@workflow-code/cli 0.2.4-20261012006.codex-studio-integration → 0.2.4-20261013001.codex-studio-integration

package/dist/{web-FDREEISF.js → web-JXC3WIJK.js}

@@ -342,7 +342,33 @@ var messages_zh_cn_default = {
   "Write file": "\u5199\u5165\u6587\u4EF6",
   Yes: "\u662F",
   "Zoom in": "\u653E\u5927",
-  "Zoom out": "\u7F29\u5C0F"
+  "Zoom out": "\u7F29\u5C0F",
+  "Open resource": "\u6253\u5F00\u8D44\u6E90",
+  "Show in conversation": "\u5728\u5BF9\u8BDD\u4E2D\u5C55\u793A",
+  "Hide preview": "\u6536\u8D77\u9884\u89C8",
+  "Open in new window": "\u5728\u65B0\u7A97\u53E3\u4E2D\u6253\u5F00",
+  "Tool call details": "\u5DE5\u5177\u8C03\u7528\u8BE6\u60C5",
+  "Please sign in to preview this server resource.": "\u8BF7\u767B\u5F55\u540E\u9884\u89C8\u670D\u52A1\u5668\u8D44\u6E90\u3002",
+  "You do not have access to this resource.": "\u4F60\u6CA1\u6709\u6B64\u8D44\u6E90\u7684\u8BBF\u95EE\u6743\u9650\u3002",
+  "The resource project is unavailable.": "\u8D44\u6E90\u6240\u5C5E\u9879\u76EE\u4E0D\u53EF\u7528\u3002",
+  "The resource project is unavailable. Import or open the target project first.": "\u8D44\u6E90\u6240\u5C5E\u9879\u76EE\u4E0D\u53EF\u7528\uFF0C\u8BF7\u5148\u5BFC\u5165\u6216\u6253\u5F00\u76EE\u6807\u9879\u76EE\u3002",
+  "The project does not allow this storage location.": "\u9879\u76EE\u4E0D\u5141\u8BB8\u4F7F\u7528\u6B64\u5B58\u50A8\u4F4D\u7F6E\u3002",
+  "This resource no longer exists.": "\u6B64\u8D44\u6E90\u5DF2\u4E0D\u5B58\u5728\u3002",
+  "Server source files cannot be previewed by this card.": "\u6B64\u5361\u7247\u4E0D\u652F\u6301\u9884\u89C8\u670D\u52A1\u5668\u6E90\u7801\u6587\u4EF6\u3002",
+  "File is outside this project.": "\u6587\u4EF6\u4E0D\u5728\u6B64\u9879\u76EE\u4E2D\u3002",
+  "File preview exceeds 2 MiB.": "\u6587\u4EF6\u9884\u89C8\u5927\u5C0F\u8D85\u8FC7 2 MiB\u3002",
+  "This project does not provide a Kanban preview.": "\u6B64\u9879\u76EE\u4E0D\u63D0\u4F9B\u770B\u677F\u9884\u89C8\u3002",
+  "Invalid resource preview URL.": "\u8D44\u6E90\u9884\u89C8\u5730\u5740\u65E0\u6548\u3002",
+  "This preview configuration no longer exists.": "\u6B64\u9884\u89C8\u914D\u7F6E\u5DF2\u4E0D\u5B58\u5728\u3002",
+  "Resource access changed. Open the card again.": "\u8D44\u6E90\u8BBF\u95EE\u72B6\u6001\u5DF2\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00\u5361\u7247\u3002",
+  "This resource preview is read-only.": "\u6B64\u8D44\u6E90\u9884\u89C8\u4E3A\u53EA\u8BFB\u3002",
+  "Invalid resource action.": "\u8D44\u6E90\u64CD\u4F5C\u65E0\u6548\u3002",
+  "Run no longer exists.": "\u6B64\u8FD0\u884C\u5DF2\u4E0D\u5B58\u5728\u3002",
+  "Conversation changed.": "\u4F1A\u8BDD\u5DF2\u53D8\u5316\u3002",
+  "Unable to load this preview. Retry or open it separately.": "\u65E0\u6CD5\u52A0\u8F7D\u6B64\u9884\u89C8\uFF0C\u8BF7\u91CD\u8BD5\u6216\u5355\u72EC\u6253\u5F00\u3002",
+  "Open in browser": "\u5728\u6D4F\u89C8\u5668\u4E2D\u6253\u5F00",
+  "No resources": "\u6682\u65E0\u8D44\u6E90",
+  "Allow popups to open this resource in a new window.": "\u8BF7\u5141\u8BB8\u5F39\u51FA\u7A97\u53E3\u4EE5\u5355\u72EC\u6253\u5F00\u6B64\u8D44\u6E90\u3002"
 };
 
 // src/web/localization.ts
@@ -1706,7 +1732,6 @@ var KanbanMethodHub = class {
 import { readFile as readFile2, readdir, realpath as realpath2 } from "fs/promises";
 import { createHash } from "crypto";
 import path2 from "path";
-var readKanbanProjectInfo = readWorkflowProjectInfo;
 var webProjectDataDirectory = (storageDir, projectDir) => path2.join(storageDir, createHash("sha256").update(projectDir).digest("hex").slice(0, 24));
 async function localKanbanRelatedProjects(project) {
   const info = readWorkflowProjectInfo(JSON.parse(await readFile2(path2.join(project.folderPath, "package.json"), "utf8")));
@@ -1846,7 +1871,7 @@ var KanbanController = class {
   async load() {
     const pkg = JSON.parse(await readFile3(path3.join(this.project.folderPath, "package.json"), "utf8"));
     const artifact = readKanbanArtifactConfig(pkg);
-    const projectInfo = readKanbanProjectInfo(pkg);
+    const projectInfo = readWorkflowProjectInfo(pkg);
     let params;
     try {
       params = parseKanbanManifestText(await readFile3(path3.join(this.project.folderPath, "kanban.json"), "utf8")).params;
@@ -2145,115 +2170,7 @@ var KanbanController = class {
   }
 };
 
-// src/web/resource-cards.ts
-var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-var string = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
-function conversationResourceCards(items, projectId, conversationId) {
-  const cards = /* @__PURE__ */ new Map();
-  for (const [index, item] of items.entries()) {
-    if (!["agent-part", "opencode-part"].includes(String(item.metadata?.kind)) || item.metadata?.partType !== "tool") {
-      continue;
-    }
-    const content = record(item.content);
-    if (content?.status !== "success") {
-      continue;
-    }
-    let output = record(content.output);
-    const details = record(output?.details);
-    if (Array.isArray(output?.content) && output.content.length === 1) {
-      try {
-        output = record(JSON.parse(String(record(output.content[0])?.text)));
-      } catch {
-      }
-    }
-    let descriptor = record(details?.resourceCard) ?? record(record(output?.details)?.resourceCard);
-    const input = record(content.input) ?? {};
-    const tool = string(content.tool) ?? "";
-    if (tool === "workflow-ui_present_card") {
-      const presentation = output?.action ? output : input;
-      if (presentation.action === "remove") {
-        cards.delete(String(presentation.cardId));
-        continue;
-      }
-      if (presentation.action !== "upsert") {
-        continue;
-      }
-      descriptor = presentation;
-    }
-    if (!descriptor) {
