@threadbase-sh/streamer 1.20.0 → 1.22.0

package/dist/cli.cjs

@@ -24089,6 +24089,27 @@ var init_zod = __esm({
   }
 });
 
+// src/lifecycle/constants.ts
+function installDir() {
+  return process.env.THREADBASE_INSTALL_DIR ?? (0, import_node_path3.join)((0, import_node_os2.homedir)(), ".threadbase");
+}
+function markerPath() {
+  return (0, import_node_path3.join)(installDir(), "prod-suspended.json");
+}
+function prefsPath() {
+  return (0, import_node_path3.join)(installDir(), "dev-prefs.json");
+}
+var import_node_os2, import_node_path3, LAUNCHD_LABEL, TASK_NAME;
+var init_constants = __esm({
+  "src/lifecycle/constants.ts"() {
+    "use strict";
+    import_node_os2 = require("os");
+    import_node_path3 = require("path");
+    LAUNCHD_LABEL = "com.ronen.threadbase";
+    TASK_NAME = process.env.THREADBASE_TASK_NAME ?? "Threadbase";
+  }
+});
+
 // node_modules/pino-std-serializers/lib/err-helpers.js
 var require_err_helpers = __commonJS({
   "node_modules/pino-std-serializers/lib/err-helpers.js"(exports2, module2) {
@@ -26078,7 +26099,7 @@ var require_thread_stream = __commonJS({
     var { version: version2 } = require_package();
     var { EventEmitter: EventEmitter6 } = require("events");
     var { Worker: Worker2 } = require("worker_threads");
-    var { join: join24 } = require("path");
+    var { join: join26 } = require("path");
     var { pathToFileURL } = require("url");
     var { wait } = require_wait();
     var {
@@ -26129,7 +26150,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join24(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join26(__dirname, "lib", "worker.js");
       const worker = new Worker2(toExecute, {
         ...opts.workerOpts,
         name: opts.workerOpts?.name || "thread-stream",
@@ -26597,7 +26618,7 @@ var require_transport = __commonJS({
     var { createRequire } = require("module");
     var { existsSync: existsSync11 } = require("fs");
     var getCallers = require_caller();
-    var { join: join24, isAbsolute: isAbsolute3, sep: sep2 } = require("path");
+    var { join: join26, isAbsolute: isAbsolute3, sep: sep2 } = require("path");
     var { fileURLToPath: fileURLToPath3 } = require("url");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
@@ -26750,7 +26771,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join24(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join26(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -26768,7 +26789,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline2) {
-        target = bundlerOverrides["pino-worker"] || join24(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join26(__dirname, "worker.js");
         options.pipelines = [pipeline2.map((dest) => {
           return {
             ...dest,
@@ -26791,7 +26812,7 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join24(__dirname, "..", "file.js");
+          return join26(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
@@ -27772,7 +27793,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join24 = ",";
+            let join26 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -27786,7 +27807,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join24 = `,
+                join26 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -27794,13 +27815,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join24;
+                res += join26;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join24}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join26}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -27821,7 +27842,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join24 = `,
+              join26 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -27835,13 +27856,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join24;
+                separator = join26;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join24;
+              separator = join26;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -27882,7 +27903,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join24 = ",";
+            let join26 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -27895,7 +27916,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join24 = `,
+                join26 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -27903,13 +27924,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join24;
+                res += join26;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join24}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join26}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -27922,7 +27943,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join24 = `,
+              join26 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -27931,7 +27952,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join24;
+                separator = join26;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -27989,20 +28010,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join25 = `,
+              const join27 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join25;
+                res2 += join27;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join25}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join27}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -28018,16 +28039,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join24 = `,
+            const join26 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join24, maximumBreadth);
+              res += stringifyTypedArray(value, join26, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join24;
+              separator = join26;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -28038,13 +28059,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join24;
+                separator = join26;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join24;
+              separator = join26;
             }
             if (separator !== "") {
               res = `
@@ -124397,27 +124418,6 @@ var require_semver2 = __commonJS({
   }
 });
 
-// src/lifecycle/constants.ts
-function installDir() {
-  return process.env.THREADBASE_INSTALL_DIR ?? (0, import_node_path21.join)((0, import_node_os4.homedir)(), ".threadbase");
-}
-function markerPath() {
-  return (0, import_node_path21.join)(installDir(), "prod-suspended.json");
-}
-function prefsPath() {
-  return (0, import_node_path21.join)(installDir(), "dev-prefs.json");
-}
-var import_node_os4, import_node_path21, LAUNCHD_LABEL, TASK_NAME;
-var init_constants = __esm({
-  "src/lifecycle/constants.ts"() {
-    "use strict";
-    import_node_os4 = require("os");
-    import_node_path21 = require("path");
-    LAUNCHD_LABEL = "com.ronen.threadbase";
-    TASK_NAME = process.env.THREADBASE_TASK_NAME ?? "Threadbase";
-  }
-});
-
 // src/lifecycle/launchd.ts
 var launchd_exports = {};
 __export(launchd_exports, {
@@ -124487,8 +124487,8 @@ function darwinPlistPath() {
   return `${process.env.HOME}/Library/LaunchAgents/${resolveLoadedLabel()}.plist`;
 }
 function getLogPaths() {
-  const dir = (0, import_node_path22.join)(installDir(), "logs");
-  return { stdout: (0, import_node_path22.join)(dir, "stdout.log"), stderr: (0, import_node_path22.join)(dir, "stderr.log") };
+  const dir = (0, import_node_path24.join)(installDir(), "logs");
+  return { stdout: (0, import_node_path24.join)(dir, "stdout.log"), stderr: (0, import_node_path24.join)(dir, "stderr.log") };
 }
 function getAgentPid() {
   try {
@@ -124508,12 +124508,12 @@ function getAgentPid() {
     return null;
   }
 }
-var import_node_child_process4, import_node_path22, BREW_LAUNCHD_LABEL2;
+var import_node_child_process4, import_node_path24, BREW_LAUNCHD_LABEL2;
 var init_launchd = __esm({
   "src/lifecycle/launchd.ts"() {
     "use strict";
     import_node_child_process4 = require("child_process");
-    import_node_path22 = require("path");
+    import_node_path24 = require("path");
     init_constants();
     BREW_LAUNCHD_LABEL2 = "homebrew.mxcl.tb-streamer";
   }
@@ -124538,9 +124538,9 @@ var init_marker_schema = __esm({
 
 // src/lifecycle/marker.ts
 function readMarker() {
-  if (!(0, import_node_fs18.existsSync)(markerPath())) return null;
+  if (!(0, import_node_fs20.existsSync)(markerPath())) return null;
   try {
-    const raw2 = (0, import_node_fs18.readFileSync)(markerPath(), "utf8");
+    const raw2 = (0, import_node_fs20.readFileSync)(markerPath(), "utf8");
     const parsed = JSON.parse(raw2);
     return MarkerSchema.parse(parsed);
   } catch (err) {
@@ -124552,21 +124552,21 @@ function readMarker() {
 }
 function writeMarker(marker) {
   MarkerSchema.parse(marker);
-  (0, import_node_fs18.mkdirSync)((0, import_node_path23.dirname)(markerPath()), { recursive: true });
+  (0, import_node_fs20.mkdirSync)((0, import_node_path25.dirname)(markerPath()), { recursive: true });
   const tmp = `${markerPath()}.tmp`;
-  (0, import_node_fs18.writeFileSync)(tmp, `${JSON.stringify(marker, null, 2)}
+  (0, import_node_fs20.writeFileSync)(tmp, `${JSON.stringify(marker, null, 2)}
 `, { mode: 384 });
-  (0, import_node_fs18.renameSync)(tmp, markerPath());
+  (0, import_node_fs20.renameSync)(tmp, markerPath());
 }
 function clearMarker() {
-  if ((0, import_node_fs18.existsSync)(markerPath())) (0, import_node_fs18.rmSync)(markerPath());
+  if ((0, import_node_fs20.existsSync)(markerPath())) (0, import_node_fs20.rmSync)(markerPath());
 }
-var import_node_fs18, import_node_path23, log3;
+var import_node_fs20, import_node_path25, log3;
 var init_marker = __esm({
   "src/lifecycle/marker.ts"() {
     "use strict";
-    import_node_fs18 = require("fs");
-    import_node_path23 = require("path");
+    import_node_fs20 = require("fs");
+    import_node_path25 = require("path");
     init_logger();
     init_constants();
     init_marker_schema();
@@ -124661,9 +124661,9 @@ var init_platform = __esm({
 // src/lifecycle/prefs.ts
 function readPrefs() {
   const path2 = prefsPath();
-  if (!(0, import_node_fs20.existsSync)(path2)) return { repos: {} };
+  if (!(0, import_node_fs22.existsSync)(path2)) return { repos: {} };
   try {
-    return PrefsSchema.parse(JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8")));
+    return PrefsSchema.parse(JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8")));
   } catch (err) {
     log5.warn(`prefs at ${path2} are malformed; treating as empty`, {
       error: err instanceof Error ? err.message : String(err)
@@ -124673,11 +124673,11 @@ function readPrefs() {
 }
 function savePrefs(p2) {
   const path2 = prefsPath();
-  (0, import_node_fs20.mkdirSync)((0, import_node_path24.dirname)(path2), { recursive: true });
+  (0, import_node_fs22.mkdirSync)((0, import_node_path26.dirname)(path2), { recursive: true });
   const tmp = `${path2}.tmp`;
-  (0, import_node_fs20.writeFileSync)(tmp, `${JSON.stringify(p2, null, 2)}
+  (0, import_node_fs22.writeFileSync)(tmp, `${JSON.stringify(p2, null, 2)}
 `, { mode: 384 });
-  (0, import_node_fs20.renameSync)(tmp, path2);
+  (0, import_node_fs22.renameSync)(tmp, path2);
 }
 function writePrefForRepo(repoToplevel, choice) {
   const p2 = readPrefs();
@@ -124698,14 +124698,14 @@ function forgetRepo(repoToplevel) {
 }
 function forgetAll() {
   const path2 = prefsPath();
-  if ((0, import_node_fs20.existsSync)(path2)) (0, import_node_fs20.rmSync)(path2);
+  if ((0, import_node_fs22.existsSync)(path2)) (0, import_node_fs22.rmSync)(path2);
 }
-var import_node_fs20, import_node_path24, log5, PrefsSchema;
+var import_node_fs22, import_node_path26, log5, PrefsSchema;
 var init_prefs = __esm({
   "src/lifecycle/prefs.ts"() {
     "use strict";
-    import_node_fs20 = require("fs");
-    import_node_path24 = require("path");
+    import_node_fs22 = require("fs");
+    import_node_path26 = require("path");
     init_zod();
     init_logger();
     init_constants();
@@ -124927,7 +124927,7 @@ __export(setKey_exports, {
 async function defaultReadStdin() {
   return new Promise((resolve6, reject) => {
     const chunks = [];
-    process.stdin.on("data", (chunk) => chunks.push(chunk));
+    process.stdin.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
     process.stdin.on("end", () => resolve6(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
@@ -128384,6 +128384,23 @@ function loadUpdateConfig(opts = {}) {
   return UpdateConfigSchema.parse(parsed);
 }
 
+// src/devLog.ts
+var import_node_fs3 = require("fs");
+var import_node_path4 = require("path");
+init_constants();
+function devLogPath() {
+  return (0, import_node_path4.join)(installDir(), "logs", "dev.log");
+}
+function appendDevSessionMarker() {
+  try {
+    const path2 = devLogPath();
+    (0, import_node_fs3.mkdirSync)((0, import_node_path4.join)(installDir(), "logs"), { recursive: true });
+    (0, import_node_fs3.appendFileSync)(path2, `=== dev session started ${(/* @__PURE__ */ new Date()).toISOString()} ===
+`, "utf8");
+  } catch {
+  }
+}
+
 // src/lan-url.ts
 var import_os2 = require("os");
 function resolveServerUrl({ publicUrl, port }) {
@@ -129428,7 +129445,7 @@ var sysPath2 = __toESM(require("path"), 1);
 // node_modules/@threadbase-sh/scanner/node_modules/readdirp/esm/index.js
 var import_promises = require("fs/promises");
 var import_node_stream = require("stream");
-var import_node_path3 = require("path");
+var import_node_path5 = require("path");
 var EntryTypes = {
   FILE_TYPE: "files",
   DIR_TYPE: "directories",
@@ -129503,7 +129520,7 @@ var ReaddirpStream = class extends import_node_stream.Readable {
     this._wantsDir = type ? DIR_TYPES.has(type) : false;
     this._wantsFile = type ? FILE_TYPES.has(type) : false;
     this._wantsEverything = type === EntryTypes.EVERYTHING_TYPE;
-    this._root = (0, import_node_path3.resolve)(root);
+    this._root = (0, import_node_path5.resolve)(root);
     this._isDirent = !opts.alwaysStat;
     this._statsProp = this._isDirent ? "dirent" : "stats";
     this._rdOptions = { encoding: "utf8", withFileTypes: this._isDirent };
@@ -129574,8 +129591,8 @@ var ReaddirpStream = class extends import_node_stream.Readable {
     let entry;
     const basename9 = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = (0, import_node_path3.resolve)((0, import_node_path3.join)(path2, basename9));
-      entry = { path: (0, import_node_path3.relative)(this._root, fullPath), fullPath, basename: basename9 };
+      const fullPath = (0, import_node_path5.resolve)((0, import_node_path5.join)(path2, basename9));
+      entry = { path: (0, import_node_path5.relative)(this._root, fullPath), fullPath, basename: basename9 };
       entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err) {
       this._onError(err);
@@ -129609,7 +129626,7 @@ var ReaddirpStream = class extends import_node_stream.Readable {
         }
         if (entryRealPathStats.isDirectory()) {
           const len = entryRealPath.length;
-          if (full.startsWith(entryRealPath) && full.substr(len, 1) === import_node_path3.sep) {
+          if (full.startsWith(entryRealPath) && full.substr(len, 1) === import_node_path5.sep) {
             const recursiveError = new Error(`Circular symlink detected: "${full}" points to "${entryRealPath}"`);
             recursiveError.code = RECURSIVE_ERROR_CODE;
             return this._onError(recursiveError);
@@ -134045,7 +134062,7 @@ function readAgentConfig(env = process.env) {
 
 // src/agent/conversation-writer.ts
 var import_promises7 = require("fs/promises");
-var import_node_path4 = require("path");
+var import_node_path6 = require("path");
 function createConversationWriter(opts) {
   const { baseDir } = opts;
   return {
@@ -134053,8 +134070,8 @@ function createConversationWriter(opts) {
       if (!args.content || args.content.length === 0) {
         throw new Error("ConversationWriter: refusing to write empty assistant turn");
       }
-      const file2 = (0, import_node_path4.join)(baseDir, `${args.sessionId}.jsonl`);
-      await (0, import_promises7.mkdir)((0, import_node_path4.dirname)(file2), { recursive: true });
+      const file2 = (0, import_node_path6.join)(baseDir, `${args.sessionId}.jsonl`);
+      await (0, import_promises7.mkdir)((0, import_node_path6.dirname)(file2), { recursive: true });
       const record2 = {
         role: "assistant",
         turnId: args.turnId,
@@ -134253,8 +134270,8 @@ async function handleSendAgentInput(sessionId, body, deps) {
 }
 
 // src/agent/handle-start-agent-session.ts
-var import_node_fs3 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs4 = require("fs");
+var import_node_path7 = require("path");
 function validateBody(body) {
   if (body === null || body === void 0 || typeof body !== "object") {
     return { ok: false };
@@ -134284,8 +134301,8 @@ async function handleStartAgentSession(body, deps) {
   }
   let conversationId = parsed.conversationId;
   if (conversationId) {
-    const jsonlPath = (0, import_node_path5.join)(deps.conversationsDir, `${conversationId}.jsonl`);
-    if (!(0, import_node_fs3.existsSync)(jsonlPath)) {
+    const jsonlPath = (0, import_node_path7.join)(deps.conversationsDir, `${conversationId}.jsonl`);
+    if (!(0, import_node_fs4.existsSync)(jsonlPath)) {
       return {
         status: 404,
         body: agentErrorResponse(
@@ -136445,13 +136462,23 @@ var authMiddleware = (deps) => async (c, next) => {
 };
 
