agent-yes 1.294.0 → 1.294.1

package/dist/{SUPPORTED_CLIS-CPXyE9Tg.js → SUPPORTED_CLIS--Qym1DSX.js}

@@ -1,12 +1,12 @@
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-CqaWZAm0.js";
-import "./ts-DYKrhLtc.js";
+import "./versionChecker-9saemWzO.js";
+import "./ts-DJQxNoOm.js";
 import "./todoAutomation-CbVVS4re.js";
 import "./JsonlStore-BqF7AQ6E.js";
 import "./globalPidIndex-CRH9L9tn.js";
 import "./pidStore-DXWqzTSz.js";
 import "./messageLog-Brx3w6zT.js";
 import "./todoStore-DF6vxHgV.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-BxxxYx1J.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-Dy5HGJI8.js";
 
 export { SUPPORTED_CLIS };

package/dist/{SUPPORTED_CLIS-BxxxYx1J.js → SUPPORTED_CLIS-Dy5HGJI8.js}

@@ -1,8 +1,8 @@
-import { t as CLIS_CONFIG } from "./ts-DYKrhLtc.js";
+import { t as CLIS_CONFIG } from "./ts-DJQxNoOm.js";
 
 //#region ts/SUPPORTED_CLIS.ts
 const SUPPORTED_CLIS = Object.keys(CLIS_CONFIG);
 
 //#endregion
 export { SUPPORTED_CLIS as t };
-//# sourceMappingURL=SUPPORTED_CLIS-BxxxYx1J.js.map
+//# sourceMappingURL=SUPPORTED_CLIS-Dy5HGJI8.js.map

package/dist/{agentShare-BXg5zEtW.js → agentShare-D5mMch-V.js}

@@ -5,7 +5,7 @@ import "./pidStore-DXWqzTSz.js";
 import "./messageLog-Brx3w6zT.js";
 import "./e2e-z1xpwSAg.js";
 import "./configShared-DKTgiz7K.js";
-import { J as resolveOne } from "./subcommands-CyhuIreR.js";
+import { J as resolveOne } from "./subcommands-DpVf1Ip5.js";
 import "./notifyStore-2SWKGwZI.js";
 import "./webrtcLink-CnQf9pmu.js";
 import "./remotes-5P__pAXA.js";
@@ -232,4 +232,4 @@ function transformEvent(rawEvent, agentId, forwarded) {
 
 //#endregion
 export { createScopedShare, listShares, revokeAllShares, revokeShare };
-//# sourceMappingURL=agentShare-BXg5zEtW.js.map
+//# sourceMappingURL=agentShare-D5mMch-V.js.map

package/dist/{callback-MneknqcS.js → callback-8NTUQZUU.js}

@@ -1,5 +1,5 @@
 import { t as agentYesHome } from "./agentYesHome-BNtn19J4.js";
-import { J as resolveOne } from "./subcommands-CyhuIreR.js";
+import { J as resolveOne } from "./subcommands-DpVf1Ip5.js";
 import { a as mintCapability, o as parseExpires } from "./callbackCore-Bl2gGcxg.js";
 import { randomBytes } from "node:crypto";
 import { chmodSync, readFileSync, renameSync, writeFileSync } from "node:fs";
@@ -72,7 +72,7 @@ async function resolveBase(flag) {
 	if (flag) return flag;
 	if (process.env.AGENT_YES_CALLBACK_BASE) return process.env.AGENT_YES_CALLBACK_BASE;
 	try {
-		const { resolveLocalServeUrl } = await import("./serve-Cn6LTsO5.js");
+		const { resolveLocalServeUrl } = await import("./serve-BzQQEsXT.js");
 		const url = await resolveLocalServeUrl();
 		if (url) return url;
 	} catch {}
@@ -187,4 +187,4 @@ async function cmdCallback(rest) {
 
