@vibedeckx/linux-x64 0.3.2 → 0.3.4

package/dist/bin.js

@@ -13356,12 +13356,12 @@ var require_semver = __commonJS({
     }
     function replaceHyphen(comp, options) {
       const r = HYPHENRANGE_REGEXP;
-      return comp.replace(r, (_3, from, fM, fm, fp35, fpr, fb, to, tM, tm, tp, tpr) => {
+      return comp.replace(r, (_3, from, fM, fm, fp36, fpr, fb, to, tM, tm, tp, tpr) => {
         if (isX(fM)) {
           from = "";
         } else if (isX(fm)) {
           from = `>=${fM}.0.0${options?.includePrerelease ? "-0" : ""}`;
-        } else if (isX(fp35)) {
+        } else if (isX(fp36)) {
           from = `>=${fM}.${fm}.0${options?.includePrerelease ? "-0" : ""}`;
         } else if (fpr) {
           from = `>=${from}`;
@@ -26774,14 +26774,14 @@ var require_tls_helpers = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.CIPHER_SUITES = void 0;
     exports.getDefaultRootsData = getDefaultRootsData;
-    var fs14 = __require("fs");
+    var fs15 = __require("fs");
     exports.CIPHER_SUITES = process.env.GRPC_SSL_CIPHER_SUITES;
     var DEFAULT_ROOTS_FILE_PATH = process.env.GRPC_DEFAULT_SSL_ROOTS_FILE_PATH;
     var defaultRootsData = null;
     function getDefaultRootsData() {
       if (DEFAULT_ROOTS_FILE_PATH) {
         if (defaultRootsData === null) {
-          defaultRootsData = fs14.readFileSync(DEFAULT_ROOTS_FILE_PATH);
+          defaultRootsData = fs15.readFileSync(DEFAULT_ROOTS_FILE_PATH);
         }
         return defaultRootsData;
       }
@@ -31817,7 +31817,7 @@ var require_fetch = __commonJS({
     module.exports = fetch2;
     var asPromise = require_aspromise();
     var inquire = require_inquire();
-    var fs14 = inquire("fs");
+    var fs15 = inquire("fs");
     function fetch2(filename, options, callback) {
       if (typeof options === "function") {
         callback = options;
@@ -31826,8 +31826,8 @@ var require_fetch = __commonJS({
         options = {};
       if (!callback)
         return asPromise(fetch2, this, filename, options);
-      if (!options.xhr && fs14 && fs14.readFile)
-        return fs14.readFile(filename, function fetchReadFileCallback(err, contents) {
+      if (!options.xhr && fs15 && fs15.readFile)
+        return fs15.readFile(filename, function fetchReadFileCallback(err, contents) {
           return err && typeof XMLHttpRequest !== "undefined" ? fetch2.xhr(filename, options, callback) : err ? callback(err) : callback(null, options.binary ? contents : contents.toString("utf8"));
         });
       return fetch2.xhr(filename, options, callback);
@@ -38161,7 +38161,7 @@ var require_util3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.addCommonProtos = exports.loadProtosWithOptionsSync = exports.loadProtosWithOptions = void 0;
-    var fs14 = __require("fs");
+    var fs15 = __require("fs");
     var path22 = __require("path");
     var Protobuf = require_protobufjs();
     function addIncludePathResolver(root, includePaths) {
@@ -38173,7 +38173,7 @@ var require_util3 = __commonJS({
         for (const directory of includePaths) {
           const fullPath = path22.join(directory, target);
           try {
-            fs14.accessSync(fullPath, fs14.constants.R_OK);
+            fs15.accessSync(fullPath, fs15.constants.R_OK);
             return fullPath;
           } catch (err) {
             continue;
@@ -47995,7 +47995,7 @@ var require_certificate_provider = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.FileWatcherCertificateProvider = void 0;
-    var fs14 = __require("fs");
+    var fs15 = __require("fs");
     var logging = require_logging();
     var constants_1 = require_constants2();
     var util_1 = __require("util");
@@ -48003,7 +48003,7 @@ var require_certificate_provider = __commonJS({
     function trace2(text2) {
       logging.trace(constants_1.LogVerbosity.DEBUG, TRACER_NAME, text2);
     }
-    var readFilePromise = (0, util_1.promisify)(fs14.readFile);
+    var readFilePromise = (0, util_1.promisify)(fs15.readFile);
     var FileWatcherCertificateProvider = class {
       constructor(config2) {
         this.config = config2;
@@ -49915,7 +49915,7 @@ var require_otlp_grpc_env_configuration = __commonJS({
     var core_1 = require_src();
     var grpc_exporter_transport_1 = require_grpc_exporter_transport();
     var node_http_1 = (init_index_node_http(), __toCommonJS(index_node_http_exports));
-    var fs14 = __require("fs");
+    var fs15 = __require("fs");
     var path22 = __require("path");
     var api_1 = (init_esm(), __toCommonJS(esm_exports));
     function fallbackIfNullishOrBlank(signalSpecific, nonSignalSpecific) {
@@ -49965,7 +49965,7 @@ var require_otlp_grpc_env_configuration = __commonJS({
       const filePath = fallbackIfNullishOrBlank(signalSpecificPath, nonSignalSpecificPath);
       if (filePath != null) {
         try {
-          return fs14.readFileSync(path22.resolve(process.cwd(), filePath));
+          return fs15.readFileSync(path22.resolve(process.cwd(), filePath));
         } catch {
           api_1.diag.warn(warningMessage);
           return void 0;
@@ -51728,7 +51728,7 @@ var require_utils10 = __commonJS({
     var exporter_metrics_otlp_http_1 = require_src26();
     var exporter_metrics_otlp_proto_1 = require_src28();
     var sdk_logs_1 = require_src4();
-    var fs14 = __require("fs");
+    var fs15 = __require("fs");
     var RESOURCE_DETECTOR_ENVIRONMENT = "env";
     var RESOURCE_DETECTOR_HOST = "host";
     var RESOURCE_DETECTOR_OS = "os";
@@ -52151,21 +52151,21 @@ var require_utils10 = __commonJS({
         const httpsAgentOptions = {};
         if (tls.ca_file) {
           try {
-            httpsAgentOptions.ca = fs14.readFileSync(tls.ca_file);
+            httpsAgentOptions.ca = fs15.readFileSync(tls.ca_file);
           } catch (e) {
             api_1.diag.warn(`Failed to read TLS CA file at ${tls.ca_file}: ${e}`);
           }
         }
         if (tls.cert_file) {
           try {
-            httpsAgentOptions.cert = fs14.readFileSync(tls.cert_file);
+            httpsAgentOptions.cert = fs15.readFileSync(tls.cert_file);
           } catch (e) {
             api_1.diag.warn(`Failed to read TLS cert file at ${tls.cert_file}: ${e}`);
           }
         }
         if (tls.key_file) {
           try {
-            httpsAgentOptions.key = fs14.readFileSync(tls.key_file);
+            httpsAgentOptions.key = fs15.readFileSync(tls.key_file);
           } catch (e) {
             api_1.diag.warn(`Failed to read TLS key file at ${tls.key_file}: ${e}`);
           }
@@ -60537,14 +60537,14 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs14 = this.flowScalar(this.type);
+              const fs15 = this.flowScalar(this.type);
               if (atNextItem || it.value) {
-                map2.items.push({ start, key: fs14, sep: [] });
+                map2.items.push({ start, key: fs15, sep: [] });
                 this.onKeyLine = true;
               } else if (it.sep) {
-                this.stack.push(fs14);
+                this.stack.push(fs15);
               } else {
-                Object.assign(it, { key: fs14, sep: [] });
+                Object.assign(it, { key: fs15, sep: [] });
                 this.onKeyLine = true;
               }
               return;
@@ -60672,13 +60672,13 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs14 = this.flowScalar(this.type);
+              const fs15 = this.flowScalar(this.type);
               if (!it || it.value)
-                fc.items.push({ start: [], key: fs14, sep: [] });
+                fc.items.push({ start: [], key: fs15, sep: [] });
               else if (it.sep)
-                this.stack.push(fs14);
+                this.stack.push(fs15);
               else
-                Object.assign(it, { key: fs14, sep: [] });
+                Object.assign(it, { key: fs15, sep: [] });
               return;
             }
             case "flow-map-end":
@@ -60994,7 +60994,7 @@ var require_FileConfigFactory = __commonJS({
     exports.setLoggerProvider = exports.getSeverity = exports.setMeterProvider = exports.getTemporalityPreference = exports.setTracerProvider = exports.setPropagator = exports.setAttributeLimits = exports.setResourceAttributes = exports.parseConfigFile = exports.hasValidConfigFile = exports.FileConfigFactory = void 0;
     var core_1 = require_src();
     var configModel_1 = require_configModel();
-    var fs14 = __require("fs");
+    var fs15 = __require("fs");
     var yaml = require_dist();
     var utils_1 = require_utils11();
     var commonModel_1 = require_commonModel();
@@ -61016,7 +61016,7 @@ var require_FileConfigFactory = __commonJS({
     function hasValidConfigFile() {
       const configFile = (0, core_1.getStringFromEnv)("OTEL_CONFIG_FILE");
       if (configFile) {
-        if (!(configFile.endsWith(".yaml") || configFile.endsWith(".yml")) || !fs14.existsSync(configFile)) {
+        if (!(configFile.endsWith(".yaml") || configFile.endsWith(".yml")) || !fs15.existsSync(configFile)) {
           api_1.diag.warn(`Config file ${configFile} set on OTEL_CONFIG_FILE is not valid`);
           return false;
         }
@@ -61028,7 +61028,7 @@ var require_FileConfigFactory = __commonJS({
     function parseConfigFile(config2) {
       const supportedFileVersions = ["1.0-rc.3"];
       const configFile = (0, core_1.getStringFromEnv)("OTEL_CONFIG_FILE") || "";
-      const file2 = fs14.readFileSync(configFile, "utf8");
+      const file2 = fs15.readFileSync(configFile, "utf8");
       const parsedContent = yaml.parse(file2);
       if (parsedContent["file_format"] && supportedFileVersions.includes(parsedContent["file_format"])) {
         const disabled = (0, utils_1.getBooleanFromConfigFile)(parsedContent["disabled"]);
@@ -66890,7 +66890,7 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../../node_modules/.pnpm/sonic-boom@4.2.0/node_modules/sonic-boom/index.js"(exports, module) {
     "use strict";
-    var fs14 = __require("fs");
+    var fs15 = __require("fs");
     var EventEmitter3 = __require("events");
     var inherits = __require("util").inherits;
     var path22 = __require("path");
@@ -66947,20 +66947,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs14.mkdirSync(path22.dirname(file2), { recursive: true });
-          const fd = fs14.openSync(file2, flags, mode);
+          if (sonic.mkdir) fs15.mkdirSync(path22.dirname(file2), { recursive: true });
+          const fd = fs15.openSync(file2, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs14.mkdir(path22.dirname(file2), { recursive: true }, (err) => {
+        fs15.mkdir(path22.dirname(file2), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs14.open(file2, flags, mode, fileOpened);
+          fs15.open(file2, flags, mode, fileOpened);
         });
       } else {
-        fs14.open(file2, flags, mode, fileOpened);
+        fs15.open(file2, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -67001,16 +67001,16 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs14.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs14.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs15.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs15.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
         this.flush = flush;
         this.flushSync = flushSync;
         this._actualWrite = actualWrite;
-        fsWriteSync = () => fs14.writeSync(this.fd, this._writingBuf, "utf8");
-        fsWrite = () => fs14.write(this.fd, this._writingBuf, "utf8", this.release);
+        fsWriteSync = () => fs15.writeSync(this.fd, this._writingBuf, "utf8");
+        fsWrite = () => fs15.write(this.fd, this._writingBuf, "utf8", this.release);
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
       }
@@ -67066,7 +67066,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs14.fsyncSync(this.fd);
+          fs15.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -67178,7 +67178,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs14.fsync(this.fd, (err) => {
+            fs15.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -67280,7 +67280,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs14.close(fd, (err) => {
+          fs15.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -67329,7 +67329,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = fs14.writeSync(this.fd, buf, "utf8");
+          const n = fs15.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -67345,7 +67345,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs14.fsyncSync(this.fd);
+        fs15.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -67366,7 +67366,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs14.writeSync(this.fd, buf);
+          const n = fs15.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -67394,13 +67394,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf || this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = fs14.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = fs15.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs14.write(this.fd, this._writingBuf, "utf8", release);
+        fs15.write(this.fd, this._writingBuf, "utf8", release);
       }
     }
     function actualWriteBuffer() {
@@ -67409,7 +67409,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs14.writeSync(this.fd, this._writingBuf);
+          const written = fs15.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -67418,7 +67418,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs14.write(this.fd, this._writingBuf, release);
+        fs15.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -67434,12 +67434,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert2(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs14.fsync(sonic.fd, closeWrapped);
+        fs15.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs14.close(sonic.fd, done);
+          fs15.close(sonic.fd, done);
         } else {
           done();
         }
@@ -82850,12 +82850,12 @@ var require_dist2 = __commonJS({
         throw new Error(`Unknown format "${name25}"`);
       return f2;
     };
-    function addFormats(ajv, list, fs14, exportName) {
+    function addFormats(ajv, list, fs15, exportName) {
       var _a26;
       var _b18;
       (_a26 = (_b18 = ajv.opts.code).formats) !== null && _a26 !== void 0 ? _a26 : _b18.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f2 of list)
-        ajv.addFormat(f2, fs14[f2]);
+        ajv.addFormat(f2, fs15[f2]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -87525,12 +87525,12 @@ var require_range = __commonJS({
       debug("replaceGTE0", comp, options);
       return comp.trim().replace(re2[options.includePrerelease ? t.GTE0PRE : t.GTE0], "");
     };
-    var hyphenReplace = (incPr) => ($0, from, fM, fm, fp35, fpr, fb, to, tM, tm, tp, tpr) => {
+    var hyphenReplace = (incPr) => ($0, from, fM, fm, fp36, fpr, fb, to, tM, tm, tp, tpr) => {
       if (isX(fM)) {
         from = "";
       } else if (isX(fm)) {
         from = `>=${fM}.0.0${incPr ? "-0" : ""}`;
-      } else if (isX(fp35)) {
+      } else if (isX(fp36)) {
         from = `>=${fM}.${fm}.0${incPr ? "-0" : ""}`;
       } else if (fpr) {
         from = `>=${from}`;
@@ -90111,8 +90111,8 @@ var require_pretty_print = __commonJS({
       serializedRoute += serializeMetaData(route.metaData);
       return serializedRoute;
     }
-    function mergeSimilarRoutes(routes34) {
-      return routes34.reduce((mergedRoutes, route) => {
+    function mergeSimilarRoutes(routes35) {