-      const target2 = { source: "local", projectId, conversationId };
-      let kind2;
-      if (tool === "workflow-kv_kv_store" || /workflow-desktop_(?:read|list|write)_project_kv/.test(tool)) {
-        kind2 = "kv";
-        Object.assign(target2, { projectId: input.projectId ?? projectId, key: input.key, scope: input.scope ?? "project", conversationId: input.conversationId ?? conversationId });
-      } else if (tool === "workflow-knowledge_knowledge_documents" || /workflow-desktop_(?:query|mutate)_project_knowledge/.test(tool)) {
-        kind2 = "knowledge";
-        Object.assign(target2, { projectId: input.projectId ?? projectId, documentId: input.documentId ?? record(output?.document)?.id });
-      } else if (tool === "read" || tool === "workflow-desktop_open_dock_tool" && input.tool === "files") {
-        kind2 = "file";
-        target2.filePath = input.filePath ?? input.path;
-      } else if (tool === "workflow-desktop_open_project" && input.kind === "project") {
-        kind2 = "project";
-        target2.projectId = input.targetId;
-      } else if (tool === "workflow-desktop_open_dock_tool") {
-        if (input.tool === "browser") {
-          kind2 = "browser";
-          target2.url = input.url;
-        }
-        if (input.tool === "preview") {
-          kind2 = "kanban";
-        }
-        if (input.tool === "open-project" && input.openedProjectKind === "project") {
-          kind2 = "project";
-          target2.projectId = input.openedProjectId;
-        }
-      }
-      if (!kind2) {
-        continue;
-      }
-      descriptor = { kind: kind2, target: target2, title: record(output?.document)?.title };
-    }
-    const kind = descriptor.kind;
-    if (!["kv", "knowledge", "project", "browser", "file", "kanban"].includes(kind)) {
-      continue;
-    }
-    const target = Object.fromEntries(Object.entries(record(descriptor.target) ?? {}).filter((entry) => typeof entry[1] === "string" && entry[1].length < 8192));
-    if (target.source === "current") {
-      target.source = "local";
-      target.projectId = projectId;
-    }
-    if (target.source && !["local", "server"].includes(target.source)) {
-      continue;
-    }
-    if (kind === "browser") {
-      try {
-        const url = new URL(target.url);
-        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) {
-          continue;
-        }
-      } catch {
-        continue;
-      }
-    } else {
-      target.source ??= "local";
-      target.projectId ??= projectId;
-      if (target.scope === "conversation") {
-        target.conversationId ??= conversationId;
-      }
-      if (kind === "file" && (!target.filePath || /^(?:[\\/]|[a-z]:)|(?:^|[\\/])\.\.(?:[\\/]|$)/i.test(target.filePath))) {
-        continue;
-      }
-    }
-    const id = string(descriptor.cardId) ?? `${kind}:${JSON.stringify(target)}`;
-    const title = (string(descriptor.title) ?? target.key ?? target.documentId ?? target.filePath ?? target.url ?? target.projectId ?? kind).slice(0, 200);
-    cards.set(id, { id, kind, title, target, itemId: item.id ?? String(index) });
-  }
-  return [...cards.values()];
-}
-
 // src/web/workflow-actions.ts
-import { readFile as readFile4, realpath as realpath3 } from "fs/promises";
-import path4 from "path";
 function createWorkflowActions(controller, runtime, project, revision, changed) {
   const states = /* @__PURE__ */ new Map();
   const epochs = /* @__PURE__ */ new Map();
@@ -2438,28 +2355,6 @@ function createWorkflowActions(controller, runtime, project, revision, changed)
           replies.push({ type: "attachments", entrypointId: id, runId: message.runId, requestId: message.requestId, paramName: message.paramName, files });
           break;
         }
-        case "resource": {
-          const run = controller.runs.find((record2) => record2.id === message.runId);
-          if (!run) {
-            throw new Error("Run no longer exists.");
-          }
-          const card = conversationResourceCards(run.items, project.id, run.scopeId).find((card2) => card2.id === message.cardId);
-          if (!card || card.target.projectId && card.target.projectId !== project.id || card.target.source === "server") {
-            throw new Error("Resource is outside this project.");
-          }
-          if (card.kind === "kv" || card.kind === "knowledge") {
-            replies.push({ type: "preview", title: card.title, content: await runtime.readResource(project, run.scopeId, card.kind, card.target) });
-          } else if (card.kind === "file") {
-            const root = await realpath3(project.folderPath), filename = await realpath3(path4.resolve(root, card.target.filePath)), relative = path4.relative(root, filename);
-            if (relative.startsWith("..") || path4.isAbsolute(relative)) {
-              throw new Error("File is outside this project.");
-            }
-            replies.push({ type: "preview", title: card.title, content: await readFile4(filename, "utf8") });
-          } else {
-            throw new Error("This resource requires an editor host.");
-          }
-          break;
-        }
         default:
           throw new Error(`Unsupported workflow action: ${message.type}`);
       }
@@ -2471,26 +2366,26 @@ function createWorkflowActions(controller, runtime, project, revision, changed)
 // src/web/runtime.ts
 import { spawn } from "child_process";
 import { existsSync, readFileSync } from "fs";
-import path5 from "path";
+import path4 from "path";
 import { fileURLToPath } from "url";
 import { WORKFLOW_RUNTIME_LOCALE_ENV } from "workflow-code";
 function cliRoot() {
-  let directory = path5.dirname(fileURLToPath(import.meta.url));
+  let directory = path4.dirname(fileURLToPath(import.meta.url));
