true;
+        } catch {
+          return true;
+        }
       }
+      return false;
     },
-    ClassDeclaration(node) {
-      const candidate = classComponent(node);
-      if (candidate !== void 0) {
-        components.push(candidate);
+    projectCitation(handleId, startLine, endLine) {
+      const source = requireSource(handleId);
+      if (!Number.isSafeInteger(startLine) || !Number.isSafeInteger(endLine) || startLine < 1 || endLine < startLine || endLine > source.lineCount) {
+        throw new ContextualAskError("ASK_ANSWER_INVALID");
       }
+      return Object.freeze({ ...publicSourceEntry(source), startLine, endLine });
     }
   });
-  visitor.visit(parseResult.program);
-  const selectedJsx = jsxNodes.filter((node) => node.start <= offset && node.end >= offset).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
-  if (selectedJsx === void 0) {
-    return void 0;
-  }
-  return components.filter(
-    (component) => component.start <= selectedJsx.start && component.end >= selectedJsx.end
-  ).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
-}
-function lineAtOffset(source, offset) {
-  let line = 1;
-  for (let index = 0; index < offset; index += 1) {
-    if (source[index] === "\n") {
-      line += 1;
-    }
-  }
-  return line;
 }
-function componentRange(source, component) {
-  return Object.freeze({
-    startLine: lineAtOffset(source, component.start),
-    endLine: lineAtOffset(source, Math.max(component.start, component.end - 1))
+
+// src/contextual-ask/manager.ts
+var ACTIVE_STATUSES = /* @__PURE__ */ new Set([
+  "queued",
+  "authorizing",
+  "running",
+  "cancelling"
+]);
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["answered", "cancelled", "failed"]);
+var DEFAULT_DEPENDENCIES2 = Object.freeze({
+  captureSnapshot: captureAskReadSnapshot,
+  createId: () => (0, import_node_crypto10.randomBytes)(16).toString("base64url"),
+  now: () => /* @__PURE__ */ new Date()
+});
+function fingerprint(request) {
+  return (0, import_node_crypto10.createHash)("sha256").update(
+    JSON.stringify({
+      envelope: request.envelope,
+      executorId: request.executorId,
+      providerDataConsent: request.providerDataConsent
+    })
+  ).digest("hex");
+}
+function fileCountBucket(count) {
+  if (count <= 1) return "one";
+  if (count <= 5) return "few";
+  return "many";
+}
+function raceWithAbort(operation, signal) {
+  const reason = () => signal.reason instanceof Error ? signal.reason : new ContextualAskError("ASK_CANCELLED");
+  if (signal.aborted) return Promise.reject(reason());
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      reject(reason());
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    operation.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(
+          error instanceof Error ? error : new ContextualAskError("ASK_EXECUTOR_UNAVAILABLE", { cause: error })
+        );
+      }
+    );
   });
 }
-function truncateSelectedLine(line, column, maxCharacters) {
-  if (line.length <= maxCharacters) {
-    return line;
-  }
-  if (maxCharacters === 1) {
-    return "\u2026";
+function createContextualAskManager(options) {
+  const dependencies = Object.freeze({
+    ...DEFAULT_DEPENDENCIES2,
+    ...options.dependencies
+  });
+  const executors = /* @__PURE__ */ new Map();
+  for (const executor of options.executors ?? []) {
+    if (executors.has(executor.executorId)) {
+      throw new TypeError("Contextual Ask executor IDs must be unique.");
+    }
+    executors.set(executor.executorId, executor);
   }
-  const contentCharacters = maxCharacters - 2;
-  const desiredStart = Math.max(0, column - 1 - Math.floor(contentCharacters / 2));
-  const start = Math.min(desiredStart, line.length - contentCharacters);
-  const end = start + contentCharacters;
-  return `${start > 0 ? "\u2026" : ""}${line.slice(start, end)}${end < line.length ? "\u2026" : ""}`.slice(
+  const jobs = /* @__PURE__ */ new Map();
+  const requests = /* @__PURE__ */ new Map();
+  const pendingRequests = /* @__PURE__ */ new Map();
+  let closed = false;
+  const isClosed = () => closed;
+  const cleanupExpired = () => {
+    const now = dependencies.now().getTime();
+    for (const [jobId, job] of jobs) {
+      if (job.expiresAt !== void 0 && now >= job.expiresAt) {
+        job.snapshot?.dispose();
+        jobs.delete(jobId);
+        const request = requests.get(job.request.requestId);
+        if (request?.jobId === jobId) requests.delete(job.request.requestId);
+      }
+    }
+  };
+  const requireJob = (jobId) => {
+    cleanupExpired();
+    const job = jobs.get(jobId);
+    if (job === void 0) throw new ContextualAskError("ASK_RESULT_EXPIRED");
+    return job;
+  };
+  const publicSnapshot = (job) => import_shared11.askJobSnapshotSchema.parse({
+    schemaVersion: import_shared11.CONTEXTUAL_ASK_SCHEMA_VERSION,
+    jobId: job.id,
+    selectionId: job.request.envelope.selection.selectionId,
+    status: job.status,
+    executor: {
+      executorId: job.executorCapability.executorId,
+      kind: job.executorCapability.kind,
+      label: job.executorCapability.label,
+      modelLabel: job.executorCapability.effectiveModelLabel
+    },
+    ...job.phaseMessage === void 0 ? {} : { phaseMessage: job.phaseMessage },
+    createdAt: job.createdAt,
+    updatedAt: job.updatedAt,
+    canCancel: ["queued", "authorizing", "running"].includes(job.status),
+    ...job.errorCode === void 0 ? {} : { errorCode: job.errorCode }
+  });
+  const appendEvent = (job, event) => {
+    job.events.push(import_shared11.askJobEventSchema.parse(event));
+    if (job.events.length > import_shared11.CONTEXTUAL_ASK_LIMITS.maximumRetainedEvents) {
+      job.events.splice(
+        0,
+        job.events.length - import_shared11.CONTEXTUAL_ASK_LIMITS.maximumRetainedEvents
+      );
+    }
+    for (const listener of job.listeners) listener(event);
+  };
+  const eventBase = (job) => {
+    job.sequence += 1;
+    return {
+      schemaVersion: import_shared11.CONTEXTUAL_ASK_SCHEMA_VERSION,
+      sequence: job.sequence,
+      jobId: job.id,
+      status: job.status,
+      timestamp: dependencies.now().toISOString()
+    };
+  };
+  const emitSnapshot = (job) => {
+    appendEvent(job, {
+      ...eventBase(job),
+      type: "snapshot",
+      snapshot: publicSnapshot(job)
+    });
+  };
+  const emitPhase = (job, message) => {
+    appendEvent(job, { ...eventBase(job), type: "phase", message });
+  };
+  const emitReadActivity = (job, entry, state) => {
+    appendEvent(job, {
+      ...eventBase(job),
+      type: "read-activity",
+      activity: entry === void 0 ? {
+        kind: "file-count",
+        bucket: fileCountBucket(job.snapshot?.grant.sources.length ?? 0)
+      } : {
+        kind: "source",
+        sourceId: entry.fileId,
+        relativePath: entry.relativePath
+      },
+      state
+    });
+  };
+  const transition = (job, status, phaseMessage, errorCode) => {
+    job.status = status;
+    job.phaseMessage = phaseMessage;
+    job.errorCode = errorCode;
+    job.updatedAt = dependencies.now().toISOString();
+    emitSnapshot(job);
+    if (!TERMINAL_STATUSES.has(status)) emitPhase(job, phaseMessage);
+  };
+  const finish = (job) => {
+    job.expiresAt = dependencies.now().getTime() + import_shared11.CONTEXTUAL_ASK_LIMITS.resultTtlMs;
+    job.lease.release();
+    job.snapshot?.dispose();
+    job.snapshot = void 0;
+  };
+  const fail = (job, error) => {
+    if (TERMINAL_STATUSES.has(job.status)) return;
+    const normalized = asContextualAskError(error);
+    const abortReason = job.controller.signal.reason;
+    const cancelled = normalized.code === "ASK_CANCELLED" || abortReason instanceof ContextualAskError && abortReason.code === "ASK_CANCELLED";
+    transition(
+      job,
+      cancelled ? "cancelled" : "failed",
+      cancelled ? "Question cancelled." : "Question failed.",
+      cancelled ? "ASK_CANCELLED" : normalized.code
+    );
+    appendEvent(job, {
+      ...eventBase(job),
+      type: "error",
+      errorCode: cancelled ? "ASK_CANCELLED" : normalized.code
+    });
+    finish(job);
+  };
+  const instrumentSnapshot = (job, snapshot2, onLimitExceeded) => {
+    const byHandle = new Map(
+      snapshot2.manifest().map((entry) => [entry.handleId, entry])
+    );
+    let readOperations = 0;
+    const beginOperation = () => {
+      readOperations += 1;
+      if (readOperations > import_shared11.CONTEXTUAL_ASK_LIMITS.maximumToolCalls) {
+        onLimitExceeded();
+        throw new ContextualAskError("ASK_LIMIT_EXCEEDED");
+      }
+    };
+    return Object.freeze({
+      manifest: () => snapshot2.manifest(),
+      read(handleId, range) {
+        beginOperation();
+        const entry = byHandle.get(handleId);
+        if (job.status === "running") emitReadActivity(job, entry, "started");
+        try {
+          const result = snapshot2.read(handleId, range);
+          if (job.status === "running") emitReadActivity(job, entry, "succeeded");
+          return result;
+        } catch (error) {
+          if (job.status === "running") emitReadActivity(job, entry, "failed");
+          throw error;
+        }
+      },
+      search(query) {
+        beginOperation();
+        if (job.status === "running") emitReadActivity(job, void 0, "started");
+        try {
+          const result = snapshot2.search(query);
+          if (job.status === "running") {
+            emitReadActivity(job, void 0, "succeeded");
+          }
+          return result;
+        } catch (error) {
+          if (job.status === "running") emitReadActivity(job, void 0, "failed");
+          throw error;
+        }
+      }
+    });
+  };
+  const projectAnswer = async (job, draft, captured) => {
+    const sourceIds = /* @__PURE__ */ new Map();
+    const sources = /* @__PURE__ */ new Map();
+    const projectCitations = (citations) => citations.map((citation) => {
+      const key = `${citation.handleId}:${String(citation.startLine)}:${String(citation.endLine)}`;
+      let sourceId = sourceIds.get(key);
+      if (sourceId === void 0) {
+        sourceId = dependencies.createId();
+        sourceIds.set(key, sourceId);
+        sources.set(
+          sourceId,
+          captured.projectCitation(
+            citation.handleId,
+            citation.startLine,
+            citation.endLine
+          )
+        );
+      }
+      return sourceId;
+    });
+    const blocks = draft.blocks.map((block) => {
+      if (block.kind === "list") {
+        return {
+          kind: "list",
+          items: block.items.map((item) => ({
+            text: item.text,
+            sourceIds: projectCitations(item.citations)
+          }))
+        };
+      }
+      return Object.freeze({
+        kind: block.kind,
+        ...block.kind === "paragraph" ? { text: block.text } : { code: block.code },
+        ...block.kind === "code" && block.language !== void 0 ? { language: block.language } : {},
+        sourceIds: projectCitations(block.citations)
+      });
+    });
+    const warnings = [...draft.warnings];
+    if (captured.grant.truncated && !warnings.some((warning) => warning.code === "source-truncated")) {
+      warnings.push(Object.freeze({ code: "source-truncated" }));
+    }
+    if (await captured.isStale() && !warnings.some((warning) => warning.code === "source-stale")) {
+      warnings.push(Object.freeze({ code: "source-stale" }));
+    }
+    const created = dependencies.now();
+    return import_shared11.askAnswerResultSchema.parse({
+      schemaVersion: import_shared11.CONTEXTUAL_ASK_SCHEMA_VERSION,
+      jobId: job.id,
+      selectionId: job.request.envelope.selection.selectionId,
+      contextHash: captured.grant.contextHash,
+      executor: {
+        executorId: job.executorCapability.executorId,
+        kind: job.executorCapability.kind,
+        label: job.executorCapability.label,
+        modelLabel: job.executorCapability.effectiveModelLabel
+      },
+      blocks,
+      sources: [...sources].map(([sourceId, source]) => ({
+        sourceId,
+        label: source.label,
+        relativePath: source.relativePath,
+        fileId: source.fileId,
+        startLine: source.startLine,
+        endLine: source.endLine,
+        confidence: source.confidence,
+        targetIds: source.targetIds,
+        ...source.sourceVersion === void 0 ? {} : { sourceVersion: source.sourceVersion },
+        contentHash: source.contentHash
+      })),
+      warnings,
+      createdAt: created.toISOString(),
+      expiresAt: new Date(
+        created.getTime() + import_shared11.CONTEXTUAL_ASK_LIMITS.resultTtlMs
+      ).toISOString()
+    });
+  };
+  const run = async (job) => {
+    const timeout = setTimeout(() => {
+      job.controller.abort(new ContextualAskError("ASK_TIMEOUT"));
+    }, import_shared11.CONTEXTUAL_ASK_LIMITS.jobTimeoutMs);
+    timeout.unref();
+    try {
+      transition(job, "authorizing", "Authorizing selected sources.");
+      const captured = await dependencies.captureSnapshot({
+        root: options.root,
+        registry: options.registry,
+        selection: job.request.envelope.selection,
+        signal: job.controller.signal,
+        createHandleId: dependencies.createId
+      });
+      if (job.controller.signal.aborted) {
+        captured.dispose();
+      }
+      job.controller.signal.throwIfAborted();
+      job.snapshot = captured;
+      transition(job, "running", "Analyzing the authorized snapshot.");
+      emitReadActivity(job, void 0, "succeeded");