 // src/api/middleware/cors.middleware.ts
+var ALLOWED_ORIGINS = /* @__PURE__ */ new Set([
+  "http://localhost:8081",
+  "http://localhost:19006",
+  "http://localhost:3000"
+]);
 var corsMiddleware = () => async (c, next) => {
-  c.res.headers.set("Access-Control-Allow-Origin", "*");
-  c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
-  c.res.headers.set("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
-  c.res.headers.set("Access-Control-Expose-Headers", "ETag");
+  const origin = c.req.header("origin");
+  const allowedOrigin = origin && ALLOWED_ORIGINS.has(origin) ? origin : null;
+  if (allowedOrigin) {
+    c.res.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+    c.res.headers.set("Vary", "Origin");
+    c.res.headers.set("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
+    c.res.headers.set("Access-Control-Allow-Headers", "Authorization, Content-Type, If-None-Match");
+    c.res.headers.set("Access-Control-Expose-Headers", "ETag");
+  }
   if (c.req.method === "OPTIONS") {
-    return c.newResponse(null, 204);
+    return c.newResponse(null, allowedOrigin ? 204 : 403);
   }
   await next();
 };
@@ -136505,8 +136532,8 @@ var createConversationRoutes = (deps) => {
 };
 
 // src/version.ts
-var import_node_fs4 = require("fs");
-var import_node_path6 = require("path");
+var import_node_fs5 = require("fs");
+var import_node_path8 = require("path");
 var cached2;
 function getVersion() {
   if (cached2 !== void 0) return cached2;
@@ -136515,22 +136542,22 @@ function getVersion() {
 }
 function resolveVersion() {
   const scriptPath = process.argv[1] ?? "";
-  const here = scriptPath ? (0, import_node_path6.dirname)(scriptPath) : process.cwd();
+  const here = scriptPath ? (0, import_node_path8.dirname)(scriptPath) : process.cwd();
   let realHere = here;
   try {
-    realHere = (0, import_node_path6.dirname)((0, import_node_fs4.realpathSync)(scriptPath));
+    realHere = (0, import_node_path8.dirname)((0, import_node_fs5.realpathSync)(scriptPath));
   } catch {
   }
-  const searchDirs = realHere === here ? [here, (0, import_node_path6.join)(here, "..")] : [here, (0, import_node_path6.join)(here, ".."), realHere, (0, import_node_path6.join)(realHere, "..")];
+  const searchDirs = realHere === here ? [here, (0, import_node_path8.join)(here, "..")] : [here, (0, import_node_path8.join)(here, ".."), realHere, (0, import_node_path8.join)(realHere, "..")];
   for (const dir of searchDirs) {
     try {
-      const v3 = (0, import_node_fs4.readFileSync)((0, import_node_path6.join)(dir, "version.txt"), "utf8").trim();
+      const v3 = (0, import_node_fs5.readFileSync)((0, import_node_path8.join)(dir, "version.txt"), "utf8").trim();
       if (v3) return v3;
     } catch {
     }
   }
   try {
-    const pkg = JSON.parse((0, import_node_fs4.readFileSync)((0, import_node_path6.join)(here, "..", "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path8.join)(here, "..", "package.json"), "utf8"));
     if (pkg.version) return `${pkg.version}+source`;
   } catch {
   }
@@ -136595,6 +136622,19 @@ var createMiscRoutes = (deps) => {
     });
   });
   app.get("/api/profiles", (c) => c.json([]));
+  app.post("/api/auth/rotate", (c) => {
+    if (deps.localNoAuth) {
+      return c.json({ error: "key rotation is disabled while localNoAuth is active" }, 403);
+    }
+    const { newKey, persisted } = deps.rotateApiKey();
+    return c.json({
+      apiKey: newKey,
+      persisted,
+      ...persisted ? {} : {
+        warning: "Key rotated in memory only. The server was started with --api-key, so the old key will be restored on restart. Remove --api-key and let the server manage the key via ~/.threadbase/server.yaml for rotation to survive restarts."
+      }
+    });
+  });
   app.post("/api/push/register", (c) => c.json({ ok: true }));
   app.post("/api/__update", async (c) => {
     const cfg = loadUpdateConfig();
@@ -136796,6 +136836,11 @@ var ALREADY_HANDLED4 = 597;
 var alreadyHandled4 = () => new Response(null, { status: ALREADY_HANDLED4 });
 var createProjectRoutes = (deps) => {
   const app = new Hono2();
+  app.get("/", (c) => {
+    const url2 = new URL(c.req.url);
+    deps.handleListProjects(url2, c.env.outgoing);
+    return alreadyHandled4();
+  });
   app.get("/popular", (c) => {
     const url2 = new URL(c.req.url);
     deps.handleGetPopularProjects(url2, c.env.outgoing);
@@ -136814,11 +136859,6 @@ var createScannerRoutes = (deps) => {
     await deps.handleSearch(url2, c.env.outgoing);
     return alreadyHandled5();
   });
-  app.get("/project-chats", async (c) => {
-    const url2 = new URL(c.req.url);
-    await deps.handleListProjectChats(url2, c.env.outgoing);
-    return alreadyHandled5();
-  });
   return app;
 };
 
@@ -138082,517 +138122,39 @@ async function recordUpload(pool2, instanceId, row) {
   );
 }
 
-// src/schemas/queryParams.schema.ts
-init_zod();
-var ListProjectChatsQuerySchema = external_exports.object({
-  refresh: external_exports.enum(["1"]).optional(),
-  refreshConversations: external_exports.enum(["1"]).optional()
-});
-
-// src/services/cache/cacheMetadata.ts
-function getCacheMetadata(repo, key) {
-  return repo.getCacheMetadata(key);
-}
-function setCacheMetadata(repo, key, value) {
-  repo.setCacheMetadata(key, value);
-}
-
-// node_modules/date-fns/constants.js
-var daysInYear = 365.2425;
-var maxTime = Math.pow(10, 8) * 24 * 60 * 60 * 1e3;
-var minTime = -maxTime;
-var millisecondsInMinute = 6e4;
-var millisecondsInHour = 36e5;
-var secondsInHour = 3600;
-var secondsInDay = secondsInHour * 24;
-var secondsInWeek = secondsInDay * 7;
-var secondsInYear = secondsInDay * daysInYear;
-var secondsInMonth = secondsInYear / 12;
-var secondsInQuarter = secondsInMonth * 3;
-var constructFromSymbol = /* @__PURE__ */ Symbol.for("constructDateFrom");
-
-// node_modules/date-fns/constructFrom.js
-function constructFrom(date5, value) {
-  if (typeof date5 === "function") return date5(value);
-  if (date5 && typeof date5 === "object" && constructFromSymbol in date5)
-    return date5[constructFromSymbol](value);
-  if (date5 instanceof Date) return new date5.constructor(value);
-  return new Date(value);
-}
-
-// node_modules/date-fns/toDate.js
-function toDate(argument, context) {
-  return constructFrom(context || argument, argument);
-}
-
-// node_modules/date-fns/compareDesc.js
-function compareDesc(dateLeft, dateRight) {
-  const diff = +toDate(dateLeft) - +toDate(dateRight);
-  if (diff > 0) return -1;
-  else if (diff < 0) return 1;
-  return diff;
-}
-
-// node_modules/date-fns/isDate.js
-function isDate(value) {
-  return value instanceof Date || typeof value === "object" && Object.prototype.toString.call(value) === "[object Date]";
-}
-
-// node_modules/date-fns/isValid.js
-function isValid(date5) {
-  return !(!isDate(date5) && typeof date5 !== "number" || isNaN(+toDate(date5)));
-}
-
-// node_modules/date-fns/parseISO.js
-function parseISO(argument, options) {
-  const invalidDate = () => constructFrom(options?.in, NaN);
-  const additionalDigits = options?.additionalDigits ?? 2;
-  const dateStrings = splitDateString(argument);
-  let date5;
-  if (dateStrings.date) {
-    const parseYearResult = parseYear(dateStrings.date, additionalDigits);
-    date5 = parseDate(parseYearResult.restDateString, parseYearResult.year);
-  }
-  if (!date5 || isNaN(+date5)) return invalidDate();
-  const timestamp = +date5;
-  let time3 = 0;
-  let offset;
-  if (dateStrings.time) {
-    time3 = parseTime(dateStrings.time);
-    if (isNaN(time3)) return invalidDate();
-  }
-  if (dateStrings.timezone) {
-    offset = parseTimezone(dateStrings.timezone);
-    if (isNaN(offset)) return invalidDate();
-  } else {
-    const tmpDate = new Date(timestamp + time3);
-    const result = toDate(0, options?.in);
-    result.setFullYear(
-      tmpDate.getUTCFullYear(),
-      tmpDate.getUTCMonth(),
-      tmpDate.getUTCDate()
-    );
-    result.setHours(
-      tmpDate.getUTCHours(),
-      tmpDate.getUTCMinutes(),
-      tmpDate.getUTCSeconds(),
-      tmpDate.getUTCMilliseconds()
-    );
-    return result;
-  }
-  return toDate(timestamp + time3 + offset, options?.in);
-}
-var patterns = {
-  dateTimeDelimiter: /[T ]/,
-  timeZoneDelimiter: /[Z ]/i,
-  timezone: /([Z+-].*)$/
-};
-var dateRegex = /^-?(?:(\d{3})|(\d{2})(?:-?(\d{2}))?|W(\d{2})(?:-?(\d{1}))?|)$/;
-var timeRegex = /^(\d{2}(?:[.,]\d*)?)(?::?(\d{2}(?:[.,]\d*)?))?(?::?(\d{2}(?:[.,]\d*)?))?$/;
-var timezoneRegex = /^([+-])(\d{2})(?::?(\d{2}))?$/;
-function splitDateString(dateString) {
-  const dateStrings = {};
-  const array2 = dateString.split(patterns.dateTimeDelimiter);
-  let timeString;
-  if (array2.length > 2) {
-    return dateStrings;
-  }
-  if (/:/.test(array2[0])) {
-    timeString = array2[0];
-  } else {
-    dateStrings.date = array2[0];
-    timeString = array2[1];
-    if (patterns.timeZoneDelimiter.test(dateStrings.date)) {
-      dateStrings.date = dateString.split(patterns.timeZoneDelimiter)[0];
-      timeString = dateString.substr(
-        dateStrings.date.length,
-        dateString.length
-      );
-    }
-  }
-  if (timeString) {
-    const token = patterns.timezone.exec(timeString);
-    if (token) {
-      dateStrings.time = timeString.replace(token[1], "");
-      dateStrings.timezone = token[1];
-    } else {
-      dateStrings.time = timeString;
-    }
-  }
-  return dateStrings;
-}
-function parseYear(dateString, additionalDigits) {
-  const regex = new RegExp(
-    "^(?:(\\d{4}|[+-]\\d{" + (4 + additionalDigits) + "})|(\\d{2}|[+-]\\d{" + (2 + additionalDigits) + "})$)"
-  );
-  const captures = dateString.match(regex);
-  if (!captures) return { year: NaN, restDateString: "" };
-  const year = captures[1] ? parseInt(captures[1]) : null;
-  const century = captures[2] ? parseInt(captures[2]) : null;
-  return {
-    year: century === null ? year : century * 100,
-    restDateString: dateString.slice((captures[1] || captures[2]).length)
-  };
-}
-function parseDate(dateString, year) {
-  if (year === null) return /* @__PURE__ */ new Date(NaN);
-  const captures = dateString.match(dateRegex);
-  if (!captures) return /* @__PURE__ */ new Date(NaN);
-  const isWeekDate = !!captures[4];
-  const dayOfYear = parseDateUnit(captures[1]);
-  const month = parseDateUnit(captures[2]) - 1;
-  const day = parseDateUnit(captures[3]);
-  const week = parseDateUnit(captures[4]);
-  const dayOfWeek = parseDateUnit(captures[5]) - 1;
-  if (isWeekDate) {
-    if (!validateWeekDate(year, week, dayOfWeek)) {
-      return /* @__PURE__ */ new Date(NaN);
-    }
-    return dayOfISOWeekYear(year, week, dayOfWeek);
-  } else {
-    const date5 = /* @__PURE__ */ new Date(0);
-    if (!validateDate(year, month, day) || !validateDayOfYearDate(year, dayOfYear)) {
-      return /* @__PURE__ */ new Date(NaN);
-    }
-    date5.setUTCFullYear(year, month, Math.max(dayOfYear, day));
-    return date5;
-  }
-}
-function parseDateUnit(value) {
-  return value ? parseInt(value) : 1;
-}
-function parseTime(timeString) {
-  const captures = timeString.match(timeRegex);
-  if (!captures) return NaN;
-  const hours = parseTimeUnit(captures[1]);
-  const minutes = parseTimeUnit(captures[2]);
-  const seconds = parseTimeUnit(captures[3]);
-  if (!validateTime(hours, minutes, seconds)) {
-    return NaN;
-  }
-  return hours * millisecondsInHour + minutes * millisecondsInMinute + seconds * 1e3;
-}
-function parseTimeUnit(value) {
-  return value && parseFloat(value.replace(",", ".")) || 0;
-}
-function parseTimezone(timezoneString) {
-  if (timezoneString === "Z") return 0;
-  const captures = timezoneString.match(timezoneRegex);
-  if (!captures) return 0;
-  const sign = captures[1] === "+" ? -1 : 1;
-  const hours = parseInt(captures[2]);
-  const minutes = captures[3] && parseInt(captures[3]) || 0;
-  if (!validateTimezone(hours, minutes)) {
-    return NaN;
-  }
-  return sign * (hours * millisecondsInHour + minutes * millisecondsInMinute);
-}
-function dayOfISOWeekYear(isoWeekYear, week, day) {
-  const date5 = /* @__PURE__ */ new Date(0);
-  date5.setUTCFullYear(isoWeekYear, 0, 4);
-  const fourthOfJanuaryDay = date5.getUTCDay() || 7;
-  const diff = (week - 1) * 7 + day + 1 - fourthOfJanuaryDay;
-  date5.setUTCDate(date5.getUTCDate() + diff);
-  return date5;
-}
-var daysInMonths = [31, null, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-function isLeapYearIndex(year) {
-  return year % 400 === 0 || year % 4 === 0 && year % 100 !== 0;
-}
-function validateDate(year, month, date5) {
-  return month >= 0 && month <= 11 && date5 >= 1 && date5 <= (daysInMonths[month] || (isLeapYearIndex(year) ? 29 : 28));
-}
-function validateDayOfYearDate(year, dayOfYear) {
-  return dayOfYear >= 1 && dayOfYear <= (isLeapYearIndex(year) ? 366 : 365);
-}
-function validateWeekDate(_year, week, day) {
-  return week >= 1 && week <= 53 && day >= 0 && day <= 6;
-}
-function validateTime(hours, minutes, seconds) {
-  if (hours === 24) {
-    return minutes === 0 && seconds === 0;
-  }
-  return seconds >= 0 && seconds < 60 && minutes >= 0 && minutes < 60 && hours >= 0 && hours < 25;
-}
-function validateTimezone(_hours, minutes) {
-  return minutes >= 0 && minutes <= 59;
-}
-
-// src/utils/dates.ts
-function parseIsoDateOrNull(value) {
-  if (!value) return null;
-  const parsed = parseISO(value);
-  return isValid(parsed) ? parsed : null;
-}
-function compareIsoDesc(a, b2) {
-  const dateA = parseIsoDateOrNull(a);
-  const dateB = parseIsoDateOrNull(b2);
-  if (!dateA && !dateB) return 0;
-  if (!dateA) return 1;
-  if (!dateB) return -1;
-  return compareDesc(dateA, dateB);
-}
-
-// src/services/projects/ensureProjectsForConversations.ts
-function ensureProjectsForConversations(repo, conversations) {
-  const conversationsByPath = /* @__PURE__ */ new Map();
-  for (const conversation of conversations) {
-    if (!conversation.projectPath) continue;
-    const canonical = canonicalizeProjectPath(conversation.projectPath);
-    if (!canonical) continue;
-    const existing = conversationsByPath.get(canonical) ?? [];
-    existing.push(conversation);
-    conversationsByPath.set(canonical, existing);
-  }
-  const pathToProjectId = /* @__PURE__ */ new Map();
-  for (const [path2, projectConversations] of conversationsByPath) {
-    const latest = pickLatestConversation(projectConversations);
-    const project = repo.upsertProjectByPath(path2, {
-      lastConversationId: latest?.id ?? null,
-      lastConversationCreatedAt: latest?.createdAt ?? null,
-      latestMessageAt: latest?.latestMessageAt ?? null
-    });
-    pathToProjectId.set(path2, project.id);
-  }
-  return pathToProjectId;
-}
-function pickLatestConversation(conversations) {
-  if (conversations.length === 0) return void 0;
-  return [...conversations].sort((a, b2) => {
-    const cmp = compareIsoDesc(a.latestMessageAt ?? null, b2.latestMessageAt ?? null);
-    if (cmp !== 0) return cmp;
-    return compareIsoDesc(a.createdAt ?? null, b2.createdAt ?? null);
-  })[0];
-}
-
-// src/services/conversations/refreshConversationCache.ts
-function refreshConversationCache(deps) {
-  const { projectsRepo, conversationsRepo, cacheMetadataRepo } = deps;
-  const conversations = conversationsRepo.listConversationsForProjectBackfill();
-  const pathToProjectId = ensureProjectsForConversations(
-    projectsRepo,
-    conversations.map((c) => ({
-      id: c.id,
-      projectPath: c.projectPath,
-      latestMessageAt: c.lastActivity ?? null,
-      createdAt: c.lastActivity ?? null
-    }))
-  );
-  let conversationsBackfilled = 0;
-  for (const conversation of conversations) {
-    if (!conversation.projectPath) continue;
-    if (conversation.projectId) continue;
-    const projectId = pathToProjectId.get(canonicalizeProjectPath(conversation.projectPath));
-    if (!projectId) continue;
-    conversationsRepo.updateConversationProjectId({
-      conversationId: conversation.id,
-      projectId
-    });
-    conversationsBackfilled += 1;
-  }
-  const latest = conversationsRepo.getLatestConversation();
-  if (latest) {
-    setCacheMetadata(cacheMetadataRepo, "last_conversation_id", latest.id);
-    if (latest.lastActivity) {
-      setCacheMetadata(cacheMetadataRepo, "last_conversation_created_at", latest.lastActivity);
-    }
-  }
-  setCacheMetadata(cacheMetadataRepo, "conversations_last_indexed_at", (/* @__PURE__ */ new Date()).toISOString());
-  return {
-    projectsTouched: pathToProjectId.size,
-    conversationsBackfilled,
-    latestConversationId: latest?.id ?? null
-  };
-}
-
-// src/services/conversations/shouldRefreshProjectsFromHdd.ts
+// src/handlers/handleListProjects.ts
 var import_fs18 = require("fs");
 var import_os7 = require("os");
 var import_path14 = require("path");
-var DEFAULT_PROJECTS_DIR = (0, import_path14.join)((0, import_os7.homedir)(), ".claude", "projects");
-function shouldRefreshProjectsFromHdd(conversationsRepo, cacheMetadataRepo, opts = {}) {
-  if (conversationsRepo.hasOrphanRows()) return true;
-  const projectsDir = opts.projectsDir ?? DEFAULT_PROJECTS_DIR;
-  let dirMtimeMs;
+function decodeProjectPath(dirName) {
+  return dirName.replace(/-/g, "/");
+}
+function handleListProjects(url2, res) {
+  const limit = Math.max(1, parseInt(url2.searchParams.get("limit") ?? "50", 10) || 50);
+  const offset = Math.max(0, parseInt(url2.searchParams.get("offset") ?? "0", 10) || 0);
+  const projectsDir = (0, import_path14.join)((0, import_os7.homedir)(), ".claude", "projects");
+  let entries;
   try {
-    dirMtimeMs = (0, import_fs18.statSync)(projectsDir).mtimeMs;
+    entries = (0, import_fs18.readdirSync)(projectsDir).map((dirName) => {
+      const fullPath = (0, import_path14.join)(projectsDir, dirName);
+      let mtime = 0;
+      try {
+        mtime = (0, import_fs18.statSync)(fullPath).mtimeMs;
+      } catch {
+      }
+      const path2 = decodeProjectPath(dirName);
+      const name = path2.split("/").filter(Boolean).pop() ?? dirName;
+      return { name, path: path2, dirName, mtime };
+    }).sort((a, b2) => b2.mtime - a.mtime);
   } catch {
-    return false;
-  }
-  const lastIndexedIso = getCacheMetadata(cacheMetadataRepo, "conversations_last_indexed_at");
-  if (!lastIndexedIso) return true;
-  const lastIndexedMs = Date.parse(lastIndexedIso);
-  if (Number.isNaN(lastIndexedMs)) return true;
-  return dirMtimeMs > lastIndexedMs;
-}
-
-// src/services/sessions/ensureSessionProjectIdsFromExistingProjects.ts
-function ensureSessionProjectIdsFromExistingProjects(projectsRepo, sessionsRepo) {
-  let linked = 0;
-  let missing = 0;
-  for (const session of sessionsRepo.listManagedSessions()) {
-    if (session.projectId) continue;
-    const canonical = canonicalizeProjectPath(session.projectPath);
-    if (!canonical) continue;
-    const project = projectsRepo.getProjectByPath(canonical);
-    if (!project) {
-      missing += 1;
-      continue;
-    }
-    sessionsRepo.updateSessionProjectId({ sessionId: session.id, projectId: project.id });
-    linked += 1;
-  }
-  return { linked, missing };
-}
-
-// src/services/projectChats/sortProjectChats.ts
-function sortProjectChats(a, b2) {
-  const byLatest = compareIsoDesc(a.latestMessageAt, b2.latestMessageAt);
-  if (byLatest !== 0) return byLatest;
-  const byUpdated = compareIsoDesc(a.updatedAt ?? null, b2.updatedAt ?? null);
-  if (byUpdated !== 0) return byUpdated;
-  const byCreated = compareIsoDesc(a.createdAt ?? null, b2.createdAt ?? null);
-  if (byCreated !== 0) return byCreated;
-  return a.title.localeCompare(b2.title);
-}
-
-// src/services/projectChats/mergeProjectChats.ts
-function mergeProjectChats(args) {
-  const { sessions, conversations } = args;
-  const resumedConversationIds = new Set(
-    sessions.filter((c) => c.type === "session").map((c) => c.resumedFromConversationId).filter((id) => Boolean(id))
-  );
-  const visibleConversations = conversations.filter((c) => {
-    if (c.type !== "conversation") return true;
-    return !resumedConversationIds.has(c.id);
-  });
-  return [...sessions, ...visibleConversations].sort(sortProjectChats);
-}
-
-// src/services/projectChats/deriveProjectChatTitle.ts
-function deriveProjectChatTitle(input) {
-  const trimmed = input.title?.trim();
-  if (trimmed) return trimmed;
-  const name = input.projectName?.trim();
-  if (name) return name;
-  const pathSuffix = input.projectPath ? input.projectPath.split(/[/\\]/).filter(Boolean).slice(-2).join("/") : "";
-  if (pathSuffix) return pathSuffix;
-  return `Untitled \xB7 ${input.id.slice(0, 8)}`;
-}
-
-// src/services/projectChats/normalizeConversationToProjectChat.ts
-function normalizeConversationToProjectChat(conversation) {
-  if (!conversation.projectId) {
-    throw new Error(
-      `normalizeConversationToProjectChat: conversation ${conversation.id} has no projectId \u2014 resolve it before normalizing`
-    );
-  }
-  return {
-    type: "conversation",
-    id: conversation.id,
-    projectId: conversation.projectId,
-    projectPath: conversation.projectPath ?? null,
-    title: deriveProjectChatTitle({
-      title: conversation.title,
-      projectName: conversation.projectName,
-      projectPath: conversation.projectPath,
-      id: conversation.id
-    }),
-    latestMessageAt: conversation.lastActivity ?? null,
-    updatedAt: conversation.lastActivity ?? null,
-    createdAt: null,
-    status: "resumable",
-    source: "hdd-cache",
-    provider: conversation.provider ?? CLAUDE_CODE_PROVIDER2,
-    indexedAt: null,
-    fileMtime: null,
-    filePath: conversation.filePath ?? null,
-    sourceHash: null
-  };
-}
-
-// src/services/projectChats/normalizeSessionToProjectChat.ts
-function normalizeSessionToProjectChat(session) {
-  if (!session.projectId) {
-    throw new Error(
-      `normalizeSessionToProjectChat: session ${session.id} has no projectId \u2014 resolve it before normalizing`
-    );
-  }
-  return {
-    type: "session",
-    id: session.id,
-    projectId: session.projectId,
-    projectPath: session.projectPath ?? null,
-    title: deriveProjectChatTitle({
-      title: session.sessionName,
-      projectName: session.projectName,
-      projectPath: session.projectPath,
-      id: session.id
-    }),
-    latestMessageAt: session.lastMessageAt ?? session.lastActivityAt ?? null,
-    updatedAt: session.lastActivityAt ?? null,
-    createdAt: session.startedAt ?? null,
-    status: "active",
-    source: "session-store",
-    resumedFromConversationId: session.resumedFromConversationId ?? null
-  };
-}
-
-// src/services/projectChats/listProjectChats.ts
-async function listProjectChats(deps, args) {
-  const {
-    cache,
-    projectsRepo,
-    conversationsRepo,
-    sessionsRepo,
-    cacheMetadataRepo,
-    getSessionResponses,
-    getFreshScanner,
-    projectsDir
-  } = deps;
-  const needsRefresh = args.refreshConversations || shouldRefreshProjectsFromHdd(conversationsRepo, cacheMetadataRepo, { projectsDir });
-  if (needsRefresh) {
-    const scanner = await getFreshScanner();
-    const metas = [...scanner.getMetadataCache().values()];
-    if (metas.length > 0) {
-      cache.upsertFromScannerMeta(metas);
-    }
-    refreshConversationCache({ cache, projectsRepo, conversationsRepo, cacheMetadataRepo });
-  }
-  ensureSessionProjectIdsFromExistingProjects(projectsRepo, sessionsRepo);
-  const sessionResponses = getSessionResponses();
-  const sessionChats = [];
-  for (const s3 of sessionResponses) {
-    if (!s3.projectId) continue;
-    sessionChats.push(normalizeSessionToProjectChat(s3));
-  }
-  const conversationChats = [];
-  const { conversations } = cache.listConversations({ limit: 1e3, offset: 0 });
-  for (const c of conversations) {
-    if (!c.projectId) continue;
-    conversationChats.push(normalizeConversationToProjectChat(c));
-  }
-  return mergeProjectChats({ sessions: sessionChats, conversations: conversationChats });
-}
-
-// src/handlers/handleListProjectChats.ts
-async function handleListProjectChats(url2, res, deps) {
-  const queryObj = Object.fromEntries(url2.searchParams.entries());
-  const parsed = ListProjectChatsQuerySchema.safeParse(queryObj);
-  if (!parsed.success) {
-    res.writeHead(400, { "Content-Type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: "Invalid query parameters",
-        details: parsed.error.flatten()
-      })
-    );
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ projects: [], total: 0 }));
     return;
   }
-  const refreshConversations = parsed.data.refreshConversations === "1" || parsed.data.refresh === "1";
-  const chats = await listProjectChats(deps, { refreshConversations });
+  const total = entries.length;
+  const page = entries.slice(offset, offset + limit).map(({ name, path: path2, dirName }) => ({ name, path: path2, dirName }));
   res.writeHead(200, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ projectChats: chats }));
+  res.end(JSON.stringify({ projects: page, total }));
 }
 