   for (let depth = 0; depth < 8; depth++) {
     try {
-      if (JSON.parse(readFileSync(path5.join(directory, "package.json"), "utf8")).name === "@workflow-code/cli") {
+      if (JSON.parse(readFileSync(path4.join(directory, "package.json"), "utf8")).name === "@workflow-code/cli") {
         return directory;
       }
     } catch {
     }
-    directory = path5.dirname(directory);
+    directory = path4.dirname(directory);
   }
   throw new Error("Cannot locate the CLI installation.");
 }
 function createWebRuntime(projectDir, storageDir, connection, relatedProjects = () => []) {
   const root = cliRoot();
-  const builtWorker = path5.join(root, "dist/web/worker.mjs");
-  const worker = existsSync(builtWorker) ? builtWorker : path5.join(root, "src/web/worker.mjs");
+  const builtWorker = path4.join(root, "dist/web/worker.mjs");
+  const worker = existsSync(builtWorker) ? builtWorker : path4.join(root, "src/web/worker.mjs");
   const children = /* @__PURE__ */ new Set();
   const active = /* @__PURE__ */ new Map();
   let disposed = false;
@@ -2514,7 +2409,7 @@ function createWebRuntime(projectDir, storageDir, connection, relatedProjects =
       WORKFLOW_SERVER_TOKEN: "",
       WORKFLOW_LLM_SERVER_URL: auth?.serverUrl ?? "",
       WORKFLOW_LLM_SERVER_TOKEN: auth?.accessToken ?? "",
-      WORKFLOW_CLI_AUTH_DIR: path5.join(storageDir, "runtime-auth")
+      WORKFLOW_CLI_AUTH_DIR: path4.join(storageDir, "runtime-auth")
     };
     for (const key of [
       "TSX_TSCONFIG_PATH",
@@ -2637,6 +2532,125 @@ function createWebRuntime(projectDir, storageDir, connection, relatedProjects =
   };
 }
 
+// src/web/resource-cards.ts
+var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var string = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
+function conversationResourceCards(items, projectId, conversationId, storageSource = "local") {
+  const cards = /* @__PURE__ */ new Map();
+  for (const [index, item] of items.entries()) {
+    if (!["agent-part", "opencode-part"].includes(String(item.metadata?.kind)) || item.metadata?.partType !== "tool") {
+      continue;
+    }
+    const content = record(item.content);
+    if (content?.status !== "success") {
+      continue;
+    }
+    let output = record(content.output);
+    const details = record(output?.details);
+    if (Array.isArray(output?.content) && output.content.length === 1) {
+      try {
+        output = record(JSON.parse(String(record(output.content[0])?.text)));
+      } catch {
+      }
+    }
+    let descriptor = record(details?.resourceCard) ?? record(record(output?.details)?.resourceCard);
+    const input = record(content.input) ?? {};
+    const tool = string(content.tool) ?? "";
+    if (tool === "workflow-ui_present_card") {
+      const presentation = output?.action ? output : input;
+      if (presentation.action === "remove") {
+        cards.delete(String(presentation.cardId));
+        continue;
+      }
+      if (presentation.action !== "upsert") {
+        continue;
+      }
+      descriptor = presentation;
+    }
+    if (!descriptor) {
+      const target2 = { source: "local", projectId, conversationId };
+      let kind2;
+      if (tool === "workflow-kv_kv_store" || /workflow-desktop_(?:read|list|write)_project_kv/.test(tool)) {
+        kind2 = "kv";
+        Object.assign(target2, { projectId: input.projectId ?? projectId, key: input.key, scope: input.scope ?? "project", conversationId: input.conversationId ?? conversationId });
+      } else if (tool === "workflow-knowledge_knowledge_documents" || /workflow-desktop_(?:query|mutate)_project_knowledge/.test(tool)) {
+        kind2 = "knowledge";
+        Object.assign(target2, { projectId: input.projectId ?? projectId, documentId: input.documentId ?? record(output?.document)?.id });
+      } else if (tool === "read" || tool === "workflow-desktop_open_dock_tool" && input.tool === "files") {
+        kind2 = "file";
+        target2.filePath = input.filePath ?? input.path;
+      } else if (tool === "workflow-desktop_open_project" && input.kind === "project") {
+        kind2 = "project";
+        target2.projectId = input.targetId;
+      } else if (tool === "workflow-desktop_open_dock_tool") {
+        if (input.tool === "browser") {
+          kind2 = "browser";
+          target2.url = input.url;
+        }
+        if (input.tool === "preview") {
+          kind2 = "kanban";
+        }
+        if (input.tool === "open-project" && input.openedProjectKind === "project") {
+          kind2 = "project";
+          target2.projectId = input.openedProjectId;
+        }
+      }
+      if (!kind2) {
+        continue;
+      }
+      if (kind2 === "kv" || kind2 === "knowledge") {
+        target2.source = input.source ?? storageSource;
+      }
+      descriptor = { kind: kind2, target: target2, title: record(output?.document)?.title };
+    }
+    const kind = descriptor.kind;
+    if (!["kv", "knowledge", "project", "browser", "file", "kanban"].includes(kind)) {
+      continue;
+    }
+    const target = Object.fromEntries(Object.entries(record(descriptor.target) ?? {}).filter((entry) => typeof entry[1] === "string" && entry[1].length < 8192));
+    if (target.source === "current") {
+      target.source = kind === "kv" || kind === "knowledge" ? storageSource : "local";
+      target.projectId = projectId;
+    }
+    if (target.source && !["local", "server"].includes(target.source)) {
+      continue;
+    }
+    if (kind === "browser") {
+      try {
+        const url = new URL(target.url);
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) {
+          continue;
+        }
+      } catch {
+        continue;
+      }
+    } else {
+      target.source ??= "local";