+      const readLimit = { exceeded: false };
+      const execution = await raceWithAbort(
+        job.executor.execute(
+          {
+            jobId: job.id,
+            envelope: job.request.envelope,
+            grant: captured.grant,
+            snapshot: instrumentSnapshot(job, captured.snapshot, () => {
+              readLimit.exceeded = true;
+            })
+          },
+          job.controller.signal
+        ),
+        job.controller.signal
+      );
+      const draft = import_shared11.askAnswerDraftSchema.parse(execution);
+      const effectiveModelLabel = job.executor.effectiveModelLabel?.();
+      if (effectiveModelLabel !== void 0) {
+        job.executorCapability = import_shared11.contextualAskExecutorCapabilitySchema.parse({
+          ...job.executorCapability,
+          effectiveModelLabel
+        });
+      }
+      if (readLimit.exceeded) throw new ContextualAskError("ASK_LIMIT_EXCEEDED");
+      job.controller.signal.throwIfAborted();
+      const result = await projectAnswer(job, draft, captured);
+      job.controller.signal.throwIfAborted();
+      job.result = result;
+      transition(job, "answered", "Answer ready.");
+      appendEvent(job, { ...eventBase(job), type: "answer-ready" });
+      finish(job);
+    } catch (error) {
+      fail(
+        job,
+        error instanceof Error && error.name === "ZodError" ? new ContextualAskError("ASK_ANSWER_INVALID", { cause: error }) : asContextualAskError(error)
+      );
+    } finally {
+      clearTimeout(timeout);
+    }
+  };
+  return Object.freeze({
+    async capability(signal) {
+      if (!options.enabled || closed) {
+        return import_shared11.contextualAskCapabilitySchema.parse({
+          schemaVersion: import_shared11.CONTEXTUAL_ASK_SCHEMA_VERSION,
+          enabled: false,
+          executors: [],
+          safety: {
+            selectionRequired: true,
+            singleTurn: true,
+            writesAllowed: false,
+            historyStored: false
+          },
+          checkedAt: dependencies.now().toISOString()
+        });
+      }
+      const capabilities = (await Promise.all(
+        [...executors.values()].map(async (executor) => {
+          try {
+            return import_shared11.contextualAskExecutorCapabilitySchema.parse(
+              await raceWithAbort(executor.capability(signal), signal)
+            );
+          } catch {
+            return void 0;
+          }
+        })
+      )).filter((capability) => capability !== void 0);
+      return import_shared11.contextualAskCapabilitySchema.parse({
+        schemaVersion: import_shared11.CONTEXTUAL_ASK_SCHEMA_VERSION,
+        enabled: true,
+        executors: capabilities,
+        safety: {
+          selectionRequired: true,
+          singleTurn: true,
+          writesAllowed: false,
+          historyStored: false
+        },
+        checkedAt: dependencies.now().toISOString()
+      });
+    },
+    async create(rawRequest) {
+      cleanupExpired();
+      if (!options.enabled || closed) throw new ContextualAskError("ASK_DISABLED");
+      const parsed = import_shared11.askJobCreateRequestSchema.safeParse(rawRequest);
+      if (!parsed.success) throw new ContextualAskError("ASK_QUESTION_INVALID");
+      const request = parsed.data;
+      const requestFingerprint = fingerprint(request);
+      const previous = requests.get(request.requestId);
+      if (previous !== void 0) {
+        if (previous.fingerprint !== requestFingerprint) {
+          throw new ContextualAskError("ASK_IDEMPOTENCY_CONFLICT");
+        }
+        return publicSnapshot(requireJob(previous.jobId));
+      }
+      const pending = pendingRequests.get(request.requestId);
+      if (pending !== void 0) {
+        if (pending.fingerprint !== requestFingerprint) {
+          throw new ContextualAskError("ASK_IDEMPOTENCY_CONFLICT");
+        }
+        return await pending.promise;
+      }
+      if ([...jobs.values()].some((job) => ACTIVE_STATUSES.has(job.status))) {
+        throw new ContextualAskError("ASK_BUSY");
+      }
+      const executor = executors.get(request.executorId);
+      if (executor === void 0)
+        throw new ContextualAskError("ASK_EXECUTOR_UNAVAILABLE");
+      const lease = options.coordinator.acquire("ask");
+      if (lease === void 0) throw new ContextualAskError("ASK_BUSY");
+      const controller = new AbortController();
+      let leaseTransferred = false;
+      const creation = (async () => {
+        try {
+          const capabilitySignal = AbortSignal.any([
+            controller.signal,
+            AbortSignal.timeout(import_shared11.CONTEXTUAL_ASK_LIMITS.capabilityTimeoutMs)
+          ]);
+          const capability = import_shared11.contextualAskExecutorCapabilitySchema.parse(
+            await raceWithAbort(
+              executor.capability(capabilitySignal),
+              capabilitySignal
+            )
+          );
+          if (isClosed()) throw new ContextualAskError("ASK_DISABLED");
+          if (capability.executorId !== executor.executorId || capability.state !== "ready" || !capability.readOnlyProven) {
+            throw new ContextualAskError("ASK_EXECUTOR_UNAVAILABLE");
+          }
+          for (const [jobId, existing] of jobs) {
+            if (TERMINAL_STATUSES.has(existing.status)) {
+              existing.snapshot?.dispose();
+              jobs.delete(jobId);
+              requests.delete(existing.request.requestId);
+            }
+          }
+          const createdAt = dependencies.now().toISOString();
+          const job = {
+            controller: new AbortController(),
+            createdAt,
+            events: [],
+            executor,
+            executorCapability: capability,
+            fingerprint: requestFingerprint,
+            id: dependencies.createId(),
+            lease,
+            listeners: /* @__PURE__ */ new Set(),
+            request,
+            errorCode: void 0,
+            expiresAt: void 0,
+            phaseMessage: "Question queued.",
+            result: void 0,
+            runPromise: void 0,
+            sequence: 0,
+            snapshot: void 0,
+            status: "queued",
+            updatedAt: createdAt
+          };
+          jobs.set(job.id, job);
+          requests.set(request.requestId, {
+            fingerprint: requestFingerprint,
+            jobId: job.id
+          });
+          leaseTransferred = true;
+          emitSnapshot(job);
+          emitPhase(job, "Question queued.");
+          job.runPromise = run(job);
+          return publicSnapshot(job);
+        } catch (error) {
+          throw error instanceof ContextualAskError ? error : new ContextualAskError("ASK_EXECUTOR_UNAVAILABLE", {
+            cause: error
+          });
+        } finally {
+          if (!leaseTransferred) lease.release();
+          pendingRequests.delete(request.requestId);
+        }
+      })();
+      pendingRequests.set(request.requestId, {
+        controller,
+        fingerprint: requestFingerprint,
+        promise: creation
+      });
+      return await creation;
+    },
+    cancel(jobId) {
+      const job = requireJob(jobId);
+      if (TERMINAL_STATUSES.has(job.status)) return publicSnapshot(job);
+      if (job.status !== "cancelling") {
+        transition(job, "cancelling", "Cancelling question.");
+        job.controller.abort(new ContextualAskError("ASK_CANCELLED"));
+        job.snapshot?.dispose();
+        job.snapshot = void 0;
+      }
+      return publicSnapshot(job);
+    },
+    events(jobId, afterSequence = 0) {
+      if (!Number.isSafeInteger(afterSequence) || afterSequence < 0) {
+        throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE");
+      }
+      return Object.freeze(
+        requireJob(jobId).events.filter((event) => event.sequence > afterSequence)
+      );
+    },
+    async result(jobId) {
+      const job = requireJob(jobId);
+      await job.runPromise;
+      const current = requireJob(jobId);
+      return import_shared11.askJobResultResponseSchema.parse({
+        snapshot: publicSnapshot(current),
+        ...current.result === void 0 ? {} : { result: current.result }
+      });
+    },
+    snapshot(jobId) {
+      return publicSnapshot(requireJob(jobId));
+    },
+    subscribe(jobId, listener) {
+      const job = requireJob(jobId);
+      if (job.listeners.size >= import_shared11.CONTEXTUAL_ASK_LIMITS.maximumEventSubscribers) {
+        throw new ContextualAskError("ASK_LIMIT_EXCEEDED");
+      }
+      job.listeners.add(listener);
+      return () => job.listeners.delete(listener);
+    },
+    async close() {
+      if (closed) return;
+      closed = true;
+      for (const pending of pendingRequests.values()) {
+        pending.controller.abort(new ContextualAskError("ASK_CANCELLED"));
+      }
+      await Promise.allSettled(
+        [...pendingRequests.values()].map((pending) => pending.promise)
+      );
+      for (const job of jobs.values()) {
+        if (ACTIVE_STATUSES.has(job.status)) {
+          job.controller.abort(new ContextualAskError("ASK_CANCELLED"));
+        }
+      }
+      await Promise.allSettled(
+        [...jobs.values()].map((job) => job.runPromise ?? Promise.resolve())
+      );
+      for (const job of jobs.values()) {
+        job.snapshot?.dispose();
+        job.listeners.clear();
+        job.lease.release();
+      }
+      jobs.clear();
+      requests.clear();
+      pendingRequests.clear();
+      await Promise.allSettled(
+        [...executors.values()].map(async (executor) => executor.dispose?.())
+      );
+    }
+  });
+}
+
+// src/contextual-ask/configured-key-executors.ts
+var import_agent3 = require("@spotpatch/agent");
+function createConfiguredKeyAskExecutors(options) {
+  const preferred = options.defaultExecutor?.kind === "configured-key" ? options.defaultExecutor : Object.freeze({
+    kind: "configured-key",
+    providerProfileId: options.ai.defaultProvider,
+    modelProfileId: options.ai.providers[options.ai.defaultProvider]?.defaultModel ?? ""
+  });
+  const providers = Object.values(options.ai.providers).sort(
+    (left, right) => left.id === preferred.providerProfileId ? -1 : right.id === preferred.providerProfileId ? 1 : 0
+  );
+  return Object.freeze(
+    providers.flatMap((provider) => {
+      const credential = (0, import_agent3.resolveProviderCredential)(
+        provider.apiKeyEnv,
+        options.environment
+      );
+      const models = Object.values(provider.models).sort(
+        (left, right) => provider.id !== preferred.providerProfileId ? 0 : left.id === preferred.modelProfileId ? -1 : right.id === preferred.modelProfileId ? 1 : 0
+      );
+      return models.map(
+        (model) => (0, import_agent3.createConfiguredKeyAskExecutor)({
+          provider,
+          model,
+          credential,
+          limits: options.ai.execution.limits,
+          ...options.fetch === void 0 ? {} : { fetch: options.fetch }
+        })
+      );
+    })
+  );
+}
+
+// src/contextual-ask/executors.ts
+function composeContextualAskExecutors(options) {
+  return Object.freeze(
+    options.defaultExecutor?.kind === "managed-codex" ? [options.managedCodex, ...options.configuredKey] : [...options.configuredKey, options.managedCodex]
+  );
+}
+
+// src/workspace/activity-coordinator.ts
+function createWorkspaceActivityCoordinator() {
+  let active;
+  return Object.freeze({
+    acquire(kind) {
+      if (active !== void 0) return void 0;
+      active = kind;
+      let released = false;
+      return Object.freeze({
+        release() {
+          if (released) return;
+          released = true;
+          if (active === kind) active = void 0;
+        }
+      });
+    },
+    current() {
+      return active;
+    }
+  });
+}
+
+// src/server/middleware.ts
+var import_shared23 = require("@spotpatch/shared");
+
+// src/contextual-ask/http.ts
+var import_shared12 = require("@spotpatch/shared");
+var STATUS_BY_ERROR = Object.freeze({
+  ASK_DISABLED: 404,
+  ASK_SELECTION_REQUIRED: 422,
+  ASK_SELECTION_STALE: 409,
+  ASK_QUESTION_INVALID: 422,
+  ASK_EXECUTOR_UNAVAILABLE: 503,
+  ASK_TIMEOUT: 504,
+  ASK_CONSENT_REQUIRED: 403,
+  ASK_BUSY: 409,
+  ASK_IDEMPOTENCY_CONFLICT: 409,
+  ASK_SOURCE_SCOPE_DENIED: 403,
+  ASK_LIMIT_EXCEEDED: 413,
+  ASK_ANSWER_INVALID: 502,
+  ASK_WRITE_ATTEMPTED: 403,
+  ASK_CANCELLED: 409,
+  ASK_RESULT_EXPIRED: 410,
+  ASK_PROTOCOL_INCOMPATIBLE: 400
+});
+var PUBLIC_MESSAGES = Object.freeze({
+  ASK_DISABLED: "Contextual Ask is not enabled.",
+  ASK_SELECTION_REQUIRED: "Select at least one source-backed element.",
+  ASK_SELECTION_STALE: "The selected source is stale.",
+  ASK_QUESTION_INVALID: "The question is invalid.",
+  ASK_EXECUTOR_UNAVAILABLE: "The selected Ask executor is unavailable.",
+  ASK_TIMEOUT: "The Ask executor did not answer before the deadline.",
+  ASK_CONSENT_REQUIRED: "Provider data consent is required.",
+  ASK_BUSY: "Another workspace task is active.",
+  ASK_IDEMPOTENCY_CONFLICT: "The request ID was reused with different content.",
+  ASK_SOURCE_SCOPE_DENIED: "The requested source scope was denied.",
+  ASK_LIMIT_EXCEEDED: "The Ask request exceeded a safety limit.",
+  ASK_ANSWER_INVALID: "The executor returned an invalid answer.",
+  ASK_WRITE_ATTEMPTED: "Ask executors cannot write project files.",
+  ASK_CANCELLED: "The Ask job was cancelled.",
+  ASK_RESULT_EXPIRED: "The Ask result has expired.",
+  ASK_PROTOCOL_INCOMPATIBLE: "The Ask protocol request is incompatible."