 // src/server.ts
@@ -139632,13 +139194,13 @@ function seal(plaintext, recipientPublicKeyBase64) {
 
 // node_modules/chokidar/index.js
 var import_node_events2 = require("events");
-var import_node_fs6 = require("fs");
+var import_node_fs7 = require("fs");
 var import_promises11 = require("fs/promises");
 var sp2 = __toESM(require("path"), 1);
 
 // node_modules/readdirp/index.js
 var import_promises9 = require("fs/promises");
-var import_node_path7 = require("path");
+var import_node_path9 = require("path");
 var import_node_stream2 = require("stream");
 var EntryTypes2 = {
   FILE_TYPE: "files",
@@ -139728,7 +139290,7 @@ var ReaddirpStream2 = class extends import_node_stream2.Readable {
     this._wantsDir = type ? DIR_TYPES2.has(type) : false;
     this._wantsFile = type ? FILE_TYPES2.has(type) : false;
     this._wantsEverything = type === EntryTypes2.EVERYTHING_TYPE;
-    this._root = (0, import_node_path7.resolve)(root);
+    this._root = (0, import_node_path9.resolve)(root);
     this._isDirent = !opts.alwaysStat;
     this._statsProp = this._isDirent ? "dirent" : "stats";
     this._rdOptions = { encoding: "utf8", withFileTypes: this._isDirent };
@@ -139799,8 +139361,8 @@ var ReaddirpStream2 = class extends import_node_stream2.Readable {
     let entry;
     const basename9 = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = (0, import_node_path7.resolve)((0, import_node_path7.join)(path2, basename9));
-      entry = { path: (0, import_node_path7.relative)(this._root, fullPath), fullPath, basename: basename9 };
+      const fullPath = (0, import_node_path9.resolve)((0, import_node_path9.join)(path2, basename9));
+      entry = { path: (0, import_node_path9.relative)(this._root, fullPath), fullPath, basename: basename9 };
       entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err) {
       this._onError(err);
@@ -139834,7 +139396,7 @@ var ReaddirpStream2 = class extends import_node_stream2.Readable {
         }
         if (entryRealPathStats.isDirectory()) {
           const len = entryRealPath.length;
-          if (full.startsWith(entryRealPath) && full.substr(len, 1) === import_node_path7.sep) {
+          if (full.startsWith(entryRealPath) && full.substr(len, 1) === import_node_path9.sep) {
             const recursiveError = new Error(`Circular symlink detected: "${full}" points to "${entryRealPath}"`);
             recursiveError.code = RECURSIVE_ERROR_CODE2;
             return this._onError(recursiveError);
@@ -139870,9 +139432,9 @@ function readdirp2(root, options = {}) {
 }
 
 // node_modules/chokidar/handler.js
-var import_node_fs5 = require("fs");
+var import_node_fs6 = require("fs");
 var import_promises10 = require("fs/promises");
-var import_node_os2 = require("os");
+var import_node_os3 = require("os");
 var sp = __toESM(require("path"), 1);
 var STR_DATA2 = "data";
 var STR_END2 = "end";
@@ -139884,7 +139446,7 @@ var isWindows3 = pl2 === "win32";
 var isMacos2 = pl2 === "darwin";
 var isLinux2 = pl2 === "linux";
 var isFreeBSD2 = pl2 === "freebsd";
-var isIBMi2 = (0, import_node_os2.type)() === "OS400";
+var isIBMi2 = (0, import_node_os3.type)() === "OS400";
 var EVENTS2 = {
   ALL: "all",
   READY: "ready",
@@ -140208,7 +139770,7 @@ function createFsWatchInstance2(path2, options, listener, errHandler, emitRaw) {
     }
   };
   try {
-    return (0, import_node_fs5.watch)(path2, {
+    return (0, import_node_fs6.watch)(path2, {
       persistent: options.persistent
     }, handleEvent);
   } catch (error51) {
@@ -140291,7 +139853,7 @@ var setFsWatchFileListener2 = (path2, fullPath, options, handlers) => {
   let cont = FsWatchFileInstances2.get(fullPath);
   const copts = cont && cont.options;
   if (copts && (copts.persistent < options.persistent || copts.interval > options.interval)) {
-    (0, import_node_fs5.unwatchFile)(fullPath);
+    (0, import_node_fs6.unwatchFile)(fullPath);
     cont = void 0;
   }
   if (cont) {
@@ -140302,7 +139864,7 @@ var setFsWatchFileListener2 = (path2, fullPath, options, handlers) => {
       listeners: listener,
       rawEmitters: rawEmitter,
       options,
-      watcher: (0, import_node_fs5.watchFile)(fullPath, options, (curr, prev) => {
+      watcher: (0, import_node_fs6.watchFile)(fullPath, options, (curr, prev) => {
         foreach2(cont.rawEmitters, (rawEmitter2) => {
           rawEmitter2(EV2.CHANGE, fullPath, { curr, prev });
         });
@@ -140319,7 +139881,7 @@ var setFsWatchFileListener2 = (path2, fullPath, options, handlers) => {
     delFromSet2(cont, KEY_RAW2, rawEmitter);
     if (isEmptySet2(cont.listeners)) {
       FsWatchFileInstances2.delete(fullPath);
-      (0, import_node_fs5.unwatchFile)(fullPath);
+      (0, import_node_fs6.unwatchFile)(fullPath);
       cont.options = cont.watcher = void 0;
       Object.freeze(cont);
     }
@@ -141189,7 +140751,7 @@ var FSWatcher2 = class extends import_node_events2.EventEmitter {
     const now = /* @__PURE__ */ new Date();
     const writes = this._pendingWrites;
     function awaitWriteFinishFn(prevStat) {
-      (0, import_node_fs6.stat)(fullPath, (err, curStat) => {
+      (0, import_node_fs7.stat)(fullPath, (err, curStat) => {
         if (err || !writes.has(path2)) {
           if (err && err.code !== "ENOENT")
             awfEmit(err);
@@ -141512,6 +141074,17 @@ function pruneAgentConversations(cache) {
   return { scanned: rows.length, pruned, missing };
 }
 