+      return routes35.reduce((mergedRoutes, route) => {
         for (const nodeRoute of mergedRoutes) {
           if (deepEqual(route.opts.constraints, nodeRoute.opts.constraints) && deepEqual(route.metaData, nodeRoute.metaData)) {
             nodeRoute.method += ", " + route.method;
@@ -90124,18 +90124,18 @@ var require_pretty_print = __commonJS({
       }, []);
     }
     function serializeNode(node, prefix, options) {
-      let routes34 = node.routes;
+      let routes35 = node.routes;
       if (options.method === void 0) {
-        routes34 = routes34.map(normalizeRoute);
+        routes35 = routes35.map(normalizeRoute);
       }
-      routes34 = routes34.map((route) => {
+      routes35 = routes35.map((route) => {
         route.metaData = getRouteMetaData(route, options);
         return route;
       });
       if (options.method === void 0) {
-        routes34 = mergeSimilarRoutes(routes34);
+        routes35 = mergeSimilarRoutes(routes35);
       }
-      return routes34.map(serializeRoute).join(`
+      return routes35.map(serializeRoute).join(`
 ${prefix}`);
     }
     function buildObjectTree(node, tree, prefix, options) {
@@ -91402,9 +91402,9 @@ var require_find_my_way = __commonJS({
         pathIndex = paramEndIndex;
       }
     };
-    Router.prototype._rebuild = function(routes34) {
+    Router.prototype._rebuild = function(routes35) {
       this.reset();
-      for (const route of routes34) {
+      for (const route of routes35) {
         const { method, path: path22, opts, handler, store } = route;
         this._on(method, path22, opts, handler, store);
       }
@@ -100612,8 +100612,8 @@ var require_commonjs6 = __commonJS({
           return this.#fullpath = this.name;
         }
         const pv = p2.fullpath();
-        const fp35 = pv + (!p2.parent ? "" : this.sep) + name25;
-        return this.#fullpath = fp35;
+        const fp36 = pv + (!p2.parent ? "" : this.sep) + name25;
+        return this.#fullpath = fp36;
       }
       /**
        * On platforms other than windows, this is identical to fullpath.
@@ -101342,8 +101342,8 @@ var require_commonjs6 = __commonJS({
        *
        * @internal
        */
-      constructor(cwd = process.cwd(), pathImpl, sep2, { nocase, childrenCacheSize = 16 * 1024, fs: fs14 = defaultFS } = {}) {
-        this.#fs = fsFromOption(fs14);
+      constructor(cwd = process.cwd(), pathImpl, sep2, { nocase, childrenCacheSize = 16 * 1024, fs: fs15 = defaultFS } = {}) {
+        this.#fs = fsFromOption(fs15);
         if (cwd instanceof URL || cwd.startsWith("file://")) {
           cwd = (0, node_url_1.fileURLToPath)(cwd);
         }
@@ -101902,8 +101902,8 @@ var require_commonjs6 = __commonJS({
       /**
        * @internal
        */
-      newRoot(fs14) {
-        return new PathWin32(this.rootPath, IFDIR, void 0, this.roots, this.nocase, this.childrenCache(), { fs: fs14 });
+      newRoot(fs15) {
+        return new PathWin32(this.rootPath, IFDIR, void 0, this.roots, this.nocase, this.childrenCache(), { fs: fs15 });
       }
       /**
        * Return true if the provided path string is an absolute path
@@ -101932,8 +101932,8 @@ var require_commonjs6 = __commonJS({
       /**
        * @internal
        */
-      newRoot(fs14) {
-        return new PathPosix(this.rootPath, IFDIR, void 0, this.roots, this.nocase, this.childrenCache(), { fs: fs14 });
+      newRoot(fs15) {
+        return new PathPosix(this.rootPath, IFDIR, void 0, this.roots, this.nocase, this.childrenCache(), { fs: fs15 });
       }
       /**
        * Return true if the provided path string is an absolute path
@@ -104288,7 +104288,7 @@ var require_createHttpError = __commonJS({
 var require_send = __commonJS({
   "../../node_modules/.pnpm/@fastify+send@4.1.0/node_modules/@fastify/send/lib/send.js"(exports, module) {
     "use strict";
-    var fs14 = __require("node:fs");
+    var fs15 = __require("node:fs");
     var path22 = __require("node:path");
     var stream = __require("node:stream");
     var debug = __require("node:util").debuglog("send");
@@ -104497,7 +104497,7 @@ var require_send = __commonJS({
     }
     function tryStat(path23) {
       return new Promise((resolve4) => {
-        fs14.stat(path23, function onstat(error48, stat2) {
+        fs15.stat(path23, function onstat(error48, stat2) {
           resolve4({ error: error48, stat: stat2 });
         });
       });
@@ -104637,7 +104637,7 @@ var require_send = __commonJS({
           metadata: { path: path23, stat: stat2 }
         };
       }
-      const stream2 = fs14.createReadStream(path23, {
+      const stream2 = fs15.createReadStream(path23, {
         highWaterMark: options.highWaterMark,
         start: offset,
         end: Math.max(offset, offset + len - 1)
@@ -105135,18 +105135,18 @@ var require_dirList = __commonJS({
     "use strict";
     var os2 = __require("node:os");
     var path22 = __require("node:path");
-    var fs14 = __require("node:fs/promises");
+    var fs15 = __require("node:fs/promises");
     var fastq = require_queue();
     var fastqConcurrency = Math.max(1, os2.cpus().length - 1);
     var dirList = {
       _getExtendedInfo: async function(dir, info) {
         const depth = dir.split(path22.sep).length;
-        const files = await fs14.readdir(dir);
+        const files = await fs15.readdir(dir);
         const worker = async (filename) => {
           const filePath = path22.join(dir, filename);
           let stats;
           try {
-            stats = await fs14.stat(filePath);
+            stats = await fs15.stat(filePath);
           } catch {
             return;
           }
@@ -105190,7 +105190,7 @@ var require_dirList = __commonJS({
        */
       list: async function(dir, options, dotfiles) {
         const entries = { dirs: [], files: [] };
-        let files = await fs14.readdir(dir);
+        let files = await fs15.readdir(dir);
         if (dotfiles === "deny" || dotfiles === "ignore") {
           files = files.filter((file2) => file2.charAt(0) !== ".");
         }
@@ -105200,7 +105200,7 @@ var require_dirList = __commonJS({
         const worker = async (filename) => {
           let stats;
           try {
-            stats = await fs14.stat(path22.join(dir, filename));
+            stats = await fs15.stat(path22.join(dir, filename));
           } catch {
             return;
           }
@@ -105329,7 +105329,7 @@ var require_static = __commonJS({
     var { fileURLToPath: fileURLToPath4 } = __require("node:url");
     var { statSync: statSync2 } = __require("node:fs");
     var { glob } = require_commonjs7();
-    var fp35 = require_plugin2();
+    var fp36 = require_plugin2();
     var send = require_send2();
     var encodingNegotiator = require_accept_negotiator();
     var contentDisposition = require_content_disposition();
@@ -105433,7 +105433,7 @@ var require_static = __commonJS({
         } else {
           const indexes = new Set(opts.index === void 0 ? ["index.html"] : [].concat(opts.index));
           const indexDirs = /* @__PURE__ */ new Map();
-          const routes34 = /* @__PURE__ */ new Set();
+          const routes35 = /* @__PURE__ */ new Set();
           const roots = Array.isArray(sendOptions.root) ? sendOptions.root : [sendOptions.root];
           for (let rootPath of roots) {
             rootPath = rootPath.split(path22.win32.sep).join(path22.posix.sep);
@@ -105449,10 +105449,10 @@ var require_static = __commonJS({
             for (let file2 of files) {
               file2 = file2.split(path22.win32.sep).join(path22.posix.sep);
               const route = prefix + file2;
-              if (routes34.has(route)) {
+              if (routes35.has(route)) {
                 continue;
               }
-              routes34.add(route);
+              routes35.add(route);
               setUpHeadAndGet(routeOpts, route, `/${file2}`, rootPath);
               const key = path22.posix.basename(route);
               if (indexes.has(key) && !indexDirs.has(key)) {
@@ -105747,7 +105747,7 @@ var require_static = __commonJS({
         throw err;
       }
     }
-    module.exports = fp35(fastifyStatic2, {
+    module.exports = fp36(fastifyStatic2, {
       fastify: "5.x",
       name: "@fastify/static"
     });
@@ -112390,7 +112390,7 @@ var require_websocket2 = __commonJS({
     var { ServerResponse } = __require("node:http");
     var { PassThrough } = __require("node:stream");
     var { randomBytes: randomBytes3 } = __require("node:crypto");
-    var fp35 = require_plugin2();
+    var fp36 = require_plugin2();
     var WebSocket2 = require_ws();
     var Duplexify = require_duplexify();
     var kWs = /* @__PURE__ */ Symbol("ws-socket");
@@ -112576,7 +112576,7 @@ var require_websocket2 = __commonJS({
       }
       next();
     }
-    module.exports = fp35(fastifyWebsocket2, {
+    module.exports = fp36(fastifyWebsocket2, {
       fastify: "5.x",
       name: "@fastify/websocket"
     });
@@ -115020,7 +115020,7 @@ var require_multipart2 = __commonJS({
     "use strict";
     var Busboy = require_main();
     var os2 = __require("node:os");
-    var fp35 = require_plugin2();
+    var fp36 = require_plugin2();
     var { createWriteStream: createWriteStream2 } = __require("node:fs");
     var { unlink: unlink2 } = __require("node:fs/promises");
     var path22 = __require("node:path");
@@ -115469,7 +115469,7 @@ var require_multipart2 = __commonJS({
         }
       });
     }
-    module.exports = fp35(fastifyMultipart2, {
+    module.exports = fp36(fastifyMultipart2, {
       fastify: "5.x",
       name: "@fastify/multipart"
     });
@@ -115594,7 +115594,7 @@ var require_token_io = __commonJS({
     });
     module.exports = __toCommonJS2(token_io_exports);
     var import_path15 = __toESM3(__require("path"));
-    var import_fs8 = __toESM3(__require("fs"));
+    var import_fs9 = __toESM3(__require("fs"));
     var import_os4 = __toESM3(__require("os"));
     var import_token_error = require_token_error();
     function findRootDir() {
@@ -115602,7 +115602,7 @@ var require_token_io = __commonJS({
         let dir = process.cwd();
         while (dir !== import_path15.default.dirname(dir)) {
           const pkgPath = import_path15.default.join(dir, ".vercel");
-          if (import_fs8.default.existsSync(pkgPath)) {
+          if (import_fs9.default.existsSync(pkgPath)) {
             return dir;
           }
           dir = import_path15.default.dirname(dir);
@@ -115673,7 +115673,7 @@ var require_auth_config = __commonJS({
       writeAuthConfig: () => writeAuthConfig
     });
     module.exports = __toCommonJS2(auth_config_exports);
-    var fs14 = __toESM3(__require("fs"));
+    var fs15 = __toESM3(__require("fs"));
     var path22 = __toESM3(__require("path"));
     var import_token_util = require_token_util();
     function getAuthConfigPath() {
@@ -115688,10 +115688,10 @@ var require_auth_config = __commonJS({
     function readAuthConfig() {
       try {
         const authPath = getAuthConfigPath();
-        if (!fs14.existsSync(authPath)) {
+        if (!fs15.existsSync(authPath)) {
           return null;
         }
-        const content = fs14.readFileSync(authPath, "utf8");
+        const content = fs15.readFileSync(authPath, "utf8");
         if (!content) {
           return null;
         }
@@ -115703,10 +115703,10 @@ var require_auth_config = __commonJS({
     function writeAuthConfig(config2) {
       const authPath = getAuthConfigPath();
       const authDir = path22.dirname(authPath);
-      if (!fs14.existsSync(authDir)) {
-        fs14.mkdirSync(authDir, { mode: 504, recursive: true });
+      if (!fs15.existsSync(authDir)) {
+        fs15.mkdirSync(authDir, { mode: 504, recursive: true });
       }
-      fs14.writeFileSync(authPath, JSON.stringify(config2, null, 2), { mode: 384 });
+      fs15.writeFileSync(authPath, JSON.stringify(config2, null, 2), { mode: 384 });
     }
     function isValidAccessToken(authConfig) {
       if (!authConfig.token)
@@ -115853,7 +115853,7 @@ var require_token_util = __commonJS({
     });
     module.exports = __toCommonJS2(token_util_exports);
     var path22 = __toESM3(__require("path"));
-    var fs14 = __toESM3(__require("fs"));
+    var fs15 = __toESM3(__require("fs"));
     var import_token_error = require_token_error();
     var import_token_io = require_token_io();
     var import_auth_config = require_auth_config();
@@ -115938,12 +115938,12 @@ var require_token_util = __commonJS({
         );
       }
       const prjPath = path22.join(dir, ".vercel", "project.json");
-      if (!fs14.existsSync(prjPath)) {
+      if (!fs15.existsSync(prjPath)) {
         throw new import_token_error.VercelOidcTokenError(
           "project.json not found, have you linked your project with `vc link?`"
         );
       }
-      const prj = JSON.parse(fs14.readFileSync(prjPath, "utf8"));
+      const prj = JSON.parse(fs15.readFileSync(prjPath, "utf8"));
       if (typeof prj.projectId !== "string" && typeof prj.orgId !== "string") {
         throw new TypeError(
           "Expected a string-valued projectId property. Try running `vc link` to re-link your project."
@@ -115960,9 +115960,9 @@ var require_token_util = __commonJS({
       }
       const tokenPath = path22.join(dir, "com.vercel.token", `${projectId}.json`);
       const tokenJson = JSON.stringify(token);
-      fs14.mkdirSync(path22.dirname(tokenPath), { mode: 504, recursive: true });
-      fs14.writeFileSync(tokenPath, tokenJson);
-      fs14.chmodSync(tokenPath, 432);
+      fs15.mkdirSync(path22.dirname(tokenPath), { mode: 504, recursive: true });
+      fs15.writeFileSync(tokenPath, tokenJson);
+      fs15.chmodSync(tokenPath, 432);
       return;
     }
     function loadToken(projectId) {
@@ -115973,10 +115973,10 @@ var require_token_util = __commonJS({
         );
       }
       const tokenPath = path22.join(dir, "com.vercel.token", `${projectId}.json`);
-      if (!fs14.existsSync(tokenPath)) {
+      if (!fs15.existsSync(tokenPath)) {
         return null;
       }
-      const token = JSON.parse(fs14.readFileSync(tokenPath, "utf8"));
+      const token = JSON.parse(fs15.readFileSync(tokenPath, "utf8"));
       assertVercelOidcTokenResponse(token);
       return token;
     }
@@ -152239,9 +152239,9 @@ var require_pump = __commonJS({
   "../../node_modules/.pnpm/pump@3.0.3/node_modules/pump/index.js"(exports, module) {
     var once = require_once();
     var eos = require_end_of_stream2();
-    var fs14;
+    var fs15;
     try {
-      fs14 = __require("fs");
+      fs15 = __require("fs");
     } catch (e) {
     }
     var noop4 = function() {
@@ -152252,8 +152252,8 @@ var require_pump = __commonJS({
     };
     var isFS = function(stream) {
       if (!ancient) return false;
-      if (!fs14) return false;
-      return (stream instanceof (fs14.ReadStream || noop4) || stream instanceof (fs14.WriteStream || noop4)) && isFn(stream.close);
+      if (!fs15) return false;
+      return (stream instanceof (fs15.ReadStream || noop4) || stream instanceof (fs15.WriteStream || noop4)) && isFn(stream.close);
     };
     var isRequest = function(stream) {
       return stream.setHeader && isFn(stream.abort);
@@ -154377,6 +154377,8 @@ import path from "path";
 var VIBEDECKX_HOME = path.join(homedir(), ".vibedeckx");
 var DB_PATH = path.join(VIBEDECKX_HOME, "data.sqlite");
 var DEFAULT_PORT = 5173;
+var MIN_WORKER_VERSION = "0.0.0";
+var WORKER_VERSION_REPORTING_SINCE = "2026-08-03";
 