+});
+function writeJson2(response, status, data) {
+  response.statusCode = status;
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Content-Type", "application/json; charset=utf-8");
+  response.end(JSON.stringify({ ok: true, data }));
+}
+function writeError(response, error, logger) {
+  const normalized = error instanceof ContextualAskError ? error : new ContextualAskError("ASK_EXECUTOR_UNAVAILABLE", { cause: error });
+  if (normalized.code === "ASK_EXECUTOR_UNAVAILABLE" && error !== normalized) {
+    logger?.warn("[spotpatch:ask] Internal contextual Ask request failure.");
+  }
+  response.statusCode = STATUS_BY_ERROR[normalized.code];
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Content-Type", "application/json; charset=utf-8");
+  response.end(
+    JSON.stringify({
+      ok: false,
+      error: {
+        code: normalized.code,
+        message: PUBLIC_MESSAGES[normalized.code]
+      }
+    })
+  );
+}
+function matchContextualAskPath(pathname) {
+  if (pathname === import_shared12.SPOTPATCH_ENDPOINTS.askCapability) {
+    return Object.freeze({ kind: "capability" });
+  }
+  if (pathname === import_shared12.SPOTPATCH_ENDPOINTS.askJobs) {
+    return Object.freeze({ kind: "create" });
+  }
+  const prefix = `${import_shared12.SPOTPATCH_ENDPOINTS.askJobs}/`;
+  if (!pathname.startsWith(prefix)) return void 0;
+  const segments = pathname.slice(prefix.length).split("/");
+  if (segments.length !== 2) return void 0;
+  let jobId;
+  try {
+    jobId = decodeURIComponent(segments[0] ?? "");
+  } catch {
+    return void 0;
+  }
+  const action = segments[1];
+  if (!/^[A-Za-z0-9_-]{1,128}$/u.test(jobId) || action !== "events" && action !== "result" && action !== "cancel") {
+    return void 0;
+  }
+  return Object.freeze({ kind: "job", action, jobId });
+}
+function parseAfterSequence(request) {
+  let url;
+  try {
+    url = new URL(request.url ?? "/", "http://spotpatch.invalid");
+  } catch {
+    throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE");
+  }
+  if ([...url.searchParams.keys()].some((key) => key !== "afterSequence")) {
+    throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE");
+  }
+  const raw = url.searchParams.get("afterSequence");
+  if (raw === null) return 0;
+  if (!/^\d+$/u.test(raw)) throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE");
+  const parsed = import_shared12.askJobEventsRequestSchema.safeParse({ afterSequence: Number(raw) });
+  if (!parsed.success || !Number.isSafeInteger(parsed.data.afterSequence)) {
+    throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE");
+  }
+  return parsed.data.afterSequence ?? 0;
+}
+function streamEvents(request, response, manager, jobId) {
+  const afterSequence = parseAfterSequence(request);
+  response.statusCode = 200;
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Content-Type", "application/x-ndjson; charset=utf-8");
+  response.setHeader("X-Content-Type-Options", "nosniff");
+  let unsubscribe = () => void 0;
+  const heartbeat = setInterval(
+    () => response.write("\n"),
+    import_shared12.CONTEXTUAL_ASK_LIMITS.eventHeartbeatMs
+  );
+  heartbeat.unref();
+  const cleanup = () => {
+    clearInterval(heartbeat);
+    unsubscribe();
+  };
+  unsubscribe = manager.subscribe(jobId, (event) => {
+    response.write(`${JSON.stringify(event)}
+`);
+    if (["answered", "cancelled", "failed"].includes(event.status)) {
+      cleanup();
+      response.end();
+    }
+  });
+  const replay = manager.events(jobId, afterSequence);
+  for (const event of replay) response.write(`${JSON.stringify(event)}
+`);
+  const latest = replay.at(-1);
+  const currentStatus = latest?.status ?? manager.snapshot(jobId).status;
+  if (["answered", "cancelled", "failed"].includes(currentStatus)) {
+    cleanup();
+    response.end();
+    return;
+  }
+  request.once("close", cleanup);
+  response.once("close", cleanup);
+}
+function hasEmptySelection(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const envelope = value.envelope;
+  if (typeof envelope !== "object" || envelope === null) return false;
+  const selection = envelope.selection;
+  if (typeof selection !== "object" || selection === null) return false;
+  return Array.isArray(selection.targets) && selection.targets.length === 0;
+}
+function lacksProviderDataConsent(value) {
+  return typeof value === "object" && value !== null && value.providerDataConsent !== true;
+}
+async function handleContextualAskRequest(request, response, route, manager, logger) {
+  try {
+    if (manager === void 0) throw new ContextualAskError("ASK_DISABLED");
+    if (route.kind === "capability") {
+      if (request.method !== "GET")
+        throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE");
+      writeJson2(
+        response,
+        200,
+        await manager.capability(
+          AbortSignal.timeout(import_shared12.CONTEXTUAL_ASK_LIMITS.capabilityTimeoutMs)
+        )
+      );
+      return;
+    }
+    if (route.kind === "create") {
+      if (request.method !== "POST")
+        throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE");
+      const raw = await readJsonRequestBody(
+        request,
+        import_shared12.CONTEXTUAL_ASK_LIMITS.maximumRequestBodyBytes
+      ).catch((error) => {
+        throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE", { cause: error });
+      });
+      const parsed = import_shared12.askJobCreateRequestSchema.safeParse(raw);
+      if (!parsed.success) {
+        throw new ContextualAskError(
+          hasEmptySelection(raw) ? "ASK_SELECTION_REQUIRED" : lacksProviderDataConsent(raw) ? "ASK_CONSENT_REQUIRED" : "ASK_PROTOCOL_INCOMPATIBLE"
+        );
+      }
+      writeJson2(response, 202, await manager.create(parsed.data));
+      return;
+    }
+    if (route.action === "events") {
+      if (request.method !== "GET")
+        throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE");
+      streamEvents(request, response, manager, route.jobId);
+      return;
+    }
+    if (route.action === "result") {
+      if (request.method !== "GET")
+        throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE");
+      writeJson2(response, 200, await manager.result(route.jobId));
+      return;
+    }
+    if (request.method !== "POST")
+      throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE");
+    const action = import_shared12.askJobActionRequestSchema.safeParse(
+      await readJsonRequestBody(request).catch((error) => {
+        throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE", { cause: error });
+      })
+    );
+    if (!action.success) throw new ContextualAskError("ASK_PROTOCOL_INCOMPATIBLE");
+    writeJson2(response, 200, manager.cancel(route.jobId));
+  } catch (error) {
+    writeError(response, error, logger);
+  }
+}
+
+// src/external-handoff/browser-http.ts
+var import_shared16 = require("@spotpatch/shared");
+
+// src/server/annotation-authorizer.ts
+var import_promises7 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
+var import_shared15 = require("@spotpatch/shared");
+
+// src/server/source-context.ts
+var import_promises6 = require("fs/promises");
+var import_node_path7 = __toESM(require("path"), 1);
+var import_shared14 = require("@spotpatch/shared");
+
+// src/server/extract-code-context.ts
+var import_oxc_parser2 = require("oxc-parser");
+function isComponentName(name) {
+  return /^[A-Z]/u.test(name);
+}
+function unwrapTypeExpression(expression) {
+  switch (expression.type) {
+    case "TSAsExpression":
+    case "TSSatisfiesExpression":
+    case "TSTypeAssertion":
+    case "TSNonNullExpression":
+    case "TSInstantiationExpression":
+      return unwrapTypeExpression(expression.expression);
+    default:
+      return expression;
+  }
+}
+function calleeName(expression) {
+  const unwrapped = unwrapTypeExpression(expression);
+  if (unwrapped.type === "Identifier") {
+    return unwrapped.name;
+  }
+  if (unwrapped.type === "MemberExpression" && !unwrapped.computed) {
+    return unwrapped.property.type === "Identifier" ? unwrapped.property.name : void 0;
+  }
+  return void 0;
+}
+function isFunctionExpression(expression) {
+  const unwrapped = unwrapTypeExpression(expression);
+  return unwrapped.type === "ArrowFunctionExpression" || unwrapped.type === "FunctionExpression";
+}
+function isSupportedComponentInitializer(expression) {
+  const unwrapped = unwrapTypeExpression(expression);
+  if (isFunctionExpression(unwrapped)) {
+    return true;
+  }
+  if (unwrapped.type !== "CallExpression") {
+    return false;
+  }
+  const name = calleeName(unwrapped.callee);
+  if (name !== "memo" && name !== "forwardRef") {
+    return false;
+  }
+  const firstArgument = unwrapped.arguments[0];
+  return firstArgument !== void 0 && firstArgument.type !== "SpreadElement" && (isFunctionExpression(firstArgument) || isSupportedComponentInitializer(firstArgument));
+}
+function variableComponent(node) {
+  if (node.id.type !== "Identifier" || !isComponentName(node.id.name) || node.init === null || !isSupportedComponentInitializer(node.init)) {
+    return void 0;
+  }
+  return Object.freeze({ start: node.start, end: node.end, name: node.id.name });
+}
+function functionComponent(node) {
+  return node.id !== null && isComponentName(node.id.name) && node.body !== null ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
+}
+function isReactComponentSuperclass(expression) {
+  if (expression === null) {
+    return false;
+  }
+  const unwrapped = unwrapTypeExpression(expression);
+  if (unwrapped.type === "Identifier") {
+    return unwrapped.name === "Component" || unwrapped.name === "PureComponent";
+  }
+  return unwrapped.type === "MemberExpression" && !unwrapped.computed && unwrapped.object.type === "Identifier" && unwrapped.object.name === "React" && (unwrapped.property.name === "Component" || unwrapped.property.name === "PureComponent");
+}
+function classComponent(node) {
+  return node.id !== null && isComponentName(node.id.name) && isReactComponentSuperclass(node.superClass) ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
+}
+function selectedOffset(source, line, column) {
+  const lines = source.split(/\r?\n/u);
+  if (line < 1 || line > lines.length) {
+    return void 0;
+  }
+  const lineStart = lines.slice(0, line - 1).reduce((total, value) => total + value.length + 1, 0);
+  const lineLength = lines[line - 1]?.length ?? 0;
+  return lineStart + Math.min(Math.max(0, column - 1), lineLength);
+}
+function findComponentSpan(options) {
+  const offset = selectedOffset(options.source, options.line, options.column);
+  if (offset === void 0) {
+    return void 0;
+  }
+  let parseResult;
+  try {
+    parseResult = (0, import_oxc_parser2.parseSync)(options.sourcePath, options.source, {
+      sourceType: "module"
+    });
+  } catch {
+    return void 0;
+  }
+  if (parseResult.errors.length > 0) {
+    return void 0;
+  }
+  const jsxNodes = [];
+  const components = [];
+  const visitor = new import_oxc_parser2.Visitor({
+    JSXElement(node) {
+      jsxNodes.push(node);
+    },
+    JSXFragment(node) {
+      jsxNodes.push(node);
+    },
+    FunctionDeclaration(node) {
+      const candidate = functionComponent(node);
+      if (candidate !== void 0) {
+        components.push(candidate);
+      }
+    },
+    VariableDeclarator(node) {
+      const candidate = variableComponent(node);
+      if (candidate !== void 0) {
+        components.push(candidate);
+      }
+    },
+    ClassDeclaration(node) {
+      const candidate = classComponent(node);
+      if (candidate !== void 0) {
+        components.push(candidate);
+      }
+    }
+  });
+  visitor.visit(parseResult.program);
+  const selectedJsx = jsxNodes.filter((node) => node.start <= offset && node.end >= offset).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
+  if (selectedJsx === void 0) {
+    return void 0;
+  }
+  return components.filter(
+    (component) => component.start <= selectedJsx.start && component.end >= selectedJsx.end
+  ).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
+}
+function lineAtOffset(source, offset) {
+  let line = 1;
+  for (let index = 0; index < offset; index += 1) {
+    if (source[index] === "\n") {
+      line += 1;
+    }
+  }
+  return line;
+}
+function componentRange(source, component) {
+  return Object.freeze({
+    startLine: lineAtOffset(source, component.start),
+    endLine: lineAtOffset(source, Math.max(component.start, component.end - 1))
+  });
+}
+function truncateSelectedLine(line, column, maxCharacters) {
+  if (line.length <= maxCharacters) {
+    return line;
+  }
+  if (maxCharacters === 1) {
+    return "\u2026";
+  }
+  const contentCharacters = maxCharacters - 2;
+  const desiredStart = Math.max(0, column - 1 - Math.floor(contentCharacters / 2));
+  const start = Math.min(desiredStart, line.length - contentCharacters);
+  const end = start + contentCharacters;
+  return `${start > 0 ? "\u2026" : ""}${line.slice(start, end)}${end < line.length ? "\u2026" : ""}`.slice(
     0,
     maxCharacters
   );
@@ -2732,9 +4090,9 @@ function extractCodeContext(options) {
 }
 
 // src/server/source-file.ts
-var import_promises4 = require("fs/promises");
-var import_node_path5 = __toESM(require("path"), 1);
-var import_shared10 = require("@spotpatch/shared");
+var import_promises5 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+var import_shared13 = require("@spotpatch/shared");
 var ALLOWED_EXTENSIONS = /* @__PURE__ */ new Set([".jsx", ".tsx"]);
 function isMissingFileError(error) {
   return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
@@ -2744,56 +4102,56 @@ async function assertInsideRoot(root, candidate) {
   let realCandidate;
   try {
     [realRoot, realCandidate] = await Promise.all([
-      (0, import_promises4.realpath)(root),
-      (0, import_promises4.realpath)(candidate)
+      (0, import_promises5.realpath)(root),
+      (0, import_promises5.realpath)(candidate)
     ]);
   } catch (error) {
     if (isMissingFileError(error)) {
-      throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.SOURCE_NOT_FOUND, void 0, {
+      throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.SOURCE_NOT_FOUND, void 0, {
         cause: error
       });
     }
     throw error;
   }
-  const relative = import_node_path5.default.relative(realRoot, realCandidate);
-  const outside = relative.startsWith(`..${import_node_path5.default.sep}`) || relative === ".." || import_node_path5.default.isAbsolute(relative);
+  const relative = import_node_path6.default.relative(realRoot, realCandidate);
+  const outside = relative.startsWith(`..${import_node_path6.default.sep}`) || relative === ".." || import_node_path6.default.isAbsolute(relative);
   if (outside) {
-    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.SOURCE_OUTSIDE_ROOT);
+    throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.SOURCE_OUTSIDE_ROOT);
   }
   return realCandidate;
 }
 async function resolveSourceFile(options) {
   const registeredPath = options.registry.resolve(options.fileId);
   if (registeredPath === void 0) {
-    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.SOURCE_NOT_FOUND);
+    throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.SOURCE_NOT_FOUND);
   }
   const sourcePath = await assertInsideRoot(options.root, registeredPath);
-  if (!ALLOWED_EXTENSIONS.has(import_node_path5.default.extname(sourcePath).toLowerCase())) {
-    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.SOURCE_NOT_FOUND);
+  if (!ALLOWED_EXTENSIONS.has(import_node_path6.default.extname(sourcePath).toLowerCase())) {
+    throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.SOURCE_NOT_FOUND);
   }
   let sourceStat;
   try {
-    sourceStat = await (0, import_promises4.stat)(sourcePath);
+    sourceStat = await (0, import_promises5.stat)(sourcePath);
   } catch (error) {
     if (isMissingFileError(error)) {
-      throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.SOURCE_NOT_FOUND, void 0, {
+      throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.SOURCE_NOT_FOUND, void 0, {
         cause: error
       });
     }
     throw error;
   }
   if (!sourceStat.isFile()) {
-    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.SOURCE_NOT_FOUND);