+      target.projectId ??= projectId;
+      if (target.scope === "conversation") {
+        target.conversationId ??= conversationId;
+      }
+      if (kind === "file" && (!target.filePath || /^(?:[\\/]|[a-z]:)|(?:^|[\\/])\.\.(?:[\\/]|$)/i.test(target.filePath))) {
+        continue;
+      }
+    }
+    const id = string(descriptor.cardId) ?? `${kind}:${JSON.stringify(target)}`;
+    const title = (string(descriptor.title) ?? string(record(output?.document)?.title) ?? target.key ?? target.documentId ?? target.filePath ?? target.url ?? target.projectId ?? kind).slice(0, 200);
+    const kanban = record(descriptor.kanban), values = record(kanban?.values);
+    cards.set(id, {
+      id,
+      kind,
+      title,
+      target,
+      itemId: item.id ?? String(index),
+      ...typeof descriptor.preview === "boolean" ? { preview: descriptor.preview } : {},
+      ...typeof descriptor.pinned === "boolean" ? { pinned: descriptor.pinned } : {},
+      ...kind === "kanban" && ["preview", "save"].includes(String(kanban?.mode)) && values && Object.keys(values).length <= 100 && Object.values(values).every((value) => typeof value === "string") ? { kanban: { mode: kanban.mode, values } } : {}
+    });
+  }
+  return [...cards.values()];
+}
+
 // src/web/account-auth.ts
 async function loginWebAccount(serverUrl, email, password) {
   if (!email.trim() || !password) {
@@ -2720,6 +2734,287 @@ async function inspectWebProject(runtime, projectDir, host) {
   };
 }
 
+// src/web/resource-preview.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { readFile as readFile4, realpath as realpath3, stat as stat3 } from "fs/promises";
+import path5 from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+var ResourcePreviews = class {
+  constructor(owner, runtime, storageDir, connection, related, resourceProjects = () => []) {
+    this.owner = owner;
+    this.runtime = runtime;
+    this.storageDir = storageDir;
+    this.connection = connection;
+    this.related = related;
+    this.resourceProjects = resourceProjects;
+  }
+  owner;
+  runtime;
+  storageDir;
+  connection;
+  related;
+  resourceProjects;
+  entries = /* @__PURE__ */ new Map();
+  generation = 0;
+  clear() {
+    this.generation++;
+    this.entries.clear();
+  }
+  get revision() {
+    return this.generation;
+  }
+  async server(id, suffix, init = {}) {
+    const connection = this.connection();
+    if (!connection) {
+      throw new Error(t("Please sign in to preview this server resource."));
+    }
+    const response = await fetch(`${connection.serverUrl}/api/workflows/${encodeURIComponent(id)}${suffix}`, {
+      ...init,
+      headers: { Authorization: `Bearer ${connection.accessToken}`, "Content-Type": "application/json" },
+      signal: AbortSignal.timeout(3e4),
+      redirect: "error"
+    });
+    const result = await response.json();
+    if (!response.ok || result.errCode !== 0) {
+      throw new Error(result.errMessage || t("You do not have access to this resource."));
+    }
+    return result.data;
+  }
+  async resolve(card) {
+    if (card.kind === "browser") {
+      return;
+    }
+    const id = card.target.projectId ?? this.owner.id;
+    if (card.target.source === "server") {
+      if (card.kind === "kv" || card.kind === "knowledge") {
+        if (id.toLowerCase() === this.owner.id.toLowerCase()) {
+          return this.owner;
+        }
+        return { id, uri: `workflow-server:${id}`, folderPath: "", name: id, projectType: "workflow", fields: [], entrypoints: [] };
+      }
+      const snapshot = await this.server(id, "/structure"), structure = snapshot.structure;
+      return {
+        ...structure,
+        id,
+        uri: `workflow-server:${id}`,
+        folderPath: "",
+        name: snapshot.workflowName ?? card.title,
+        projectType: structure.projectType,
+        fields: structure.params ?? [],
+        entrypoints: structure.entrypoints ?? []
+      };
+    }
+    if (id === this.owner.id) {
+      return this.owner;
+    }
+    for (const directory of /* @__PURE__ */ new Set([...this.related().map((binding) => binding.projectDir), ...this.resourceProjects()])) {
+      let root, pkg;
+      try {
+        root = await realpath3(directory);
+        pkg = JSON.parse(await readFile4(path5.join(root, "package.json"), "utf8"));
+      } catch {
+        continue;
+      }
+      if (String(pkg.id).toLowerCase() !== id.toLowerCase()) {
+        continue;
+      }
+      const inspected = await this.runtime.inspect([root]);
+      const project = inspected.projects.find((project2) => project2.id.toLowerCase() === id.toLowerCase());
+      if (!project) {
+        throw new Error(t("The resource project is unavailable."));
+      }
+      return { ...project, uri: pathToFileURL2(root).href };
+    }
+    throw new Error(t("The resource project is unavailable. Import or open the target project first."));
+  }
+  async open(card) {
+    const generation = this.generation;
+    const project = await this.resolve(card);
+    const id = randomUUID3(), data = { card, project }, entry = { data };
+    const target = card.target, scopeId = target.conversationId ?? "";
+    if (card.kind === "kv" || card.kind === "knowledge") {
+      if (target.source === "server") {
+        const query = new URLSearchParams({ scope: target.scope ?? "project" });
+        if (target.conversationId) {
+          query.set("conversationId", target.conversationId);
+        }
+        if (target.key) {
+          query.set("key", target.key);
+        }
+        data.content = await this.server(project.id, card.kind === "knowledge" ? `/knowledge-documents${target.documentId ? `/${encodeURIComponent(target.documentId)}` : ""}` : `/kv${target.key ? "/entry" : ""}?${query}`);