 // src/load-env.ts
 function getArg(argv, name25) {
@@ -169019,11 +169021,11 @@ function buildCommand(builderArgs) {
     }
   };
 }
-function* generateRouteMapHelpLines(routes34, docs, args) {
+function* generateRouteMapHelpLines(routes35, docs, args) {
   const { brief, fullDescription, hideRoute } = docs;
   const { headers } = args.text;
   yield args.ansiColor ? `\x1B[1m${headers.usage}\x1B[22m` : headers.usage;
-  for (const [name25, route] of Object.entries(routes34)) {
+  for (const [name25, route] of Object.entries(routes35)) {
     if (!hideRoute || !hideRoute[name25] || args.includeHidden) {
       const externalRouteName = args.config.caseStyle === "convert-camel-to-kebab" ? convertCamelCaseToKebabCase(name25) : name25;
       yield `  ${route.formatUsageLine({
@@ -169053,7 +169055,7 @@ function* generateRouteMapHelpLines(routes34, docs, args) {
   }
   yield "";
   yield args.ansiColor ? `\x1B[1m${headers.commands}\x1B[22m` : headers.commands;
-  const visibleRoutes = Object.entries(routes34).filter(
+  const visibleRoutes = Object.entries(routes35).filter(
     ([name25]) => !hideRoute || !hideRoute[name25] || args.includeHidden
   );
   const rows = visibleRoutes.map(([internalRouteName, route]) => {
@@ -169081,24 +169083,24 @@ function* generateRouteMapHelpLines(routes34, docs, args) {
   }
 }
 function buildRouteMap({
-  routes: routes34,
+  routes: routes35,
   defaultCommand: defaultCommandRoute,
   docs,
   aliases
 }) {
-  if (Object.entries(routes34).length === 0) {
+  if (Object.entries(routes35).length === 0) {
     throw new InternalError("Route map must contain at least one route");
   }
   const activeAliases = aliases ?? {};
   const aliasesByRoute = /* @__PURE__ */ new Map();
   for (const [alias, routeName] of Object.entries(activeAliases)) {
-    if (alias in routes34) {
+    if (alias in routes35) {
       throw new InternalError(`Cannot use "${alias}" as an alias when a route with that name already exists`);
     }
     const routeAliases = aliasesByRoute.get(routeName) ?? [];
     aliasesByRoute.set(routeName, [...routeAliases, alias]);
   }
-  const defaultCommand = defaultCommandRoute ? routes34[defaultCommandRoute] : void 0;
+  const defaultCommand = defaultCommandRoute ? routes35[defaultCommandRoute] : void 0;
   if (defaultCommand && defaultCommand.kind === RouteMapSymbol) {
     throw new InternalError(
       `Cannot use "${defaultCommandRoute}" as the default command because it is not a Command`
@@ -169107,7 +169109,7 @@ function buildRouteMap({
   const resolveRouteName = (input) => {
     if (input in activeAliases) {
       return activeAliases[input];
-    } else if (input in routes34) {
+    } else if (input in routes35) {
       return input;
     }
   };
@@ -169125,7 +169127,7 @@ function buildRouteMap({
       return `${args.prefix.join(" ")} ${routeNames.join("|")} ...`;
     },
     formatHelp: (config2) => {
-      const lines = [...generateRouteMapHelpLines(routes34, docs, config2)];
+      const lines = [...generateRouteMapHelpLines(routes35, docs, config2)];
       const text2 = lines.join("\n");
       return text2 + "\n";
     },
@@ -169168,11 +169170,11 @@ function buildRouteMap({
     },
     getRoutingTargetForInput: (input) => {
       const routeName = input in activeAliases ? activeAliases[input] : input;
-      return routes34[routeName];
+      return routes35[routeName];
     },
     getAllEntries() {
       const hiddenRoutes = docs.hideRoute;
-      return Object.entries(routes34).map(([originalRouteName, target]) => {
+      return Object.entries(routes35).map(([originalRouteName, target]) => {
         return {
           name: {
             original: originalRouteName,
@@ -169192,7 +169194,7 @@ async function run(app, inputs, context2) {
 }
 
 // src/command.ts
-import fs13 from "node:fs";
+import fs14 from "node:fs";
 import path21 from "node:path";
 
 // src/storage/sqlite.ts
@@ -185910,8 +185912,6 @@ var mapProject = (row) => ({
   path: row.path,
   is_remote: fromDbBool(row.is_remote),
   remote_path: row.remote_path ?? void 0,
-  remote_url: row.remote_url ?? void 0,
-  remote_api_key: row.remote_api_key ?? void 0,
   agent_mode: row.agent_mode ?? "local",
   executor_mode: row.executor_mode ?? "local",
   sync_up_config: row.sync_up_config ? JSON.parse(row.sync_up_config) : void 0,
@@ -185927,10 +185927,10 @@ var createCoreRepos = (kdb, h) => ({
         path: opts.path ?? null,
         remote_path: opts.remote_path ?? null,
         is_remote: h.toDbBool(false),
-        remote_url: null,
-        remote_api_key: null,
-        // Dead column: never populated by any current caller (kept only so
-        // legacy DDL/back-compat readers relying on its presence don't break).
+        // Dead columns: never populated by any current caller (kept only so
+        // legacy DDL/back-compat readers relying on their presence don't break).
+        // remote_url/remote_api_key are leftovers from the removed direct-URL
+        // (outbound) transport — all remote traffic rides reverse-connect now.
         remote_project_id: null,
         agent_mode: opts.agent_mode ?? "local",
         executor_mode: opts.executor_mode ?? "local",
@@ -186051,9 +186051,21 @@ var mapRemoteServer = (row) => ({
   status: row.status ?? "unknown",
   last_connected_at: row.last_connected_at ?? void 0,
   cross_remote_access: row.cross_remote_access ?? "off",
+  worker_version: row.worker_version ?? void 0,
+  worker_capabilities: parseWorkerCapabilities(row.worker_capabilities),
+  worker_version_reported_at: row.worker_version_reported_at ?? void 0,
   created_at: row.created_at,
   updated_at: row.updated_at
 });
+function parseWorkerCapabilities(raw) {
+  if (!raw) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed.filter((c) => typeof c === "string") : void 0;
+  } catch {
+    return void 0;
+  }
+}
 var mapProjectRemote = (row) => ({
   id: row.id,
   project_id: row.project_id,
@@ -186101,9 +186113,6 @@ var createRemoteServerRepos = (kdb, _h) => ({
       await kdb.insertInto("remote_servers").values({
         id,
         name: server.name,
-        url: null,
-        api_key: null,
-        connection_mode: "inbound",
         connect_token: null,
         connect_token_created_at: null,
         last_connected_at: null,
@@ -186152,6 +186161,14 @@ var createRemoteServerRepos = (kdb, _h) => ({
       if (status === "online") sets.last_connected_at = sql`datetime('now')`;
       await kdb.updateTable("remote_servers").set(sets).where("id", "=", id).execute();
     },
+    updateWorkerVersion: async (id, version2, capabilities) => {
+      await kdb.updateTable("remote_servers").set({
+        worker_version: version2,
+        worker_capabilities: JSON.stringify(capabilities),
+        worker_version_reported_at: sql`datetime('now')`,
+        updated_at: sql`datetime('now')`
+      }).where("id", "=", id).execute();
+    },
     generateToken: async (id, userId) => {
       const existing = await readRemoteServerRow(kdb, id, userId);
       if (!existing) return void 0;
@@ -186318,8 +186335,17 @@ var mapExecutorProcess = (row) => ({
   status: row.status
 });
 var mapRemoteExecutorProcess = (row) => ({
-  ...row,
-  status: row.status
+  local_process_id: row.local_process_id,
+  remote_server_id: row.remote_server_id,
+  remote_process_id: row.remote_process_id,
+  executor_id: row.executor_id,
+  project_id: row.project_id,
+  branch: row.branch,
+  started_at: row.started_at,
+  status: row.status,
+  exit_code: row.exit_code,
+  finished_at: row.finished_at,
+  machine_id: row.machine_id
 });
 var createExecutorRepos = (kdb, h) => ({
   executorGroups: {
@@ -187149,6 +187175,10 @@ var createSearchCacheRepos = (kdb, _h) => ({
       ]).executeTakeFirstOrThrow();
       return { running: Number(row.running) };
     },
+    countRunningRemoteSessions: async () => {
+      const row = await kdb.selectFrom("session_search_cache as c").innerJoin("remote_session_mappings as mapping", (join2) => join2.onRef("mapping.local_session_id", "=", "c.local_session_id").onRef("mapping.project_id", "=", "c.project_id").onRef("mapping.remote_server_id", "=", "c.target_id")).innerJoin("project_remotes as association", (join2) => join2.onRef("association.project_id", "=", "c.project_id").onRef("association.remote_server_id", "=", "c.target_id")).where("c.target_id", "!=", "local").where("c.deleted_at", "is", null).where("c.status", "=", "running").select([sql`count(*)`.as("n")]).executeTakeFirstOrThrow();
+      return Number(row.n);
+    },
     updateRemoteSessionActivity: async (entry) => {
       return kdb.transaction().execute(async (trx) => {
         const authorized = await trx.selectFrom("remote_session_mappings as mapping").innerJoin("project_remotes as association", (join2) => join2.onRef("association.project_id", "=", "mapping.project_id").onRef("association.remote_server_id", "=", "mapping.remote_server_id")).select("mapping.branch").where("mapping.local_session_id", "=", entry.localSessionId).where("mapping.project_id", "=", entry.projectId).where("mapping.remote_server_id", "=", entry.targetId).where("mapping.remote_session_id", "=", entry.remoteSessionId).executeTakeFirst();
@@ -203388,6 +203418,14 @@ var createDatabase = (dbPath) => {
       `);
     }
   }
+  {
+    const workerVersionInfo = db.prepare("PRAGMA table_info(remote_servers)").all();
+    for (const column of ["worker_version", "worker_capabilities", "worker_version_reported_at"]) {
+      if (!workerVersionInfo.some((col) => col.name === column)) {
+        db.exec(`ALTER TABLE remote_servers ADD COLUMN ${column} TEXT`);
+      }
+    }
+  }
   db.exec("UPDATE remote_servers SET status = 'offline' WHERE status = 'online'");
   {
     const oldIndex = db.prepare(
@@ -238501,16 +238539,12 @@ function resolveUserId(authResult) {
 }
 
 // src/routes/project-routes.ts
-function sanitizeProject(project) {
-  const { remote_api_key, ...safe } = project;
-  return { ...safe, has_remote_api_key: !!remote_api_key };
-}
 var routes2 = async (fastify2) => {
   fastify2.get("/api/projects", async (req, reply) => {
     const authResult = requireAuth(req, reply);
     if (authResult === null) return;
     const userId = resolveUserId(authResult);
-    const projects = (await fastify2.storage.projects.getAll(userId)).map(sanitizeProject);
+    const projects = await fastify2.storage.projects.getAll(userId);
     return reply.code(200).send({ projects });
   });
   fastify2.get("/api/projects/:id", async (req, reply) => {
@@ -238521,7 +238555,7 @@ var routes2 = async (fastify2) => {
     if (!project) {
       return reply.code(404).send({ error: "Project not found" });
     }
-    return reply.code(200).send({ project: sanitizeProject(project) });
+    return reply.code(200).send({ project });
   });
   fastify2.post("/api/dialog/select-folder", async (req, reply) => {
     const folderPath = await selectFolder();
@@ -238592,7 +238626,7 @@ var routes2 = async (fastify2) => {
       agent_mode: agentMode,
       executor_mode: executorMode
     }, userId);
-    return reply.code(201).send({ project: sanitizeProject(project) });
+    return reply.code(201).send({ project });
   });
   fastify2.put("/api/projects/:id", async (req, reply) => {
     const authResult = requireAuth(req, reply);
@@ -238632,7 +238666,7 @@ var routes2 = async (fastify2) => {
     if (!updated) {
       return reply.code(404).send({ error: "Project not found" });
     }
-    return reply.code(200).send({ project: sanitizeProject(updated) });
+    return reply.code(200).send({ project: updated });
   });
   fastify2.delete("/api/projects/:id", async (req, reply) => {
     const authResult = requireAuth(req, reply);
@@ -238771,11 +238805,101 @@ function requireUserFacingOrTrustedProxyUserId(request, reply) {
   return authResult === void 0 && request.server.authEnabled ? void 0 : resolveUserId(authResult);
 }
 
+// src/update-check.ts
+var SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/;
+async function fetchLatestPublishedVersion(pkg = "vibedeckx", fetchImpl = fetch) {
+  try {
+    const response = await fetchImpl(
+      `https://registry.npmjs.org/${pkg}/latest`,
+      { signal: AbortSignal.timeout(4e3) }
+    );
+    if (!response.ok) return void 0;
+    const body = await response.json();
+    return typeof body.version === "string" && parseSemver(body.version) ? body.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parseSemver(version2) {
+  const match2 = SEMVER_RE.exec(version2);
+  if (!match2) return void 0;
+  return {
+    core: [match2[1], match2[2], match2[3]],
+    prerelease: match2[4]?.split(".")
+  };
+}
+function compareNumericStrings(a, b2) {
+  if (a.length !== b2.length) return a.length - b2.length;
+  return a < b2 ? -1 : a > b2 ? 1 : 0;
+}
+function comparePrereleaseIdentifiers(a, b2) {
+  const aNumeric = /^\d+$/.test(a);
+  const bNumeric = /^\d+$/.test(b2);
+  if (aNumeric && bNumeric) return compareNumericStrings(a, b2);
+  if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+  return a < b2 ? -1 : a > b2 ? 1 : 0;
+}
+function compareSemver(a, b2) {
+  for (let i = 0; i < 3; i += 1) {
+    const compared = compareNumericStrings(a.core[i], b2.core[i]);
+    if (compared !== 0) return compared;
+  }
+  if (!a.prerelease && !b2.prerelease) return 0;
+  if (!a.prerelease) return 1;
+  if (!b2.prerelease) return -1;
+  const length = Math.max(a.prerelease.length, b2.prerelease.length);
+  for (let i = 0; i < length; i += 1) {
+    const aId = a.prerelease[i];
+    const bId = b2.prerelease[i];
+    if (aId === void 0) return -1;
+    if (bId === void 0) return 1;
+    const compared = comparePrereleaseIdentifiers(aId, bId);
+    if (compared !== 0) return compared;
+  }
+  return 0;
+}
+function compareVersionStrings(a, b2) {
+  const parsedA = parseSemver(a);
+  const parsedB = parseSemver(b2);
+  if (!parsedA || !parsedB) return void 0;
+  return compareSemver(parsedA, parsedB);
+}
+function compareUpdateStatus(current, latest) {
+  if (latest === void 0) return "unknown";
+  const currentParsed = parseSemver(current);
+  const latestParsed = parseSemver(latest);
+  if (!currentParsed || !latestParsed) return "unknown";
+  return compareSemver(latestParsed, currentParsed) > 0 ? "update-available" : "up-to-date";
+}
+
 // src/routes/remote-server-routes.ts
 function sanitizeServer(server) {
   const { connect_token: _t, ...safe } = server;
   return safe;
 }
+var npmLatestCache;
+var npmLatestRefreshInFlight = false;
+function getLatestWorkerVersion() {
+  const ttlMs = npmLatestCache?.value !== void 0 ? 60 * 60 * 1e3 : 5 * 60 * 1e3;
+  const fresh = npmLatestCache !== void 0 && Date.now() - npmLatestCache.fetchedAt < ttlMs;
+  if (!fresh && !npmLatestRefreshInFlight) {
+    npmLatestRefreshInFlight = true;
+    void fetchLatestPublishedVersion().then((value) => {
+      npmLatestCache = { value, fetchedAt: Date.now() };
+    }).finally(() => {
+      npmLatestRefreshInFlight = false;
+    });
+  }
+  return npmLatestCache?.value;
+}
+function workerUpdateStatus(workerVersion, latest) {
+  if (!workerVersion) return "unreported";
+  const vsMin = compareVersionStrings(workerVersion, MIN_WORKER_VERSION);
+  if (vsMin !== void 0 && vsMin < 0) return "behind-min";
+  const vsLatest = latest === void 0 ? void 0 : compareVersionStrings(workerVersion, latest);
+  if (vsLatest !== void 0 && vsLatest < 0) return "behind-latest";
+  return "current";
+}
 var CROSS_REMOTE_ACCESS_VALUES = ["off", "read", "exec"];
 var isCrossRemoteAccess = (value) => typeof value === "string" && CROSS_REMOTE_ACCESS_VALUES.includes(value);
 var routes3 = async (fastify2) => {
@@ -238783,7 +238907,12 @@ var routes3 = async (fastify2) => {
     const userId = requireUserFacingUserId(request, reply);
     if (userId === null) return;
     const servers = await fastify2.storage.remoteServers.getAll(userId);
-    return reply.send(servers.map(sanitizeServer));
+    const latest = getLatestWorkerVersion();
+    return reply.send(servers.map((server) => ({
+      ...sanitizeServer(server),
+      latest_worker_version: latest,
+      worker_update_status: workerUpdateStatus(server.worker_version, latest)
+    })));
   });
   fastify2.post("/api/remote-servers", async (request, reply) => {
     const userId = requireUserFacingUserId(request, reply);
@@ -238942,12 +239071,94 @@ var routes3 = async (fastify2) => {
 };
 var remote_server_routes_default = (0, import_fastify_plugin4.default)(routes3, { name: "remote-server-routes" });
 