+    throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.SOURCE_NOT_FOUND);
   }
   if (sourceStat.size > MAX_SOURCE_FILE_BYTES) {
-    throw new import_shared10.SpotPatchError(import_shared10.ERROR_CODES.SOURCE_TOO_LARGE);
+    throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.SOURCE_TOO_LARGE);
   }
   return sourcePath;
 }
 
 // src/server/source-context.ts
 function toDisplayPath(root, sourcePath) {
-  return import_node_path6.default.relative(root, sourcePath).split(import_node_path6.default.sep).join("/");
+  return import_node_path7.default.relative(root, sourcePath).split(import_node_path7.default.sep).join("/");
 }
 async function readSourceContext(options) {
   const sourcePath = await resolveSourceFile({
@@ -2803,10 +4161,10 @@ async function readSourceContext(options) {
   });
   let source;
   try {
-    source = await (0, import_promises5.readFile)(sourcePath, "utf8");
+    source = await (0, import_promises6.readFile)(sourcePath, "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")) {
-      throw new import_shared11.SpotPatchError(import_shared11.ERROR_CODES.SOURCE_NOT_FOUND, void 0, {
+      throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.SOURCE_NOT_FOUND, void 0, {
         cause: error
       });
     }
@@ -2814,13 +4172,13 @@ async function readSourceContext(options) {
   }
   const lines = source.split(/\r?\n/);
   if (options.request.line > lines.length) {
-    throw new import_shared11.SpotPatchError(import_shared11.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.INVALID_REQUEST);
   }
-  const extension = import_node_path6.default.extname(sourcePath).toLowerCase();
+  const extension = import_node_path7.default.extname(sourcePath).toLowerCase();
   return extractCodeContext({
     source,
     sourcePath,
-    relativePath: toDisplayPath(await (0, import_promises5.realpath)(options.root), sourcePath),
+    relativePath: toDisplayPath(await (0, import_promises6.realpath)(options.root), sourcePath),
     language: extension === ".tsx" ? "tsx" : "jsx",
     line: options.request.line,
     column: options.request.column,
@@ -2832,9 +4190,9 @@ async function readSourceContext(options) {
 // src/server/annotation-authorizer.ts
 function sanitizePageContext(page) {
   return Object.freeze({
-    url: (0, import_shared12.sanitizeUrl)(page.url, page.url),
-    pathname: (0, import_shared12.redactSensitiveText)(page.pathname),
-    title: (0, import_shared12.redactSensitiveText)(page.title),
+    url: (0, import_shared15.sanitizeUrl)(page.url, page.url),
+    pathname: (0, import_shared15.redactSensitiveText)(page.pathname),
+    title: (0, import_shared15.redactSensitiveText)(page.title),
     viewportWidth: page.viewportWidth,
     viewportHeight: page.viewportHeight,
     devicePixelRatio: page.devicePixelRatio
@@ -2853,18 +4211,18 @@ function compactSourceRef(source) {
 async function authorizeSourceRef(source, registry, root) {
   const markerOrigin = source.origin === "jsx-host" || source.origin === "dom-ancestor";
   if (markerOrigin && (source.fileId === void 0 || source.line === void 0 || source.column === void 0)) {
-    throw new import_shared12.SpotPatchError(import_shared12.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared15.SpotPatchError(import_shared15.ERROR_CODES.INVALID_REQUEST);
   }
   if (source.fileId === void 0) {
     if (source.origin === "none" && source.relativePath !== void 0) {
-      throw new import_shared12.SpotPatchError(import_shared12.ERROR_CODES.INVALID_REQUEST);
+      throw new import_shared15.SpotPatchError(import_shared15.ERROR_CODES.INVALID_REQUEST);
     }
     return compactSourceRef(source);
   }
   const sourcePath = await resolveSourceFile({ fileId: source.fileId, registry, root });
-  const relativePath = import_node_path7.default.relative(await (0, import_promises6.realpath)(root), sourcePath).split(import_node_path7.default.sep).join("/");
+  const relativePath = import_node_path8.default.relative(await (0, import_promises7.realpath)(root), sourcePath).split(import_node_path8.default.sep).join("/");
   if (source.relativePath !== void 0 && source.relativePath !== relativePath) {
-    throw new import_shared12.SpotPatchError(import_shared12.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared15.SpotPatchError(import_shared15.ERROR_CODES.INVALID_REQUEST);
   }
   return Object.freeze({ ...compactSourceRef(source), relativePath });
 }
@@ -2900,7 +4258,7 @@ async function authorizeTarget(target, input) {
     maxLines: input.options.budget.maxCodeLines
   });
   if (marker === void 0 && target.code !== void 0) {
-    throw new import_shared12.SpotPatchError(import_shared12.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared15.SpotPatchError(import_shared15.ERROR_CODES.INVALID_REQUEST);
   }
   const code = marker === void 0 ? void 0 : await readSourceContext({
     request: marker,
@@ -2910,7 +4268,7 @@ async function authorizeTarget(target, input) {
     maxLines: input.options.budget.maxCodeLines
   });
   if (target.code !== void 0 && target.code.relativePath !== code?.relativePath) {
-    throw new import_shared12.SpotPatchError(import_shared12.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared15.SpotPatchError(import_shared15.ERROR_CODES.INVALID_REQUEST);
   }
   return Object.freeze({
     instruction: target.instruction,
@@ -2945,11 +4303,11 @@ async function authorizeTarget(target, input) {
 async function authorizeAnnotation(input) {
   const requestedTargets = input.annotation.targets;
   if (requestedTargets.length > input.options.maxTargets) {
-    throw new import_shared12.SpotPatchError(import_shared12.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared15.SpotPatchError(import_shared15.ERROR_CODES.INVALID_REQUEST);
   }
   const identities = requestedTargets.map(targetIdentity);
   if (new Set(identities).size !== identities.length) {
-    throw new import_shared12.SpotPatchError(import_shared12.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared15.SpotPatchError(import_shared15.ERROR_CODES.INVALID_REQUEST);
   }
   const targets = Object.freeze(
     await Promise.all(requestedTargets.map((target) => authorizeTarget(target, input)))
@@ -2965,30 +4323,30 @@ async function authorizeAnnotation(input) {
 }
 
 // src/external-handoff/browser-http.ts
-function matchExternalHandoffBrowserPath(path9) {
-  if (path9 === import_shared13.SPOTPATCH_ENDPOINTS.externalHandoffCapability) return "capability";
-  if (path9 === import_shared13.SPOTPATCH_ENDPOINTS.externalHandoffPublish) return "publish";
-  if (path9 === import_shared13.SPOTPATCH_ENDPOINTS.externalHandoffStatus) return "status";
-  if (path9 === import_shared13.SPOTPATCH_ENDPOINTS.externalHandoffResolveDelivery) {
+function matchExternalHandoffBrowserPath(path10) {
+  if (path10 === import_shared16.SPOTPATCH_ENDPOINTS.externalHandoffCapability) return "capability";
+  if (path10 === import_shared16.SPOTPATCH_ENDPOINTS.externalHandoffPublish) return "publish";
+  if (path10 === import_shared16.SPOTPATCH_ENDPOINTS.externalHandoffStatus) return "status";
+  if (path10 === import_shared16.SPOTPATCH_ENDPOINTS.externalHandoffResolveDelivery) {
     return "resolve-delivery";
   }
   return void 0;
 }
 function requireService(options) {
   if (!options.options.externalAgent.enabled || options.service === void 0) {
-    throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.EXTERNAL_HANDOFF_DISABLED);
+    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.EXTERNAL_HANDOFF_DISABLED);
   }
   return options.service;
 }
 function remapAuthorizationError(error) {
-  if (error instanceof import_shared13.SpotPatchError) {
-    if (error.code === import_shared13.ERROR_CODES.SOURCE_NOT_FOUND || error.code === import_shared13.ERROR_CODES.SOURCE_OUTSIDE_ROOT || error.code === import_shared13.ERROR_CODES.SOURCE_TOO_LARGE) {
-      throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.HANDOFF_SOURCE_STALE, void 0, {
+  if (error instanceof import_shared16.SpotPatchError) {
+    if (error.code === import_shared16.ERROR_CODES.SOURCE_NOT_FOUND || error.code === import_shared16.ERROR_CODES.SOURCE_OUTSIDE_ROOT || error.code === import_shared16.ERROR_CODES.SOURCE_TOO_LARGE) {
+      throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.HANDOFF_SOURCE_STALE, void 0, {
         cause: error
       });
     }
-    if (error.code === import_shared13.ERROR_CODES.INVALID_REQUEST) {
-      throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.HANDOFF_VALIDATION_FAILED, void 0, {
+    if (error.code === import_shared16.ERROR_CODES.INVALID_REQUEST) {
+      throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.HANDOFF_VALIDATION_FAILED, void 0, {
         cause: error
       });
     }
@@ -2997,38 +4355,38 @@ function remapAuthorizationError(error) {
 }
 async function handleExternalHandoffBrowserRequest(request, response, route, options, writeSuccess) {
   if (request.method !== "POST") {
-    throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
   }
   const service = requireService(options);
   if (route === "capability") {
-    const parsed2 = import_shared13.externalHandoffCapabilityRequestSchema.safeParse(
+    const parsed2 = import_shared16.externalHandoffCapabilityRequestSchema.safeParse(
       await readJsonRequestBody(request)
     );
-    if (!parsed2.success) throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.INVALID_REQUEST);
+    if (!parsed2.success) throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
     writeSuccess(response, 200, service.capability());
     return;
   }
   if (route === "status") {
-    const parsed2 = import_shared13.externalHandoffStatusRequestSchema.safeParse(
+    const parsed2 = import_shared16.externalHandoffStatusRequestSchema.safeParse(
       await readJsonRequestBody(request)
     );
-    if (!parsed2.success) throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.INVALID_REQUEST);
+    if (!parsed2.success) throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
     writeSuccess(response, 200, service.status(parsed2.data.cursor));
     return;
   }
   if (route === "resolve-delivery") {
-    const parsed2 = import_shared13.externalHandoffResolveDeliveryRequestSchema.safeParse(
+    const parsed2 = import_shared16.externalHandoffResolveDeliveryRequestSchema.safeParse(
       await readJsonRequestBody(request)
     );
-    if (!parsed2.success) throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.INVALID_REQUEST);
+    if (!parsed2.success) throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
     writeSuccess(response, 200, service.resolveDelivery(parsed2.data.cursor));
     return;
   }
-  const parsed = import_shared13.externalHandoffPublishRequestSchema.safeParse(
-    await readJsonRequestBody(request, import_shared13.EXTERNAL_HANDOFF_LIMITS.maximumPublishBodyBytes)
+  const parsed = import_shared16.externalHandoffPublishRequestSchema.safeParse(
+    await readJsonRequestBody(request, import_shared16.EXTERNAL_HANDOFF_LIMITS.maximumPublishBodyBytes)
   );
   if (!parsed.success) {
-    throw new import_shared13.SpotPatchError(import_shared13.ERROR_CODES.HANDOFF_VALIDATION_FAILED);
+    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.HANDOFF_VALIDATION_FAILED);
   }
   const result = await service.publish(parsed.data, async (annotation) => {
     try {
@@ -3046,41 +4404,41 @@ async function handleExternalHandoffBrowserRequest(request, response, route, opt
 }
 
 // src/external-agent/browser-http.ts
-var import_shared14 = require("@spotpatch/shared");
-function matchExternalAgentBrowserPath(path9) {
-  if (path9 === import_shared14.SPOTPATCH_ENDPOINTS.externalAgentControlStatus) return "status";
-  if (path9 === import_shared14.SPOTPATCH_ENDPOINTS.externalAgentControlConnect) return "connect";
-  if (path9 === import_shared14.SPOTPATCH_ENDPOINTS.externalAgentControlDisconnect) {
+var import_shared17 = require("@spotpatch/shared");
+function matchExternalAgentBrowserPath(path10) {
+  if (path10 === import_shared17.SPOTPATCH_ENDPOINTS.externalAgentControlStatus) return "status";
+  if (path10 === import_shared17.SPOTPATCH_ENDPOINTS.externalAgentControlConnect) return "connect";
+  if (path10 === import_shared17.SPOTPATCH_ENDPOINTS.externalAgentControlDisconnect) {
     return "disconnect";
   }
-  if (path9 === import_shared14.SPOTPATCH_ENDPOINTS.externalAgentControlCancel) return "cancel";
-  if (path9 === import_shared14.SPOTPATCH_ENDPOINTS.externalAgentEvents) return "events";
-  if (path9 === import_shared14.SPOTPATCH_ENDPOINTS.externalAgentResult) return "result";
+  if (path10 === import_shared17.SPOTPATCH_ENDPOINTS.externalAgentControlCancel) return "cancel";
+  if (path10 === import_shared17.SPOTPATCH_ENDPOINTS.externalAgentEvents) return "events";
+  if (path10 === import_shared17.SPOTPATCH_ENDPOINTS.externalAgentResult) return "result";
   return void 0;
 }
 function writeEvent(response, event) {
-  response.write(`${JSON.stringify(import_shared14.externalAgentEventSchema.parse(event))}
+  response.write(`${JSON.stringify(import_shared17.externalAgentEventSchema.parse(event))}
 `);
 }
 function createExternalAgentBrowserController(port) {
   const streams = /* @__PURE__ */ new Set();
   let disposed = false;
   const handleEvents = async (request, response) => {
-    const parsed = import_shared14.externalAgentEventsRequestSchema.safeParse(
+    const parsed = import_shared17.externalAgentEventsRequestSchema.safeParse(
       await readJsonRequestBody(request)
     );
     if (!parsed.success) {
-      throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.INVALID_REQUEST);
+      throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INVALID_REQUEST);
     }
-    if (disposed || streams.size >= import_shared14.EXTERNAL_AGENT_CONTROL_LIMITS.maximumEventSubscribers) {
-      throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.BRIDGE_BUSY);
+    if (disposed || streams.size >= import_shared17.EXTERNAL_AGENT_CONTROL_LIMITS.maximumEventSubscribers) {
+      throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.BRIDGE_BUSY);
     }
     response.statusCode = 200;
     response.setHeader("Cache-Control", "no-store");
     response.setHeader("Content-Type", "application/x-ndjson; charset=utf-8");
     response.setHeader("X-Content-Type-Options", "nosniff");
     streams.add(response);
-    const initial = import_shared14.externalAgentControlStatusSchema.parse(port.getStatus());
+    const initial = import_shared17.externalAgentControlStatusSchema.parse(port.getStatus());
     writeEvent(response, { type: "status", data: initial });
     const unsubscribe = port.subscribe((status) => {
       if (!response.destroyed && status.sequence > (parsed.data.afterSequence ?? -1)) {
@@ -3096,7 +4454,7 @@ function createExternalAgentBrowserController(port) {
           emittedAt: (/* @__PURE__ */ new Date()).toISOString()
         });
       }
-    }, import_shared14.EXTERNAL_AGENT_CONTROL_LIMITS.eventHeartbeatMs);
+    }, import_shared17.EXTERNAL_AGENT_CONTROL_LIMITS.eventHeartbeatMs);
     heartbeat.unref();
     await new Promise((resolve) => {
       const close = () => {
@@ -3112,29 +4470,29 @@ function createExternalAgentBrowserController(port) {
   return Object.freeze({
     async handle(request, response, route, writeSuccess) {
       if (request.method !== "POST" || disposed) {
-        throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.INVALID_REQUEST);
+        throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INVALID_REQUEST);
       }
       if (route === "events") {
         await handleEvents(request, response);
         return;
       }
       if (route === "status") {
-        const parsed2 = import_shared14.externalAgentControlStatusRequestSchema.safeParse(
+        const parsed2 = import_shared17.externalAgentControlStatusRequestSchema.safeParse(
           await readJsonRequestBody(request)
         );
-        if (!parsed2.success) throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.INVALID_REQUEST);
+        if (!parsed2.success) throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INVALID_REQUEST);
         writeSuccess(
           response,
           200,
-          import_shared14.externalAgentControlStatusSchema.parse(port.getStatus())
+          import_shared17.externalAgentControlStatusSchema.parse(port.getStatus())