+// src/services/projectChats/deriveProjectChatTitle.ts
+function deriveProjectChatTitle(input) {
+  const trimmed = input.title?.trim();
+  if (trimmed) return trimmed;
+  const name = input.projectName?.trim();
+  if (name) return name;
+  const pathSuffix = input.projectPath ? input.projectPath.split(/[/\\]/).filter(Boolean).slice(-2).join("/") : "";
+  if (pathSuffix) return pathSuffix;
+  return `Untitled \xB7 ${input.id.slice(0, 8)}`;
+}
+
 // src/services/questions/detectAskUserQuestion.ts
 function normalizeContent2(raw2) {
   if (Array.isArray(raw2)) return raw2;
@@ -141941,6 +141514,226 @@ function debounce(fn, waitMs) {
   return debounced;
 }
 
+// node_modules/date-fns/constants.js
+var daysInYear = 365.2425;
+var maxTime = Math.pow(10, 8) * 24 * 60 * 60 * 1e3;
+var minTime = -maxTime;
+var millisecondsInMinute = 6e4;
+var millisecondsInHour = 36e5;
+var secondsInHour = 3600;
+var secondsInDay = secondsInHour * 24;
+var secondsInWeek = secondsInDay * 7;
+var secondsInYear = secondsInDay * daysInYear;
+var secondsInMonth = secondsInYear / 12;
+var secondsInQuarter = secondsInMonth * 3;
+var constructFromSymbol = /* @__PURE__ */ Symbol.for("constructDateFrom");
+
+// node_modules/date-fns/constructFrom.js
+function constructFrom(date5, value) {
+  if (typeof date5 === "function") return date5(value);
+  if (date5 && typeof date5 === "object" && constructFromSymbol in date5)
+    return date5[constructFromSymbol](value);
+  if (date5 instanceof Date) return new date5.constructor(value);
+  return new Date(value);
+}
+
+// node_modules/date-fns/toDate.js
+function toDate(argument, context) {
+  return constructFrom(context || argument, argument);
+}
+
+// node_modules/date-fns/isDate.js
+function isDate(value) {
+  return value instanceof Date || typeof value === "object" && Object.prototype.toString.call(value) === "[object Date]";
+}
+
+// node_modules/date-fns/isValid.js
+function isValid(date5) {
+  return !(!isDate(date5) && typeof date5 !== "number" || isNaN(+toDate(date5)));
+}
+
+// node_modules/date-fns/parseISO.js
+function parseISO(argument, options) {
+  const invalidDate = () => constructFrom(options?.in, NaN);
+  const additionalDigits = options?.additionalDigits ?? 2;
+  const dateStrings = splitDateString(argument);
+  let date5;
+  if (dateStrings.date) {
+    const parseYearResult = parseYear(dateStrings.date, additionalDigits);
+    date5 = parseDate(parseYearResult.restDateString, parseYearResult.year);
+  }
+  if (!date5 || isNaN(+date5)) return invalidDate();
+  const timestamp = +date5;
+  let time3 = 0;
+  let offset;
+  if (dateStrings.time) {
+    time3 = parseTime(dateStrings.time);
+    if (isNaN(time3)) return invalidDate();
+  }
+  if (dateStrings.timezone) {
+    offset = parseTimezone(dateStrings.timezone);
+    if (isNaN(offset)) return invalidDate();
+  } else {
+    const tmpDate = new Date(timestamp + time3);
+    const result = toDate(0, options?.in);
+    result.setFullYear(
+      tmpDate.getUTCFullYear(),
+      tmpDate.getUTCMonth(),
+      tmpDate.getUTCDate()
+    );
+    result.setHours(
+      tmpDate.getUTCHours(),
+      tmpDate.getUTCMinutes(),
+      tmpDate.getUTCSeconds(),
+      tmpDate.getUTCMilliseconds()
+    );
+    return result;
+  }
+  return toDate(timestamp + time3 + offset, options?.in);
+}
+var patterns = {
+  dateTimeDelimiter: /[T ]/,
+  timeZoneDelimiter: /[Z ]/i,
+  timezone: /([Z+-].*)$/
+};
+var dateRegex = /^-?(?:(\d{3})|(\d{2})(?:-?(\d{2}))?|W(\d{2})(?:-?(\d{1}))?|)$/;
+var timeRegex = /^(\d{2}(?:[.,]\d*)?)(?::?(\d{2}(?:[.,]\d*)?))?(?::?(\d{2}(?:[.,]\d*)?))?$/;
+var timezoneRegex = /^([+-])(\d{2})(?::?(\d{2}))?$/;
+function splitDateString(dateString) {
+  const dateStrings = {};
+  const array2 = dateString.split(patterns.dateTimeDelimiter);
+  let timeString;
+  if (array2.length > 2) {
+    return dateStrings;
+  }
+  if (/:/.test(array2[0])) {
+    timeString = array2[0];
+  } else {
+    dateStrings.date = array2[0];
+    timeString = array2[1];
+    if (patterns.timeZoneDelimiter.test(dateStrings.date)) {
+      dateStrings.date = dateString.split(patterns.timeZoneDelimiter)[0];
+      timeString = dateString.substr(
+        dateStrings.date.length,
+        dateString.length
+      );
+    }
+  }
+  if (timeString) {
+    const token = patterns.timezone.exec(timeString);
+    if (token) {
+      dateStrings.time = timeString.replace(token[1], "");
+      dateStrings.timezone = token[1];
+    } else {
+      dateStrings.time = timeString;
+    }
+  }
+  return dateStrings;
+}
+function parseYear(dateString, additionalDigits) {
+  const regex = new RegExp(
+    "^(?:(\\d{4}|[+-]\\d{" + (4 + additionalDigits) + "})|(\\d{2}|[+-]\\d{" + (2 + additionalDigits) + "})$)"
+  );
+  const captures = dateString.match(regex);
+  if (!captures) return { year: NaN, restDateString: "" };
+  const year = captures[1] ? parseInt(captures[1]) : null;
+  const century = captures[2] ? parseInt(captures[2]) : null;
+  return {
+    year: century === null ? year : century * 100,
+    restDateString: dateString.slice((captures[1] || captures[2]).length)
+  };
+}
+function parseDate(dateString, year) {
+  if (year === null) return /* @__PURE__ */ new Date(NaN);
+  const captures = dateString.match(dateRegex);
+  if (!captures) return /* @__PURE__ */ new Date(NaN);
+  const isWeekDate = !!captures[4];
+  const dayOfYear = parseDateUnit(captures[1]);
+  const month = parseDateUnit(captures[2]) - 1;
+  const day = parseDateUnit(captures[3]);
+  const week = parseDateUnit(captures[4]);
+  const dayOfWeek = parseDateUnit(captures[5]) - 1;
+  if (isWeekDate) {
+    if (!validateWeekDate(year, week, dayOfWeek)) {
+      return /* @__PURE__ */ new Date(NaN);
+    }
+    return dayOfISOWeekYear(year, week, dayOfWeek);
+  } else {
+    const date5 = /* @__PURE__ */ new Date(0);
+    if (!validateDate(year, month, day) || !validateDayOfYearDate(year, dayOfYear)) {
+      return /* @__PURE__ */ new Date(NaN);
+    }
+    date5.setUTCFullYear(year, month, Math.max(dayOfYear, day));
+    return date5;
+  }
+}
+function parseDateUnit(value) {
+  return value ? parseInt(value) : 1;
+}
+function parseTime(timeString) {
+  const captures = timeString.match(timeRegex);
+  if (!captures) return NaN;
+  const hours = parseTimeUnit(captures[1]);
+  const minutes = parseTimeUnit(captures[2]);
+  const seconds = parseTimeUnit(captures[3]);
+  if (!validateTime(hours, minutes, seconds)) {
+    return NaN;
+  }
+  return hours * millisecondsInHour + minutes * millisecondsInMinute + seconds * 1e3;
+}
+function parseTimeUnit(value) {
+  return value && parseFloat(value.replace(",", ".")) || 0;
+}
+function parseTimezone(timezoneString) {
+  if (timezoneString === "Z") return 0;
+  const captures = timezoneString.match(timezoneRegex);
+  if (!captures) return 0;
+  const sign = captures[1] === "+" ? -1 : 1;
+  const hours = parseInt(captures[2]);
+  const minutes = captures[3] && parseInt(captures[3]) || 0;
+  if (!validateTimezone(hours, minutes)) {
+    return NaN;
+  }
+  return sign * (hours * millisecondsInHour + minutes * millisecondsInMinute);
+}
+function dayOfISOWeekYear(isoWeekYear, week, day) {
+  const date5 = /* @__PURE__ */ new Date(0);
+  date5.setUTCFullYear(isoWeekYear, 0, 4);
+  const fourthOfJanuaryDay = date5.getUTCDay() || 7;
+  const diff = (week - 1) * 7 + day + 1 - fourthOfJanuaryDay;
+  date5.setUTCDate(date5.getUTCDate() + diff);
+  return date5;
+}
+var daysInMonths = [31, null, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+function isLeapYearIndex(year) {
+  return year % 400 === 0 || year % 4 === 0 && year % 100 !== 0;
+}
+function validateDate(year, month, date5) {
+  return month >= 0 && month <= 11 && date5 >= 1 && date5 <= (daysInMonths[month] || (isLeapYearIndex(year) ? 29 : 28));
+}
+function validateDayOfYearDate(year, dayOfYear) {
+  return dayOfYear >= 1 && dayOfYear <= (isLeapYearIndex(year) ? 366 : 365);
+}
+function validateWeekDate(_year, week, day) {
+  return week >= 1 && week <= 53 && day >= 0 && day <= 6;
+}
+function validateTime(hours, minutes, seconds) {
+  if (hours === 24) {
+    return minutes === 0 && seconds === 0;
+  }
+  return seconds >= 0 && seconds < 60 && minutes >= 0 && minutes < 60 && hours >= 0 && hours < 25;
+}
+function validateTimezone(_hours, minutes) {
+  return minutes >= 0 && minutes <= 59;
+}
+
+// src/utils/dates.ts
+function parseIsoDateOrNull(value) {
+  if (!value) return null;
+  const parsed = parseISO(value);
+  return isValid(parsed) ? parsed : null;
+}
+
 // src/utils/isScannedSnapshotStale.ts
 var STALENESS_TOLERANCE_MS = 1e3;
 function isScannedSnapshotStale(snapshotTimestamp, fileMtimeMs) {
@@ -142116,6 +141909,7 @@ var StreamerServer = class {
   binding = false;
   cacheReady = false;
   apiKey;
+  apiKeySource;
   localNoAuth;
   logMenubarRequests;
   verbose;
@@ -142127,6 +141921,8 @@ var StreamerServer = class {
   publicUrl = null;
   pairTokens = new PairTokenStore();
   exchangeAttempts = /* @__PURE__ */ new Map();
+  sessionStartAttempts = /* @__PURE__ */ new Map();
+  sessionInputAttempts = /* @__PURE__ */ new Map();
   ptyGracePeriodMs;
   defaultSystemPrompt;
   // Map of sessionId → grace timer; fires to kill PTY after WS disconnect
@@ -142162,8 +141958,14 @@ var StreamerServer = class {
   constructor(config2) {
     this.sessionStatusBus.setMaxListeners(0);
     this.apiKey = config2.apiKey;
+    this.apiKeySource = config2.apiKeySource ?? "config";
     this.localNoAuth = config2.localNoAuth ?? false;
     this.logMenubarRequests = config2.logMenubarRequests ?? false;
+    if (this.localNoAuth) {
+      console.warn(
+        "[WARN] localNoAuth is ENABLED \u2014 all requests from localhost bypass authentication. Do not run with --local-no-auth in shared or production environments."
+      );
+    }
     this.verbose = config2.verbose ?? false;
     this.disableDb = config2.disableDb ?? false;
     this.scanProfiles = config2.scanProfiles;
@@ -142341,10 +142143,15 @@ var StreamerServer = class {
       });
     }
     const agentClient = this.agentClient;
+    const self2 = this;
     const apiDeps = {
-      apiKey: this.apiKey,
+      // ponytail: getter so rotateApiKey() takes effect without restarting the server
+      get apiKey() {
+        return self2.apiKey;
+      },
       localNoAuth: this.localNoAuth,
       logMenubarRequests: this.logMenubarRequests,
+      rotateApiKey: () => this.rotateApiKey(),
       publicUrl: this.publicUrl,
       browseRoot: this.browseRoot,
       ptyManager: this.ptyManager,
@@ -142375,8 +142182,8 @@ var StreamerServer = class {
       handleConversationsCount: (url2, res) => this.handleConversationsCount(url2, res),
       handleGetConversation: (id, url2, res, ifNoneMatch) => this.handleGetConversation(id, url2, res, ifNoneMatch),
       handleSearch: (url2, res) => this.handleSearch(url2, res),
+      handleListProjects: (url2, res) => handleListProjects(url2, res),
       handleGetPopularProjects: (url2, res) => this.handleGetPopularProjects(url2, res),
-      handleListProjectChats: (url2, res) => this.handleListProjectChats(url2, res),
       handlePairStart: (res) => this.handlePairStart(res),
       handlePairExchange: (req, res) => this.handlePairExchange(req, res),
       handleBrowse: (url2, res) => this.handleBrowse(url2, res),
@@ -142811,19 +142618,45 @@ var StreamerServer = class {
       machineName: hostname4()
     });
   }
-  checkExchangeRateLimit(ip) {
+  rotateApiKey() {
+    const oldKey = this.apiKey;
+    const newKey = generateApiKey();
+    const persisted = this.apiKeySource === "config";
+    if (persisted) setApiKey(newKey);
+    this.apiKey = newKey;
+    this.log.info("API key rotated", {
+      event: "auth.api_key_rotated",
+      oldKeyMasked: `${oldKey.slice(0, 6)}\u2026`,
+      newKeyMasked: `${newKey.slice(0, 6)}\u2026`,
+      persisted
+    });
+    return { newKey, persisted };
+  }
+  checkRateLimit(map2, key, limit, windowMs) {
     const now = Date.now();
-    const windowMs = 6e4;
-    const limit = 5;
-    const arr = (this.exchangeAttempts.get(ip) ?? []).filter((t2) => now - t2 < windowMs);
+    const arr = (map2.get(key) ?? []).filter((t2) => now - t2 < windowMs);
     if (arr.length >= limit) {
-      this.exchangeAttempts.set(ip, arr);
+      map2.set(key, arr);
       return false;
     }
     arr.push(now);
-    this.exchangeAttempts.set(ip, arr);
+    map2.set(key, arr);
+    setTimeout(() => {
+      const remaining = (map2.get(key) ?? []).filter((t2) => Date.now() - t2 < windowMs);
+      if (remaining.length === 0) map2.delete(key);
+      else map2.set(key, remaining);
+    }, windowMs);
     return true;
   }
+  checkExchangeRateLimit(ip) {
+    return this.checkRateLimit(this.exchangeAttempts, ip, 5, 6e4);
+  }
+  checkSessionStartRateLimit(ip) {
+    return this.checkRateLimit(this.sessionStartAttempts, ip, 10, 6e4);
+  }
+  checkSessionInputRateLimit(sessionId) {
+    return this.checkRateLimit(this.sessionInputAttempts, sessionId, 500, 6e4);
+  }
   async handleListConversations(url2, res) {
     const limit = intParam(url2, "limit", 50);
     const offset = intParam(url2, "offset", 0);
@@ -142985,21 +142818,6 @@ var StreamerServer = class {
     const projects = this.cache.getPopularProjects(limit);
     json2(res, 200, { projects, total: projects.length });
   }
-  async handleListProjectChats(url2, res) {
-    if (!this.cache || !this.projectsRepo || !this.conversationsRepo || !this.sessionsRepo || !this.cacheMetadataRepo) {
-      json2(res, 503, { error: "Cache not available" });
-      return;
-    }
-    await handleListProjectChats(url2, res, {
-      cache: this.cache,
-      projectsRepo: this.projectsRepo,
-      conversationsRepo: this.conversationsRepo,
-      sessionsRepo: this.sessionsRepo,
-      cacheMetadataRepo: this.cacheMetadataRepo,
-      getSessionResponses: () => this.sessionStore.list(this.ptyAttachedIds()),
-      getFreshScanner: () => this.getFreshScanner()
-    });
-  }
   buildStatCache(previousScanner) {
     if (!this.cache) return void 0;
     const dbStats = this.cache.getFileStats();
@@ -143476,6 +143294,10 @@ var StreamerServer = class {
     }
   }
   async handleSendInput(sessionId, req, res) {
+    if (!this.checkSessionInputRateLimit(sessionId)) {
+      json2(res, 429, { error: "Too many input requests for this session. Please slow down." });
+      return;
+    }
     if (this.agentConfig.enabled) {
       const body2 = await readBody(req);
       const cache = this.cache;
@@ -143757,6 +143579,13 @@ var StreamerServer = class {
     json2(res, 201, { sessionId: session.id });
   }
   async handleStartSession(req, res) {
+    const ip = req.socket?.remoteAddress ?? "unknown";
+    if (!this.checkSessionStartRateLimit(ip)) {
+      json2(res, 429, {
+        error: "Too many session start requests. Please wait before trying again."
+      });
+      return;
+    }
     if (this.agentConfig.enabled) {
       const body2 = await readBody(req);
       const result = await handleStartAgentSession(body2, {
@@ -144280,7 +144109,7 @@ async function checkForUpdate(opts) {
 }
 