+      } else {
+        const info = readWorkflowProjectInfo(JSON.parse(await readFile4(path5.join(project.folderPath, "package.json"), "utf8")));
+        if (info.dataStorage && !isWorkflowProjectDataStorageLocationAllowed(info, "local")) {
+          throw new Error(t("The project does not allow this storage location."));
+        }
+        data.content = await this.runtime.readResource(project, scopeId, card.kind, target);
+      }
+      if (card.kind === "knowledge" && (data.content === null || data.content === void 0)) {
+        throw new Error(t("This resource no longer exists."));
+      }
+      data.format = card.kind === "knowledge" && typeof data.content.markdown === "string" ? "markdown" : "json";
+    } else if (card.kind === "file") {
+      if (target.source === "server") {
+        throw new Error(t("Server source files cannot be previewed by this card."));
+      }
+      const root = await realpath3(project.assistant?.workdir ?? project.folderPath);
+      const filename = await realpath3(path5.resolve(root, target.filePath));
+      const relative = path5.relative(root, filename);
+      if (relative === ".." || relative.startsWith(`..${path5.sep}`) || path5.isAbsolute(relative)) {
+        throw new Error(t("File is outside this project."));
+      }
+      if (!(await stat3(filename)).isFile() || (await stat3(filename)).size > 2 * 1024 * 1024) {
+        throw new Error(t("File preview exceeds 2 MiB."));
+      }
+      data.content = await readFile4(filename, "utf8");
+      data.format = /\.mdx?$/i.test(filename) ? "markdown" : "text";
+    } else if (card.kind === "browser") {
+      data.format = "browser";
+      data.content = target.url;
+    } else if (card.kind === "kanban" || project?.projectType === "kanban" && card.preview !== false) {
+      if (project?.projectType !== "kanban") {
+        throw new Error(t("This project does not provide a Kanban preview."));
+      }
+      let params, configurations, activeId;
+      if (target.source === "server") {
+        const workspace = await this.server(project.id, "/kanban");
+        params = workspace.manifest?.params ?? [];
+        configurations = workspace.configurations;
+        activeId = workspace.activeConfigurationId;
+        const connection = this.connection(), url = new URL(workspace.preview.url, `${connection.serverUrl}/`);
+        const expected = `/api/workflows/${encodeURIComponent(project.id)}/kanban/previews/`;
+        if (url.origin !== new URL(connection.serverUrl).origin || !url.pathname.startsWith(expected) || url.search || url.hash) {
+          throw new Error(t("Invalid resource preview URL."));
+        }
+        const segments = url.pathname.slice(expected.length).split("/");
+        const assetPrefix = `${expected}${segments.slice(0, 3).join("/")}/`;
+        entry.remote = { url, prefix: assetPrefix, connection };
+        data.kanban = { url: `/resource-assets/${id}/${url.pathname.slice(assetPrefix.length)}`, nonce: workspace.preview.nonce, configuration: { id: "", name: "", params: {} } };
+      } else {
+        params = project.fields;
+        try {
+          params = parseKanbanManifestText(await readFile4(path5.join(project.folderPath, "kanban.json"), "utf8")).params;
+        } catch (error) {
+          if (error.code !== "ENOENT") {
+            throw error;
+          }
+        }
+        let workspace = {};
+        try {
+          workspace = JSON.parse(await readFile4(path5.join(webProjectDataDirectory(this.storageDir, project.folderPath), "kanban.json"), "utf8"));
+        } catch (error) {
+          if (error.code !== "ENOENT") {
+            throw error;
+          }
+        }
+        configurations = workspace.configurations ?? [];
+        activeId = workspace.activeConfigurationId;
+      }
+      const selected = configurations.find((item) => item.id === (target.configurationId ?? activeId));
+      if (target.configurationId && !selected) {
+        throw new Error(t("This preview configuration no longer exists."));
+      }
+      const values = sanitizeKanbanValues(params, { ...selected?.values ?? createDefaultKanbanValues(params), ...card.kanban?.mode === "preview" ? card.kanban.values : {} });
+      const configuration = { id: selected?.id ?? id, name: selected?.name ?? card.title, params: createInjectedKanbanParams(params, values) };
+      if (!entry.remote) {
+        if (!project.kanban) {
+          throw new Error(t("This project does not provide a Kanban preview."));
+        }
+        entry.local = new KanbanPreview(project.folderPath, project.kanban, () => configuration);
+        data.kanban = { url: entry.local.url, nonce: entry.local.nonce, configuration };
+      } else {
+        data.kanban.configuration = configuration;
+      }
+      data.format = "kanban";
+    } else {
+      data.format = "project";
+      data.content = project;
+    }
+    if (generation !== this.generation) {
+      throw new Error(t("Resource access changed. Open the card again."));
+    }
+    if (this.entries.size >= 64) {
+      this.entries.delete(this.entries.keys().next().value);
+    }
+    this.entries.set(id, entry);
+    return { id, data, url: `/resource/${id}?workflowLocale=${locale()}` };
+  }
+  get(id) {
+    const entry = this.entries.get(id);
+    if (!entry) {
+      throw new Error(t("Resource access changed. Open the card again."));
+    }
+    return entry.data;
+  }
+  async asset(url) {
+    const generation = this.generation;
+    if (url.pathname.startsWith("/kanban/")) {
+      for (const entry of this.entries.values()) {
+        if (entry.local && url.pathname.startsWith(`/kanban/${entry.local.nonce}/`)) {