         );
         return;
       }
       if (route === "connect") {
-        const parsed2 = import_shared14.externalAgentControlConnectRequestSchema.safeParse(
+        const parsed2 = import_shared17.externalAgentControlConnectRequestSchema.safeParse(
           await readJsonRequestBody(request)
         );
-        if (!parsed2.success) throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.INVALID_REQUEST);
+        if (!parsed2.success) throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INVALID_REQUEST);
         const controller = new AbortController();
         response.once("close", () => {
           if (!response.writableEnded) controller.abort("browser-disconnected");
@@ -3142,45 +4500,45 @@ function createExternalAgentBrowserController(port) {
         writeSuccess(
           response,
           200,
-          import_shared14.externalAgentControlStatusSchema.parse(
+          import_shared17.externalAgentControlStatusSchema.parse(
             await port.connect(parsed2.data, controller.signal)
           )
         );
         return;
       }
       if (route === "disconnect") {
-        const parsed2 = import_shared14.externalAgentControlDisconnectRequestSchema.safeParse(
+        const parsed2 = import_shared17.externalAgentControlDisconnectRequestSchema.safeParse(
           await readJsonRequestBody(request)
         );
-        if (!parsed2.success) throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.INVALID_REQUEST);
+        if (!parsed2.success) throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INVALID_REQUEST);
         writeSuccess(
           response,
           200,
-          import_shared14.externalAgentControlStatusSchema.parse(await port.disconnect(parsed2.data))
+          import_shared17.externalAgentControlStatusSchema.parse(await port.disconnect(parsed2.data))
         );
         return;
       }
       if (route === "cancel") {
-        const parsed2 = import_shared14.externalAgentControlCancelRequestSchema.safeParse(
+        const parsed2 = import_shared17.externalAgentControlCancelRequestSchema.safeParse(
           await readJsonRequestBody(request)
         );
-        if (!parsed2.success) throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.INVALID_REQUEST);
+        if (!parsed2.success) throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INVALID_REQUEST);
         writeSuccess(
           response,
           200,
-          import_shared14.externalAgentControlStatusSchema.parse(await port.cancel(parsed2.data))
+          import_shared17.externalAgentControlStatusSchema.parse(await port.cancel(parsed2.data))
         );
         return;
       }
-      const parsed = import_shared14.externalAgentResultRequestSchema.safeParse(
+      const parsed = import_shared17.externalAgentResultRequestSchema.safeParse(
         await readJsonRequestBody(request)
       );
-      if (!parsed.success) throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.INVALID_REQUEST);
+      if (!parsed.success) throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INVALID_REQUEST);
       const result = port.getResult(parsed.data.revision);
       if (result === void 0) {
-        throw new import_shared14.SpotPatchError(import_shared14.ERROR_CODES.HANDOFF_NOT_FOUND);
+        throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.HANDOFF_NOT_FOUND);
       }
-      writeSuccess(response, 200, import_shared14.externalAgentManagedResultSchema.parse(result));
+      writeSuccess(response, 200, import_shared17.externalAgentManagedResultSchema.parse(result));
     },
     dispose() {
       if (disposed) return;
@@ -3192,10 +4550,10 @@ function createExternalAgentBrowserController(port) {
 }
 
 // src/server/agent-http.ts
-var import_shared16 = require("@spotpatch/shared");
+var import_shared19 = require("@spotpatch/shared");
 
 // src/server/agent-request.ts
-var import_shared15 = require("@spotpatch/shared");
+var import_shared18 = require("@spotpatch/shared");
 async function authorizeAgentJobRequest(input) {
   const annotation = await authorizeAnnotation({
     annotation: input.request.annotation,
@@ -3231,21 +4589,21 @@ var EVENT_STREAM_END_STATUSES = /* @__PURE__ */ new Set([
   "reverted",
   "failed"
 ]);
-function matchAgentRequestPath(path9) {
-  if (path9 === import_shared16.SPOTPATCH_ENDPOINTS.agentCapability) {
+function matchAgentRequestPath(path10) {
+  if (path10 === import_shared19.SPOTPATCH_ENDPOINTS.agentCapability) {
     return Object.freeze({ kind: "capability" });
   }
-  if (path9 === import_shared16.SPOTPATCH_ENDPOINTS.agentWorkspaceHealth) {
+  if (path10 === import_shared19.SPOTPATCH_ENDPOINTS.agentWorkspaceHealth) {
     return Object.freeze({ kind: "workspace-health" });
   }
-  if (path9 === import_shared16.SPOTPATCH_ENDPOINTS.agentJobs) {
+  if (path10 === import_shared19.SPOTPATCH_ENDPOINTS.agentJobs) {
     return Object.freeze({ kind: "create-job" });
   }
-  const prefix = `${import_shared16.SPOTPATCH_ENDPOINTS.agentJobs}/`;
-  if (!path9.startsWith(prefix)) {
+  const prefix = `${import_shared19.SPOTPATCH_ENDPOINTS.agentJobs}/`;
+  if (!path10.startsWith(prefix)) {
     return void 0;
   }
-  const segments = path9.slice(prefix.length).split("/");
+  const segments = path10.slice(prefix.length).split("/");
   const jobId = segments[0];
   const action = segments[1];
   if (segments.length !== 2 || jobId === void 0 || !AGENT_JOB_ID_PATTERN.test(jobId) || action === void 0 || !AGENT_JOB_ACTIONS.has(action)) {
@@ -3259,7 +4617,7 @@ function matchAgentRequestPath(path9) {
 }
 function requireAgentManager(options) {
   if (options.agentManager === void 0 || options.options.ai === false) {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.AI_DISABLED);
+    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.AI_DISABLED);
   }
   return options.agentManager;
 }
@@ -3312,13 +4670,13 @@ function streamAgentJobEvents(response, manager, jobId) {
 }
 async function handleCapability(request, response, options, writeSuccess) {
   if (request.method !== "POST") {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.INVALID_REQUEST);
   }
-  const parsed = import_shared16.agentCapabilityRequestSchema.safeParse(
+  const parsed = import_shared19.agentCapabilityRequestSchema.safeParse(
     await readJsonRequestBody(request)
   );
   if (!parsed.success) {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.INVALID_REQUEST);
   }
   const controller = new AbortController();
   const abort = () => {
@@ -3337,13 +4695,13 @@ async function handleCapability(request, response, options, writeSuccess) {
 }
 async function handleCreateJob(request, response, options, writeSuccess) {
   if (request.method !== "POST") {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.INVALID_REQUEST);
   }
-  const parsed = import_shared16.agentJobCreateRequestSchema.safeParse(
+  const parsed = import_shared19.agentJobCreateRequestSchema.safeParse(
     await readJsonRequestBody(request, MAX_AGENT_REQUEST_BODY_BYTES)
   );
   if (!parsed.success) {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.INVALID_REQUEST);
   }
   const authorizedRequest = await authorizeAgentJobRequest({
     request: parsed.data,
@@ -3356,13 +4714,13 @@ async function handleCreateJob(request, response, options, writeSuccess) {
 }
 async function handleWorkspaceHealth(request, response, options, writeSuccess) {
   if (request.method !== "POST") {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.INVALID_REQUEST);
   }
-  const parsed = import_shared16.agentWorkspaceHealthRequestSchema.safeParse(
+  const parsed = import_shared19.agentWorkspaceHealthRequestSchema.safeParse(
     await readJsonRequestBody(request)
   );
   if (!parsed.success) {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.INVALID_REQUEST);
   }
   const controller = new AbortController();
   const abort = () => {
@@ -3379,13 +4737,13 @@ async function handleWorkspaceHealth(request, response, options, writeSuccess) {
 async function handleJobAction(request, response, options, route, writeSuccess) {
   const manager = requireAgentManager(options);
   if (request.method !== "POST") {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.INVALID_REQUEST);
   }
-  const parsed = import_shared16.agentJobActionRequestSchema.safeParse(
+  const parsed = import_shared19.agentJobActionRequestSchema.safeParse(
     await readJsonRequestBody(request)
   );
   if (!parsed.success) {
-    throw new import_shared16.SpotPatchError(import_shared16.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.INVALID_REQUEST);
   }
   if (route.action === "events") {
     streamAgentJobEvents(response, manager, route.jobId);
@@ -3439,13 +4797,13 @@ function detectIntegratedEditor(environment) {
 function editorCommand(editor) {
   return editor === "cursor" ? "cursor" : "code";
 }
-var DEFAULT_DEPENDENCIES2 = Object.freeze({
+var DEFAULT_DEPENDENCIES3 = Object.freeze({
   environment: process.env,
   fallbackLauncher: import_launch_editor.default,
   processSpawner: (command, arguments_, options) => (0, import_node_child_process2.spawn)(command, [...arguments_], options),
   startupGraceMs: EDITOR_STARTUP_GRACE_MS
 });
-function createEditorLauncher(dependencies = DEFAULT_DEPENDENCIES2) {
+function createEditorLauncher(dependencies = DEFAULT_DEPENDENCIES3) {
   return (target, configuredEditor) => {
     const integratedEditor = detectIntegratedEditor(dependencies.environment);
     const resolvedEditor = configuredEditor === "auto" ? integratedEditor : configuredEditor;
@@ -3500,27 +4858,27 @@ function createEditorLauncher(dependencies = DEFAULT_DEPENDENCIES2) {
 var launchConfiguredEditor = createEditorLauncher();
 
 // src/server/data-flow-http.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto11 = require("crypto");
 var import_analyzer = require("@spotpatch/analyzer");
-var import_shared17 = require("@spotpatch/shared");
+var import_shared20 = require("@spotpatch/shared");
 function envelopeBytes(report) {
   return Buffer.byteLength(JSON.stringify({ ok: true, data: report }), "utf8");
 }
 function limitDataFlowReportToBytes(report, maximumBytes) {
-  const structurallyLimited = (0, import_shared17.limitDataFlowReportCollections)(report);
+  const structurallyLimited = (0, import_shared20.limitDataFlowReportCollections)(report);
   if (envelopeBytes(structurallyLimited) <= maximumBytes) {
     return structurallyLimited;
   }
-  let limited = (0, import_shared17.limitDataFlowReportCollections)(structurallyLimited, {
+  let limited = (0, import_shared20.limitDataFlowReportCollections)(structurallyLimited, {
     forceTruncation: true,
     maximumDependencies: 0,
     truncatedBy: "bytes"
   });
   if (envelopeBytes(limited) > maximumBytes) {
-    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INTERNAL_ERROR);
+    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INTERNAL_ERROR);
   }
   for (let maximumDependencies = 1; maximumDependencies <= structurallyLimited.dependencies.length; maximumDependencies += 1) {
-    const candidate = (0, import_shared17.limitDataFlowReportCollections)(structurallyLimited, {
+    const candidate = (0, import_shared20.limitDataFlowReportCollections)(structurallyLimited, {
       forceTruncation: true,
       maximumDependencies,
       truncatedBy: "bytes"
@@ -3546,7 +4904,7 @@ async function analyzeTarget(request, analyzer, options) {
         request.componentSourceId
       );
       if (anchor?.sourceVersion !== request.sourceVersion) {
-        throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.DATA_FLOW_SOURCE_STALE);
+        throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.DATA_FLOW_SOURCE_STALE);
       }
       return anchor;
     }
@@ -3563,7 +4921,7 @@ async function analyzeTarget(request, analyzer, options) {
     column: resolvedRequest.column
   });
   if (resolvedRequest.sourceVersion !== void 0 && resolvedRequest.sourceVersion !== report.component.source.sourceVersion) {
-    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.DATA_FLOW_SOURCE_STALE);
+    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.DATA_FLOW_SOURCE_STALE);
   }
   return limitDataFlowReportToBytes(
     report,
@@ -3572,31 +4930,31 @@ async function analyzeTarget(request, analyzer, options) {
 }
 function requireAnalyzer(analyzer) {
   if (analyzer === void 0) {
-    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.DATA_FLOW_DISABLED);
+    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.DATA_FLOW_DISABLED);
   }
   return analyzer;
 }
 async function handleComponentDataFlowReport(request, analyzer, options) {
-  const parsed = import_shared17.dataFlowComponentReportRequestSchema.safeParse(
+  const parsed = import_shared20.dataFlowComponentReportRequestSchema.safeParse(
     await readJsonRequestBody(
       request,
       options.options.dataFlow.limits.protocolRequestMaxBytes
     )
   );
   if (!parsed.success) {
-    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INVALID_REQUEST);
   }
   return analyzeTarget(parsed.data, requireAnalyzer(analyzer), options);
 }
 async function handlePageDataFlowReport(request, analyzer, options) {
-  const parsed = import_shared17.dataFlowPageReportRequestSchema.safeParse(
+  const parsed = import_shared20.dataFlowPageReportRequestSchema.safeParse(
     await readJsonRequestBody(
       request,
       options.options.dataFlow.limits.protocolRequestMaxBytes
     )
   );
   if (!parsed.success) {
-    throw new import_shared17.SpotPatchError(import_shared17.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INVALID_REQUEST);
   }
   const activeAnalyzer = requireAnalyzer(analyzer);
   const componentReports = await Promise.all(
@@ -3620,10 +4978,10 @@ async function handlePageDataFlowReport(request, analyzer, options) {
   const analyzedVersions = new Set(
     componentReports.flatMap((report2) => report2.baseline.analyzedSourceVersions)
   );
-  const reportId = `page_${(0, import_node_crypto9.createHash)("sha256").update(componentReports.map((report2) => report2.reportId).join("\0")).digest("base64url").slice(0, 22)}`;
+  const reportId = `page_${(0, import_node_crypto11.createHash)("sha256").update(componentReports.map((report2) => report2.reportId).join("\0")).digest("base64url").slice(0, 22)}`;
   const complete = componentReports.every((report2) => report2.completeness.complete);
   const report = Object.freeze({
-    schemaVersion: import_shared17.DATA_FLOW_SCHEMA_VERSION,
+    schemaVersion: import_shared20.DATA_FLOW_SCHEMA_VERSION,
     reportId,
     baseline: Object.freeze({
       registryEpoch: options.session.id,
@@ -3667,9 +5025,9 @@ async function handlePageDataFlowReport(request, analyzer, options) {
 }
 
 // src/server/request-security.ts
-var import_node_crypto10 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var import_node_net = require("net");
-var import_shared18 = require("@spotpatch/shared");
+var import_shared21 = require("@spotpatch/shared");
 function getSingleHeader(request, name) {
   const value = request.headers[name.toLowerCase()];
   return Array.isArray(value) ? value[0] : value;
@@ -3680,7 +5038,7 @@ function tokensMatch2(actual, expected) {
   }
   const actualBytes = Buffer.from(actual);
   const expectedBytes = Buffer.from(expected);
-  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto10.timingSafeEqual)(actualBytes, expectedBytes);
+  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto12.timingSafeEqual)(actualBytes, expectedBytes);
 }
 function isLoopbackHostname(hostname) {
   const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
@@ -3713,33 +5071,42 @@ function parseOrigin(value) {
     return void 0;
   }
 }
+function isSameOriginBrowserGet(request) {
+  return request.method === "GET" && getSingleHeader(request, "sec-fetch-site")?.toLowerCase() === "same-origin" && getSingleHeader(request, "sec-fetch-mode")?.toLowerCase() === "cors" && getSingleHeader(request, "sec-fetch-dest")?.toLowerCase() === "empty";
+}
 function assertRequestAuthorized(request, options) {
-  const actualToken = getSingleHeader(request, import_shared18.SPOTPATCH_TOKEN_HEADER);
+  const actualToken = getSingleHeader(request, import_shared21.SPOTPATCH_TOKEN_HEADER);