 // src/updater/install.ts
-var import_node_fs17 = require("fs");
+var import_node_fs19 = require("fs");
 
 // src/updater/active-sessions.ts
 async function countActiveSessions(opts) {
@@ -144333,8 +144162,8 @@ function isBrewInstall(scriptPath = process.argv[1] ?? "") {
 
 // src/updater/download.ts
 var import_node_crypto4 = require("crypto");
-var import_node_fs7 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path10 = require("path");
 var import_promises15 = require("stream/promises");
 
 // src/updater/manifest.ts
@@ -144394,13 +144223,13 @@ async function downloadAndVerify(opts) {
       `Manifest references ${artifact.filename} but it is not attached to the release`
     );
   }
-  (0, import_node_fs7.mkdirSync)((0, import_node_path8.dirname)(targetPath), { recursive: true });
+  (0, import_node_fs8.mkdirSync)((0, import_node_path10.dirname)(targetPath), { recursive: true });
   const res = await fetch(asset.browserDownloadUrl);
   if (!res.ok || !res.body) {
     throw new Error(`Failed to download ${artifact.filename}: ${res.status} ${res.statusText}`);
   }
   const hash2 = (0, import_node_crypto4.createHash)("sha256");
-  const out = (0, import_node_fs7.createWriteStream)(targetPath);
+  const out = (0, import_node_fs8.createWriteStream)(targetPath);
   let bytes = 0;
   const measured = new TransformStream({
     transform(chunk, controller) {
@@ -144412,19 +144241,19 @@ async function downloadAndVerify(opts) {
   try {
     await (0, import_promises15.pipeline)(res.body.pipeThrough(measured), out);
   } catch (err) {
-    (0, import_node_fs7.rmSync)(targetPath, { force: true });
+    (0, import_node_fs8.rmSync)(targetPath, { force: true });
     throw err;
   }
   const actual = hash2.digest("hex");
   if (actual !== artifact.sha256) {
-    (0, import_node_fs7.rmSync)(targetPath, { force: true });
+    (0, import_node_fs8.rmSync)(targetPath, { force: true });
     throw new Error(
       `sha256 mismatch for ${artifact.filename}: expected ${artifact.sha256}, got ${actual}`
     );
   }
-  const stat10 = (0, import_node_fs7.statSync)(targetPath);
+  const stat10 = (0, import_node_fs8.statSync)(targetPath);
   if (stat10.size !== artifact.size) {
-    (0, import_node_fs7.rmSync)(targetPath, { force: true });
+    (0, import_node_fs8.rmSync)(targetPath, { force: true });
     throw new Error(
       `size mismatch for ${artifact.filename}: expected ${artifact.size}, got ${stat10.size}`
     );
@@ -144433,17 +144262,17 @@ async function downloadAndVerify(opts) {
 }
 
 // src/updater/paths.ts
-var import_node_os3 = require("os");
-var import_node_path9 = require("path");
-var THREADBASE_ROOT = (0, import_node_path9.join)((0, import_node_os3.homedir)(), ".threadbase");
-var RELEASES_DIR = (0, import_node_path9.join)(THREADBASE_ROOT, "releases");
-var CURRENT_SYMLINK = (0, import_node_path9.join)(THREADBASE_ROOT, "current");
-var DOWNLOAD_DIR = (0, import_node_path9.join)(THREADBASE_ROOT, "releases", ".tmp");
+var import_node_os4 = require("os");
+var import_node_path11 = require("path");
+var THREADBASE_ROOT = (0, import_node_path11.join)((0, import_node_os4.homedir)(), ".threadbase");
+var RELEASES_DIR = (0, import_node_path11.join)(THREADBASE_ROOT, "releases");
+var CURRENT_SYMLINK = (0, import_node_path11.join)(THREADBASE_ROOT, "current");
+var DOWNLOAD_DIR = (0, import_node_path11.join)(THREADBASE_ROOT, "releases", ".tmp");
 function releaseDir(version2) {
-  return (0, import_node_path9.join)(RELEASES_DIR, version2);
+  return (0, import_node_path11.join)(RELEASES_DIR, version2);
 }
 function downloadPath(version2, filename) {
-  return (0, import_node_path9.join)(DOWNLOAD_DIR, `${version2}-${filename}`);
+  return (0, import_node_path11.join)(DOWNLOAD_DIR, `${version2}-${filename}`);
 }
 
 // src/updater/restart.ts
@@ -144524,75 +144353,75 @@ async function stopService(opts = {}) {
 }
 
 // src/updater/stamp-version.ts
-var import_node_fs8 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path12 = require("path");
 function stampVersionTxt(destDir, version2) {
-  const distDir = (0, import_node_path10.join)(destDir, "dist");
-  (0, import_node_fs8.mkdirSync)(distDir, { recursive: true });
-  (0, import_node_fs8.writeFileSync)((0, import_node_path10.join)(distDir, "version.txt"), `${version2}+update
+  const distDir = (0, import_node_path12.join)(destDir, "dist");
+  (0, import_node_fs9.mkdirSync)(distDir, { recursive: true });
+  (0, import_node_fs9.writeFileSync)((0, import_node_path12.join)(distDir, "version.txt"), `${version2}+update
 `);
 }
 
 // src/updater/swap.ts
-var import_node_fs9 = require("fs");
-var import_node_path11 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path13 = require("path");
 var import_semver2 = __toESM(require_semver2(), 1);
 var KEEP_LAST_N = 2;
 function swapCurrent(version2) {
   const target = releaseDir(version2);
-  if (!(0, import_node_fs9.existsSync)(target)) {
+  if (!(0, import_node_fs10.existsSync)(target)) {
     throw new Error(`Cannot swap to ${version2}: ${target} does not exist`);
   }
   if (process.platform === "win32") {
     const tmp = `${CURRENT_SYMLINK}.new`;
-    (0, import_node_fs9.rmSync)(tmp, { recursive: true, force: true });
-    (0, import_node_fs9.cpSync)(target, tmp, { recursive: true });
-    if ((0, import_node_fs9.existsSync)(CURRENT_SYMLINK)) {
-      (0, import_node_fs9.rmSync)(CURRENT_SYMLINK, { recursive: true, force: true });
+    (0, import_node_fs10.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs10.cpSync)(target, tmp, { recursive: true });
+    if ((0, import_node_fs10.existsSync)(CURRENT_SYMLINK)) {
+      (0, import_node_fs10.rmSync)(CURRENT_SYMLINK, { recursive: true, force: true });
     }
-    (0, import_node_fs9.renameSync)(tmp, CURRENT_SYMLINK);
-    (0, import_node_fs9.copyFileSync)((0, import_node_path11.join)(CURRENT_SYMLINK, "dist", "cli.cjs"), (0, import_node_path11.join)(THREADBASE_ROOT, "cli.js"));
+    (0, import_node_fs10.renameSync)(tmp, CURRENT_SYMLINK);
+    (0, import_node_fs10.copyFileSync)((0, import_node_path13.join)(CURRENT_SYMLINK, "dist", "cli.cjs"), (0, import_node_path13.join)(THREADBASE_ROOT, "cli.js"));
     return;
   }
   const tmpLink = `${CURRENT_SYMLINK}.new`;
-  if ((0, import_node_fs9.existsSync)(tmpLink) || lstatSafeIsSymlink(tmpLink)) {
-    (0, import_node_fs9.unlinkSync)(tmpLink);
+  if ((0, import_node_fs10.existsSync)(tmpLink) || lstatSafeIsSymlink(tmpLink)) {
+    (0, import_node_fs10.unlinkSync)(tmpLink);
   }
-  (0, import_node_fs9.symlinkSync)(target, tmpLink);
-  (0, import_node_fs9.renameSync)(tmpLink, CURRENT_SYMLINK);
-  const cliJs = (0, import_node_path11.join)(THREADBASE_ROOT, "cli.js");
+  (0, import_node_fs10.symlinkSync)(target, tmpLink);
+  (0, import_node_fs10.renameSync)(tmpLink, CURRENT_SYMLINK);
+  const cliJs = (0, import_node_path13.join)(THREADBASE_ROOT, "cli.js");
   const tmpCliJs = `${cliJs}.new`;
-  if ((0, import_node_fs9.existsSync)(tmpCliJs) || lstatSafeIsSymlink(tmpCliJs)) (0, import_node_fs9.unlinkSync)(tmpCliJs);
-  (0, import_node_fs9.symlinkSync)((0, import_node_path11.join)(target, "dist", "cli.cjs"), tmpCliJs);
-  (0, import_node_fs9.renameSync)(tmpCliJs, cliJs);
+  if ((0, import_node_fs10.existsSync)(tmpCliJs) || lstatSafeIsSymlink(tmpCliJs)) (0, import_node_fs10.unlinkSync)(tmpCliJs);
+  (0, import_node_fs10.symlinkSync)((0, import_node_path13.join)(target, "dist", "cli.cjs"), tmpCliJs);
+  (0, import_node_fs10.renameSync)(tmpCliJs, cliJs);
 }
 function lstatSafeIsSymlink(path2) {
   try {
-    return (0, import_node_fs9.lstatSync)(path2).isSymbolicLink();
+    return (0, import_node_fs10.lstatSync)(path2).isSymbolicLink();
   } catch {
     return false;
   }
 }
 function pruneOldReleases(activeVersion, keep = KEEP_LAST_N) {
-  if (!(0, import_node_fs9.existsSync)(RELEASES_DIR)) return [];
-  const entries = (0, import_node_fs9.readdirSync)(RELEASES_DIR, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).filter((name) => import_semver2.default.valid(name) !== null);
+  if (!(0, import_node_fs10.existsSync)(RELEASES_DIR)) return [];
+  const entries = (0, import_node_fs10.readdirSync)(RELEASES_DIR, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).filter((name) => import_semver2.default.valid(name) !== null);
   const sorted = entries.sort((a, b2) => import_semver2.default.rcompare(a, b2));
   const toKeep = new Set(sorted.slice(0, keep));
   toKeep.add(activeVersion);
   const removed = [];
   for (const name of sorted) {
     if (toKeep.has(name)) continue;
-    (0, import_node_fs9.rmSync)(releaseDir(name), { recursive: true, force: true });
+    (0, import_node_fs10.rmSync)(releaseDir(name), { recursive: true, force: true });
     removed.push(name);
   }
   return removed;
 }
 function ensureReleasesDir() {
-  (0, import_node_fs9.mkdirSync)(RELEASES_DIR, { recursive: true });
+  (0, import_node_fs10.mkdirSync)(RELEASES_DIR, { recursive: true });
 }
 
 // src/updater/unpack.ts
-var import_node_fs16 = require("fs");
+var import_node_fs17 = require("fs");
 