+          const asset2 = await entry.local.asset(url);
+          return generation === this.generation ? asset2 : void 0;
+        }
+      }
+      return;
+    }
+    const match = /^\/resource-assets\/([^/]+)\/(.+)$/.exec(url.pathname);
+    const remote = match && this.entries.get(match[1])?.remote;
+    const connection = this.connection();
+    if (!remote || remote.connection.serverUrl !== connection?.serverUrl || remote.connection.accessToken !== connection?.accessToken) {
+      return;
+    }
+    const asset = decodeURIComponent(match[2]);
+    if (asset.includes("\\") || asset.split("/").some((part) => part === ".." || !part) || !/\.[a-z\d]+$/i.test(asset)) {
+      return;
+    }
+    const address = new URL(`${remote.prefix}${match[2]}`, remote.url.origin);
+    const response = await fetch(address, { headers: { Authorization: `Bearer ${remote.connection.accessToken}` }, redirect: "error", signal: AbortSignal.timeout(3e4) });
+    if (!response.ok) {
+      return;
+    }
+    const content = Buffer.from(await response.arrayBuffer());
+    if (generation !== this.generation) {
+      return;
+    }
+    return { content, headers: {
+      "Content-Type": response.headers.get("content-type") ?? "application/octet-stream",
+      "Content-Security-Policy": `${response.headers.get("content-security-policy") ?? "default-src 'none'"}; frame-ancestors 'self' vscode-webview: vscode-file: http://127.0.0.1:* http://localhost:*`,
+      "Cache-Control": "no-store",
+      "Access-Control-Allow-Origin": "*",
+      "X-Content-Type-Options": "nosniff"
+    } };
+  }
+  async bridge(id, value) {
+    const generation = this.generation;
+    const data = this.get(id), project = data.project, call = parseKanbanBridgeCall(value);
+    if (data.format !== "kanban" || !project) {
+      throw new Error(t("This project does not provide a Kanban preview."));
+    }
+    if (!["runtime.getLocale", "kv.getValue", "relatedProject.kv.getValue", "knowledge.listDocuments", "knowledge.getDocument", "knowledge.searchDocuments", "knowledge.readDocumentLines", "files.readFile"].includes(call.operation)) {
+      throw new Error(t("This resource preview is read-only."));
+    }
+    if (call.operation === "runtime.getLocale") {
+      return locale();
+    }
+    let result;
+    if (data.card.target.source === "server" || project.projectInfo?.dataStorage?.mode === "server") {
+      result = await this.server(project.id, "/kanban/bridge", { method: "POST", body: JSON.stringify({ call }) });
+    } else if (call.operation === "files.readFile") {
+      const file = await this.runtime.readFile(project, String(call.input.fileId));
+      result = { file: file.reference, base64: (await readFile4(file.path)).toString("base64") };
+    } else {
+      if (!this.runtime.kanbanBridge) {
+        throw new Error(t("The resource project is unavailable."));
+      }
+      result = await this.runtime.kanbanBridge(project, call);
+    }
+    if (generation !== this.generation) {
+      throw new Error(t("Resource access changed. Open the card again."));
+    }
+    return result;
+  }
+};
+
 // src/web/server.ts
 async function startWebServer(options) {
   const projectDir = await realpath4(path6.resolve(options.projectDir));
@@ -2738,6 +3033,7 @@ async function startWebServer(options) {
   let authCheck;
   const sensitiveTokens = /* @__PURE__ */ new Set();
   let relatedProjects = options.host?.relatedProjects ?? [];
+  let resourceProjects = options.host?.resourceProjects ?? [];
   const runtime = options.runtime ?? createWebRuntime(projectDir, storageDir, () => connection, () => relatedProjects);
   let inspected;
   try {
@@ -2759,6 +3055,7 @@ async function startWebServer(options) {
     throw new Error("Unsupported Workflow project type.");
   }
   const project = descriptor;
+  const resources = new ResourcePreviews(project, runtime, storageDir, () => connection, () => relatedProjects, () => resourceProjects);
   const key = createHash3("sha256").update(project.assistant ? `assistant:${project.id}:${project.assistant.workdir}` : projectDir).digest("hex").slice(0, 24);
   const historyPath = path6.join(storageDir, key, "conversations.json");
   let saved = {};
@@ -2798,7 +3095,8 @@ async function startWebServer(options) {
     project,
     ...isKanban ? { kanban: kanbanController.state() } : isWorkflow ? workflowActions.state() : { sessions: controller.sessions, activeId: controller.activeId, running: controller.running, parameterValues: controller.current.parameterValues ?? {} },
     account: { ...account, user: account.user && { userId: account.user.userId, email: account.user.email, displayName: account.user.displayName, avatarUrl: account.user.avatarUrl } },
-    authenticationRevision: authRevision
+    authenticationRevision: authRevision,
+    resourceRevision: resources.revision
   }, [...sensitiveTokens], false));
   const broadcast = () => {
     if (broadcastTimer) {
@@ -2918,6 +3216,7 @@ ${token}`;
     authIdentity = identity;
     const candidate = !signedOut && serverUrl && token ? { serverUrl: serverUrl.replace(/\/+$/, ""), accessToken: token } : void 0;
     if (changed) {
+      resources.clear();
       connection = void 0;
       authRevision++;
       parameterStates.clear();
@@ -2959,6 +3258,7 @@ ${token}`;
           return;
         }
         connection = void 0;
+        resources.clear();
         kanbanController?.authenticationChanged();
         if (!changed) {
           authRevision++;
@@ -3029,6 +3329,62 @@ ${token}`;
     if (message.projectUri && message.projectUri !== project.uri) {
       throw new Error("Project changed.");
     }
+    if (message.type === "resource-data") {