-// src/routes/project-remote-routes.ts
+// src/routes/worker-stats-routes.ts
 var import_fastify_plugin5 = __toESM(require_plugin2(), 1);
+var API_KEY = process.env.VIBEDECKX_API_KEY || void 0;
+var STALE_WORKER_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1e3;
+var PHASE4_UNKNOWN_SHARE_MAX = 0.05;
+var PHASE4_DEPRECATION_DAYS = 60;
+function parseDbTimestamp3(ts) {
+  if (!ts) return void 0;
+  const ms = Date.parse(ts.replace(" ", "T") + "Z");
+  return Number.isNaN(ms) ? void 0 : ms;
+}
+function countByVersion(versions) {
+  const counts = {};
+  for (const version2 of versions) {
+    const key = version2 ?? "unknown";
+    counts[key] = (counts[key] ?? 0) + 1;
+  }
+  return counts;
+}
+function oldestVersion(versions) {
+  let oldest;
+  for (const version2 of versions) {
+    if (oldest === void 0) {
+      oldest = version2;
+      continue;
+    }
+    const cmp = compareVersionStrings(version2, oldest);
+    if (cmp !== void 0 && cmp < 0) oldest = version2;
+  }
+  return oldest;
+}
+var routes4 = async (fastify2) => {
+  fastify2.get("/api/admin/worker-version-stats", async (request, reply) => {
+    const apiKeyHeader = request.headers["x-vibedeckx-api-key"];
+    const isOperator = API_KEY !== void 0 && apiKeyHeader !== void 0 || !fastify2.authEnabled && API_KEY === void 0;
+    if (!isOperator) return reply.code(404).send({ error: "Not found" });
+    const now3 = Date.now();
+    const servers = await fastify2.storage.remoteServers.getAll();
+    const connected = servers.filter((server) => fastify2.reverseConnectManager.isConnected(server.id));
+    const everActive = servers.filter((server) => server.last_connected_at !== void 0);
+    const connectedVersions = connected.map((server) => server.worker_version);
+    const unknownConnected = connectedVersions.filter((v2) => v2 === void 0).length;
+    const unknownShareConnected = connected.length > 0 ? unknownConnected / connected.length : null;
+    const daysSinceReporting = Math.floor(
+      (now3 - Date.parse(WORKER_VERSION_REPORTING_SINCE)) / (24 * 60 * 60 * 1e3)
+    );
+    return reply.send({
+      min_worker_version: MIN_WORKER_VERSION,
+      reporting_since: WORKER_VERSION_REPORTING_SINCE,
+      workers_total: servers.length,
+      connected_workers: connected.length,
+      // Two lenses on the distribution: _all accumulates dead rows forever
+      // (abandoned trials), _connected is the one Phase 4 decisions use.
+      versions_all: countByVersion(servers.map((server) => server.worker_version)),
+      versions_connected: countByVersion(connectedVersions),
+      oldest_connected_version: oldestVersion(
+        connectedVersions.filter((v2) => v2 !== void 0)
+      ) ?? null,
+      // Deploy blast radius: how many live tunnels a restart would sever, and
+      // how many of those are mid-turn (the actual user harm — idle sessions
+      // recover on reconnect).
+      active_remote_sessions: fastify2.remoteSessionMap.size,
+      active_turns: await fastify2.storage.searchCache.countRunningRemoteSessions(),
+      // Upgrade-failure tripwire: workers that were active once but have been
+      // offline > 7 days — the classic "daemon didn't come back" signature.
+      stale_workers_7d: everActive.filter((server) => {
+        if (fastify2.reverseConnectManager.isConnected(server.id)) return false;
+        const lastSeen = parseDbTimestamp3(server.last_connected_at);
+        return lastSeen !== void 0 && now3 - lastSeen > STALE_WORKER_THRESHOLD_MS;
+      }).length,
+      phase4_ready: {
+        unknown_share_connected: unknownShareConnected,
+        unknown_share_max: PHASE4_UNKNOWN_SHARE_MAX,
+        days_since_reporting_release: daysSinceReporting,
+        deprecation_days: PHASE4_DEPRECATION_DAYS,
+        verdict: unknownShareConnected !== null && unknownShareConnected < PHASE4_UNKNOWN_SHARE_MAX && daysSinceReporting >= PHASE4_DEPRECATION_DAYS
+      }
+    });
+  });
+};
+var worker_stats_routes_default = (0, import_fastify_plugin5.default)(routes4, { name: "worker-stats-routes" });
+
+// src/routes/project-remote-routes.ts
+var import_fastify_plugin6 = __toESM(require_plugin2(), 1);
 function sanitizeProjectRemote(pr) {
   return pr;
 }
-var routes4 = async (fastify2) => {
+var routes5 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:id/remotes",
     async (request, reply) => {
@@ -239047,12 +239258,12 @@ var routes4 = async (fastify2) => {
     }
   );
 };
-var project_remote_routes_default = (0, import_fastify_plugin5.default)(routes4, { name: "project-remote-routes" });
+var project_remote_routes_default = (0, import_fastify_plugin6.default)(routes5, { name: "project-remote-routes" });
 
 // src/routes/executor-group-routes.ts
-var import_fastify_plugin6 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin7 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID11 } from "crypto";
-var routes5 = async (fastify2) => {
+var routes6 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/executor-groups",
     async (req, reply) => {
@@ -239123,17 +239334,17 @@ var routes5 = async (fastify2) => {
     }
   );
 };
-var executor_group_routes_default = (0, import_fastify_plugin6.default)(routes5, { name: "executor-group-routes" });
+var executor_group_routes_default = (0, import_fastify_plugin7.default)(routes6, { name: "executor-group-routes" });
 
 // src/routes/executor-routes.ts
-var import_fastify_plugin7 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin8 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID12 } from "crypto";
 function normalizeSqlTimestamp(value) {
   if (!value) return null;
   if (value.includes("T") && /(Z|[+-]\d{2}:?\d{2})$/.test(value)) return value;
   return value.replace(" ", "T") + "Z";
 }
-var routes6 = async (fastify2) => {
+var routes7 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/executors",
     async (req, reply) => {
@@ -239272,13 +239483,13 @@ var routes6 = async (fastify2) => {
     return reply.code(200).send({ success: true });
   });
 };
-var executor_routes_default = (0, import_fastify_plugin7.default)(routes6, { name: "executor-routes" });
+var executor_routes_default = (0, import_fastify_plugin8.default)(routes7, { name: "executor-routes" });
 
 // src/routes/process-routes.ts
-var import_fastify_plugin8 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin9 = __toESM(require_plugin2(), 1);
 import path9 from "path";
 import { randomUUID as randomUUID13 } from "crypto";
-var routes7 = async (fastify2) => {
+var routes8 = async (fastify2) => {
   fastify2.post("/api/path/execute", async (req, reply) => {
     const userId = requireAuth(req, reply);
     if (userId === null) return;
@@ -239490,10 +239701,10 @@ var routes7 = async (fastify2) => {
     return reply.code(200).send({ processes });
   });
 };
-var process_routes_default = (0, import_fastify_plugin8.default)(routes7, { name: "process-routes" });
+var process_routes_default = (0, import_fastify_plugin9.default)(routes8, { name: "process-routes" });
 
 // src/routes/worktree-routes.ts
-var import_fastify_plugin9 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin10 = __toESM(require_plugin2(), 1);
 import { mkdir as mkdir3 } from "fs/promises";
 async function getAllRemoteConfigs(fastify2, project) {
   const remotes = await fastify2.storage.projectRemotes.getByProject(project.id);
@@ -239506,7 +239717,7 @@ async function getRemoteConfig(fastify2, project) {
   const all = await getAllRemoteConfigs(fastify2, project);
   return all.length > 0 ? all[0] : null;
 }
-var routes8 = async (fastify2) => {
+var routes9 = async (fastify2) => {
   fastify2.get("/api/path/branches", async (req, reply) => {
     const projectPath = req.query.path;
     if (!projectPath) {
@@ -240034,10 +240245,10 @@ var routes8 = async (fastify2) => {
     });
   });
 };
-var worktree_routes_default = (0, import_fastify_plugin9.default)(routes8, { name: "worktree-routes" });
+var worktree_routes_default = (0, import_fastify_plugin10.default)(routes9, { name: "worktree-routes" });
 
 // src/routes/diff-routes.ts
-var import_fastify_plugin10 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin11 = __toESM(require_plugin2(), 1);
 import path10 from "path";
 import { readFileSync as readFileSync4 } from "fs";
 import { execFileSync as execFileSync5 } from "child_process";
@@ -240345,7 +240556,7 @@ async function getUntrackedFiles(cwd) {
   }
   return files;
 }
-var routes9 = async (fastify2) => {
+var routes10 = async (fastify2) => {
   fastify2.get("/api/path/diff", async (req, reply) => {
     const projectPath = req.query.path;
     if (!projectPath) {
@@ -240536,10 +240747,10 @@ var routes9 = async (fastify2) => {
     }
   });
 };
-var diff_routes_default = (0, import_fastify_plugin10.default)(routes9, { name: "diff-routes" });
+var diff_routes_default = (0, import_fastify_plugin11.default)(routes10, { name: "diff-routes" });
 
 // src/routes/file-routes.ts
-var import_fastify_plugin11 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin12 = __toESM(require_plugin2(), 1);
 import path11 from "path";
 import fs2 from "fs/promises";
 import { createReadStream, constants as fsConstants } from "fs";
@@ -240762,7 +240973,7 @@ async function searchSymbol(basePath33, symbol26) {
   }
   return { hits, truncated };
 }
-var routes10 = async (fastify2) => {
+var routes11 = async (fastify2) => {
   fastify2.get("/api/path/browse", async (req, reply) => {
     const projectPath = req.query.path;
     if (!projectPath) {
@@ -241323,10 +241534,10 @@ var routes10 = async (fastify2) => {
     }
   });
 };
-var file_routes_default = (0, import_fastify_plugin11.default)(routes10, { name: "file-routes" });
+var file_routes_default = (0, import_fastify_plugin12.default)(routes11, { name: "file-routes" });
 
 // src/routes/agent-session-routes.ts
-var import_fastify_plugin12 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin13 = __toESM(require_plugin2(), 1);
 
 // src/utils/paste-file.ts
 import { chmod, mkdir as mkdir4, open } from "node:fs/promises";
@@ -241377,7 +241588,7 @@ function messageTextLength(content) {
   }
   return n;
 }
-var routes11 = async (fastify2) => {
+var routes12 = async (fastify2) => {
   const instructionReceiverToken = randomUUID15();
   const instructionDeliveryLocks = /* @__PURE__ */ new Map();
   async function serializeInstructionDelivery(key, effect) {
@@ -242731,10 +242942,10 @@ var routes11 = async (fastify2) => {
     return reply.code(200).send({ success: true, favorited });
   });
 };
-var agent_session_routes_default = (0, import_fastify_plugin12.default)(routes11, { name: "agent-session-routes" });
+var agent_session_routes_default = (0, import_fastify_plugin13.default)(routes12, { name: "agent-session-routes" });
 
 // src/routes/branch-activity-routes.ts
-var import_fastify_plugin13 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin14 = __toESM(require_plugin2(), 1);
 function toResponse(map2) {
   return {
     branches: Array.from(map2.entries()).map(([branch, state]) => ({
@@ -242749,7 +242960,7 @@ function fromResponse(resp) {
     resp.branches.map((b2) => [b2.branch ?? "", { activity: b2.activity, since: b2.since }])
   );
 }
-var routes12 = async (fastify2) => {
+var routes13 = async (fastify2) => {
   function proxyAuto(remoteServerId, method, apiPath, body) {
     return proxyToRemoteAuto(remoteServerId, method, apiPath, body, {
       reverseConnectManager: fastify2.reverseConnectManager
@@ -242814,10 +243025,10 @@ var routes12 = async (fastify2) => {
     }
   );
 };
-var branch_activity_routes_default = (0, import_fastify_plugin13.default)(routes12, { name: "branch-activity-routes" });
+var branch_activity_routes_default = (0, import_fastify_plugin14.default)(routes13, { name: "branch-activity-routes" });
 
 // src/routes/merge-status-routes.ts
-var import_fastify_plugin14 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin15 = __toESM(require_plugin2(), 1);
 function resolveTargets(comparisons, storedTargets) {
   const sources = [];
   const effective = comparisons.map((comparison) => {
@@ -242931,7 +243142,7 @@ function sendComputed(reply, repoPath, comparisons, repository) {
     return reply.code(statusCode).send({ error: message });
   }
 }
-var routes13 = async (fastify2) => {
+var routes14 = async (fastify2) => {
   fastify2.post(
     "/api/path/branches/merge-status",
     async (req, reply) => {
@@ -243053,11 +243264,11 @@ var routes13 = async (fastify2) => {
     }
   );
 };
-var merge_status_routes_default = (0, import_fastify_plugin14.default)(routes13, { name: "merge-status-routes" });
+var merge_status_routes_default = (0, import_fastify_plugin15.default)(routes14, { name: "merge-status-routes" });
 