   if (!tokensMatch2(actualToken, options.sessionToken)) {
-    throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.INVALID_TOKEN);
+    throw new import_shared21.SpotPatchError(import_shared21.ERROR_CODES.INVALID_TOKEN);
   }
   const hostHeader = getSingleHeader(request, "host");
   const originHeader = getSingleHeader(request, "origin");
   const host = hostHeader === void 0 ? void 0 : parseHost(hostHeader);
   const origin = originHeader === void 0 ? void 0 : parseOrigin(originHeader);
-  if (host === void 0 || origin === void 0) {
-    throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+  if (host === void 0) {
+    throw new import_shared21.SpotPatchError(import_shared21.ERROR_CODES.ORIGIN_NOT_ALLOWED);
   }
   const hostIsLoopback = isLoopbackHostname(host.hostname);
+  if (origin === void 0) {
+    if (!isSameOriginBrowserGet(request) || !options.allowLan && !hostIsLoopback) {
+      throw new import_shared21.SpotPatchError(import_shared21.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+    }
+    return;
+  }
   const originIsLoopback = isLoopbackHostname(origin.hostname);
   if (!options.allowLan) {
     if (!hostIsLoopback || !originIsLoopback) {
-      throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+      throw new import_shared21.SpotPatchError(import_shared21.ERROR_CODES.ORIGIN_NOT_ALLOWED);
     }
     return;
   }
   if (!originIsLoopback && origin.host.toLowerCase() !== host.host.toLowerCase()) {
-    throw new import_shared18.SpotPatchError(import_shared18.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+    throw new import_shared21.SpotPatchError(import_shared21.ERROR_CODES.ORIGIN_NOT_ALLOWED);
   }
 }
 
 // src/server/runtime-bootstrap.ts
-var import_shared19 = require("@spotpatch/shared");
+var import_shared22 = require("@spotpatch/shared");
 function getSingleHeader2(request, name) {
   const value = request.headers[name.toLowerCase()];
   return Array.isArray(value) ? value[0] : value;
@@ -3754,7 +5121,7 @@ function resolveRuntimeBootstrapOptions(options) {
   if (expectedOrigin.origin !== options.expectedOrigin || expectedOrigin.protocol !== "http:" || !isLoopbackHostname(expectedOrigin.hostname)) {
     throw new TypeError("The SpotPatch bootstrap origin must be a loopback origin.");
   }
-  const parsedConfig = import_shared19.runtimeConfigSchema.safeParse(options.runtimeConfig);
+  const parsedConfig = import_shared22.runtimeConfigSchema.safeParse(options.runtimeConfig);
   if (!parsedConfig.success) {
     throw new TypeError("The SpotPatch Runtime configuration is invalid.");
   }
@@ -3766,7 +5133,7 @@ function resolveRuntimeBootstrapOptions(options) {
 function assertRuntimeBootstrapRequest(request, expectedOrigin) {
   const contentType = getSingleHeader2(request, "content-type")?.split(";", 1)[0]?.trim().toLowerCase();
   if (request.method !== "POST" || contentType !== "application/json") {
-    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared22.SpotPatchError(import_shared22.ERROR_CODES.INVALID_REQUEST);
   }
   const host = getSingleHeader2(request, "host");
   let hostIsLoopback = false;
@@ -3778,152 +5145,152 @@ function assertRuntimeBootstrapRequest(request, expectedOrigin) {
     }
   }
   if (!hostIsLoopback || getSingleHeader2(request, "origin") !== expectedOrigin || getSingleHeader2(request, "sec-fetch-site") !== "same-origin") {
-    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.ORIGIN_NOT_ALLOWED);
+    throw new import_shared22.SpotPatchError(import_shared22.ERROR_CODES.ORIGIN_NOT_ALLOWED);
   }
 }
 async function readRuntimeBootstrap(request, options) {
   assertRuntimeBootstrapRequest(request, options.expectedOrigin);
-  const parsedBody = import_shared19.runtimeBootstrapRequestSchema.safeParse(
+  const parsedBody = import_shared22.runtimeBootstrapRequestSchema.safeParse(
     await readJsonRequestBody(request)
   );
   if (!parsedBody.success) {
-    throw new import_shared19.SpotPatchError(import_shared19.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared22.SpotPatchError(import_shared22.ERROR_CODES.INVALID_REQUEST);
   }
   return options.runtimeConfig;
 }
 
 // src/server/middleware.ts
-var STATUS_BY_ERROR = Object.freeze({
-  [import_shared20.ERROR_CODES.INVALID_REQUEST]: 400,
-  [import_shared20.ERROR_CODES.INVALID_TOKEN]: 401,
-  [import_shared20.ERROR_CODES.ORIGIN_NOT_ALLOWED]: 403,
-  [import_shared20.ERROR_CODES.SOURCE_NOT_FOUND]: 404,
-  [import_shared20.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: 403,
-  [import_shared20.ERROR_CODES.SOURCE_TOO_LARGE]: 413,
-  [import_shared20.ERROR_CODES.EDITOR_OPEN_FAILED]: 500,
-  [import_shared20.ERROR_CODES.DATA_FLOW_DISABLED]: 404,
-  [import_shared20.ERROR_CODES.DATA_FLOW_SOURCE_STALE]: 409,
-  [import_shared20.ERROR_CODES.DATA_FLOW_ANALYSIS_CANCELLED]: 409,
-  [import_shared20.ERROR_CODES.AI_DISABLED]: 404,
-  [import_shared20.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: 503,
-  [import_shared20.ERROR_CODES.PROVIDER_AUTH_FAILED]: 502,
-  [import_shared20.ERROR_CODES.PROVIDER_PROTOCOL_UNSUPPORTED]: 502,
-  [import_shared20.ERROR_CODES.MODEL_NOT_ALLOWED]: 400,
-  [import_shared20.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED]: 422,
-  [import_shared20.ERROR_CODES.PROVIDER_RATE_LIMITED]: 429,
-  [import_shared20.ERROR_CODES.AGENT_BUSY]: 409,
-  [import_shared20.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: 413,
-  [import_shared20.ERROR_CODES.AGENT_CANCELLED]: 409,
-  [import_shared20.ERROR_CODES.EXTERNAL_HANDOFF_DISABLED]: 404,
-  [import_shared20.ERROR_CODES.EXTERNAL_HANDOFF_UNAVAILABLE]: 503,
-  [import_shared20.ERROR_CODES.HANDOFF_VALIDATION_FAILED]: 422,
-  [import_shared20.ERROR_CODES.HANDOFF_SOURCE_STALE]: 409,
-  [import_shared20.ERROR_CODES.HANDOFF_NOT_FOUND]: 404,
-  [import_shared20.ERROR_CODES.HANDOFF_EXPIRED]: 410,
-  [import_shared20.ERROR_CODES.HANDOFF_CURSOR_INVALID]: 409,
-  [import_shared20.ERROR_CODES.HANDOFF_RESPONSE_TOO_LARGE]: 413,
-  [import_shared20.ERROR_CODES.BRIDGE_UNAUTHORIZED]: 401,
-  [import_shared20.ERROR_CODES.BRIDGE_PROTOCOL_MISMATCH]: 409,
-  [import_shared20.ERROR_CODES.BRIDGE_BUSY]: 429,
-  [import_shared20.ERROR_CODES.EXTERNAL_AGENT_BUSY]: 409,
-  [import_shared20.ERROR_CODES.ACTIVE_ADAPTER_CONFLICT]: 409,
-  [import_shared20.ERROR_CODES.ACTIVE_ADAPTER_LEASE_INVALID]: 409,
-  [import_shared20.ERROR_CODES.ACTIVE_DISPATCH_INVALID]: 409,
-  [import_shared20.ERROR_CODES.SESSION_NOT_FOUND]: 404,
-  [import_shared20.ERROR_CODES.SESSION_AMBIGUOUS]: 409,
-  [import_shared20.ERROR_CODES.SESSION_CLOSED]: 410,
-  [import_shared20.ERROR_CODES.WORKTREE_DIRTY]: 409,
-  [import_shared20.ERROR_CODES.WORKTREE_NOT_REPOSITORY]: 409,
-  [import_shared20.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS]: 409,
-  [import_shared20.ERROR_CODES.WORKTREE_CONFLICTED]: 409,
-  [import_shared20.ERROR_CODES.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: 413,
-  [import_shared20.ERROR_CODES.WORKTREE_UNTRACKED_UNSUPPORTED]: 409,
-  [import_shared20.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: 409,
-  [import_shared20.ERROR_CODES.TOOL_DENIED]: 403,
-  [import_shared20.ERROR_CODES.TOOL_INPUT_INVALID]: 422,
-  [import_shared20.ERROR_CODES.TOOL_ARGUMENTS_INVALID]: 422,
-  [import_shared20.ERROR_CODES.TOOL_CALL_ID_CONFLICT]: 422,
-  [import_shared20.ERROR_CODES.TOOL_PATH_DENIED]: 403,
-  [import_shared20.ERROR_CODES.PATCH_REJECTED]: 422,
-  [import_shared20.ERROR_CODES.VALIDATION_FAILED]: 422,
-  [import_shared20.ERROR_CODES.APPLY_CONFLICT]: 409,
-  [import_shared20.ERROR_CODES.INTERNAL_ERROR]: 500
+var STATUS_BY_ERROR2 = Object.freeze({
+  [import_shared23.ERROR_CODES.INVALID_REQUEST]: 400,
+  [import_shared23.ERROR_CODES.INVALID_TOKEN]: 401,
+  [import_shared23.ERROR_CODES.ORIGIN_NOT_ALLOWED]: 403,
+  [import_shared23.ERROR_CODES.SOURCE_NOT_FOUND]: 404,
+  [import_shared23.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: 403,
+  [import_shared23.ERROR_CODES.SOURCE_TOO_LARGE]: 413,
+  [import_shared23.ERROR_CODES.EDITOR_OPEN_FAILED]: 500,
+  [import_shared23.ERROR_CODES.DATA_FLOW_DISABLED]: 404,
+  [import_shared23.ERROR_CODES.DATA_FLOW_SOURCE_STALE]: 409,
+  [import_shared23.ERROR_CODES.DATA_FLOW_ANALYSIS_CANCELLED]: 409,
+  [import_shared23.ERROR_CODES.AI_DISABLED]: 404,
+  [import_shared23.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: 503,
+  [import_shared23.ERROR_CODES.PROVIDER_AUTH_FAILED]: 502,
+  [import_shared23.ERROR_CODES.PROVIDER_PROTOCOL_UNSUPPORTED]: 502,
+  [import_shared23.ERROR_CODES.MODEL_NOT_ALLOWED]: 400,
+  [import_shared23.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED]: 422,
+  [import_shared23.ERROR_CODES.PROVIDER_RATE_LIMITED]: 429,
+  [import_shared23.ERROR_CODES.AGENT_BUSY]: 409,
+  [import_shared23.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: 413,
+  [import_shared23.ERROR_CODES.AGENT_CANCELLED]: 409,
+  [import_shared23.ERROR_CODES.EXTERNAL_HANDOFF_DISABLED]: 404,
+  [import_shared23.ERROR_CODES.EXTERNAL_HANDOFF_UNAVAILABLE]: 503,
+  [import_shared23.ERROR_CODES.HANDOFF_VALIDATION_FAILED]: 422,
+  [import_shared23.ERROR_CODES.HANDOFF_SOURCE_STALE]: 409,
+  [import_shared23.ERROR_CODES.HANDOFF_NOT_FOUND]: 404,
+  [import_shared23.ERROR_CODES.HANDOFF_EXPIRED]: 410,
+  [import_shared23.ERROR_CODES.HANDOFF_CURSOR_INVALID]: 409,
+  [import_shared23.ERROR_CODES.HANDOFF_RESPONSE_TOO_LARGE]: 413,
+  [import_shared23.ERROR_CODES.BRIDGE_UNAUTHORIZED]: 401,
+  [import_shared23.ERROR_CODES.BRIDGE_PROTOCOL_MISMATCH]: 409,
+  [import_shared23.ERROR_CODES.BRIDGE_BUSY]: 429,
+  [import_shared23.ERROR_CODES.EXTERNAL_AGENT_BUSY]: 409,
+  [import_shared23.ERROR_CODES.ACTIVE_ADAPTER_CONFLICT]: 409,
+  [import_shared23.ERROR_CODES.ACTIVE_ADAPTER_LEASE_INVALID]: 409,
+  [import_shared23.ERROR_CODES.ACTIVE_DISPATCH_INVALID]: 409,
+  [import_shared23.ERROR_CODES.SESSION_NOT_FOUND]: 404,
+  [import_shared23.ERROR_CODES.SESSION_AMBIGUOUS]: 409,
+  [import_shared23.ERROR_CODES.SESSION_CLOSED]: 410,
+  [import_shared23.ERROR_CODES.WORKTREE_DIRTY]: 409,
+  [import_shared23.ERROR_CODES.WORKTREE_NOT_REPOSITORY]: 409,
+  [import_shared23.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS]: 409,
+  [import_shared23.ERROR_CODES.WORKTREE_CONFLICTED]: 409,
+  [import_shared23.ERROR_CODES.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: 413,
+  [import_shared23.ERROR_CODES.WORKTREE_UNTRACKED_UNSUPPORTED]: 409,
+  [import_shared23.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: 409,
+  [import_shared23.ERROR_CODES.TOOL_DENIED]: 403,
+  [import_shared23.ERROR_CODES.TOOL_INPUT_INVALID]: 422,
+  [import_shared23.ERROR_CODES.TOOL_ARGUMENTS_INVALID]: 422,
+  [import_shared23.ERROR_CODES.TOOL_CALL_ID_CONFLICT]: 422,
+  [import_shared23.ERROR_CODES.TOOL_PATH_DENIED]: 403,
+  [import_shared23.ERROR_CODES.PATCH_REJECTED]: 422,
+  [import_shared23.ERROR_CODES.VALIDATION_FAILED]: 422,
+  [import_shared23.ERROR_CODES.APPLY_CONFLICT]: 409,
+  [import_shared23.ERROR_CODES.INTERNAL_ERROR]: 500
 });
-var PUBLIC_MESSAGES = Object.freeze({
-  [import_shared20.ERROR_CODES.INVALID_REQUEST]: "The request is invalid.",
-  [import_shared20.ERROR_CODES.INVALID_TOKEN]: "The session token is invalid.",
-  [import_shared20.ERROR_CODES.ORIGIN_NOT_ALLOWED]: "The request origin is not allowed.",
-  [import_shared20.ERROR_CODES.SOURCE_NOT_FOUND]: "The source file is unavailable.",
-  [import_shared20.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: "The source file is outside the project root.",
-  [import_shared20.ERROR_CODES.SOURCE_TOO_LARGE]: "The source file exceeds the size limit.",
-  [import_shared20.ERROR_CODES.EDITOR_OPEN_FAILED]: "The editor request could not be started.",
-  [import_shared20.ERROR_CODES.DATA_FLOW_DISABLED]: "Component data-flow analysis is not enabled.",
-  [import_shared20.ERROR_CODES.DATA_FLOW_SOURCE_STALE]: "The selected source version is stale.",
-  [import_shared20.ERROR_CODES.DATA_FLOW_ANALYSIS_CANCELLED]: "The data-flow analysis was cancelled.",
-  [import_shared20.ERROR_CODES.AI_DISABLED]: "AI execution is not enabled.",
-  [import_shared20.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: "The AI provider is unavailable.",
-  [import_shared20.ERROR_CODES.PROVIDER_AUTH_FAILED]: "The AI provider rejected authentication.",
-  [import_shared20.ERROR_CODES.PROVIDER_PROTOCOL_UNSUPPORTED]: "The AI provider protocol is unsupported.",
-  [import_shared20.ERROR_CODES.MODEL_NOT_ALLOWED]: "The selected model is not allowed.",
-  [import_shared20.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED]: "The selected model cannot run SpotPatch tools.",
-  [import_shared20.ERROR_CODES.PROVIDER_RATE_LIMITED]: "The AI provider is rate limited.",
-  [import_shared20.ERROR_CODES.AGENT_BUSY]: "Another Agent job is already running.",
-  [import_shared20.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: "The Agent job exceeded a safety limit.",
-  [import_shared20.ERROR_CODES.AGENT_CANCELLED]: "The Agent job was cancelled.",
-  [import_shared20.ERROR_CODES.EXTERNAL_HANDOFF_DISABLED]: "External Agent handoff is not enabled.",
-  [import_shared20.ERROR_CODES.EXTERNAL_HANDOFF_UNAVAILABLE]: "External Agent handoff is temporarily unavailable.",
-  [import_shared20.ERROR_CODES.HANDOFF_VALIDATION_FAILED]: "The handoff content is invalid.",
-  [import_shared20.ERROR_CODES.HANDOFF_SOURCE_STALE]: "The selected source is stale.",
-  [import_shared20.ERROR_CODES.HANDOFF_NOT_FOUND]: "No current handoff is available.",
-  [import_shared20.ERROR_CODES.HANDOFF_EXPIRED]: "The handoff has expired.",
-  [import_shared20.ERROR_CODES.HANDOFF_CURSOR_INVALID]: "The handoff cursor is invalid.",
-  [import_shared20.ERROR_CODES.HANDOFF_RESPONSE_TOO_LARGE]: "The handoff exceeds the size limit.",
-  [import_shared20.ERROR_CODES.BRIDGE_UNAUTHORIZED]: "The local bridge request is unauthorized.",
-  [import_shared20.ERROR_CODES.BRIDGE_PROTOCOL_MISMATCH]: "The local bridge protocol is incompatible.",
-  [import_shared20.ERROR_CODES.BRIDGE_BUSY]: "The local bridge is busy.",
-  [import_shared20.ERROR_CODES.EXTERNAL_AGENT_BUSY]: "The connected external Agent is busy.",
-  [import_shared20.ERROR_CODES.ACTIVE_ADAPTER_CONFLICT]: "Another active Agent adapter is connected.",
-  [import_shared20.ERROR_CODES.ACTIVE_ADAPTER_LEASE_INVALID]: "The active Agent adapter lease is invalid.",
-  [import_shared20.ERROR_CODES.ACTIVE_DISPATCH_INVALID]: "The active Agent dispatch transition is invalid.",
-  [import_shared20.ERROR_CODES.SESSION_NOT_FOUND]: "No active SpotPatch session was found.",
-  [import_shared20.ERROR_CODES.SESSION_AMBIGUOUS]: "More than one SpotPatch session matches.",
-  [import_shared20.ERROR_CODES.SESSION_CLOSED]: "The SpotPatch session has closed.",
-  [import_shared20.ERROR_CODES.WORKTREE_DIRTY]: "Local changes require explicit inclusion consent.",
-  [import_shared20.ERROR_CODES.WORKTREE_NOT_REPOSITORY]: "The project root is not a Git repository.",
-  [import_shared20.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS]: "A Git operation is currently in progress.",
-  [import_shared20.ERROR_CODES.WORKTREE_CONFLICTED]: "The local workspace contains unresolved merge conflicts.",
-  [import_shared20.ERROR_CODES.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: "The local workspace exceeds the safe isolation size limit.",
-  [import_shared20.ERROR_CODES.WORKTREE_UNTRACKED_UNSUPPORTED]: "An untracked path cannot be isolated safely.",
-  [import_shared20.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: "The local workspace state cannot be isolated safely.",
-  [import_shared20.ERROR_CODES.TOOL_DENIED]: "The Agent tool request was denied.",
-  [import_shared20.ERROR_CODES.TOOL_INPUT_INVALID]: "The Agent tool input was invalid.",
-  [import_shared20.ERROR_CODES.TOOL_ARGUMENTS_INVALID]: "The Agent tool arguments are invalid.",
-  [import_shared20.ERROR_CODES.TOOL_CALL_ID_CONFLICT]: "A tool call ID conflicts within one Agent turn.",
-  [import_shared20.ERROR_CODES.TOOL_PATH_DENIED]: "The Agent tool path was denied.",
-  [import_shared20.ERROR_CODES.PATCH_REJECTED]: "The proposed patch was rejected.",
-  [import_shared20.ERROR_CODES.VALIDATION_FAILED]: "The proposed change failed validation.",
-  [import_shared20.ERROR_CODES.APPLY_CONFLICT]: "The change conflicts with the current worktree.",
-  [import_shared20.ERROR_CODES.INTERNAL_ERROR]: "The request could not be completed."