 // node_modules/tar/dist/esm/index.min.js
 var import_events4 = __toESM(require("events"), 1);
@@ -144600,35 +144429,35 @@ var import_fs24 = __toESM(require("fs"), 1);
 var import_node_events3 = require("events");
 var import_node_stream3 = __toESM(require("stream"), 1);
 var import_node_string_decoder = require("string_decoder");
-var import_node_path12 = __toESM(require("path"), 1);
-var import_node_fs10 = __toESM(require("fs"), 1);
+var import_node_path14 = __toESM(require("path"), 1);
+var import_node_fs11 = __toESM(require("fs"), 1);
 var import_path20 = require("path");
 var import_events5 = require("events");
 var import_assert = __toESM(require("assert"), 1);
 var import_buffer = require("buffer");
 var Ps = __toESM(require("zlib"), 1);
 var import_zlib = __toESM(require("zlib"), 1);
-var import_node_path13 = require("path");
-var import_node_path14 = require("path");
+var import_node_path15 = require("path");
+var import_node_path16 = require("path");
 var import_fs25 = __toESM(require("fs"), 1);
 var import_fs26 = __toESM(require("fs"), 1);
 var import_path21 = __toESM(require("path"), 1);
-var import_node_path15 = require("path");
+var import_node_path17 = require("path");
 var import_path22 = __toESM(require("path"), 1);
-var import_node_fs11 = __toESM(require("fs"), 1);
+var import_node_fs12 = __toESM(require("fs"), 1);
 var import_node_assert = __toESM(require("assert"), 1);
 var import_node_crypto5 = require("crypto");
-var import_node_fs12 = __toESM(require("fs"), 1);
-var import_node_path16 = __toESM(require("path"), 1);
-var import_fs27 = __toESM(require("fs"), 1);
 var import_node_fs13 = __toESM(require("fs"), 1);
-var import_node_path17 = __toESM(require("path"), 1);
-var import_node_fs14 = __toESM(require("fs"), 1);
-var import_promises16 = __toESM(require("fs/promises"), 1);
 var import_node_path18 = __toESM(require("path"), 1);
-var import_node_path19 = require("path");
+var import_fs27 = __toESM(require("fs"), 1);
+var import_node_fs14 = __toESM(require("fs"), 1);
+var import_node_path19 = __toESM(require("path"), 1);
 var import_node_fs15 = __toESM(require("fs"), 1);
+var import_promises16 = __toESM(require("fs/promises"), 1);
 var import_node_path20 = __toESM(require("path"), 1);
+var import_node_path21 = require("path");
+var import_node_fs16 = __toESM(require("fs"), 1);
+var import_node_path22 = __toESM(require("path"), 1);
 var zr = Object.defineProperty;
 var Ur = (s3, t2) => {
   for (var e in t2) zr(s3, e, { get: t2[e], enumerable: true });
@@ -145522,12 +145351,12 @@ var F2 = class {
   }
 };
 var un = (s3, t2) => {
-  let i = s3, r = "", n, o = import_node_path13.posix.parse(s3).root || ".";
+  let i = s3, r = "", n, o = import_node_path15.posix.parse(s3).root || ".";
   if (Buffer.byteLength(i) < 100) n = [i, r, false];
   else {
-    r = import_node_path13.posix.dirname(i), i = import_node_path13.posix.basename(i);
+    r = import_node_path15.posix.dirname(i), i = import_node_path15.posix.basename(i);
     do
-      Buffer.byteLength(i) <= 100 && Buffer.byteLength(r) <= t2 ? n = [i, r, false] : Buffer.byteLength(i) > 100 && Buffer.byteLength(r) <= t2 ? n = [i.slice(0, 99), r, true] : (i = import_node_path13.posix.join(import_node_path13.posix.basename(r), i), r = import_node_path13.posix.dirname(r));
+      Buffer.byteLength(i) <= 100 && Buffer.byteLength(r) <= t2 ? n = [i, r, false] : Buffer.byteLength(i) > 100 && Buffer.byteLength(r) <= t2 ? n = [i.slice(0, 99), r, true] : (i = import_node_path15.posix.join(import_node_path15.posix.basename(r), i), r = import_node_path15.posix.dirname(r));
     while (r !== o && n === void 0);
     n || (n = [s3.slice(0, 99), "", true]);
   }
@@ -145573,7 +145402,7 @@ var ft = class s {
     if (t2 === "") return Buffer.allocUnsafe(0);
     let e = Buffer.byteLength(t2), i = 512 * Math.ceil(1 + e / 512), r = Buffer.allocUnsafe(i);
     for (let n = 0; n < 512; n++) r[n] = 0;
-    new F2({ path: ("PaxHeader/" + (0, import_node_path14.basename)(this.path ?? "")).slice(0, 99), mode: this.mode || 420, uid: this.uid, gid: this.gid, size: e, mtime: this.mtime, type: this.global ? "GlobalExtendedHeader" : "ExtendedHeader", linkpath: "", uname: this.uname || "", gname: this.gname || "", devmaj: 0, devmin: 0, atime: this.atime, ctime: this.ctime }).encode(r), r.write(t2, 512, e, "utf8");
+    new F2({ path: ("PaxHeader/" + (0, import_node_path16.basename)(this.path ?? "")).slice(0, 99), mode: this.mode || 420, uid: this.uid, gid: this.gid, size: e, mtime: this.mtime, type: this.global ? "GlobalExtendedHeader" : "ExtendedHeader", linkpath: "", uname: this.uname || "", gname: this.gname || "", devmaj: 0, devmin: 0, atime: this.atime, ctime: this.ctime }).encode(r), r.write(t2, 512, e, "utf8");
     for (let n = e + 512; n < r.length; n++) r[n] = 0;
     return r;
   }
@@ -145992,15 +145821,15 @@ var Qi = (s3, t2) => {
 var Mn = (s3) => {
   let t2 = new rt(s3), e = s3.file, i;
   try {
-    i = import_node_fs10.default.openSync(e, "r");
-    let r = import_node_fs10.default.fstatSync(i), n = s3.maxReadSize || 16 * 1024 * 1024;
+    i = import_node_fs11.default.openSync(e, "r");
+    let r = import_node_fs11.default.fstatSync(i), n = s3.maxReadSize || 16 * 1024 * 1024;
     if (r.size < n) {
-      let o = Buffer.allocUnsafe(r.size), h = import_node_fs10.default.readSync(i, o, 0, r.size, 0);
+      let o = Buffer.allocUnsafe(r.size), h = import_node_fs11.default.readSync(i, o, 0, r.size, 0);
       t2.end(h === o.byteLength ? o : o.subarray(0, h));
     } else {
       let o = 0, h = Buffer.allocUnsafe(n);
       for (; o < r.size; ) {
-        let a = import_node_fs10.default.readSync(i, h, 0, n, o);
+        let a = import_node_fs11.default.readSync(i, h, 0, n, o);
         if (a === 0) break;
         o += a, t2.write(h.subarray(0, a));
       }
@@ -146008,7 +145837,7 @@ var Mn = (s3) => {
     }
   } finally {
     if (typeof i == "number") try {
-      import_node_fs10.default.closeSync(i);
+      import_node_fs11.default.closeSync(i);
     } catch {
     }
   }
@@ -146016,7 +145845,7 @@ var Mn = (s3) => {
 var Bn = (s3, t2) => {
   let e = new rt(s3), i = s3.maxReadSize || 16 * 1024 * 1024, r = s3.file;
   return new Promise((o, h) => {
-    e.on("error", h), e.on("end", o), import_node_fs10.default.stat(r, (a, l) => {
+    e.on("error", h), e.on("end", o), import_node_fs11.default.stat(r, (a, l) => {
       if (a) h(a);
       else {
         let c = new _t(r, { readSize: i, size: l.size });
@@ -146029,7 +145858,7 @@ var Ct = K2(Mn, Bn, (s3) => new rt(s3), (s3) => new rt(s3), (s3, t2) => {
   t2?.length && Qi(s3, t2), s3.noResume || vn(s3);
 });
 var Ji = (s3, t2, e) => (s3 &= 4095, e && (s3 = (s3 | 384) & -19), t2 && (s3 & 256 && (s3 |= 64), s3 & 32 && (s3 |= 8), s3 & 4 && (s3 |= 1)), s3);
-var { isAbsolute: zn, parse: qs } = import_node_path15.win32;
+var { isAbsolute: zn, parse: qs } = import_node_path17.win32;
 var ce = (s3) => {
   let t2 = "", e = qs(s3);
   for (; zn(s3) || e.root; ) {
@@ -146738,11 +146567,11 @@ var $n = (s3, t2) => {
 };
 var fr = (s3, t2) => {
   t2.forEach((e) => {
-    e.charAt(0) === "@" ? Ct({ file: import_node_path12.default.resolve(s3.cwd, e.slice(1)), sync: true, noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
+    e.charAt(0) === "@" ? Ct({ file: import_node_path14.default.resolve(s3.cwd, e.slice(1)), sync: true, noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
   }), s3.end();
 };
 var dr = async (s3, t2) => {
-  for (let e of t2) e.charAt(0) === "@" ? await Ct({ file: import_node_path12.default.resolve(String(s3.cwd), e.slice(1)), noResume: true, onReadEntry: (i) => {
+  for (let e of t2) e.charAt(0) === "@" ? await Ct({ file: import_node_path14.default.resolve(String(s3.cwd), e.slice(1)), noResume: true, onReadEntry: (i) => {
     s3.add(i);
   } }) : s3.add(e);
   s3.end();
@@ -146769,29 +146598,29 @@ var ur = !Er && typeof mr == "number" ? mr | Sr | wr | yr : null;
 var us = ur !== null ? () => ur : jn ? (s3) => s3 < to ? eo : "w" : () => "w";
 var ps = (s3, t2, e) => {
   try {
-    return import_node_fs13.default.lchownSync(s3, t2, e);
+    return import_node_fs14.default.lchownSync(s3, t2, e);
   } catch (i) {
     if (i?.code !== "ENOENT") throw i;
   }
 };
 var Ei = (s3, t2, e, i) => {
-  import_node_fs13.default.lchown(s3, t2, e, (r) => {
+  import_node_fs14.default.lchown(s3, t2, e, (r) => {
     i(r && r?.code !== "ENOENT" ? r : null);
   });
 };
 var io = (s3, t2, e, i, r) => {
-  if (t2.isDirectory()) Es(import_node_path17.default.resolve(s3, t2.name), e, i, (n) => {
+  if (t2.isDirectory()) Es(import_node_path19.default.resolve(s3, t2.name), e, i, (n) => {
     if (n) return r(n);
-    let o = import_node_path17.default.resolve(s3, t2.name);
+    let o = import_node_path19.default.resolve(s3, t2.name);
     Ei(o, e, i, r);
   });
   else {
-    let n = import_node_path17.default.resolve(s3, t2.name);
+    let n = import_node_path19.default.resolve(s3, t2.name);
     Ei(n, e, i, r);
   }
 };
 var Es = (s3, t2, e, i) => {
-  import_node_fs13.default.readdir(s3, { withFileTypes: true }, (r, n) => {
+  import_node_fs14.default.readdir(s3, { withFileTypes: true }, (r, n) => {
     if (r) {
       if (r.code === "ENOENT") return i();
       if (r.code !== "ENOTDIR" && r.code !== "ENOTSUP") return i(r);
@@ -146807,12 +146636,12 @@ var Es = (s3, t2, e, i) => {
   });
 };
 var so = (s3, t2, e, i) => {
-  t2.isDirectory() && ws(import_node_path17.default.resolve(s3, t2.name), e, i), ps(import_node_path17.default.resolve(s3, t2.name), e, i);
+  t2.isDirectory() && ws(import_node_path19.default.resolve(s3, t2.name), e, i), ps(import_node_path19.default.resolve(s3, t2.name), e, i);
 };
 var ws = (s3, t2, e) => {
   let i;
   try {
-    i = import_node_fs13.default.readdirSync(s3, { withFileTypes: true });
+    i = import_node_fs14.default.readdirSync(s3, { withFileTypes: true });
   } catch (r) {
     let n = r;
     if (n?.code === "ENOENT") return;
@@ -146846,32 +146675,32 @@ var St = class extends Error {
   }
 };
 var no = (s3, t2) => {
-  import_node_fs14.default.stat(s3, (e, i) => {
+  import_node_fs15.default.stat(s3, (e, i) => {
     (e || !i.isDirectory()) && (e = new Se(s3, e?.code || "ENOTDIR")), t2(e);
   });
 };
 var gr = (s3, t2, e) => {
   s3 = f(s3);
   let i = t2.umask ?? 18, r = t2.mode | 448, n = (r & i) !== 0, o = t2.uid, h = t2.gid, a = typeof o == "number" && typeof h == "number" && (o !== t2.processUid || h !== t2.processGid), l = t2.preserve, c = t2.unlink, d = f(t2.cwd), S2 = (E2, x2) => {
-    E2 ? e(E2) : x2 && a ? Es(x2, o, h, (Le) => S2(Le)) : n ? import_node_fs14.default.chmod(s3, r, e) : e();
+    E2 ? e(E2) : x2 && a ? Es(x2, o, h, (Le) => S2(Le)) : n ? import_node_fs15.default.chmod(s3, r, e) : e();
   };
   if (s3 === d) return no(s3, S2);
   if (l) return import_promises16.default.mkdir(s3, { mode: r, recursive: true }).then((E2) => S2(null, E2 ?? void 0), S2);
-  let D2 = f(import_node_path18.default.relative(d, s3)).split("/");
+  let D2 = f(import_node_path20.default.relative(d, s3)).split("/");
   Ss(d, D2, r, c, d, void 0, S2);
 };
 var Ss = (s3, t2, e, i, r, n, o) => {
   if (t2.length === 0) return o(null, n);
-  let h = t2.shift(), a = f(import_node_path18.default.resolve(s3 + "/" + h));
-  import_node_fs14.default.mkdir(a, e, br(a, t2, e, i, r, n, o));
+  let h = t2.shift(), a = f(import_node_path20.default.resolve(s3 + "/" + h));
+  import_node_fs15.default.mkdir(a, e, br(a, t2, e, i, r, n, o));
 };
 var br = (s3, t2, e, i, r, n, o) => (h) => {
-  h ? import_node_fs14.default.lstat(s3, (a, l) => {
+  h ? import_node_fs15.default.lstat(s3, (a, l) => {
     if (a) a.path = a.path && f(a.path), o(a);
     else if (l.isDirectory()) Ss(s3, t2, e, i, r, n, o);
-    else if (i) import_node_fs14.default.unlink(s3, (c) => {
+    else if (i) import_node_fs15.default.unlink(s3, (c) => {
       if (c) return o(c);
-      import_node_fs14.default.mkdir(s3, e, br(s3, t2, e, i, r, n, o));
+      import_node_fs15.default.mkdir(s3, e, br(s3, t2, e, i, r, n, o));
     });
     else {
       if (l.isSymbolicLink()) return o(new St(s3, s3 + "/" + t2.join("/")));
@@ -146882,7 +146711,7 @@ var br = (s3, t2, e, i, r, n, o) => (h) => {
 var oo = (s3) => {
   let t2 = false, e;
   try {
-    t2 = import_node_fs14.default.statSync(s3).isDirectory();
+    t2 = import_node_fs15.default.statSync(s3).isDirectory();
   } catch (i) {
     e = i?.code;
   } finally {
@@ -146892,20 +146721,20 @@ var oo = (s3) => {
 var _r = (s3, t2) => {
   s3 = f(s3);
   let e = t2.umask ?? 18, i = t2.mode | 448, r = (i & e) !== 0, n = t2.uid, o = t2.gid, h = typeof n == "number" && typeof o == "number" && (n !== t2.processUid || o !== t2.processGid), a = t2.preserve, l = t2.unlink, c = f(t2.cwd), d = (E2) => {
-    E2 && h && ws(E2, n, o), r && import_node_fs14.default.chmodSync(s3, i);
+    E2 && h && ws(E2, n, o), r && import_node_fs15.default.chmodSync(s3, i);
   };
   if (s3 === c) return oo(c), d();
-  if (a) return d(import_node_fs14.default.mkdirSync(s3, { mode: i, recursive: true }) ?? void 0);
-  let T2 = f(import_node_path18.default.relative(c, s3)).split("/"), D2;
+  if (a) return d(import_node_fs15.default.mkdirSync(s3, { mode: i, recursive: true }) ?? void 0);
+  let T2 = f(import_node_path20.default.relative(c, s3)).split("/"), D2;
   for (let E2 = T2.shift(), x2 = c; E2 && (x2 += "/" + E2); E2 = T2.shift()) {
-    x2 = f(import_node_path18.default.resolve(x2));
+    x2 = f(import_node_path20.default.resolve(x2));
     try {
-      import_node_fs14.default.mkdirSync(x2, i), D2 = D2 || x2;
+      import_node_fs15.default.mkdirSync(x2, i), D2 = D2 || x2;
     } catch {
-      let Le = import_node_fs14.default.lstatSync(x2);
+      let Le = import_node_fs15.default.lstatSync(x2);
       if (Le.isDirectory()) continue;
       if (l) {
-        import_node_fs14.default.unlinkSync(x2), import_node_fs14.default.mkdirSync(x2, i), D2 = D2 || x2;
+        import_node_fs15.default.unlinkSync(x2), import_node_fs15.default.mkdirSync(x2, i), D2 = D2 || x2;
         continue;
       } else if (Le.isSymbolicLink()) return new St(x2, x2 + "/" + T2.join("/"));
     }
@@ -146927,14 +146756,14 @@ var ho = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;
 var ao = ho === "win32";
 var lo = (s3) => s3.split("/").slice(0, -1).reduce((e, i) => {
   let r = e.at(-1);
-  return r !== void 0 && (i = (0, import_node_path19.join)(r, i)), e.push(i || "/"), e;
+  return r !== void 0 && (i = (0, import_node_path21.join)(r, i)), e.push(i || "/"), e;
 }, []);
 var yi = class {
   #t = /* @__PURE__ */ new Map();
   #i = /* @__PURE__ */ new Map();
   #s = /* @__PURE__ */ new Set();
   reserve(t2, e) {
-    t2 = ao ? ["win32 parallelization disabled"] : t2.map((r) => ut((0, import_node_path19.join)(Tr(r))));
+    t2 = ao ? ["win32 parallelization disabled"] : t2.map((r) => ut((0, import_node_path21.join)(Tr(r))));
     let i = new Set(t2.map((r) => lo(r)).reduce((r, n) => r.concat(n)));
     this.#i.set(e, { dirs: i, paths: t2 });
     for (let r of t2) {
@@ -147024,17 +146853,17 @@ var fo = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;
 var Te = fo === "win32";
 var mo = 1024;
 var uo = (s3, t2) => {
-  if (!Te) return import_node_fs12.default.unlink(s3, t2);
+  if (!Te) return import_node_fs13.default.unlink(s3, t2);
   let e = s3 + ".DELETE." + (0, import_node_crypto5.randomBytes)(16).toString("hex");
-  import_node_fs12.default.rename(s3, e, (i) => {
+  import_node_fs13.default.rename(s3, e, (i) => {
     if (i) return t2(i);
-    import_node_fs12.default.unlink(e, t2);
+    import_node_fs13.default.unlink(e, t2);
   });
 };
 var po = (s3) => {
-  if (!Te) return import_node_fs12.default.unlinkSync(s3);
+  if (!Te) return import_node_fs13.default.unlinkSync(s3);
   let t2 = s3 + ".DELETE." + (0, import_node_crypto5.randomBytes)(16).toString("hex");
-  import_node_fs12.default.renameSync(s3, t2), import_node_fs12.default.unlinkSync(t2);
+  import_node_fs13.default.renameSync(s3, t2), import_node_fs13.default.unlinkSync(t2);
 };
 var vr = (s3, t2, e) => s3 !== void 0 && s3 === s3 >>> 0 ? s3 : t2 !== void 0 && t2 === t2 >>> 0 ? t2 : e;
 var Xt = class extends rt {
@@ -147074,7 +146903,7 @@ var Xt = class extends rt {
       if (t2.preserveOwner) throw new TypeError("cannot preserve owner in archive and also set owner explicitly");
       this.uid = t2.uid, this.gid = t2.gid, this.setOwner = true;
     } else this.uid = void 0, this.gid = void 0, this.setOwner = false;
-    this.preserveOwner = t2.preserveOwner === void 0 && typeof t2.uid != "number" ? process.getuid?.() === 0 : !!t2.preserveOwner, this.processUid = (this.preserveOwner || this.setOwner) && process.getuid ? process.getuid() : void 0, this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ? process.getgid() : void 0, this.maxDepth = typeof t2.maxDepth == "number" ? t2.maxDepth : mo, this.forceChown = t2.forceChown === true, this.win32 = !!t2.win32 || Te, this.newer = !!t2.newer, this.keep = !!t2.keep, this.noMtime = !!t2.noMtime, this.preservePaths = !!t2.preservePaths, this.unlink = !!t2.unlink, this.cwd = f(import_node_path16.default.resolve(t2.cwd || process.cwd())), this.strip = Number(t2.strip) || 0, this.processUmask = this.chmod ? typeof t2.processUmask == "number" ? t2.processUmask : Lr() : 0, this.umask = typeof t2.umask == "number" ? t2.umask : this.processUmask, this.dmode = t2.dmode || 511 & ~this.umask, this.fmode = t2.fmode || 438 & ~this.umask, this.on("entry", (e) => this[Dr](e));
+    this.preserveOwner = t2.preserveOwner === void 0 && typeof t2.uid != "number" ? process.getuid?.() === 0 : !!t2.preserveOwner, this.processUid = (this.preserveOwner || this.setOwner) && process.getuid ? process.getuid() : void 0, this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ? process.getgid() : void 0, this.maxDepth = typeof t2.maxDepth == "number" ? t2.maxDepth : mo, this.forceChown = t2.forceChown === true, this.win32 = !!t2.win32 || Te, this.newer = !!t2.newer, this.keep = !!t2.keep, this.noMtime = !!t2.noMtime, this.preservePaths = !!t2.preservePaths, this.unlink = !!t2.unlink, this.cwd = f(import_node_path18.default.resolve(t2.cwd || process.cwd())), this.strip = Number(t2.strip) || 0, this.processUmask = this.chmod ? typeof t2.processUmask == "number" ? t2.processUmask : Lr() : 0, this.umask = typeof t2.umask == "number" ? t2.umask : this.processUmask, this.dmode = t2.dmode || 511 & ~this.umask, this.fmode = t2.fmode || 438 & ~this.umask, this.on("entry", (e) => this[Dr](e));
   }
   warn(t2, e, i = {}) {
     return (t2 === "TAR_BAD_ARCHIVE" || t2 === "TAR_ABORT") && (i.recoverable = false), super.warn(t2, e, i);
@@ -147088,7 +146917,7 @@ var Xt = class extends rt {
     let [n, o] = ce(i), h = o.replaceAll(/\\/g, "/").split("/");
     if (h.includes("..") || Te && /^[a-z]:\.\.$/i.test(h[0] ?? "")) {
       if (e === "path" || r === "Link") return this.warn("TAR_ENTRY_ERROR", `${e} contains '..'`, { entry: t2, [e]: i }), false;
-      let a = import_node_path16.default.posix.dirname(t2.path), l = import_node_path16.default.posix.normalize(import_node_path16.default.posix.join(a, h.join("/")));
+      let a = import_node_path18.default.posix.dirname(t2.path), l = import_node_path18.default.posix.normalize(import_node_path18.default.posix.join(a, h.join("/")));
       if (l.startsWith("../") || l === "..") return this.warn("TAR_ENTRY_ERROR", `${e} escapes extraction directory`, { entry: t2, [e]: i }), false;
     }
     return n && (t2[e] = String(o), this.warn("TAR_ENTRY_INFO", `stripping ${n} from absolute ${e}`, { entry: t2, [e]: i })), true;
@@ -147106,12 +146935,12 @@ var Xt = class extends rt {
     }
     if (isFinite(this.maxDepth) && i.length > this.maxDepth) return this.warn("TAR_ENTRY_ERROR", "path excessively deep", { entry: t2, path: e, depth: i.length, maxDepth: this.maxDepth }), false;
     if (!this[Rs](t2, "path") || !this[Rs](t2, "linkpath")) return false;
-    if (t2.absolute = import_node_path16.default.isAbsolute(t2.path) ? f(import_node_path16.default.resolve(t2.path)) : f(import_node_path16.default.resolve(this.cwd, t2.path)), !this.preservePaths && typeof t2.absolute == "string" && t2.absolute.indexOf(this.cwd + "/") !== 0 && t2.absolute !== this.cwd) return this.warn("TAR_ENTRY_ERROR", "path escaped extraction target", { entry: t2, path: f(t2.path), resolvedPath: t2.absolute, cwd: this.cwd }), false;
+    if (t2.absolute = import_node_path18.default.isAbsolute(t2.path) ? f(import_node_path18.default.resolve(t2.path)) : f(import_node_path18.default.resolve(this.cwd, t2.path)), !this.preservePaths && typeof t2.absolute == "string" && t2.absolute.indexOf(this.cwd + "/") !== 0 && t2.absolute !== this.cwd) return this.warn("TAR_ENTRY_ERROR", "path escaped extraction target", { entry: t2, path: f(t2.path), resolvedPath: t2.absolute, cwd: this.cwd }), false;
     if (t2.absolute === this.cwd && t2.type !== "Directory" && t2.type !== "GNUDumpDir") return false;
     if (this.win32) {
-      let { root: r } = import_node_path16.default.win32.parse(String(t2.absolute));
+      let { root: r } = import_node_path18.default.win32.parse(String(t2.absolute));
       t2.absolute = r + ts(String(t2.absolute).slice(r.length));
-      let { root: n } = import_node_path16.default.win32.parse(t2.path);
+      let { root: n } = import_node_path18.default.win32.parse(t2.path);
       t2.path = n + ts(t2.path.slice(n.length));
     }
     return true;
@@ -147150,16 +146979,16 @@ var Xt = class extends rt {
   [Ts](t2, e) {
     let i = typeof t2.mode == "number" ? t2.mode & 4095 : this.fmode, r = new et(String(t2.absolute), { flags: us(t2.size), mode: i, autoClose: false });
     r.on("error", (a) => {
-      r.fd && import_node_fs12.default.close(r.fd, () => {
+      r.fd && import_node_fs13.default.close(r.fd, () => {
       }), r.write = () => true, this[O2](a, t2), e();
     });
     let n = 1, o = (a) => {
       if (a) {
-        r.fd && import_node_fs12.default.close(r.fd, () => {
+        r.fd && import_node_fs13.default.close(r.fd, () => {
         }), this[O2](a, t2), e();
         return;
       }
-      --n === 0 && r.fd !== void 0 && import_node_fs12.default.close(r.fd, (l) => {
+      --n === 0 && r.fd !== void 0 && import_node_fs13.default.close(r.fd, (l) => {
         l ? this[O2](l, t2) : this[$t](), e();
       });
     };
@@ -147168,12 +146997,12 @@ var Xt = class extends rt {
       if (typeof l == "number" && t2.mtime && !this.noMtime) {
         n++;
         let c = t2.atime || /* @__PURE__ */ new Date(), d = t2.mtime;
-        import_node_fs12.default.futimes(l, c, d, (S2) => S2 ? import_node_fs12.default.utimes(a, c, d, (T2) => o(T2 && S2)) : o());
+        import_node_fs13.default.futimes(l, c, d, (S2) => S2 ? import_node_fs13.default.utimes(a, c, d, (T2) => o(T2 && S2)) : o());
       }
       if (typeof l == "number" && this[ge](t2)) {
         n++;
         let c = this[be](t2), d = this[_e](t2);
-        typeof c == "number" && typeof d == "number" && import_node_fs12.default.fchown(l, c, d, (S2) => S2 ? import_node_fs12.default.chown(a, c, d, (T2) => o(T2 && S2)) : o());
+        typeof c == "number" && typeof d == "number" && import_node_fs13.default.fchown(l, c, d, (S2) => S2 ? import_node_fs13.default.chown(a, c, d, (T2) => o(T2 && S2)) : o());
       }
       o();
     });
@@ -147192,20 +147021,20 @@ var Xt = class extends rt {
       let n = 1, o = () => {
         --n === 0 && (e(), this[$t](), t2.resume());
       };
-      t2.mtime && !this.noMtime && (n++, import_node_fs12.default.utimes(String(t2.absolute), t2.atime || /* @__PURE__ */ new Date(), t2.mtime, o)), this[ge](t2) && (n++, import_node_fs12.default.chown(String(t2.absolute), Number(this[be](t2)), Number(this[_e](t2)), o)), o();
+      t2.mtime && !this.noMtime && (n++, import_node_fs13.default.utimes(String(t2.absolute), t2.atime || /* @__PURE__ */ new Date(), t2.mtime, o)), this[ge](t2) && (n++, import_node_fs13.default.chown(String(t2.absolute), Number(this[be](t2)), Number(this[_e](t2)), o)), o();
     });
   }
   [Cr](t2) {
     t2.unsupported = true, this.warn("TAR_ENTRY_UNSUPPORTED", `unsupported entry type: ${t2.type}`, { entry: t2 }), t2.resume();
   }
   [Ar](t2, e) {
-    let i = f(import_node_path16.default.relative(this.cwd, import_node_path16.default.resolve(import_node_path16.default.dirname(String(t2.absolute)), String(t2.linkpath)))).split("/");
+    let i = f(import_node_path18.default.relative(this.cwd, import_node_path18.default.resolve(import_node_path18.default.dirname(String(t2.absolute)), String(t2.linkpath)))).split("/");
     this[Re](t2, this.cwd, i, () => this[gi](t2, String(t2.linkpath), "symlink", e), (r) => {
       this[O2](r, t2), e();
     });
   }
   [Ir](t2, e) {
-    let i = f(import_node_path16.default.resolve(this.cwd, String(t2.linkpath))), r = f(String(t2.linkpath)).split("/");
+    let i = f(import_node_path18.default.resolve(this.cwd, String(t2.linkpath))), r = f(String(t2.linkpath)).split("/");
     this[Re](t2, this.cwd, r, () => this[gi](t2, i, "link", e), (n) => {
       this[O2](n, t2), e();
     });
@@ -147213,10 +147042,10 @@ var Xt = class extends rt {
   [Re](t2, e, i, r, n) {
     let o = i.shift();
     if (this.preservePaths || o === void 0) return r();
-    let h = import_node_path16.default.resolve(e, o);
-    import_node_fs12.default.lstat(h, (a, l) => {
+    let h = import_node_path18.default.resolve(e, o);
+    import_node_fs13.default.lstat(h, (a, l) => {
       if (a) return r();
-      if (l?.isSymbolicLink()) return n(new St(h, import_node_path16.default.resolve(h, i.join("/"))));
+      if (l?.isSymbolicLink()) return n(new St(h, import_node_path18.default.resolve(h, i.join("/"))));
       this[Re](t2, h, i, r, n);
     });
   }
@@ -147250,7 +147079,7 @@ var Xt = class extends rt {
       });
     }, n = () => {
       if (t2.absolute !== this.cwd) {
-        let h = f(import_node_path16.default.dirname(String(t2.absolute)));
+        let h = f(import_node_path18.default.dirname(String(t2.absolute)));
         if (h !== this.cwd) return this[yt](h, this.dmode, (a) => {
           if (a) {
             this[O2](a, t2), i();
@@ -147261,7 +147090,7 @@ var Xt = class extends rt {
       }
       o();
     }, o = () => {
-      import_node_fs12.default.lstat(String(t2.absolute), (h, a) => {
+      import_node_fs13.default.lstat(String(t2.absolute), (h, a) => {
         if (a && (this.keep || this.newer && a.mtime > (t2.mtime ?? a.mtime))) {
           this[Ls](t2), i();
           return;
@@ -147270,9 +147099,9 @@ var Xt = class extends rt {
         if (a.isDirectory()) {
           if (t2.type === "Directory") {
             let l = this.chmod && t2.mode && (a.mode & 4095) !== t2.mode, c = (d) => this[P2](d ?? null, t2, i);
-            return l ? import_node_fs12.default.chmod(String(t2.absolute), Number(t2.mode), c) : c();
+            return l ? import_node_fs13.default.chmod(String(t2.absolute), Number(t2.mode), c) : c();
           }
-          if (t2.absolute !== this.cwd) return import_node_fs12.default.rmdir(String(t2.absolute), (l) => this[P2](l ?? null, t2, i));
+          if (t2.absolute !== this.cwd) return import_node_fs13.default.rmdir(String(t2.absolute), (l) => this[P2](l ?? null, t2, i));
         }
         if (t2.absolute === this.cwd) return this[P2](null, t2, i);
         uo(String(t2.absolute), (l) => this[P2](l ?? null, t2, i));
@@ -147300,7 +147129,7 @@ var Xt = class extends rt {
     }
   }
   [gi](t2, e, i, r) {
-    import_node_fs12.default[i](e, String(t2.absolute), (n) => {
+    import_node_fs13.default[i](e, String(t2.absolute), (n) => {
       n ? this[O2](n, t2) : (this[$t](), t2.resume()), r();
     });
   }
@@ -147325,23 +147154,23 @@ var xe = class extends Xt {
       this[Oe] = true;
     }
     if (t2.absolute !== this.cwd) {
-      let n = f(import_node_path16.default.dirname(String(t2.absolute)));
+      let n = f(import_node_path18.default.dirname(String(t2.absolute)));
       if (n !== this.cwd) {
         let o = this[yt](n, this.dmode);
         if (o) return this[O2](o, t2);
       }
     }
-    let [e, i] = ye(() => import_node_fs12.default.lstatSync(String(t2.absolute)));
+    let [e, i] = ye(() => import_node_fs13.default.lstatSync(String(t2.absolute)));
     if (i && (this.keep || this.newer && i.mtime > (t2.mtime ?? i.mtime))) return this[Ls](t2);
     if (e || this[Os](t2, i)) return this[P2](null, t2);
     if (i.isDirectory()) {
       if (t2.type === "Directory") {
         let o = this.chmod && t2.mode && (i.mode & 4095) !== t2.mode, [h] = o ? ye(() => {
-          import_node_fs12.default.chmodSync(String(t2.absolute), Number(t2.mode));
+          import_node_fs13.default.chmodSync(String(t2.absolute), Number(t2.mode));
         }) : [];
         return this[P2](h, t2);
       }
-      let [n] = ye(() => import_node_fs12.default.rmdirSync(String(t2.absolute)));
+      let [n] = ye(() => import_node_fs13.default.rmdirSync(String(t2.absolute)));
       this[P2](n, t2);
     }
     let [r] = t2.absolute === this.cwd ? [] : ye(() => po(String(t2.absolute)));
@@ -147351,21 +147180,21 @@ var xe = class extends Xt {
     let i = typeof t2.mode == "number" ? t2.mode & 4095 : this.fmode, r = (h) => {
       let a;
       try {
-        import_node_fs12.default.closeSync(n);
+        import_node_fs13.default.closeSync(n);
       } catch (l) {
         a = l;
       }
       (h || a) && this[O2](h || a, t2), e();
     }, n;
     try {
-      n = import_node_fs12.default.openSync(String(t2.absolute), us(t2.size), i);
+      n = import_node_fs13.default.openSync(String(t2.absolute), us(t2.size), i);
     } catch (h) {
       return r(h);
     }
     let o = this.transform && this.transform(t2) || t2;
     o !== t2 && (o.on("error", (h) => this[O2](h, t2)), t2.pipe(o)), o.on("data", (h) => {
       try {
-        import_node_fs12.default.writeSync(n, h, 0, h.length);
+        import_node_fs13.default.writeSync(n, h, 0, h.length);
       } catch (a) {
         r(a);
       }
@@ -147374,10 +147203,10 @@ var xe = class extends Xt {
       if (t2.mtime && !this.noMtime) {
         let a = t2.atime || /* @__PURE__ */ new Date(), l = t2.mtime;
         try {
-          import_node_fs12.default.futimesSync(n, a, l);
+          import_node_fs13.default.futimesSync(n, a, l);
         } catch (c) {
           try {
-            import_node_fs12.default.utimesSync(String(t2.absolute), a, l);
+            import_node_fs13.default.utimesSync(String(t2.absolute), a, l);
           } catch {
             h = c;
           }
@@ -147386,10 +147215,10 @@ var xe = class extends Xt {
       if (this[ge](t2)) {
         let a = this[be](t2), l = this[_e](t2);
         try {
-          import_node_fs12.default.fchownSync(n, Number(a), Number(l));
+          import_node_fs13.default.fchownSync(n, Number(a), Number(l));
         } catch (c) {
           try {
-            import_node_fs12.default.chownSync(String(t2.absolute), Number(a), Number(l));
+            import_node_fs13.default.chownSync(String(t2.absolute), Number(a), Number(l));
           } catch {
             h = h || c;
           }
@@ -147405,11 +147234,11 @@ var xe = class extends Xt {
       return;
     }
     if (t2.mtime && !this.noMtime) try {
-      import_node_fs12.default.utimesSync(String(t2.absolute), t2.atime || /* @__PURE__ */ new Date(), t2.mtime);
+      import_node_fs13.default.utimesSync(String(t2.absolute), t2.atime || /* @__PURE__ */ new Date(), t2.mtime);
     } catch {
     }
     if (this[ge](t2)) try {
-      import_node_fs12.default.chownSync(String(t2.absolute), Number(this[be](t2)), Number(this[_e](t2)));
+      import_node_fs13.default.chownSync(String(t2.absolute), Number(this[be](t2)), Number(this[_e](t2)));
     } catch {
     }
     e(), t2.resume();
@@ -147425,30 +147254,30 @@ var xe = class extends Xt {
     if (this.preservePaths || i.length === 0) return r();
     let o = e;
     for (let h of i) {
-      o = import_node_path16.default.resolve(o, h);
-      let [a, l] = ye(() => import_node_fs12.default.lstatSync(o));
+      o = import_node_path18.default.resolve(o, h);
+      let [a, l] = ye(() => import_node_fs13.default.lstatSync(o));
       if (a) return r();
-      if (l.isSymbolicLink()) return n(new St(o, import_node_path16.default.resolve(e, i.join("/"))));
+      if (l.isSymbolicLink()) return n(new St(o, import_node_path18.default.resolve(e, i.join("/"))));
     }
     r();
   }
   [gi](t2, e, i, r) {
     let n = `${i}Sync`;
     try {
-      import_node_fs12.default[n](e, String(t2.absolute)), r(), t2.resume();
+      import_node_fs13.default[n](e, String(t2.absolute)), r(), t2.resume();
     } catch (o) {
       return this[O2](o, t2);
     }
   }
 };
 var Eo = (s3) => {
-  let t2 = new xe(s3), e = s3.file, i = import_node_fs11.default.statSync(e), r = s3.maxReadSize || 16 * 1024 * 1024;
+  let t2 = new xe(s3), e = s3.file, i = import_node_fs12.default.statSync(e), r = s3.maxReadSize || 16 * 1024 * 1024;
   new Be(e, { readSize: r, size: i.size }).pipe(t2);
 };
 var wo = (s3, t2) => {
   let e = new Xt(s3), i = s3.maxReadSize || 16 * 1024 * 1024, r = s3.file;
   return new Promise((o, h) => {
-    e.on("error", h), e.on("close", o), import_node_fs11.default.stat(r, (a, l) => {
+    e.on("error", h), e.on("close", o), import_node_fs12.default.stat(r, (a, l) => {
       if (a) h(a);
       else {
         let c = new _t(r, { readSize: i, size: l.size });
@@ -147464,15 +147293,15 @@ var yo = (s3, t2) => {
   let e = new kt(s3), i = true, r, n;
   try {
     try {
-      r = import_node_fs15.default.openSync(s3.file, "r+");
+      r = import_node_fs16.default.openSync(s3.file, "r+");
     } catch (a) {
-      if (a?.code === "ENOENT") r = import_node_fs15.default.openSync(s3.file, "w+");
+      if (a?.code === "ENOENT") r = import_node_fs16.default.openSync(s3.file, "w+");
       else throw a;
     }
-    let o = import_node_fs15.default.fstatSync(r), h = Buffer.alloc(512);
+    let o = import_node_fs16.default.fstatSync(r), h = Buffer.alloc(512);
     t: for (n = 0; n < o.size; n += 512) {
       for (let c = 0, d = 0; c < 512; c += d) {
-        if (d = import_node_fs15.default.readSync(r, h, c, h.length - c, n + c), n === 0 && h[0] === 31 && h[1] === 139) throw new Error("cannot append to compressed archives");
+        if (d = import_node_fs16.default.readSync(r, h, c, h.length - c, n + c), n === 0 && h[0] === 31 && h[1] === 139) throw new Error("cannot append to compressed archives");
         if (!d) break t;
       }
       let a = new F2(h);
@@ -147484,7 +147313,7 @@ var yo = (s3, t2) => {
     i = false, Ro(s3, e, n, r, t2);
   } finally {
     if (i) try {
-      import_node_fs15.default.closeSync(r);
+      import_node_fs16.default.closeSync(r);
     } catch {
     }
   }
@@ -147497,29 +147326,29 @@ var go = (s3, t2) => {
   t2 = Array.from(t2);
   let e = new wt(s3), i = (n, o, h) => {
     let a = (T2, D2) => {
-      T2 ? import_node_fs15.default.close(n, (E2) => h(T2)) : h(null, D2);
+      T2 ? import_node_fs16.default.close(n, (E2) => h(T2)) : h(null, D2);
     }, l = 0;
     if (o === 0) return a(null, 0);
     let c = 0, d = Buffer.alloc(512), S2 = (T2, D2) => {
       if (T2 || D2 === void 0) return a(T2);
-      if (c += D2, c < 512 && D2) return import_node_fs15.default.read(n, d, c, d.length - c, l + c, S2);
+      if (c += D2, c < 512 && D2) return import_node_fs16.default.read(n, d, c, d.length - c, l + c, S2);
       if (l === 0 && d[0] === 31 && d[1] === 139) return a(new Error("cannot append to compressed archives"));
       if (c < 512) return a(null, l);
       let E2 = new F2(d);
       if (!E2.cksumValid) return a(null, l);
       let x2 = 512 * Math.ceil((E2.size ?? 0) / 512);
       if (l + x2 + 512 > o || (l += x2 + 512, l >= o)) return a(null, l);
-      s3.mtimeCache && E2.mtime && s3.mtimeCache.set(String(E2.path), E2.mtime), c = 0, import_node_fs15.default.read(n, d, 0, 512, l, S2);
+      s3.mtimeCache && E2.mtime && s3.mtimeCache.set(String(E2.path), E2.mtime), c = 0, import_node_fs16.default.read(n, d, 0, 512, l, S2);
     };
-    import_node_fs15.default.read(n, d, 0, 512, l, S2);
+    import_node_fs16.default.read(n, d, 0, 512, l, S2);
   };
   return new Promise((n, o) => {
     e.on("error", o);
     let h = "r+", a = (l, c) => {
-      if (l && l.code === "ENOENT" && h === "r+") return h = "w+", import_node_fs15.default.open(s3.file, h, a);
+      if (l && l.code === "ENOENT" && h === "r+") return h = "w+", import_node_fs16.default.open(s3.file, h, a);
       if (l || !c) return o(l);
-      import_node_fs15.default.fstat(c, (d, S2) => {
-        if (d) return import_node_fs15.default.close(c, () => o(d));
+      import_node_fs16.default.fstat(c, (d, S2) => {
+        if (d) return import_node_fs16.default.close(c, () => o(d));
         i(c, S2.size, (T2, D2) => {
           if (T2) return o(T2);
           let E2 = new et(s3.file, { fd: c, start: D2 });
@@ -147527,16 +147356,16 @@ var go = (s3, t2) => {
         });
       });
     };
-    import_node_fs15.default.open(s3.file, h, a);
+    import_node_fs16.default.open(s3.file, h, a);
   });
 };
 var bo = (s3, t2) => {
   t2.forEach((e) => {
-    e.charAt(0) === "@" ? Ct({ file: import_node_path20.default.resolve(s3.cwd, e.slice(1)), sync: true, noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
+    e.charAt(0) === "@" ? Ct({ file: import_node_path22.default.resolve(s3.cwd, e.slice(1)), sync: true, noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
   }), s3.end();
 };
 var _o = async (s3, t2) => {
-  for (let e of t2) e.charAt(0) === "@" ? await Ct({ file: import_node_path20.default.resolve(String(s3.cwd), e.slice(1)), noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
+  for (let e of t2) e.charAt(0) === "@" ? await Ct({ file: import_node_path22.default.resolve(String(s3.cwd), e.slice(1)), noResume: true, onReadEntry: (i) => s3.add(i) }) : s3.add(e);
   s3.end();
 };
 var vt = K2(yo, go, () => {
@@ -147559,19 +147388,34 @@ var To = (s3) => {
 // src/updater/unpack.ts
 async function unpackTarball(opts) {
   const { tarballPath, destDir } = opts;
-  (0, import_node_fs16.rmSync)(destDir, { recursive: true, force: true });
-  (0, import_node_fs16.mkdirSync)(destDir, { recursive: true });
+  (0, import_node_fs17.rmSync)(destDir, { recursive: true, force: true });
+  (0, import_node_fs17.mkdirSync)(destDir, { recursive: true });
   await So({ file: tarballPath, cwd: destDir });
 }
 