 // src/routes/chat-session-routes.ts
-var import_fastify_plugin15 = __toESM(require_plugin2(), 1);
-var routes14 = async (fastify2) => {
+var import_fastify_plugin16 = __toESM(require_plugin2(), 1);
+var routes15 = async (fastify2) => {
   const getAuthorizedSession = (req, reply, sessionId) => {
     const authResult = requireUserFacingUserId(req, reply);
     if (authResult === null) return null;
@@ -243162,10 +243373,10 @@ var routes14 = async (fastify2) => {
     return reply.send({ ok: true });
   });
 };
-var chat_session_routes_default = (0, import_fastify_plugin15.default)(routes14, { name: "chat-session-routes" });
+var chat_session_routes_default = (0, import_fastify_plugin16.default)(routes15, { name: "chat-session-routes" });
 
 // src/routes/project-chat-routes.ts
-var import_fastify_plugin16 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin17 = __toESM(require_plugin2(), 1);
 import { createHash as createHash6, randomUUID as randomUUID16 } from "crypto";
 var MAX_TITLE_LENGTH = 200;
 var MAX_MESSAGE_LENGTH = 1e5;
@@ -243278,7 +243489,7 @@ function parseWorkspaceSelectionBody(body) {
   if (!requestId || requestId.length > MAX_TOOL_SELECTOR_ID || !workspaceId || workspaceId.length > MAX_TOOL_SELECTOR_ID) return null;
   return { requestId, workspaceId };
 }
-var routes15 = async (fastify2) => {
+var routes16 = async (fastify2) => {
   const getOwnedThread = async (req, reply, threadId) => {
     const authResult = requireAuth(req, reply);
     if (authResult === null) return null;
@@ -243497,10 +243708,10 @@ var routes15 = async (fastify2) => {
     }
   });
 };
-var project_chat_routes_default = (0, import_fastify_plugin16.default)(routes15, { name: "project-chat-routes" });
+var project_chat_routes_default = (0, import_fastify_plugin17.default)(routes16, { name: "project-chat-routes" });
 
 // src/routes/project-activity-routes.ts
-var import_fastify_plugin17 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin18 = __toESM(require_plugin2(), 1);
 
 // src/project-activity.ts
 var RECENT_THREAD_LIMIT = 5;
@@ -243508,7 +243719,7 @@ var RECENT_SESSION_LIMIT = 8;
 var RECENT_RUN_LIMIT = 5;
 var PRIORITY_TASK_LIMIT = 5;
 var ATTENTION_LIMIT = 10;
-var parseDbTimestamp3 = (value) => {
+var parseDbTimestamp4 = (value) => {
   if (!value) return null;
   const explicitZone = /(?:Z|[+-]\d\d:\d\d)$/i.test(value);
   const parsed = Date.parse(explicitZone ? value : `${value.replace(" ", "T")}Z`);
@@ -243533,8 +243744,8 @@ var localActivity = (session) => {
     lastActiveAt: maxTimestamp(
       session.last_user_message_at,
       session.last_completed_at,
-      parseDbTimestamp3(session.updated_at),
-      parseDbTimestamp3(session.created_at)
+      parseDbTimestamp4(session.updated_at),
+      parseDbTimestamp4(session.created_at)
     ),
     lastUserMessageAt: session.last_user_message_at ?? null,
     lastCompletedAt: session.last_completed_at ?? null
@@ -243598,7 +243809,7 @@ async function getProjectActivity(storage, projectId, userId) {
       entityId: run2.id,
       status: run2.status,
       title: run2.scheduleName,
-      occurredAtMs: parseDbTimestamp3(run2.finished_at ?? run2.started_at) ?? 0
+      occurredAtMs: parseDbTimestamp4(run2.finished_at ?? run2.started_at) ?? 0
     }))
   ].sort((left, right) => right.occurredAtMs - left.occurredAtMs || right.entityId.localeCompare(left.entityId)).slice(0, ATTENTION_LIMIT).map(({ occurredAtMs, ...item }) => ({
     ...item,
@@ -243618,7 +243829,7 @@ async function getProjectActivity(storage, projectId, userId) {
 }
 
 // src/routes/project-activity-routes.ts
-var routes16 = async (fastify2) => {
+var routes17 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/activity",
     async (req, reply) => {
@@ -243634,12 +243845,12 @@ var routes16 = async (fastify2) => {
     }
   );
 };
-var project_activity_routes_default = (0, import_fastify_plugin17.default)(routes16);
+var project_activity_routes_default = (0, import_fastify_plugin18.default)(routes17);
 
 // src/routes/task-routes.ts
-var import_fastify_plugin18 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin19 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID17 } from "crypto";
-var routes17 = async (fastify2) => {
+var routes18 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/tasks",
     async (req, reply) => {
@@ -243799,12 +244010,12 @@ Description: ${description}`,
     return reply.code(200).send({ success: true });
   });
 };
-var task_routes_default = (0, import_fastify_plugin18.default)(routes17, { name: "task-routes" });
+var task_routes_default = (0, import_fastify_plugin19.default)(routes18, { name: "task-routes" });
 
 // src/routes/rule-routes.ts
-var import_fastify_plugin19 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin20 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID18 } from "crypto";
-var routes18 = async (fastify2) => {
+var routes19 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/rules",
     async (req, reply) => {
@@ -243890,12 +244101,12 @@ var routes18 = async (fastify2) => {
     return reply.code(200).send({ success: true });
   });
 };
-var rule_routes_default = (0, import_fastify_plugin19.default)(routes18, { name: "rule-routes" });
+var rule_routes_default = (0, import_fastify_plugin20.default)(routes19, { name: "rule-routes" });
 
 // src/routes/command-routes.ts
-var import_fastify_plugin20 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin21 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID19 } from "crypto";
-var routes19 = async (fastify2) => {
+var routes20 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/commands",
     async (req, reply) => {
@@ -243964,10 +244175,10 @@ var routes19 = async (fastify2) => {
     return reply.code(200).send({ success: true });
   });
 };
-var command_routes_default = (0, import_fastify_plugin20.default)(routes19, { name: "command-routes" });
+var command_routes_default = (0, import_fastify_plugin21.default)(routes20, { name: "command-routes" });
 
 // src/routes/workflow-run-routes.ts
-var import_fastify_plugin21 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin22 = __toESM(require_plugin2(), 1);
 
 // src/utils/review-brief.ts
 var BASE_TIMEOUT_MS = 15e3;
@@ -244299,7 +244510,7 @@ function errStatus(err) {
       return 500;
   }
 }
-async function routes20(fastify2) {
+async function routes21(fastify2) {
   const remoteRunMap = /* @__PURE__ */ new Map();
   const TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set(["completed", "cancelled", "failed"]);
   const trackRemoteRun = (localRun, info) => {
@@ -244764,10 +244975,10 @@ async function routes20(fastify2) {
     return reply.send({ runs });
   });
 }
-var workflow_run_routes_default = (0, import_fastify_plugin21.default)(routes20, { name: "workflow-run-routes" });
+var workflow_run_routes_default = (0, import_fastify_plugin22.default)(routes21, { name: "workflow-run-routes" });
 
 // src/routes/settings-routes.ts
-var import_fastify_plugin22 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin23 = __toESM(require_plugin2(), 1);
 var SettingsValidationError = class extends Error {
 };
 var DEFAULT_PROXY_CONFIG = { type: "none", host: "", port: 0 };
@@ -244831,7 +245042,7 @@ function requireSettingsUser(req, reply) {
   if (auth === null) return null;
   return resolveUserId(auth);
 }
-var routes21 = async (fastify2) => {
+var routes22 = async (fastify2) => {
   fastify2.get("/api/settings/agent-processes", async (req, reply) => {
     if (requireAuth(req, reply) === null) return;
     const saved = await fastify2.storage.settings.get("agentProcesses");
@@ -245105,11 +245316,11 @@ var routes21 = async (fastify2) => {
     return reply.code(200).send(updated);
   });
 };
-var settings_routes_default = (0, import_fastify_plugin22.default)(routes21, { name: "settings-routes" });
+var settings_routes_default = (0, import_fastify_plugin23.default)(routes22, { name: "settings-routes" });
 
 // src/routes/translate-routes.ts
-var import_fastify_plugin23 = __toESM(require_plugin2(), 1);
-var routes22 = async (fastify2) => {
+var import_fastify_plugin24 = __toESM(require_plugin2(), 1);
+var routes23 = async (fastify2) => {
   fastify2.post(
     "/api/translate",
     async (req, reply) => {
@@ -245150,10 +245361,10 @@ ${text2}`,
     }
   );
 };
-var translate_routes_default = (0, import_fastify_plugin23.default)(routes22, { name: "translate-routes" });
+var translate_routes_default = (0, import_fastify_plugin24.default)(routes23, { name: "translate-routes" });
 
 // src/routes/websocket-routes.ts
-var import_fastify_plugin24 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin25 = __toESM(require_plugin2(), 1);
 
 // src/routes/executor-stream-handlers.ts
 import { randomUUID as randomUUID20 } from "crypto";
@@ -245364,7 +245575,6 @@ async function verifyWsToken(token) {
 }
 async function authenticateWs(authEnabled, query, socket) {
   if (!authEnabled) return { userId: null, kind: "solo" };
-  if (process.env.VIBEDECKX_API_KEY && query.apiKey) return { userId: null, kind: "api_key" };
   const reject = (error48) => {
     try {
       socket.send(JSON.stringify({ error: error48 }));
@@ -245421,7 +245631,7 @@ async function userOwnsSession(fastify2, sessionId, userId) {
 }
 
 // src/routes/websocket-routes.ts
-var routes23 = async (fastify2) => {
+var routes24 = async (fastify2) => {
   fastify2.reverseConnectManager.setStatusChangeHandler((remoteServerId, status) => {
     if (status !== "online") return;
     const cache2 = fastify2.remotePatchCache;
@@ -245637,25 +245847,21 @@ var routes23 = async (fastify2) => {
         console.log(`[AgentWS] Connection attempt for session ${sessionId} (auth=${fastify2.authEnabled})`);
         let principalUserId = fastify2.authEnabled ? null : "local";
         if (fastify2.authEnabled) {
-          const apiKey = req.query.apiKey;
           const token = req.query.token;
-          const apiKeyTrusted = !!process.env.VIBEDECKX_API_KEY && !!apiKey;
-          if (!apiKeyTrusted) {
-            if (!token) {
-              console.log(`[AgentWS] Auth rejected: no token (session=${sessionId})`);
-              socket.send(JSON.stringify({ error: "Authentication required" }));
-              socket.close();
-              return;
-            }
-            const userId = await verifyWsToken(token);
-            if (!userId) {
-              console.log(`[AgentWS] Auth rejected: invalid token (session=${sessionId})`);
-              socket.send(JSON.stringify({ error: "Invalid authentication token" }));
-              socket.close();
-              return;
-            }
-            principalUserId = userId;
+          if (!token) {
+            console.log(`[AgentWS] Auth rejected: no token (session=${sessionId})`);
+            socket.send(JSON.stringify({ error: "Authentication required" }));
+            socket.close();
+            return;
+          }
+          const userId = await verifyWsToken(token);
+          if (!userId) {
+            console.log(`[AgentWS] Auth rejected: invalid token (session=${sessionId})`);
+            socket.send(JSON.stringify({ error: "Invalid authentication token" }));
+            socket.close();
+            return;
           }
+          principalUserId = userId;
         }
         if (principalUserId !== null && !await userOwnsSession(fastify2, sessionId, principalUserId)) {
           console.log(`[AgentWS] Ownership denied for session ${sessionId} (user=${principalUserId})`);
@@ -245785,37 +245991,33 @@ var routes23 = async (fastify2) => {
         const { sessionId } = req.params;
         let principalUserId = fastify2.authEnabled ? null : "local";
         if (fastify2.authEnabled) {
-          const apiKey = req.query.apiKey;
           const token = req.query.token;
-          const apiKeyTrusted = !!process.env.VIBEDECKX_API_KEY && !!apiKey;
-          if (!apiKeyTrusted) {
-            if (!token) {
-              console.log(`[ChatWS] Auth rejected: no token (session=${sessionId})`);
-              try {
-                socket.send(JSON.stringify({ error: "Authentication required" }));
-              } catch {
-              }
-              try {
-                socket.close();
-              } catch {
-              }
-              return;
+          if (!token) {
+            console.log(`[ChatWS] Auth rejected: no token (session=${sessionId})`);
+            try {
+              socket.send(JSON.stringify({ error: "Authentication required" }));
+            } catch {
             }
-            const userId = await verifyWsToken(token);
-            if (!userId) {
-              console.log(`[ChatWS] Auth rejected: invalid token (session=${sessionId})`);
-              try {
-                socket.send(JSON.stringify({ error: "Invalid authentication token" }));
-              } catch {
-              }
-              try {
-                socket.close();
-              } catch {
-              }
-              return;
+            try {
+              socket.close();
+            } catch {
             }
-            principalUserId = userId;
+            return;
+          }
+          const userId = await verifyWsToken(token);
+          if (!userId) {
+            console.log(`[ChatWS] Auth rejected: invalid token (session=${sessionId})`);
+            try {
+              socket.send(JSON.stringify({ error: "Invalid authentication token" }));
+            } catch {
+            }
+            try {
+              socket.close();
+            } catch {
+            }
+            return;
           }
+          principalUserId = userId;
         }
         if (principalUserId !== null) {
           const owned = fastify2.chatSessionManager.getSession(sessionId);
@@ -245868,10 +246070,10 @@ var routes23 = async (fastify2) => {
     );
   });
 };
-var websocket_routes_default = (0, import_fastify_plugin24.default)(routes23, { name: "websocket-routes" });
+var websocket_routes_default = (0, import_fastify_plugin25.default)(routes24, { name: "websocket-routes" });
 
 // src/routes/reverse-connect-routes.ts
-var import_fastify_plugin25 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin26 = __toESM(require_plugin2(), 1);
 import { randomBytes as randomBytes2, createHash as createHash7, verify as cryptoVerify } from "crypto";
 
 // src/utils/rate-limited-warn.ts
@@ -245908,10 +246110,15 @@ function createRateLimitedWarn(windowMs, maxKeys) {
 }
 