+var PUBLIC_MESSAGES2 = Object.freeze({
+  [import_shared23.ERROR_CODES.INVALID_REQUEST]: "The request is invalid.",
+  [import_shared23.ERROR_CODES.INVALID_TOKEN]: "The session token is invalid.",
+  [import_shared23.ERROR_CODES.ORIGIN_NOT_ALLOWED]: "The request origin is not allowed.",
+  [import_shared23.ERROR_CODES.SOURCE_NOT_FOUND]: "The source file is unavailable.",
+  [import_shared23.ERROR_CODES.SOURCE_OUTSIDE_ROOT]: "The source file is outside the project root.",
+  [import_shared23.ERROR_CODES.SOURCE_TOO_LARGE]: "The source file exceeds the size limit.",
+  [import_shared23.ERROR_CODES.EDITOR_OPEN_FAILED]: "The editor request could not be started.",
+  [import_shared23.ERROR_CODES.DATA_FLOW_DISABLED]: "Component data-flow analysis is not enabled.",
+  [import_shared23.ERROR_CODES.DATA_FLOW_SOURCE_STALE]: "The selected source version is stale.",
+  [import_shared23.ERROR_CODES.DATA_FLOW_ANALYSIS_CANCELLED]: "The data-flow analysis was cancelled.",
+  [import_shared23.ERROR_CODES.AI_DISABLED]: "AI execution is not enabled.",
+  [import_shared23.ERROR_CODES.PROVIDER_NOT_CONFIGURED]: "The AI provider is unavailable.",
+  [import_shared23.ERROR_CODES.PROVIDER_AUTH_FAILED]: "The AI provider rejected authentication.",
+  [import_shared23.ERROR_CODES.PROVIDER_PROTOCOL_UNSUPPORTED]: "The AI provider protocol is unsupported.",
+  [import_shared23.ERROR_CODES.MODEL_NOT_ALLOWED]: "The selected model is not allowed.",
+  [import_shared23.ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED]: "The selected model cannot run SpotPatch tools.",
+  [import_shared23.ERROR_CODES.PROVIDER_RATE_LIMITED]: "The AI provider is rate limited.",
+  [import_shared23.ERROR_CODES.AGENT_BUSY]: "Another Agent job is already running.",
+  [import_shared23.ERROR_CODES.AGENT_LIMIT_EXCEEDED]: "The Agent job exceeded a safety limit.",
+  [import_shared23.ERROR_CODES.AGENT_CANCELLED]: "The Agent job was cancelled.",
+  [import_shared23.ERROR_CODES.EXTERNAL_HANDOFF_DISABLED]: "External Agent handoff is not enabled.",
+  [import_shared23.ERROR_CODES.EXTERNAL_HANDOFF_UNAVAILABLE]: "External Agent handoff is temporarily unavailable.",
+  [import_shared23.ERROR_CODES.HANDOFF_VALIDATION_FAILED]: "The handoff content is invalid.",
+  [import_shared23.ERROR_CODES.HANDOFF_SOURCE_STALE]: "The selected source is stale.",
+  [import_shared23.ERROR_CODES.HANDOFF_NOT_FOUND]: "No current handoff is available.",
+  [import_shared23.ERROR_CODES.HANDOFF_EXPIRED]: "The handoff has expired.",
+  [import_shared23.ERROR_CODES.HANDOFF_CURSOR_INVALID]: "The handoff cursor is invalid.",
+  [import_shared23.ERROR_CODES.HANDOFF_RESPONSE_TOO_LARGE]: "The handoff exceeds the size limit.",
+  [import_shared23.ERROR_CODES.BRIDGE_UNAUTHORIZED]: "The local bridge request is unauthorized.",
+  [import_shared23.ERROR_CODES.BRIDGE_PROTOCOL_MISMATCH]: "The local bridge protocol is incompatible.",
+  [import_shared23.ERROR_CODES.BRIDGE_BUSY]: "The local bridge is busy.",
+  [import_shared23.ERROR_CODES.EXTERNAL_AGENT_BUSY]: "The connected external Agent is busy.",
+  [import_shared23.ERROR_CODES.ACTIVE_ADAPTER_CONFLICT]: "Another active Agent adapter is connected.",
+  [import_shared23.ERROR_CODES.ACTIVE_ADAPTER_LEASE_INVALID]: "The active Agent adapter lease is invalid.",
+  [import_shared23.ERROR_CODES.ACTIVE_DISPATCH_INVALID]: "The active Agent dispatch transition is invalid.",
+  [import_shared23.ERROR_CODES.SESSION_NOT_FOUND]: "No active SpotPatch session was found.",
+  [import_shared23.ERROR_CODES.SESSION_AMBIGUOUS]: "More than one SpotPatch session matches.",
+  [import_shared23.ERROR_CODES.SESSION_CLOSED]: "The SpotPatch session has closed.",
+  [import_shared23.ERROR_CODES.WORKTREE_DIRTY]: "Local changes require explicit inclusion consent.",
+  [import_shared23.ERROR_CODES.WORKTREE_NOT_REPOSITORY]: "The project root is not a Git repository.",
+  [import_shared23.ERROR_CODES.WORKTREE_OPERATION_IN_PROGRESS]: "A Git operation is currently in progress.",
+  [import_shared23.ERROR_CODES.WORKTREE_CONFLICTED]: "The local workspace contains unresolved merge conflicts.",
+  [import_shared23.ERROR_CODES.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: "The local workspace exceeds the safe isolation size limit.",
+  [import_shared23.ERROR_CODES.WORKTREE_UNTRACKED_UNSUPPORTED]: "An untracked path cannot be isolated safely.",
+  [import_shared23.ERROR_CODES.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: "The local workspace state cannot be isolated safely.",
+  [import_shared23.ERROR_CODES.TOOL_DENIED]: "The Agent tool request was denied.",
+  [import_shared23.ERROR_CODES.TOOL_INPUT_INVALID]: "The Agent tool input was invalid.",
+  [import_shared23.ERROR_CODES.TOOL_ARGUMENTS_INVALID]: "The Agent tool arguments are invalid.",
+  [import_shared23.ERROR_CODES.TOOL_CALL_ID_CONFLICT]: "A tool call ID conflicts within one Agent turn.",
+  [import_shared23.ERROR_CODES.TOOL_PATH_DENIED]: "The Agent tool path was denied.",
+  [import_shared23.ERROR_CODES.PATCH_REJECTED]: "The proposed patch was rejected.",
+  [import_shared23.ERROR_CODES.VALIDATION_FAILED]: "The proposed change failed validation.",
+  [import_shared23.ERROR_CODES.APPLY_CONFLICT]: "The change conflicts with the current worktree.",
+  [import_shared23.ERROR_CODES.INTERNAL_ERROR]: "The request could not be completed."
 });
-function writeJson2(response, status, payload) {
+function writeJson3(response, status, payload) {
   response.statusCode = status;
   response.setHeader("Cache-Control", "no-store");
   response.setHeader("Content-Type", "application/json; charset=utf-8");
   response.end(JSON.stringify(payload));
 }
 function asSpotPatchError(error) {
-  return error instanceof import_shared20.SpotPatchError ? error : new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INTERNAL_ERROR, void 0, { cause: error });
+  return error instanceof import_shared23.SpotPatchError ? error : new import_shared23.SpotPatchError(import_shared23.ERROR_CODES.INTERNAL_ERROR, void 0, { cause: error });
 }
-function writeError(response, error, logger) {
+function writeError2(response, error, logger) {
   const normalized = asSpotPatchError(error);
-  if (normalized.code === import_shared20.ERROR_CODES.INTERNAL_ERROR) {
+  if (normalized.code === import_shared23.ERROR_CODES.INTERNAL_ERROR) {
     logger?.warn("[spotpatch:server] Internal request failure.");
   }
-  writeJson2(response, STATUS_BY_ERROR[normalized.code], {
+  writeJson3(response, STATUS_BY_ERROR2[normalized.code], {
     ok: false,
     error: {
       code: normalized.code,
-      message: PUBLIC_MESSAGES[normalized.code]
+      message: PUBLIC_MESSAGES2[normalized.code]
     }
   });
 }
@@ -3935,11 +5302,11 @@ function requestPath(request) {
   }
 }
 async function handleSourceContext(request, options) {
-  const parsed = import_shared20.sourceContextRequestSchema.safeParse(
+  const parsed = import_shared23.sourceContextRequestSchema.safeParse(
     await readJsonRequestBody(request)
   );
   if (!parsed.success) {
-    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared23.SpotPatchError(import_shared23.ERROR_CODES.INVALID_REQUEST);
   }
   return readSourceContext({
     request: parsed.data,
@@ -3950,9 +5317,9 @@ async function handleSourceContext(request, options) {
   });
 }
 async function handleOpenEditor(request, options) {
-  const parsed = import_shared20.openEditorRequestSchema.safeParse(await readJsonRequestBody(request));
+  const parsed = import_shared23.openEditorRequestSchema.safeParse(await readJsonRequestBody(request));
   if (!parsed.success) {
-    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INVALID_REQUEST);
+    throw new import_shared23.SpotPatchError(import_shared23.ERROR_CODES.INVALID_REQUEST);
   }
   const body = parsed.data;
   const sourcePath = await resolveSourceFile({
@@ -3969,7 +5336,7 @@ async function handleOpenEditor(request, options) {
     options.logger?.warn(
       `[spotpatch:server] ${options.options.editor === "auto" ? "The detected editor" : options.options.editor} rejected an editor request.`
     );
-    throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.EDITOR_OPEN_FAILED, void 0, {
+    throw new import_shared23.SpotPatchError(import_shared23.ERROR_CODES.EDITOR_OPEN_FAILED, void 0, {
       cause: error
     });
   }
@@ -3979,73 +5346,84 @@ function createSpotPatchMiddleware(options) {
   const dataFlowAnalyzer = createDataFlowAnalyzer(options);
   const externalAgentController = options.externalAgentControl === void 0 ? void 0 : createExternalAgentBrowserController(options.externalAgentControl);
   const middleware = (request, response, next) => {
-    const path9 = requestPath(request);
-    const agentRoute = matchAgentRequestPath(path9);
-    const externalAgentRoute = matchExternalAgentBrowserPath(path9);
-    const externalHandoffRoute = matchExternalHandoffBrowserPath(path9);
-    if (path9 !== import_shared20.SPOTPATCH_ENDPOINTS.sourceContext && path9 !== import_shared20.SPOTPATCH_ENDPOINTS.openEditor && path9 !== import_shared20.SPOTPATCH_ENDPOINTS.dataFlowComponentReport && path9 !== import_shared20.SPOTPATCH_ENDPOINTS.dataFlowPageReport && agentRoute === void 0 && externalAgentRoute === void 0 && externalHandoffRoute === void 0 && !path9.startsWith(`${import_shared20.SPOTPATCH_API_BASE}/`)) {
+    const path10 = requestPath(request);
+    const agentRoute = matchAgentRequestPath(path10);
+    const askRoute = matchContextualAskPath(path10);
+    const externalAgentRoute = matchExternalAgentBrowserPath(path10);
+    const externalHandoffRoute = matchExternalHandoffBrowserPath(path10);
+    if (path10 !== import_shared23.SPOTPATCH_ENDPOINTS.sourceContext && path10 !== import_shared23.SPOTPATCH_ENDPOINTS.openEditor && path10 !== import_shared23.SPOTPATCH_ENDPOINTS.dataFlowComponentReport && path10 !== import_shared23.SPOTPATCH_ENDPOINTS.dataFlowPageReport && agentRoute === void 0 && askRoute === void 0 && externalAgentRoute === void 0 && externalHandoffRoute === void 0 && !path10.startsWith(`${import_shared23.SPOTPATCH_API_BASE}/`)) {
       next();
       return;
     }
     const handle = async () => {
-      if (path9 === import_shared20.SPOTPATCH_ENDPOINTS.bootstrap && bootstrap !== void 0) {
+      if (path10 === import_shared23.SPOTPATCH_ENDPOINTS.bootstrap && bootstrap !== void 0) {
         const data = await readRuntimeBootstrap(
           request,
           bootstrap
         );
-        writeJson2(response, 200, { ok: true, data });
+        writeJson3(response, 200, { ok: true, data });
         return;
       }
       assertRequestAuthorized(request, {
         allowLan: options.options.allowLan,
         sessionToken: options.session.token
       });
-      if (path9 === import_shared20.SPOTPATCH_ENDPOINTS.sourceContext) {
+      if (askRoute !== void 0) {
+        await handleContextualAskRequest(
+          request,
+          response,
+          askRoute,
+          options.contextualAskManager,
+          options.logger
+        );
+        return;
+      }
+      if (path10 === import_shared23.SPOTPATCH_ENDPOINTS.sourceContext) {
         if (request.method !== "POST") {
-          throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INVALID_REQUEST);
+          throw new import_shared23.SpotPatchError(import_shared23.ERROR_CODES.INVALID_REQUEST);
         }
         const data = await handleSourceContext(request, options);
-        writeJson2(response, 200, { ok: true, data });
+        writeJson3(response, 200, { ok: true, data });
         return;
       }
-      if (path9 === import_shared20.SPOTPATCH_ENDPOINTS.openEditor) {
+      if (path10 === import_shared23.SPOTPATCH_ENDPOINTS.openEditor) {
         if (request.method !== "POST") {
-          throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INVALID_REQUEST);
+          throw new import_shared23.SpotPatchError(import_shared23.ERROR_CODES.INVALID_REQUEST);
         }
         const data = await handleOpenEditor(request, options);
-        writeJson2(response, 200, { ok: true, data });
+        writeJson3(response, 200, { ok: true, data });
         return;
       }
-      if (path9 === import_shared20.SPOTPATCH_ENDPOINTS.dataFlowComponentReport) {
+      if (path10 === import_shared23.SPOTPATCH_ENDPOINTS.dataFlowComponentReport) {
         if (request.method !== "POST") {
-          throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INVALID_REQUEST);
+          throw new import_shared23.SpotPatchError(import_shared23.ERROR_CODES.INVALID_REQUEST);
         }
         const data = await handleComponentDataFlowReport(
           request,
           dataFlowAnalyzer,
           options
         );
-        writeJson2(response, 200, { ok: true, data });
+        writeJson3(response, 200, { ok: true, data });
         return;
       }
-      if (path9 === import_shared20.SPOTPATCH_ENDPOINTS.dataFlowPageReport) {
+      if (path10 === import_shared23.SPOTPATCH_ENDPOINTS.dataFlowPageReport) {
         if (request.method !== "POST") {