+// src/updater/update-log.ts
+var import_node_fs18 = require("fs");
+var import_node_path23 = require("path");
+var LOG_PATH = (0, import_node_path23.join)(THREADBASE_ROOT, "update.log");
+function appendUpdateLog(line) {
+  try {
+    (0, import_node_fs18.mkdirSync)(THREADBASE_ROOT, { recursive: true });
+    (0, import_node_fs18.appendFileSync)(LOG_PATH, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+`, "utf8");
+  } catch {
+  }
+}
+
 // src/updater/install.ts
 async function runInstall(opts) {
   if (isBrewInstall()) {
-    return {
+    const result = {
       kind: "unsupported-install",
       reason: "Installed via Homebrew \u2014 run `brew upgrade tb-streamer` to update.",
       current: opts.currentVersion
     };
+    appendUpdateLog(`[no-op] ${result.reason}`);
+    return result;
   }
   const check2 = await checkForUpdate({
     currentVersion: opts.currentVersion,
@@ -147579,6 +147423,9 @@ async function runInstall(opts) {
     pinnedVersion: opts.pinnedVersion,
     allowMajor: opts.allowMajor
   });
+  appendUpdateLog(
+    `[check] current=${check2.current} latest=${check2.latest ?? "none"} status=${check2.reason}`
+  );
   if (!check2.wouldInstall) {
     return { kind: "no-op", reason: check2.reason, current: check2.current, latest: check2.latest };
   }
@@ -147604,33 +147451,27 @@ async function runInstall(opts) {
   const artifact = pickArtifact(manifest);
   if (opts.dryRun) {
     const asset = target.assets.find((a) => a.name === artifact.filename);
-    return {
-      kind: "dry-run",
-      latest: targetVersion,
-      tarballUrl: asset?.browserDownloadUrl ?? "(missing)"
-    };
+    const tarballUrl = asset?.browserDownloadUrl ?? "(missing)";
+    appendUpdateLog(
+      `[dry-run] would install ${check2.current} \u2192 ${targetVersion} from ${tarballUrl}`
+    );
+    return { kind: "dry-run", latest: targetVersion, tarballUrl };
   }
   if (opts.config.defer_if_active_sessions && !opts.force && opts.runningServer) {
     const active = await countActiveSessions(opts.runningServer);
     if (active.kind === "count" && active.count > 0) {
-      return {
-        kind: "deferred",
-        reason: `${active.count} active session(s); use --force to interrupt`,
-        activeSessions: active.count,
-        latest: targetVersion
-      };
+      const reason = `${active.count} active session(s); use --force to interrupt`;
+      appendUpdateLog(`[deferred] ${check2.current} \u2192 ${targetVersion}: ${reason}`);
+      return { kind: "deferred", reason, activeSessions: active.count, latest: targetVersion };
     }
     if (active.kind === "error") {
-      return {
-        kind: "deferred",
-        reason: `cannot determine active sessions (${active.reason}); use --force to override`,
-        activeSessions: -1,
-        latest: targetVersion
-      };
+      const reason = `cannot determine active sessions (${active.reason}); use --force to override`;
+      appendUpdateLog(`[deferred] ${check2.current} \u2192 ${targetVersion}: ${reason}`);
+      return { kind: "deferred", reason, activeSessions: -1, latest: targetVersion };
     }
   }
   ensureReleasesDir();
-  (0, import_node_fs17.mkdirSync)(DOWNLOAD_DIR, { recursive: true });
+  (0, import_node_fs19.mkdirSync)(DOWNLOAD_DIR, { recursive: true });
   const tarballPath = downloadPath(targetVersion, artifact.filename);
   await downloadAndVerify({ manifest, assets: target.assets, targetPath: tarballPath });
   const destDir = releaseDir(targetVersion);
@@ -147649,18 +147490,22 @@ async function runInstall(opts) {
   } catch (err) {
     restartMethod = `failed: ${err instanceof Error ? err.message : String(err)}`;
   }
-  return {
+  const installed = {
     kind: "installed",
     previous: check2.current,
     installed: targetVersion,
     pruned,
     restart: { method: restartMethod }
   };
+  appendUpdateLog(
+    `[installed] ${installed.previous} \u2192 ${installed.installed} restart=${installed.restart.method}${pruned.length > 0 ? ` pruned=${pruned.length}` : ""}`
+  );
+  return installed;
 }
 