 // src/routes/reverse-connect-routes.ts
+function extractReportedVersion(frame) {
+  if (typeof frame.version !== "string" || frame.version.length === 0) return void 0;
+  const capabilities = Array.isArray(frame.capabilities) ? frame.capabilities.filter((c) => typeof c === "string") : [];
+  return { version: frame.version, capabilities };
+}
 var MACHINE_HANDSHAKE_TIMEOUT_MS = 5e3;
 var REJECT_LOG_WINDOW_MS = 3e4;
 var REJECT_LOG_MAX_KEYS = 500;
-var routes24 = async (fastify2) => {
+var routes25 = async (fastify2) => {
   const logRejectedUpgrade = createRateLimitedWarn(REJECT_LOG_WINDOW_MS, REJECT_LOG_MAX_KEYS);
   fastify2.get("/api/reverse-connect/identity", async (req, reply) => {
     const token = req.headers["x-vibedeckx-connect-token"];
@@ -245952,12 +246159,31 @@ var routes24 = async (fastify2) => {
         const ownerId = await fastify2.storage.remoteServers.getOwnerId(serverId) ?? "";
         const nonce = randomBytes2(32);
         let settled = false;
+        let stashedVersion;
+        const recordWorkerVersion = async (reported) => {
+          if (!reported) {
+            console.log(`[ReverseConnect] Worker ${serverId} reported no version (pre-reporting release)`);
+            return;
+          }
+          const previous = (await fastify2.storage.remoteServers.getById(serverId))?.worker_version;
+          await fastify2.storage.remoteServers.updateWorkerVersion(serverId, reported.version, reported.capabilities);
+          if (previous !== reported.version) {
+            console.log(`[ReverseConnect] Worker ${serverId} version ${previous ?? "unreported"} \u2192 ${reported.version}`);
+          }
+          const cmp = compareVersionStrings(reported.version, MIN_WORKER_VERSION);
+          if (cmp !== void 0 && cmp < 0) {
+            console.warn(
+              `[ReverseConnect] Worker ${serverId} runs ${reported.version}, below MIN_WORKER_VERSION ${MIN_WORKER_VERSION} \u2014 advise upgrading`
+            );
+          }
+        };
         const registerUnauthenticated = async () => {
           if (settled) return;
           settled = true;
           socket.off("message", onChallengeReply);
           fastify2.reverseConnectManager.registerConnection(serverId, ws);
           await fastify2.storage.remoteServers.updateStatus(serverId, "online");
+          await recordWorkerVersion(stashedVersion);
         };
         const timer = setTimeout(() => {
           registerUnauthenticated().catch((err) => {
@@ -245972,6 +246198,10 @@ var routes24 = async (fastify2) => {
             } catch {
               return;
             }
+            if (frame?.type === "status") {
+              stashedVersion = extractReportedVersion(frame) ?? stashedVersion;
+              return;
+            }
             if (frame?.type !== "machine_auth" || settled) return;
             settled = true;
             clearTimeout(timer);
@@ -246007,6 +246237,7 @@ var routes24 = async (fastify2) => {
             console.log(`[ReverseConnect] Machine auth verified ${fingerprint.slice(0, 12)} for ${serverId}`);
             fastify2.reverseConnectManager.registerConnection(serverId, ws, fingerprint);
             await fastify2.storage.remoteServers.updateStatus(serverId, "online");
+            await recordWorkerVersion(extractReportedVersion(frame) ?? stashedVersion);
           } catch (err) {
             console.error(`[ReverseConnect] Machine challenge handling failed for ${serverId}:`, err);
             try {
@@ -246021,10 +246252,10 @@ var routes24 = async (fastify2) => {
     );
   });
 };
-var reverse_connect_routes_default = (0, import_fastify_plugin25.default)(routes24, { name: "reverse-connect-routes" });
+var reverse_connect_routes_default = (0, import_fastify_plugin26.default)(routes25, { name: "reverse-connect-routes" });
 
 // src/routes/event-routes.ts
-var import_fastify_plugin26 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin27 = __toESM(require_plugin2(), 1);
 function toWireEvent(event) {
   if (event.type === "executor:stopped" && (event.tailOutput !== void 0 || event.finalResult !== void 0)) {
     const { tailOutput: _tailOutput, finalResult: _finalResult, ...rest } = event;
@@ -246032,31 +246263,28 @@ function toWireEvent(event) {
   }
   return event;
 }
-var routes25 = async (fastify2) => {
+var routes26 = async (fastify2) => {
   fastify2.get("/api/events", async (req, reply) => {
     let userId = null;
     if (fastify2.authEnabled) {
-      const apiKey = req.headers["x-vibedeckx-api-key"];
-      if (!(process.env.VIBEDECKX_API_KEY && apiKey)) {
-        const token = req.query.token;
-        if (!token) {
-          return reply.code(401).send({ error: "Unauthorized" });
-        }
-        try {
-          const { verifyToken: verifyToken3 } = await Promise.resolve().then(() => (init_dist(), dist_exports));
-          const payload = await verifyToken3(token, {
-            secretKey: process.env.CLERK_SECRET_KEY,
-            clockSkewInMs: CLERK_CLOCK_SKEW_MS
-          });
-          if (!payload.sub) {
-            return reply.code(401).send({ error: "Unauthorized" });
-          }
-          userId = payload.sub;
-        } catch (err) {
-          const reason = err?.reason;
-          if (reason) console.log(`[EventsSSE] token verification failed: ${reason}`);
+      const token = req.query.token;
+      if (!token) {
+        return reply.code(401).send({ error: "Unauthorized" });
+      }
+      try {
+        const { verifyToken: verifyToken3 } = await Promise.resolve().then(() => (init_dist(), dist_exports));
+        const payload = await verifyToken3(token, {
+          secretKey: process.env.CLERK_SECRET_KEY,
+          clockSkewInMs: CLERK_CLOCK_SKEW_MS
+        });
+        if (!payload.sub) {
           return reply.code(401).send({ error: "Unauthorized" });
         }
+        userId = payload.sub;
+      } catch (err) {
+        const reason = err?.reason;
+        if (reason) console.log(`[EventsSSE] token verification failed: ${reason}`);
+        return reply.code(401).send({ error: "Unauthorized" });
       }
     }
     reply.raw.writeHead(200, {
@@ -246090,10 +246318,10 @@ var routes25 = async (fastify2) => {
     await reply;
   });
 };
-var event_routes_default = (0, import_fastify_plugin26.default)(routes25, { name: "event-routes" });
+var event_routes_default = (0, import_fastify_plugin27.default)(routes26, { name: "event-routes" });
 
 // src/routes/terminal-routes.ts
-var import_fastify_plugin27 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin28 = __toESM(require_plugin2(), 1);
 import path13 from "path";
 
 // src/utils/path-project.ts
@@ -246121,7 +246349,7 @@ async function getRemoteConfig5(fastify2, project, remoteServerId) {
     remotePath: target.remote_path
   };
 }
-var routes26 = async (fastify2) => {
+var routes27 = async (fastify2) => {
   fastify2.post("/api/path/terminals", async (req, reply) => {
     const { path: projectPath, branch } = req.body;
     if (!projectPath) {
@@ -246297,11 +246525,11 @@ var routes26 = async (fastify2) => {
     }
   );
 };
-var terminal_routes_default = (0, import_fastify_plugin27.default)(routes26, { name: "terminal-routes" });
+var terminal_routes_default = (0, import_fastify_plugin28.default)(routes27, { name: "terminal-routes" });
 
 // src/routes/browser-routes.ts
-var import_fastify_plugin28 = __toESM(require_plugin2(), 1);
-var routes27 = async (fastify2) => {
+var import_fastify_plugin29 = __toESM(require_plugin2(), 1);
+var routes28 = async (fastify2) => {
   const ensureProjectAccess = async (req, reply) => {
     const userId = requireUserFacingUserId(req, reply);
     if (userId === null) return null;
@@ -246372,10 +246600,10 @@ var routes27 = async (fastify2) => {
     return reply.code(200).send({ ok: true });
   });
 };
-var browser_routes_default = (0, import_fastify_plugin28.default)(routes27, { name: "browser-routes" });
+var browser_routes_default = (0, import_fastify_plugin29.default)(routes28, { name: "browser-routes" });
 
 // src/routes/browser-proxy-routes.ts
-var import_fastify_plugin29 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin30 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID21 } from "crypto";
 
 // src/utils/ssrf-guard.ts
@@ -246871,7 +247099,7 @@ function generateInjectedScript(projectId, targetOrigin, proxyWsPrefix) {
 })();
 </script>`;
 }
-var routes28 = async (fastify2) => {
+var routes29 = async (fastify2) => {
   fastify2.get("/api/projects/:id/browser/proxy/*", async (req, reply) => {
     const userId = requireUserFacingOrTrustedProxyUserId(req, reply);
     if (userId === null) return;
@@ -246940,7 +247168,7 @@ var routes28 = async (fastify2) => {
     const { id: projectId } = req.params;
     const principal = await authenticateWs(fastify2.authEnabled, req.query, socket);
     if (!principal) return;
-    const projectOwner = principal.kind === "api_key" ? void 0 : principal.userId ?? "local";
+    const projectOwner = principal.userId ?? "local";
     if (!await fastify2.storage.projects.getById(projectId, projectOwner)) {
       try {
         socket.send(JSON.stringify({ error: "Forbidden" }));
@@ -247043,10 +247271,10 @@ var routes28 = async (fastify2) => {
     });
   });
 };
-var browser_proxy_routes_default = (0, import_fastify_plugin29.default)(routes28, { name: "browser-proxy-routes" });
+var browser_proxy_routes_default = (0, import_fastify_plugin30.default)(routes29, { name: "browser-proxy-routes" });
 
 // src/routes/cross-remote-target-routes.ts
-var import_fastify_plugin30 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin31 = __toESM(require_plugin2(), 1);
 import path14 from "path";
 import { promises as fs3 } from "fs";
 
@@ -247126,7 +247354,7 @@ var clampTimeoutMs = (timeoutSec) => {
   const requested = typeof timeoutSec === "number" && Number.isFinite(timeoutSec) && timeoutSec > 0 ? timeoutSec : DEFAULT_TIMEOUT_SEC;
   return Math.min(requested, MAX_TIMEOUT_SEC) * 1e3;
 };
-var routes29 = async (fastify2) => {
+var routes30 = async (fastify2) => {
   fastify2.post(
     "/api/path/cross-remote/exec",
     async (request, reply) => {
@@ -247234,10 +247462,10 @@ var routes29 = async (fastify2) => {
     return reply.send(result);
   });
 };
-var cross_remote_target_routes_default = (0, import_fastify_plugin30.default)(routes29, { name: "cross-remote-target-routes" });
+var cross_remote_target_routes_default = (0, import_fastify_plugin31.default)(routes30, { name: "cross-remote-target-routes" });
 
 // src/routes/cross-remote-mcp-routes.ts
-var import_fastify_plugin31 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin32 = __toESM(require_plugin2(), 1);
 var PROTOCOL_VERSION = "2024-11-05";
 var AUDIT_ARGS_MAX = 1024;
 var NOT_ACCESSIBLE = "remote not found or not accessible";
@@ -247340,7 +247568,7 @@ var textResult = (text2, isError = false) => ({
   content: [{ type: "text", text: text2 }],
   ...isError ? { isError: true } : {}
 });
-var routes30 = async (fastify2) => {
+var routes31 = async (fastify2) => {
   const guard = new SessionConcurrencyGuard();
   let cachedSecret;
   const getSecret = () => {
@@ -247461,10 +247689,10 @@ var routes30 = async (fastify2) => {
     }
   });
 };
-var cross_remote_mcp_routes_default = (0, import_fastify_plugin31.default)(routes30, { name: "cross-remote-mcp-routes" });
+var cross_remote_mcp_routes_default = (0, import_fastify_plugin32.default)(routes31, { name: "cross-remote-mcp-routes" });
 
 // src/routes/schedule-routes.ts
-var import_fastify_plugin32 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin33 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID22 } from "crypto";
 import path15 from "path";
 var RUN_TYPES = ["command", "prompt"];
@@ -247483,7 +247711,7 @@ function validateResolved(b2) {
   if (cronError) return `Invalid cron expression: ${cronError}`;
   return null;
 }
-var routes31 = async (fastify2) => {
+var routes32 = async (fastify2) => {
   const sendTerminalManualOutcome = (reply, request, replay) => {
     if (!request.terminalStatus || request.terminalResponseStatus === null) return null;
     const common = { runId: request.runId, status: request.terminalStatus, durable: true, replay };
@@ -247714,10 +247942,10 @@ var routes31 = async (fastify2) => {
     }
   );
 };
-var schedule_routes_default = (0, import_fastify_plugin32.default)(routes31, { name: "schedule-routes" });
+var schedule_routes_default = (0, import_fastify_plugin33.default)(routes32, { name: "schedule-routes" });
 
 // src/search/catalog.ts
-var parseDbTimestamp4 = (ts) => {
+var parseDbTimestamp5 = (ts) => {
   if (!ts) return null;
   const ms = Date.parse(ts.replace(" ", "T") + "Z");
   return Number.isNaN(ms) ? null : ms;
@@ -247739,7 +247967,7 @@ async function buildSearchCatalog(deps, projectId, projectPath) {
       id: s3.id,
       branch: s3.branch === "" ? null : s3.branch,
       title: s3.title ?? null,
-      lastActiveAt: s3.last_user_message_at ?? parseDbTimestamp4(s3.updated_at),
+      lastActiveAt: s3.last_user_message_at ?? parseDbTimestamp5(s3.updated_at),
       favoritedAt: s3.favorited_at ?? null,
       entryCount,
       status: s3.status,
@@ -248006,10 +248234,10 @@ var searchRoutes = async (fastify2) => {
 var search_routes_default = searchRoutes;
 
 // src/routes/notification-routes.ts
-var import_fastify_plugin33 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin34 = __toESM(require_plugin2(), 1);
 var MAX_LIMIT = 500;
 var DEFAULT_LIMIT = 100;
-var routes32 = async (fastify2) => {
+var routes33 = async (fastify2) => {
   fastify2.get(
     "/api/notifications",
     async (req, reply) => {
@@ -248041,7 +248269,7 @@ var routes32 = async (fastify2) => {
     return reply.code(200).send({ ok: true });
   });
 };
-var notification_routes_default = (0, import_fastify_plugin33.default)(routes32, { name: "notification-routes" });
+var notification_routes_default = (0, import_fastify_plugin34.default)(routes33, { name: "notification-routes" });
 
 // ../../node_modules/.pnpm/@clerk+fastify@3.1.2_fastify@5.7.2_react-dom@19.2.3_react@19.2.3__react@19.2.3/node_modules/@clerk/fastify/dist/chunk-RY4T2JMQ.mjs
 import { Readable as Readable2 } from "stream";
@@ -248093,7 +248321,7 @@ var requestToProxyRequest = (req) => {
 
 // ../../node_modules/.pnpm/@clerk+fastify@3.1.2_fastify@5.7.2_react-dom@19.2.3_react@19.2.3__react@19.2.3/node_modules/@clerk/fastify/dist/index.mjs
 init_dist();
-var import_fastify_plugin34 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin35 = __toESM(require_plugin2(), 1);
 
 // ../../node_modules/.pnpm/@clerk+backend@3.2.0_react-dom@19.2.3_react@19.2.3__react@19.2.3/node_modules/@clerk/backend/dist/internal.mjs
 init_chunk_JW73PKED();
@@ -248381,7 +248609,7 @@ var plugin = (instance, opts, done) => {
   instance.addHook(hookName, withClerkMiddleware(opts));
   done();
 };
-var clerkPlugin = (0, import_fastify_plugin34.default)(plugin, {
+var clerkPlugin = (0, import_fastify_plugin35.default)(plugin, {
   name: "@clerk/fastify",
   fastify: "5.x"
 });
@@ -249129,12 +249357,10 @@ async function shutdownLogging() {
 }
 