+      return [{ type: "resource-data", requestId: message.requestId, data: resources.get(String(message.id)) }];
+    }
+    if (message.type === "resource-refresh" || message.type === "resource-select") {
+      const card = resources.get(String(message.id)).card;
+      const selection = message.type === "resource-select" ? message.selection : void 0;
+      const target = { ...card.target };
+      if (selection && ["kv", "knowledge"].includes(card.kind)) {
+        for (const key2 of card.kind === "knowledge" ? ["documentId"] : ["key", "scope", "conversationId"]) {
+          if (typeof selection[key2] === "string" && selection[key2].length <= 8192) {
+            target[key2] = selection[key2];
+          }
+        }
+      }
+      const preview = await resources.open({ ...card, target });
+      return [{ type: "resource-data", requestId: message.requestId, id: preview.id, data: preview.data }];
+    }
+    if (message.type === "resource-bridge") {
+      return [{ type: "resource-bridge", requestId: message.requestId, value: await resources.bridge(String(message.id), message.call) }];
+    }
+    if (message.type === "resource") {
+      if (!["open", "inline", "window", "project", void 0].includes(message.action)) {
+        throw new Error(t("Invalid resource action."));
+      }
+      let items, scopeId;
+      if (workflowController) {
+        const run = workflowController.runs.find((run2) => run2.id === message.runId);
+        if (!run) {
+          throw new Error(t("Run no longer exists."));
+        }
+        items = run.items;
+        scopeId = run.scopeId;
+      } else {
+        const current2 = conversationController?.current;
+        if (!current2 || message.sessionId && message.sessionId !== current2.id) {
+          throw new Error(t("Conversation changed."));
+        }
+        items = current2.messages.find((answer) => answer.id === message.messageId)?.items ?? [];
+        scopeId = current2.id;
+      }
+      const card = conversationResourceCards(items, project.id, scopeId, project.projectInfo?.dataStorage?.mode === "server" ? "server" : "local").find((card2) => card2.id === message.cardId);
+      if (!card) {
+        throw new Error(t("This resource no longer exists."));
+      }
+      const preview = await resources.open(card);
+      return [{
+        type: "resource-preview",
+        requestId: message.requestId,
+        cardId: card.id,
+        action: message.action ?? "open",
+        id: preview.id,
+        url: preview.url,
+        card,
+        project: preview.data.project
+      }];
+    }
     if (kanbanController && !["ready", "login", "verify", "logout", "usage"].includes(message.type)) {
       return kanbanController.handle(message);
     }
@@ -3191,27 +3547,6 @@ ${token}`;
         }
         break;
       }
-      case "resource": {
-        const answer = current.messages.find((entry) => entry.id === message.messageId);
-        const card = conversationResourceCards(answer?.items ?? [], project.id, current.id).find((entry) => entry.id === message.cardId);
-        if (!card || card.target.projectId && card.target.projectId !== project.id || card.target.source === "server") {
-          throw new Error("Resource is outside this project.");
-        }
-        if (card.kind === "kv" || card.kind === "knowledge") {
-          replies.push({ type: "preview", title: card.title, content: await runtime.readResource(project, current.id, card.kind, card.target) });
-        } else if (card.kind === "file") {
-          const root = await realpath4(project.assistant?.workdir ?? projectDir);
-          const filename = await realpath4(path6.resolve(root, card.target.filePath));
-          const relative = path6.relative(root, filename);
-          if (relative === ".." || relative.startsWith(`..${path6.sep}`) || path6.isAbsolute(relative)) {
-            throw new Error("File is outside this project.");
-          }
-          replies.push({ type: "preview", title: card.title, content: await readFile5(filename, "utf8") });
-        } else {
-          throw new Error("This resource requires an editor host.");
-        }
-        break;
-      }
       case "usage": {
         if (!connection) {
           throw new Error("Workflow Server login is not configured.");
@@ -3309,13 +3644,14 @@ ${token}`;
       const host = new URL(`http://${request.headers.host ?? ""}`);
       const forwarded = !!options.host && ["127.0.0.1", "localhost", "[::1]"].includes(host.hostname) && !host.username && !host.password && host.pathname === "/" && !host.search && !host.hash;
       const url = new URL(request.url ?? "/", origin);
-      const sandboxAsset = !!kanbanController && url.pathname.startsWith("/kanban/") && ["GET", "HEAD"].includes(request.method ?? "") && request.headers.origin === "null";
+      const resourceAsset = url.pathname.startsWith("/kanban/") || url.pathname.startsWith("/resource-assets/");
+      const sandboxAsset = resourceAsset && ["GET", "HEAD"].includes(request.method ?? "") && request.headers.origin === "null";
       if (request.headers.host !== new URL(origin).host && !forwarded || request.headers.origin && request.headers.origin !== (forwarded ? host.origin : origin) && !sandboxAsset) {
         json(response, 403, { message: "Invalid request origin." });
         return;
       }
-      if (kanbanController && url.pathname.startsWith("/kanban/") && ["GET", "HEAD"].includes(request.method ?? "")) {
-        const asset = await kanbanController.preview.asset(url);
+      if (resourceAsset && ["GET", "HEAD"].includes(request.method ?? "")) {
+        const asset = await kanbanController?.preview.asset(url) ?? await resources.asset(url);
         if (!asset) {