-          throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INVALID_REQUEST);
+          throw new import_shared23.SpotPatchError(import_shared23.ERROR_CODES.INVALID_REQUEST);
         }
         const data = await handlePageDataFlowReport(request, dataFlowAnalyzer, options);
-        writeJson2(response, 200, { ok: true, data });
+        writeJson3(response, 200, { ok: true, data });
         return;
       }
       if (externalAgentRoute !== void 0) {
         if (!options.options.externalAgent.enabled || externalAgentController === void 0) {
-          throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.EXTERNAL_HANDOFF_DISABLED);
+          throw new import_shared23.SpotPatchError(import_shared23.ERROR_CODES.EXTERNAL_HANDOFF_DISABLED);
         }
         await externalAgentController.handle(
           request,
           response,
           externalAgentRoute,
           (target, status, data) => {
-            writeJson2(target, status, { ok: true, data });
+            writeJson3(target, status, { ok: true, data });
           }
         );
         return;
@@ -4062,13 +5440,13 @@ function createSpotPatchMiddleware(options) {
             ...options.externalHandoffService === void 0 ? {} : { service: options.externalHandoffService }
           },
           (target, status, data) => {
-            writeJson2(target, status, { ok: true, data });
+            writeJson3(target, status, { ok: true, data });
           }
         );
         return;
       }
       if (agentRoute === void 0) {
-        throw new import_shared20.SpotPatchError(import_shared20.ERROR_CODES.INVALID_REQUEST);
+        throw new import_shared23.SpotPatchError(import_shared23.ERROR_CODES.INVALID_REQUEST);
       }
       await handleAgentRequest(
         request,
@@ -4076,12 +5454,12 @@ function createSpotPatchMiddleware(options) {
         options,
         agentRoute,
         (target, status, data) => {
-          writeJson2(target, status, { ok: true, data });
+          writeJson3(target, status, { ok: true, data });
         }
       );
     };
     void handle().catch((error) => {
-      writeError(response, error, options.logger);
+      writeError2(response, error, options.logger);
     });
   };
   return Object.assign(middleware, {
@@ -4092,13 +5470,13 @@ function createSpotPatchMiddleware(options) {
 }
 
 // src/server/source-registration.ts
-var import_node_crypto11 = require("crypto");
-var import_promises7 = require("fs/promises");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_crypto13 = require("crypto");
+var import_promises8 = require("fs/promises");
+var import_node_path9 = __toESM(require("path"), 1);
 var import_compiler = require("@spotpatch/compiler");
-var import_shared21 = require("@spotpatch/shared");
+var import_shared24 = require("@spotpatch/shared");
 var import_zod2 = require("zod");
-var REGISTRATION_BODY_LIMIT_BYTES = import_shared21.DEFAULT_DATA_FLOW_LIMITS.protocolRequestMaxBytes;
+var REGISTRATION_BODY_LIMIT_BYTES = import_shared24.DEFAULT_DATA_FLOW_LIMITS.protocolRequestMaxBytes;
 var REGISTRATION_IDENTITY_PATTERN = /^[A-Za-z0-9_-]{16,128}$/u;
 var DATA_FLOW_IDENTITY_PATTERN = /^[A-Za-z0-9_-]{1,128}$/u;
 var INTERNAL_SECRET_HEADER = "x-spotpatch-internal";
@@ -4114,7 +5492,7 @@ var registrationRequestSchema = import_zod2.z.strictObject({
         line: import_zod2.z.number().int().positive().max(1e7),
         column: import_zod2.z.number().int().positive().max(1e7)
       })
-    ).max(import_shared21.DEFAULT_DATA_FLOW_LIMITS.sourceMaxComponents)
+    ).max(import_shared24.DEFAULT_DATA_FLOW_LIMITS.sourceMaxComponents)
   }).optional()
 });
 function getSingleHeader3(request, name) {
@@ -4127,16 +5505,16 @@ function identitiesMatch(actual, expected) {
   }
   const actualBytes = Buffer.from(actual);
   const expectedBytes = Buffer.from(expected);
-  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto11.timingSafeEqual)(actualBytes, expectedBytes);
+  return actualBytes.byteLength === expectedBytes.byteLength && (0, import_node_crypto13.timingSafeEqual)(actualBytes, expectedBytes);
 }
 function isWithinRoot(root, candidate) {
-  const relative = import_node_path8.default.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${import_node_path8.default.sep}`) && relative !== ".." && !import_node_path8.default.isAbsolute(relative);
+  const relative = import_node_path9.default.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${import_node_path9.default.sep}`) && relative !== ".." && !import_node_path9.default.isAbsolute(relative);
 }
 function hasForbiddenSegment(root, candidate) {
-  return import_node_path8.default.relative(root, candidate).split(import_node_path8.default.sep).some((segment) => FORBIDDEN_SOURCE_SEGMENTS.has(segment));
+  return import_node_path9.default.relative(root, candidate).split(import_node_path9.default.sep).some((segment) => FORBIDDEN_SOURCE_SEGMENTS.has(segment));
 }
-function writeJson3(response, statusCode, payload) {
+function writeJson4(response, statusCode, payload) {
   const body = JSON.stringify(payload);
   response.statusCode = statusCode;
   response.setHeader("Cache-Control", "no-store");
@@ -4156,15 +5534,15 @@ function requestComesFromLoopbackWorker(request) {
   }
 }
 async function resolveAuthorizedSource(root, requestedPath, shouldTransform) {
-  if (!import_node_path8.default.isAbsolute(requestedPath) || requestedPath.includes("\0")) {
+  if (!import_node_path9.default.isAbsolute(requestedPath) || requestedPath.includes("\0")) {
     return void 0;
   }
   try {
-    const sourceStat = await (0, import_promises7.lstat)(requestedPath);
+    const sourceStat = await (0, import_promises8.lstat)(requestedPath);
     if (!sourceStat.isFile() || sourceStat.isSymbolicLink()) {
       return void 0;
     }
-    const resolvedPath = await (0, import_promises7.realpath)(requestedPath);
+    const resolvedPath = await (0, import_promises8.realpath)(requestedPath);
     if (!isWithinRoot(root, resolvedPath) || hasForbiddenSegment(root, resolvedPath) || !shouldTransform(resolvedPath)) {
       return void 0;
     }
@@ -4177,7 +5555,7 @@ async function createSourceRegistrationService(input) {
   if (!REGISTRATION_IDENTITY_PATTERN.test(input.internalSecret) || !REGISTRATION_IDENTITY_PATTERN.test(input.registryEpoch)) {
     throw new TypeError("The source registration identity is invalid.");
   }
-  const root = await (0, import_promises7.realpath)(input.root);
+  const root = await (0, import_promises8.realpath)(input.root);
   const sourceFilter = (0, import_compiler.createSourceFilter)(root, input.options);
   const dataFlowFilter = (0, import_compiler.createDataFlowSourceFilter)(root, input.options);
   const registrationQueues = /* @__PURE__ */ new Map();
@@ -4188,7 +5566,7 @@ async function createSourceRegistrationService(input) {
     let fileId;
     const previous = registrationQueues.get(sourcePath) ?? Promise.resolve();
     const current = previous.catch(() => void 0).then(async () => {
-      const currentSource = await (0, import_promises7.readFile)(sourcePath, "utf8");
+      const currentSource = await (0, import_promises8.readFile)(sourcePath, "utf8");
       if ((0, import_compiler.createDataFlowSourceVersion)(currentSource) !== dataFlow.sourceVersion) {
         return;
       }
@@ -4213,14 +5591,14 @@ async function createSourceRegistrationService(input) {
         getSingleHeader3(request, INTERNAL_SECRET_HEADER),
         input.internalSecret
       )) {
-        writeJson3(response, 403, { ok: false });
+        writeJson4(response, 403, { ok: false });
         return;
       }
       const parsed = registrationRequestSchema.safeParse(
         await readJsonRequestBody(request, REGISTRATION_BODY_LIMIT_BYTES)
       );
       if (!parsed.success || parsed.data.epoch !== input.registryEpoch) {
-        writeJson3(response, 400, { ok: false });
+        writeJson4(response, 400, { ok: false });
         return;
       }
       const sourcePath = await resolveAuthorizedSource(
@@ -4229,19 +5607,19 @@ async function createSourceRegistrationService(input) {
         (absolutePath) => parsed.data.dataFlow === void 0 ? sourceFilter.shouldTransform(absolutePath, "<") : dataFlowFilter.shouldTransform(absolutePath, "")
       );
       if (sourcePath === void 0) {
-        writeJson3(response, 403, { ok: false });
+        writeJson4(response, 403, { ok: false });
         return;
       }
       const fileId = await registerCurrentSource(sourcePath, parsed.data.dataFlow);
       if (fileId === void 0) {
-        writeJson3(response, 409, { ok: false });
+        writeJson4(response, 409, { ok: false });
         return;
       }
-      writeJson3(response, 200, { epoch: input.registryEpoch, fileId });
+      writeJson4(response, 200, { epoch: input.registryEpoch, fileId });
     };
     void handle().catch(() => {
       if (!response.headersSent) {
-        writeJson3(response, 400, { ok: false });
+        writeJson4(response, 400, { ok: false });
       } else {
         response.destroy();
       }
@@ -4251,11 +5629,11 @@ async function createSourceRegistrationService(input) {
 }
 
 // src/session/session.ts
-var import_node_crypto12 = require("crypto");
+var import_node_crypto14 = require("crypto");
 function createSession() {
   return Object.freeze({
-    id: (0, import_node_crypto12.randomBytes)(16).toString("base64url"),
-    token: (0, import_node_crypto12.randomBytes)(16).toString("base64url")
+    id: (0, import_node_crypto14.randomBytes)(16).toString("base64url"),
+    token: (0, import_node_crypto14.randomBytes)(16).toString("base64url")
   });
 }
 
@@ -4266,6 +5644,7 @@ var OPTION_KEYS = Object.freeze([
   "budget",
   "debug",
   "dataFlow",
+  "contextualAsk",
   "editor",
   "enabled",
   "externalAgent",
@@ -4357,6 +5736,9 @@ function serializeResolvedSpotPatchOptions(options) {
     dataFlow: options.dataFlow.enabled ? Object.freeze({
       runtime: options.dataFlow.runtime
     }) : false,
+    contextualAsk: options.contextualAsk.enabled ? Object.freeze({
+      ...options.contextualAsk.defaultExecutor === void 0 ? {} : { defaultExecutor: options.contextualAsk.defaultExecutor }
+    }) : false,
     editor: options.editor,
     enabled: options.enabled,
     externalAgent: options.externalAgent.enabled,
@@ -4409,6 +5791,33 @@ function parseDataFlow(value) {
     runtime: value.runtime
   });
 }
+function parseContextualAsk(value) {
+  if (value === false || value === true) return value;
+  if (!isRecord2(value)) {
+    throw new TypeError("The SpotPatch contextual Ask transport is invalid.");
+  }
+  const keys = Object.keys(value);
+  if (keys.length === 0) return Object.freeze({});
+  if (!hasExactKeys(value, ["defaultExecutor"]) || !isRecord2(value.defaultExecutor)) {
+    throw new TypeError("The SpotPatch contextual Ask transport is invalid.");
+  }
+  const preference = value.defaultExecutor;
+  if (preference.kind === "managed-codex" && hasExactKeys(preference, ["kind"])) {
+    return Object.freeze({
+      defaultExecutor: Object.freeze({ kind: "managed-codex" })
+    });
+  }
+  if (preference.kind === "configured-key" && hasExactKeys(preference, ["kind", "modelProfileId", "providerProfileId"]) && typeof preference.providerProfileId === "string" && typeof preference.modelProfileId === "string") {
+    return Object.freeze({
+      defaultExecutor: Object.freeze({
+        kind: "configured-key",
+        providerProfileId: preference.providerProfileId,
+        modelProfileId: preference.modelProfileId
+      })
+    });
+  }
+  throw new TypeError("The SpotPatch contextual Ask transport is invalid.");
+}
 function parseSerializedSpotPatchOptions(value) {
   if (!isRecord2(value) || !hasExactKeys(value, OPTION_KEYS)) {
     throw new TypeError("The SpotPatch options transport is invalid.");
@@ -4423,6 +5832,7 @@ function parseSerializedSpotPatchOptions(value) {
       budget: parseBudget(value.budget),
       debug: value.debug,
       dataFlow: parseDataFlow(value.dataFlow),
+      contextualAsk: parseContextualAsk(value.contextualAsk),
       editor: value.editor,
       enabled: value.enabled,
       externalAgent: value.externalAgent,
@@ -4441,10 +5851,15 @@ function parseSerializedSpotPatchOptions(value) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ContextualAskError,
   DEFAULT_EXCLUDE,
   DEFAULT_OPTIONS,
   applyIntegrationPlan,
+  captureAskReadSnapshot,
+  composeContextualAskExecutors,
   createAgentJobManager,
+  createConfiguredKeyAskExecutors,
+  createContextualAskManager,
   createExternalHandoffService,
   createIntegrationFileChange,
   createRuntimeAiConfig,
@@ -4453,9 +5868,12 @@ function parseSerializedSpotPatchOptions(value) {
   createSourceRegistrationService,
   createSourceRegistry,
   createSpotPatchMiddleware,
+  createWorkspaceActivityCoordinator,
   discoverProjectValidationCheck,
+  handleContextualAskRequest,
   integrationPathExists,
   isLoopbackHostname,
+  matchContextualAskPath,
   parseSerializedSpotPatchOptions,
   readIntegrationFile,
   readJsonRequestBody,