 // src/server.ts
-var API_KEY = process.env.VIBEDECKX_API_KEY;
+var API_KEY2 = process.env.VIBEDECKX_API_KEY || void 0;
 function requireAuth(req, reply) {
   const server = req.server;
   if (!server.authEnabled) return void 0;
-  const apiKeyHeader = req.headers["x-vibedeckx-api-key"];
-  if (API_KEY && apiKeyHeader) return void 0;
   try {
     const { userId } = getAuth(req);
     if (!userId) {
@@ -249221,19 +249447,12 @@ var createServer = async (opts) => {
     done();
   });
   server.addHook("onRequest", (req, reply, done) => {
-    if (!API_KEY) return done();
-    if (!req.url.startsWith("/api/")) return done();
+    if (!API_KEY2) return done();
+    if (!req.url.startsWith("/api/admin/")) return done();
     if (req.method === "OPTIONS") return done();
-    const pathname = req.url.split("?")[0];
-    if (pathname === "/api/config" || pathname === "/api/reverse-connect" || pathname === "/api/reverse-connect/identity") {
-      return done();
-    }
     const providedKey = req.headers["x-vibedeckx-api-key"] || req.query?.apiKey;
-    if (!providedKey && authEnabled) {
-      return done();
-    }
-    if (providedKey !== API_KEY) {
-      return reply.code(401).send({ error: "Unauthorized" });
+    if (providedKey !== API_KEY2) {
+      return reply.code(404).send({ error: "Not found" });
     }
     done();
   });
@@ -249309,6 +249528,7 @@ var createServer = async (opts) => {
   server.register(reverse_connect_routes_default);
   server.register(project_routes_default);
   server.register(remote_server_routes_default);
+  server.register(worker_stats_routes_default);
   server.register(project_remote_routes_default);
   server.register(search_routes_default);
   server.register(executor_group_routes_default);
@@ -249530,6 +249750,94 @@ function redactErrorSecret(error48, secret) {
   return redactSecretForms(message, secret);
 }
 
+// src/utils/package-version.ts
+import fs7 from "fs";
+function readPackageVersion() {
+  for (const candidate of ["../package.json", "../../package.json"]) {
+    try {
+      const parsed = JSON.parse(
+        fs7.readFileSync(new URL(candidate, import.meta.url), "utf8")
+      );
+      if (typeof parsed.version === "string" && parsed.version.length > 0) return parsed.version;
+    } catch {
+    }
+  }
+  return "unknown";
+}
+
+// src/reverse-connect-capabilities.ts
+var WORKER_CAPABILITIES = {
+  // --- Agent sessions ---
+  "http:GET /api/path/agent-sessions": { since: "0.2.0", summary: "\u4F1A\u8BDD\u5217\u8868(\u6309\u8DEF\u5F84)" },
+  "http:POST /api/path/agent-sessions": { since: "0.2.0", summary: "\u521B\u5EFA\u4F1A\u8BDD" },
+  "http:POST /api/path/agent-sessions/new": { since: "0.2.0", summary: "\u521B\u5EFA\u4F1A\u8BDD(\u6307\u5B9A ID)" },
+  "http:GET /api/agent-sessions/:param": { since: "0.2.0", summary: "\u8BFB\u4F1A\u8BDD\u8BE6\u60C5/\u5BF9\u8BDD" },
+  "http:POST /api/agent-sessions/:param/message": { since: "0.2.0", summary: "\u53D1\u6D88\u606F\u7ED9\u4F1A\u8BDD" },
+  "http:POST /api/agent-sessions/:param/paste": { since: "0.2.0", summary: "\u7C98\u8D34\u56FE\u7247/\u957F\u6587\u672C" },
+  "http:POST /api/agent-sessions/:param/stop": { since: "0.2.0", summary: "\u505C\u6B62\u4F1A\u8BDD turn" },
+  "http:POST /api/agent-sessions/:param/restart": { since: "0.2.0", summary: "\u91CD\u542F\u4F1A\u8BDD\u8FDB\u7A0B" },
+  "http:POST /api/agent-sessions/:param/agent-type": { since: "0.2.0", summary: "\u5207\u6362 agent \u7C7B\u578B" },
+  "http:POST /api/agent-sessions/:param/model": { since: "0.2.0", summary: "\u5207\u6362\u4F1A\u8BDD\u6A21\u578B" },
+  "http:POST /api/path/agent-sessions/:param/branch": { since: "0.2.0", summary: "\u4ECE\u5386\u53F2\u5206\u53C9\u4F1A\u8BDD" },
+  "http:POST /api/agent-sessions/:param/switch-mode": { since: "0.2.0", summary: "\u6743\u9650\u6A21\u5F0F\u5207\u6362" },
+  "http:POST /api/agent-sessions/:param/accept-plan": { since: "0.2.0", summary: "\u63A5\u53D7\u8BA1\u5212(\u9000\u51FA plan \u6A21\u5F0F)" },
+  "http:POST /api/agent-sessions/:param/approve": { since: "0.2.0", summary: "\u5DE5\u5177\u5BA1\u6279\u51B3\u5B9A" },
+  "http:DELETE /api/agent-sessions/:param": { since: "0.2.0", summary: "\u5220\u9664\u4F1A\u8BDD" },
+  "http:PATCH /api/agent-sessions/:param/title": { since: "0.2.0", summary: "\u6539\u4F1A\u8BDD\u6807\u9898" },
+  "http:PATCH /api/agent-sessions/:param/favorite": { since: "0.2.0", summary: "\u6536\u85CF\u4F1A\u8BDD" },
+  "ws:/api/agent-sessions/:param/stream": { since: "0.2.0", summary: "\u4F1A\u8BDD\u6D88\u606F\u6D41(JSON Patch)" },
+  // --- Executors / processes / terminals ---
+  "http:POST /api/path/execute": { since: "0.2.0", summary: "\u542F\u52A8 executor \u8FDB\u7A0B" },
+  "http:POST /api/execute-one-shot": { since: "0.2.0", summary: "\u4E00\u6B21\u6027\u547D\u4EE4\u6267\u884C" },
+  "http:POST /api/executor-processes/:param/stop": { since: "0.2.0", summary: "\u505C\u6B62 executor \u8FDB\u7A0B" },
+  "http:GET /api/executor-processes/running": { since: "0.2.0", summary: "\u8FD0\u884C\u4E2D\u8FDB\u7A0B\u5217\u8868" },
+  "http:POST /api/path/terminals": { since: "0.2.0", summary: "\u5F00\u7EC8\u7AEF" },
+  "http:POST /api/path/terminals/:param/send": { since: "0.2.0", summary: "\u7EC8\u7AEF\u8F93\u5165" },
+  "ws:/api/executor-processes/:param/logs": { since: "0.2.0", summary: "\u8FDB\u7A0B\u65E5\u5FD7\u6D41" },
+  // --- Workflow runs ---
+  // Empirically bisected via cross-version e2e: 0.2.4 → 404, 0.2.5 → serves.
+  "http:POST /api/path/workflow-runs": { since: "0.2.5", summary: "\u521B\u5EFA workflow run" },
+  "http:GET /api/path/workflow-runs": { since: "0.2.5", summary: "workflow run \u5217\u8868" },
+  "http:GET /api/path/workflow-runs/reviewer-candidate": { since: "0.2.5", summary: "reviewer \u5019\u9009\u67E5\u8BE2" },
+  "http:GET /api/workflow-runs/:param": { since: "0.2.5", summary: "\u8BFB workflow run" },
+  "http:POST /api/workflow-runs/:param/gate": { since: "0.2.5", summary: "workflow \u7528\u6237\u95F8\u95E8\u51B3\u5B9A" },
+  "http:POST /api/workflow-runs/:param/cancel": { since: "0.2.5", summary: "\u53D6\u6D88 workflow run" },
+  // --- Git / worktrees / diff ---
+  "http:GET /api/path/worktrees": { since: "0.2.0", summary: "worktree \u5217\u8868/\u72B6\u6001" },
+  "http:POST /api/path/worktrees": { since: "0.2.0", summary: "\u5EFA worktree" },
+  "http:DELETE /api/path/worktrees": { since: "0.2.0", summary: "\u5220 worktree" },
+  "http:GET /api/path/branches": { since: "0.2.0", summary: "\u5206\u652F\u5217\u8868" },
+  "http:GET /api/path/branches/activity": { since: "0.2.0", summary: "\u5206\u652F\u6D3B\u52A8\u6982\u89C8" },
+  "http:POST /api/path/branches/merge-status": { since: "0.2.0", summary: "\u5206\u652F\u5408\u5E76\u72B6\u6001\u68C0\u6D4B" },
+  "http:GET /api/path/diff": { since: "0.2.0", summary: "\u5DE5\u4F5C\u533A/\u5206\u652F diff" },
+  "http:GET /api/path/commits": { since: "0.2.0", summary: "\u63D0\u4EA4\u5217\u8868" },
+  // --- Files ---
+  "http:GET /api/browse": { since: "0.2.0", summary: "\u6D4F\u89C8\u8FDC\u7AEF\u76EE\u5F55(server \u7BA1\u7406\u9875)" },
+  "http:POST /api/mkdir": { since: "0.2.0", summary: "\u8FDC\u7AEF\u5EFA\u76EE\u5F55" },
+  "http:GET /api/path/browse": { since: "0.2.0", summary: "\u6D4F\u89C8\u9879\u76EE\u76EE\u5F55" },
+  "http:GET /api/path/list-files": { since: "0.2.0", summary: "\u6587\u4EF6\u6811\u5217\u4E3E" },
+  "http:GET /api/path/file-content": { since: "0.2.0", summary: "\u8BFB\u6587\u4EF6\u5185\u5BB9" },
+  "http:GET /api/path/symbol-search": { since: "0.2.0", summary: "\u7B26\u53F7\u641C\u7D22" },
+  "http:GET /api/path/file-download": { since: "0.2.0", summary: "\u6587\u4EF6\u4E0B\u8F7D(\u53EF\u4E8C\u8FDB\u5236)" },
+  "http:POST /api/path/upload": { since: "0.2.0", summary: "\u6587\u4EF6\u4E0A\u4F20" },
+  "http:DELETE /api/path/delete": { since: "0.2.0", summary: "\u5220\u9664\u6587\u4EF6" },
+  // --- Search / notifications / cross-remote ---
+  "http:GET /api/path/search-catalog": { since: "0.2.0", summary: "\u641C\u7D22\u76EE\u5F55\u5FEB\u7167" },
+  // Empirically probed: 0.2.15 → 404, 0.2.16 → 400 (route exists).
+  "http:POST /api/notification-outbox/query": { since: "0.2.16", summary: "\u62C9\u53D6 worker \u901A\u77E5 outbox" },
+  "http:POST /api/path/cross-remote/exec": { since: "0.2.0", summary: "\u8DE8\u8FDC\u7A0B\u7F51\u5173:\u6267\u884C\u547D\u4EE4" },
+  "http:POST /api/path/cross-remote/read-file": { since: "0.2.0", summary: "\u8DE8\u8FDC\u7A0B\u7F51\u5173:\u8BFB\u6587\u4EF6" },
+  "http:POST /api/path/cross-remote/list-dir": { since: "0.2.0", summary: "\u8DE8\u8FDC\u7A0B\u7F51\u5173:\u5217\u76EE\u5F55" },
+  "http:POST /api/path/cross-remote/stat": { since: "0.2.0", summary: "\u8DE8\u8FDC\u7A0B\u7F51\u5173:stat" },
+  "http:POST /api/path/cross-remote/process-list": { since: "0.2.0", summary: "\u8DE8\u8FDC\u7A0B\u7F51\u5173:\u8FDB\u7A0B\u5217\u8868" },
+  // --- Raw passthrough ---
+  // Browser preview proxies caller-supplied paths (and localhost ports) through
+  // the tunnel; the path set is unbounded by design, so it registers as one
+  // passthrough capability instead of per-route entries.
+  "passthrough:browser-proxy": { since: "0.2.0", summary: "\u6D4F\u89C8\u5668\u9884\u89C8\u900F\u4F20(\u4EFB\u610F path+port)" }
+};
+var WORKER_CAPABILITY_KEYS = Object.keys(WORKER_CAPABILITIES);
+
 // src/reverse-connect-client.ts
 var MACHINE_KEY_SETTING = "reverse_machine_private_key";
 var RECONNECT_BASE_DELAY_MS = 1e3;
@@ -249574,7 +249882,12 @@ var ReverseConnectClient = class {
       console.log("[ReverseClient] Socket open, awaiting server handshake");
       this.openedAt = Date.now();
       this.resetNoPingTimer();
-      const frame = { type: "status", ready: true };
+      const frame = {
+        type: "status",
+        ready: true,
+        version: readPackageVersion(),
+        capabilities: WORKER_CAPABILITY_KEYS
+      };
       this.ws.send(JSON.stringify(frame));
     });
     this.ws.on("message", (data) => {
@@ -249663,7 +249976,9 @@ var ReverseConnectClient = class {
       const reply = {
         type: "machine_auth",
         publicKey: publicKeyPem,
-        signature: signature.toString("base64")
+        signature: signature.toString("base64"),
+        version: readPackageVersion(),
+        capabilities: WORKER_CAPABILITY_KEYS
       };
       this.sendFrame(reply);
     } catch (err) {
@@ -249703,14 +250018,10 @@ var ReverseConnectClient = class {
         });
         body = await response.text();
       } else {
-        const injectHeaders = { ...frame.headers ?? {} };
-        if (process.env.VIBEDECKX_API_KEY) {
-          injectHeaders["x-vibedeckx-api-key"] = process.env.VIBEDECKX_API_KEY;
-        }
         const response = await this.localServer.inject({
           method: frame.method,
           url: frame.path,
-          headers: injectHeaders,
+          headers: frame.headers ?? {},
           payload: frame.body
         });
         status = response.statusCode;
@@ -249750,11 +250061,7 @@ var ReverseConnectClient = class {
     }
   }
   handleWsOpen(frame) {
-    const queryParts = [
-      ...frame.query ? [frame.query] : [],
-      ...process.env.VIBEDECKX_API_KEY ? [`apiKey=${encodeURIComponent(process.env.VIBEDECKX_API_KEY)}`] : []
-    ];
-    const wsUrl = `ws://127.0.0.1:${this.localPort}${frame.path}${queryParts.length ? `?${queryParts.join("&")}` : ""}`;
+    const wsUrl = `ws://127.0.0.1:${this.localPort}${frame.path}${frame.query ? `?${frame.query}` : ""}`;
     console.log(`[ReverseClient] Opening local WS channel ${frame.channelId} \u2192 ${frame.path}`);
     const localWs = new wrapper_default(wsUrl);
     localWs.on("open", () => {
@@ -249856,71 +250163,8 @@ var ReverseConnectClient = class {
 // src/connect-daemon.ts
 import { spawn as spawn5 } from "node:child_process";
 import { randomUUID as randomUUID23 } from "node:crypto";
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 import path19 from "node:path";
-
-// src/update-check.ts
-var SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/;
-async function fetchLatestPublishedVersion(pkg = "vibedeckx", fetchImpl = fetch) {
-  try {
-    const response = await fetchImpl(
-      `https://registry.npmjs.org/${pkg}/latest`,
-      { signal: AbortSignal.timeout(4e3) }
-    );
-    if (!response.ok) return void 0;
-    const body = await response.json();
-    return typeof body.version === "string" && parseSemver(body.version) ? body.version : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function parseSemver(version2) {
-  const match2 = SEMVER_RE.exec(version2);
-  if (!match2) return void 0;
-  return {
-    core: [match2[1], match2[2], match2[3]],
-    prerelease: match2[4]?.split(".")
-  };
-}
-function compareNumericStrings(a, b2) {
-  if (a.length !== b2.length) return a.length - b2.length;
-  return a < b2 ? -1 : a > b2 ? 1 : 0;
-}
-function comparePrereleaseIdentifiers(a, b2) {
-  const aNumeric = /^\d+$/.test(a);
-  const bNumeric = /^\d+$/.test(b2);
-  if (aNumeric && bNumeric) return compareNumericStrings(a, b2);
-  if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
-  return a < b2 ? -1 : a > b2 ? 1 : 0;
-}
-function compareSemver(a, b2) {
-  for (let i = 0; i < 3; i += 1) {
-    const compared = compareNumericStrings(a.core[i], b2.core[i]);
-    if (compared !== 0) return compared;
-  }
-  if (!a.prerelease && !b2.prerelease) return 0;
-  if (!a.prerelease) return 1;
-  if (!b2.prerelease) return -1;
-  const length = Math.max(a.prerelease.length, b2.prerelease.length);
-  for (let i = 0; i < length; i += 1) {
-    const aId = a.prerelease[i];
-    const bId = b2.prerelease[i];
-    if (aId === void 0) return -1;
-    if (bId === void 0) return 1;
-    const compared = comparePrereleaseIdentifiers(aId, bId);
-    if (compared !== 0) return compared;
-  }
-  return 0;
-}
-function compareUpdateStatus(current, latest) {
-  if (latest === void 0) return "unknown";
-  const currentParsed = parseSemver(current);
-  const latestParsed = parseSemver(latest);
-  if (!currentParsed || !latestParsed) return "unknown";
-  return compareSemver(latestParsed, currentParsed) > 0 ? "update-available" : "up-to-date";
-}
-
-// src/connect-daemon.ts
 var CONNECT_DAEMON_CHILD_ENV = "VIBEDECKX_INTERNAL_CONNECT_DAEMON";
 var CONNECT_DAEMON_TOKEN_ENV = "VIBEDECKX_INTERNAL_CONNECT_TOKEN";
 function buildDaemonChildArgs(argv) {
@@ -250258,7 +250502,7 @@ function parseLinuxProcessStartTicks(stat2) {
 function readLinuxProcessStartTicks(pid) {
   try {
     return parseLinuxProcessStartTicks(
-      fs7.readFileSync(`/proc/${pid}/stat`, "utf8")
+      fs8.readFileSync(`/proc/${pid}/stat`, "utf8")
     );
   } catch (error48) {
     if (error48 instanceof Error && "code" in error48 && (error48.code === "ENOENT" || error48.code === "ESRCH")) {
@@ -250287,7 +250531,7 @@ function daemonStateLockOwnerPath(lockPath) {
 function readDaemonStateLockOwner(lockPath) {
   let contents;
   try {
-    contents = fs7.readFileSync(daemonStateLockOwnerPath(lockPath), "utf8");
+    contents = fs8.readFileSync(daemonStateLockOwnerPath(lockPath), "utf8");
   } catch (error48) {
     if (hasErrorCode(error48, "ENOENT") || hasErrorCode(error48, "ENOTDIR")) {
       return void 0;
@@ -250315,26 +250559,26 @@ function createDaemonStateLockCandidate(lockPath) {
     nonce: randomUUID23()
   };
   const candidatePath = `${lockPath}.candidate-${process.pid}-${owner.nonce}`;
-  fs7.mkdirSync(candidatePath, { mode: 448 });
+  fs8.mkdirSync(candidatePath, { mode: 448 });
   try {
-    fs7.chmodSync(candidatePath, 448);
+    fs8.chmodSync(candidatePath, 448);
     const ownerPath = daemonStateLockOwnerPath(candidatePath);
-    fs7.writeFileSync(ownerPath, `${JSON.stringify(owner)}
+    fs8.writeFileSync(ownerPath, `${JSON.stringify(owner)}
 `, {
       flag: "wx",
       mode: 384
     });
-    fs7.chmodSync(ownerPath, 384);
+    fs8.chmodSync(ownerPath, 384);
     return { path: candidatePath, owner };
   } catch (error48) {
-    fs7.rmSync(candidatePath, { recursive: true, force: true });
+    fs8.rmSync(candidatePath, { recursive: true, force: true });
     throw error48;
   }
 }
 function quarantineRecoverableDaemonStateLock(lockPath) {
   let stat2;
   try {
-    stat2 = fs7.lstatSync(lockPath);
+    stat2 = fs8.lstatSync(lockPath);
   } catch (error48) {
     if (hasErrorCode(error48, "ENOENT")) return;
     throw error48;
@@ -250347,7 +250591,7 @@ function quarantineRecoverableDaemonStateLock(lockPath) {
   }
   const quarantinePath = `${lockPath}.stale-${stat2.dev}-${stat2.ino}-${String(stat2.ctimeMs).replace(".", "-")}`;
   try {
-    fs7.renameSync(lockPath, quarantinePath);
+    fs8.renameSync(lockPath, quarantinePath);
   } catch (error48) {
     if (hasErrorCode(error48, "ENOENT") || hasErrorCode(error48, "EEXIST") || hasErrorCode(error48, "ENOTEMPTY")) {
       return;
@@ -250361,7 +250605,7 @@ function acquireDaemonStateLock(lockPath) {
   try {
     for (let attempt = 0; attempt < 8; attempt += 1) {
       try {
-        fs7.renameSync(candidate.path, lockPath);
+        fs8.renameSync(candidate.path, lockPath);
         acquired = true;
         return candidate.owner;
       } catch (error48) {
@@ -250376,7 +250620,7 @@ function acquireDaemonStateLock(lockPath) {
     );
   } finally {
     if (!acquired) {
-      fs7.rmSync(candidate.path, { recursive: true, force: true });
+      fs8.rmSync(candidate.path, { recursive: true, force: true });
     }
   }
 }
@@ -250387,7 +250631,7 @@ function sweepLockQuarantine(lockPath) {
   const candidatePrefix = `${base}.candidate-`;
   let entries;
   try {
-    entries = fs7.readdirSync(runDir);
+    entries = fs8.readdirSync(runDir);
   } catch {
     return;
   }
@@ -250401,7 +250645,7 @@ function sweepLockQuarantine(lockPath) {
     }
     if (!removable) continue;
     try {
-      fs7.rmSync(path19.join(runDir, entry), { recursive: true, force: true });
+      fs8.rmSync(path19.join(runDir, entry), { recursive: true, force: true });
     } catch {
     }
   }
@@ -250413,13 +250657,13 @@ function releaseDaemonStateLock(lockPath, expected) {
       `Cannot release daemon state lock at ${lockPath}: lock ownership changed`
     );
   }
-  fs7.rmSync(lockPath, { recursive: true });
+  fs8.rmSync(lockPath, { recursive: true });
 }
 function withDaemonStateLock(dataDir, operation) {
   const lockPath = daemonStateLockPath(dataDir);
   const runDir = path19.dirname(lockPath);
-  fs7.mkdirSync(runDir, { recursive: true, mode: 448 });
-  fs7.chmodSync(runDir, 448);
+  fs8.mkdirSync(runDir, { recursive: true, mode: 448 });
+  fs8.chmodSync(runDir, 448);
   const owner = acquireDaemonStateLock(lockPath);
   try {
     sweepLockQuarantine(lockPath);
@@ -250437,7 +250681,7 @@ function inspectDaemonState(dataDir) {
   const statePath = daemonStatePath(dataDir);
   let contents;
   try {
-    contents = fs7.readFileSync(statePath, "utf8");
+    contents = fs8.readFileSync(statePath, "utf8");
   } catch (error48) {
     if (error48 instanceof Error && "code" in error48 && error48.code === "ENOENT") {
       return { kind: "missing" };
@@ -250649,14 +250893,14 @@ function claimDaemonStateUnlocked(dataDir, connectTo, version2) {
     version: version2
   };
   const statePath = daemonStatePath(dataDir);
-  fs7.mkdirSync(path19.dirname(statePath), { recursive: true, mode: 448 });
-  fs7.chmodSync(path19.dirname(statePath), 448);
-  fs7.writeFileSync(statePath, `${JSON.stringify(state)}
+  fs8.mkdirSync(path19.dirname(statePath), { recursive: true, mode: 448 });
+  fs8.chmodSync(path19.dirname(statePath), 448);
+  fs8.writeFileSync(statePath, `${JSON.stringify(state)}
 `, {
     flag: "wx",
     mode: 384
   });
-  fs7.chmodSync(statePath, 384);
+  fs8.chmodSync(statePath, 384);
   return state;
 }
 function removeDaemonStateIfOwned(dataDir, expected) {
@@ -250669,7 +250913,7 @@ function removeDaemonStateIfOwnedUnlocked(dataDir, expected) {
   const statePath = daemonStatePath(dataDir);
   let contents;
   try {
-    contents = fs7.readFileSync(statePath, "utf8");
+    contents = fs8.readFileSync(statePath, "utf8");
   } catch (error48) {
     if (hasErrorCode(error48, "ENOENT")) return false;
     throw error48;
@@ -250684,7 +250928,7 @@ function removeDaemonStateIfOwnedUnlocked(dataDir, expected) {
     return false;
   }
   try {
-    fs7.unlinkSync(statePath);
+    fs8.unlinkSync(statePath);
     return true;
   } catch (error48) {
     if (hasErrorCode(error48, "ENOENT")) return false;
@@ -250794,26 +251038,26 @@ import path20 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { promisify as promisify8 } from "node:util";
 import childProcess from "node:child_process";
-import fs12, { constants as fsConstants4 } from "node:fs/promises";
+import fs13, { constants as fsConstants4 } from "node:fs/promises";
 