 // cli/prod.ts
 var import_node_child_process6 = require("child_process");
-var import_node_fs19 = require("fs");
+var import_node_fs21 = require("fs");
 init_constants();
 init_launchd();
 init_marker();
@@ -147746,7 +147591,7 @@ async function runProdDoctor(opts) {
   return { findings, repairs };
 }
 var defaultSpawnTail = ({ files, lines, follow }) => {
-  const existing = files.filter((f2) => (0, import_node_fs19.existsSync)(f2));
+  const existing = files.filter((f2) => (0, import_node_fs21.existsSync)(f2));
   if (existing.length === 0) {
     return Promise.resolve({
       ok: false,
@@ -147800,8 +147645,8 @@ function registerProdCommands(program3) {
   const prod = new Command("prod").description(
     "Manage the launchd-supervised prod streamer"
   );
-  prod.command("start").description("Restore prod after a user-held suspension").option("--preserve-logs", "Keep existing stdout + stderr logs", false).action(async (opts) => {
-    if (opts.preserveLogs !== true) clearSupervisorLogs();
+  prod.command("start").description("Restore prod after a user-held suspension").option("--clear-logs", "Clear existing stdout + stderr logs", false).action(async (opts) => {
+    if (opts.clearLogs === true) clearSupervisorLogs();
     const r = await runProdStart();
     log4.info(r.message, void 0, "console");
     if (!r.ok) process.exitCode = 1;
@@ -147819,10 +147664,10 @@ function registerProdCommands(program3) {
     ];
     log4.info(parts.join("\n  "), void 0, "console");
   });
-  prod.command("restart").description("Stop + restart the supervised streamer (re-reads service definition)").option("--preserve-logs", "Keep existing stdout + stderr logs", false).action(async (opts) => {
+  prod.command("restart").description("Stop + restart the supervised streamer (re-reads service definition)").option("--clear-logs", "Clear existing stdout + stderr logs", false).action(async (opts) => {
     const sup = getSupervisor();
     const specPath = process.platform === "darwin" ? darwinPlistPath() : "";
-    if (opts.preserveLogs !== true) clearSupervisorLogs();
+    if (opts.clearLogs === true) clearSupervisorLogs();
     sup.bootoutAgent();
     sup.bootstrapAgent(specPath);
     const what = process.platform === "darwin" ? `agent restarted from ${specPath}` : `task '${TASK_NAME}' restarted`;
@@ -147876,6 +147721,7 @@ program2.command("serve").description("Start the streamer server").option("-p, -
   const apiKey = opts.apiKey ?? loadOrCreateApiKey();
   const publicUrl = opts.publicUrl ?? loadPublicUrl() ?? null;
   const isProdInvocation = opts.prod === true || process.ppid === 1;
+  if (!isProdInvocation) appendDevSessionMarker();
   let resolvedPort = requestedPort;
   if (!isProdInvocation) {
     const { resolveDevPlan: resolveDevPlan2, detectProdActive: detectProdActive2, isPortInUse: isPortInUse2, findFreePort: findFreePort2, takeoverProd: takeoverProd2 } = await Promise.resolve().then(() => (init_dev_takeover(), dev_takeover_exports));
@@ -147902,6 +147748,7 @@ program2.command("serve").description("Start the streamer server").option("-p, -
   const server = new StreamerServer({
     port: resolvedPort,
     apiKey,
+    apiKeySource: opts.apiKey ? "cli" : "config",
     localNoAuth: opts.localNoAuth,
     verbose: opts.verbose,
     logMenubarRequests: opts.logMenubarRequests,
@@ -147965,8 +147812,8 @@ program2.command("cache").description("Manage the local SQLite conversation cach
     `${process.env.HOME}/.threadbase/cache`
   ).action((opts) => {
     const { rmSync: rmSync6, existsSync: existsSync11 } = require("fs");
-    const { join: join24 } = require("path");
-    const dbPath = join24(opts.cacheDir, "cache.db");
+    const { join: join26 } = require("path");
+    const dbPath = join26(opts.cacheDir, "cache.db");
     for (const suffix of ["", "-shm", "-wal"]) {
       const f2 = dbPath + suffix;
       if (existsSync11(f2)) {
@@ -148015,6 +147862,9 @@ program2.command("update").description("Check for streamer updates from GitHub R
         pinnedVersion: opts.version,
         allowMajor: opts.allowMajor
       });
+      appendUpdateLog(
+        `[check] current=${result2.current} latest=${result2.latest ?? "none"} status=${result2.reason}`
+      );
       log7.info(`Current : ${result2.current}`, void 0, "console");
       log7.info(`Latest  : ${result2.latest ?? "(none)"}`, void 0, "console");
       log7.info(`Channel : ${cfg.channel}`, void 0, "console");
@@ -148067,6 +147917,7 @@ program2.command("update").description("Check for streamer updates from GitHub R
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
+    appendUpdateLog(`[error] ${message}`);
     log7.error(`Update failed: ${message}`, { error: message }, "console");
     process.exitCode = 1;
   }