           json(response, 404, { message: "Kanban asset not found." });
           return;
@@ -3349,6 +3685,10 @@ ${token}`;
           json(response, 200, { connected: true });
           return;
         }
+        if (url.pathname === "/api/resource-state" && request.method === "GET") {
+          json(response, 200, { type: "state", authenticationRevision: authRevision, resourceRevision: resources.revision });
+          return;
+        }
         if (url.pathname === "/api/events" && request.method === "GET") {
           const disconnectKanban = kanbanController?.methods.connect(url.searchParams.get("clientId") ?? "");
           response.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive" });
@@ -3370,7 +3710,7 @@ ${token}`;
           const operation = () => handleMessage(message).then((value2) => {
             messages = value2;
           });
-          const concurrent = ["resolve", "ready", "kanban-bridge", "kanban-method-state", "kanban-method-reply", "kanban-methods"].includes(message.type);
+          const concurrent = ["resolve", "ready", "resource", "resource-data", "resource-refresh", "resource-select", "resource-bridge", "kanban-bridge", "kanban-method-state", "kanban-method-reply", "kanban-methods"].includes(message.type);
           const task = concurrent ? operation() : mutations.catch(() => void 0).then(operation);
           if (!concurrent) {
             mutations = task;
@@ -3399,10 +3739,10 @@ ${token}`;
         response.end();
         return;
       }
-      if (url.pathname === "/") {
+      if (url.pathname === "/" || /^\/resource\/[a-f\d-]{36}$/.test(url.pathname)) {
         const ancestors = options.host ? "'self' vscode-webview: vscode-file: https://*.vscode-cdn.net https://*.vscode-webview.net http://127.0.0.1:* http://localhost:*" : "'self' vscode-webview:";
-        response.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: http:; font-src 'self'; connect-src 'self'; media-src 'self' blob:; frame-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors ${ancestors}; form-action 'self'` });
-        const ui = isKanban ? "kanban-workspace" : isWorkflow ? "workflow-workspace" : "workflow-ui";
+        response.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: http:; font-src 'self'; connect-src 'self'; media-src 'self' blob:; frame-src 'self' https: http:; object-src 'none'; base-uri 'none'; frame-ancestors ${ancestors}; form-action 'self'` });
+        const ui = url.pathname !== "/" ? "resource-preview" : isKanban ? "kanban-workspace" : isWorkflow ? "workflow-workspace" : "workflow-ui";
         response.end(`<!doctype html><html lang="${locale()}" data-theme="${options.theme ?? "auto"}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="workflow-project" content="${key}"><title>Workflow</title><link rel="stylesheet" href="/assets/codicons/codicon.css"><link rel="stylesheet" href="/assets/${ui}.css"><link rel="stylesheet" href="/assets/theme.css"></head><body data-surface="${options.host?.surface ?? "editor"}" data-account-host="${hostManaged}"><div id="app"></div><script src="/assets/${ui}.js" defer></script></body></html>`);
         return;
       }
@@ -3411,6 +3751,8 @@ ${token}`;
       assets["/assets/workflow-workspace.css"] = "text/css";
       assets["/assets/kanban-workspace.js"] = "application/javascript";
       assets["/assets/kanban-workspace.css"] = "text/css";
+      assets["/assets/resource-preview.js"] = "application/javascript";
+      assets["/assets/resource-preview.css"] = "text/css";
       if (!assets[url.pathname]) {
         json(response, 404, { message: "Not found." });
         return;
@@ -3453,10 +3795,19 @@ ${token}`;
     kanbanController,
     setHostRelatedProjects: (value) => {
       relatedProjects = value;
+      resources.clear();
+    },
+    setHostResourceProjects: (value) => {
+      resourceProjects = value;
+      resources.clear();
     },
     setHostConnection: async (value) => {
+      if (hostManaged && JSON.stringify(value) === JSON.stringify(hostConnection)) {
+        return;
+      }
       authEpoch++;
       authCheck?.abort();
+      resources.clear();
       hostConnection = value;
       hostManaged = true;
       signedOut = !value;
@@ -3492,6 +3843,15 @@ import { createInterface } from "readline";
 
 // src/web/host-config.ts
 import path7 from "path";
+function parseHostResourceProjects(value) {
+  if (value === void 0) {
+    return [];
+  }
+  if (!Array.isArray(value) || value.length > 100 || value.some((directory) => typeof directory !== "string" || !path7.isAbsolute(directory))) {
+    throw new Error("Invalid host resource projects.");
+  }
+  return [...new Set(value)];
+}
 function parseHostRelatedProjects(value) {
   if (value === void 0) {
     return [];
@@ -3547,7 +3907,8 @@ function parseHostConfiguration(value) {
     assistant,
     assistantProjectDir,
     connection: parseHostConnection(configuration.connection),
-    relatedProjects: parseHostRelatedProjects(configuration.relatedProjects)
+    relatedProjects: parseHostRelatedProjects(configuration.relatedProjects),
+    ...configuration.resourceProjects === void 0 ? {} : { resourceProjects: parseHostResourceProjects(configuration.resourceProjects) }
   };
 }
 
@@ -3659,6 +4020,9 @@ async function main(argv) {
             });
           } else if (message.type === "related-projects") {
             app.setHostRelatedProjects(parseHostRelatedProjects(message.relatedProjects));
+            if (message.resourceProjects !== void 0) {
+              app.setHostResourceProjects(parseHostResourceProjects(message.resourceProjects));
+            }
           } else if (message.type === "close") {
             break;
           } else {