 // ../../node_modules/.pnpm/wsl-utils@0.1.0/node_modules/wsl-utils/index.js
 import process4 from "node:process";
-import fs11, { constants as fsConstants3 } from "node:fs/promises";
+import fs12, { constants as fsConstants3 } from "node:fs/promises";
 
 // ../../node_modules/.pnpm/is-wsl@3.1.0/node_modules/is-wsl/index.js
 import process3 from "node:process";
 import os from "node:os";
-import fs10 from "node:fs";
+import fs11 from "node:fs";
 
 // ../../node_modules/.pnpm/is-inside-container@1.0.0/node_modules/is-inside-container/index.js
-import fs9 from "node:fs";
+import fs10 from "node:fs";
 
 // ../../node_modules/.pnpm/is-docker@3.0.0/node_modules/is-docker/index.js
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 var isDockerCached;
 function hasDockerEnv() {
   try {
-    fs8.statSync("/.dockerenv");
+    fs9.statSync("/.dockerenv");
     return true;
   } catch {
     return false;
@@ -250821,7 +251065,7 @@ function hasDockerEnv() {
 }
 function hasDockerCGroup() {
   try {
-    return fs8.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+    return fs9.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
   } catch {
     return false;
   }
@@ -250837,7 +251081,7 @@ function isDocker() {
 var cachedResult;
 var hasContainerEnv = () => {
   try {
-    fs9.statSync("/run/.containerenv");
+    fs10.statSync("/run/.containerenv");
     return true;
   } catch {
     return false;
@@ -250862,7 +251106,7 @@ var isWsl = () => {
     return true;
   }
   try {
-    return fs10.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
+    return fs11.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
   } catch {
     return false;
   }
@@ -250880,14 +251124,14 @@ var wslDrivesMountPoint = /* @__PURE__ */ (() => {
     const configFilePath = "/etc/wsl.conf";
     let isConfigFileExists = false;
     try {
-      await fs11.access(configFilePath, fsConstants3.F_OK);
+      await fs12.access(configFilePath, fsConstants3.F_OK);
       isConfigFileExists = true;
     } catch {
     }
     if (!isConfigFileExists) {
       return defaultMountPoint;
     }
-    const configContent = await fs11.readFile(configFilePath, { encoding: "utf8" });
+    const configContent = await fs12.readFile(configFilePath, { encoding: "utf8" });
     const configMountPoint = /(?<!#.*)root\s*=\s*(?<mountPoint>.*)/g.exec(configContent);
     if (!configMountPoint) {
       return defaultMountPoint;
@@ -251192,7 +251436,7 @@ var baseOpen = async (options) => {
       const isBundled = !__dirname2 || __dirname2 === "/";
       let exeLocalXdgOpen = false;
       try {
-        await fs12.access(localXdgOpenPath, fsConstants4.X_OK);
+        await fs13.access(localXdgOpenPath, fsConstants4.X_OK);
         exeLocalXdgOpen = true;
       } catch {
       }
@@ -251307,21 +251551,11 @@ function loadTLSOptions(flags) {
     process.exit(1);
   }
   return {
-    cert: fs13.readFileSync(certPath),
-    key: fs13.readFileSync(keyPath),
-    ...clientCAPath && { clientCA: fs13.readFileSync(clientCAPath) }
+    cert: fs14.readFileSync(certPath),
+    key: fs14.readFileSync(keyPath),
+    ...clientCAPath && { clientCA: fs14.readFileSync(clientCAPath) }
   };
 }
-function readPackageVersion() {
-  try {
-    const parsed = JSON.parse(
-      fs13.readFileSync(new URL("../package.json", import.meta.url), "utf8")
-    );
-    return typeof parsed.version === "string" && parsed.version.length > 0 ? parsed.version : "unknown";
-  } catch {
-    return "unknown";
-  }
-}
 var startCommand = buildCommand({
   parameters: {
     flags: {
@@ -251334,7 +251568,7 @@ var startCommand = buildCommand({
       host: {
         kind: "parsed",
         parse: String,
-        brief: "Network interface to bind (default: 127.0.0.1, loopback only). Use 0.0.0.0 to expose on all interfaces \u2014 only do so behind --auth, VIBEDECKX_API_KEY, or a trusted tunnel/proxy.",
+        brief: "Network interface to bind (default: 127.0.0.1, loopback only). Use 0.0.0.0 to expose on all interfaces \u2014 only do so behind --auth or an authenticating proxy.",
         optional: true
       },
       auth: {
@@ -251405,11 +251639,16 @@ var startCommand = buildCommand({
     const noLocalProjects = flags["no-local-projects"] ?? false;
     const tls = loadTLSOptions(flags);
     const isLoopbackHost = host === "127.0.0.1" || host === "::1" || host === "localhost";
-    if (!isLoopbackHost && !authEnabled && !process.env.VIBEDECKX_API_KEY) {
+    if (!isLoopbackHost && !authEnabled) {
       console.warn(
         `Warning: binding to ${host} exposes vibedeckx on the network with no authentication.
-Anyone who can reach this host can run commands via the executor API. Enable --auth or
-set VIBEDECKX_API_KEY, or keep the default loopback bind (127.0.0.1) behind a trusted tunnel/proxy.`
+Anyone who can reach this host can run commands via the executor API. Enable --auth, or put
+an authenticating proxy in front, or keep the default loopback bind (127.0.0.1).`
+      );
+    }
+    if (process.env.VIBEDECKX_API_KEY) {
+      console.log(
+        "VIBEDECKX_API_KEY is set: it authenticates operator-only endpoints (/api/admin/*).\nIt does not lock the rest of the API and is not user authentication \u2014 use --auth or a\nproxy in front for that."
       );
     }
     console.log(`Starting vibedeckx${tls ? " (HTTPS)" : ""}...`);
@@ -251685,7 +251924,7 @@ var connectRoutes = buildRouteMap({
   defaultCommand: "run",
   docs: { brief: "Connect to a Vibedeckx server as an inbound node" }
 });
-var routes33 = buildRouteMap({
+var routes34 = buildRouteMap({
   routes: {
     start: startCommand,
     connect: connectRoutes
@@ -251695,7 +251934,7 @@ var routes33 = buildRouteMap({
     brief: "Vibedeckx - AI-powered app generator"
   }
 });
-var program = buildApplication(routes33, {
+var program = buildApplication(routes34, {
   name: "vibedeckx",
   versionInfo: {
     currentVersion: readPackageVersion()