 //#endregion
 export { loadOrCreateCallbackSecret as i, isCallbackRevoked as n, loadCallbackSecretReadOnly as r, cmdCallback as t };
-//# sourceMappingURL=callback-MneknqcS.js.map
+//# sourceMappingURL=callback-8NTUQZUU.js.map

package/dist/{callback-TqS7f7-H.js → callback-BILMv2RY.js}

@@ -5,11 +5,11 @@ import "./pidStore-DXWqzTSz.js";
 import "./messageLog-Brx3w6zT.js";
 import "./e2e-z1xpwSAg.js";
 import "./configShared-DKTgiz7K.js";
-import "./subcommands-CyhuIreR.js";
+import "./subcommands-DpVf1Ip5.js";
 import "./notifyStore-2SWKGwZI.js";
 import "./webrtcLink-CnQf9pmu.js";
 import "./remotes-5P__pAXA.js";
 import "./callbackCore-Bl2gGcxg.js";
-import { i as loadOrCreateCallbackSecret, n as isCallbackRevoked, r as loadCallbackSecretReadOnly, t as cmdCallback } from "./callback-MneknqcS.js";
+import { i as loadOrCreateCallbackSecret, n as isCallbackRevoked, r as loadCallbackSecretReadOnly, t as cmdCallback } from "./callback-8NTUQZUU.js";
 
 export { cmdCallback };

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import { t as invokedCliName } from "./invokedCli-zdFbz1ST.js";
 import { n as logger } from "./logger-CDIsZ-Pp.js";
-import { a as versionString, r as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-CqaWZAm0.js";
-import { d as getRustBinary } from "./rustBinary-Wh9kNpga.js";
+import { a as versionString, r as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-9saemWzO.js";
+import { d as getRustBinary } from "./rustBinary-BUabDlJS.js";
 import { argv } from "process";
 import { spawn } from "child_process";
 import ms from "ms";
@@ -295,7 +295,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 	const rawArg = process.argv[2];
 	const managerCommands = !invokedCliName(process.argv);
 	const isHelpFlag = rawArg === "-h" || rawArg === "--help";
-	const { isSubcommand, runSubcommand, cmdHelp, isUnknownManagerToken, isBareManagerInvocation } = await import("./subcommands-CE0EOwno.js");
+	const { isSubcommand, runSubcommand, cmdHelp, isUnknownManagerToken, isBareManagerInvocation } = await import("./subcommands-BsC1OmsA.js");
 	if (isHelpFlag && process.argv.length === 3) {
 		await cmdHelp(managerCommands);
 		process.exit(0);
@@ -309,7 +309,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 		process.exit(code ?? 0);
 	}
 	{
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-CPXyE9Tg.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS--Qym1DSX.js");
 		if (isUnknownManagerToken(rawArg, managerCommands, SUPPORTED_CLIS)) {
 			process.stderr.write(`ay: unknown subcommand or CLI '${rawArg}'.\n    See 'ay help' for subcommands. To run an agent, name a CLI:\n    'ay <cli> …' (e.g. 'ay claude …') or 'ay --cli <cli> …'.\n`);
 			process.exit(1);
@@ -360,7 +360,7 @@ if (config.useRust) {
 		}
 	}
 	if (rustBinary) {
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-CPXyE9Tg.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS--Qym1DSX.js");
 		const rustArgs = buildRustArgs(process.argv, config.cli, SUPPORTED_CLIS);
 		if (config.verbose) {
 			console.log(`[rust] Using binary: ${rustBinary}`);

package/dist/{cmdPs-BwDyVmFi.js → cmdPs-CXWn0bk5.js}

@@ -5,7 +5,7 @@ import "./pidStore-DXWqzTSz.js";
 import "./messageLog-Brx3w6zT.js";
 import "./e2e-z1xpwSAg.js";
 import "./configShared-DKTgiz7K.js";
-import { F as listRecords, dt as buildAgentForest, ft as flattenForest, h as deriveLiveState } from "./subcommands-CyhuIreR.js";
+import { F as listRecords, dt as buildAgentForest, ft as flattenForest, h as deriveLiveState } from "./subcommands-DpVf1Ip5.js";
 import "./notifyStore-2SWKGwZI.js";
 import "./webrtcLink-CnQf9pmu.js";
 import "./remotes-5P__pAXA.js";
@@ -330,4 +330,4 @@ function readPpidSync(pid) {
 
 //#endregion
 export { cmdPs };
-//# sourceMappingURL=cmdPs-BwDyVmFi.js.map
+//# sourceMappingURL=cmdPs-CXWn0bk5.js.map

package/dist/index.js

@@ -1,6 +1,6 @@
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-CqaWZAm0.js";
-import { a as hasTodoStore, i as answerAsk, l as AgentContext, n as agentYes, o as listAsks, r as config, s as listAsksForProject, t as CLIS_CONFIG } from "./ts-DYKrhLtc.js";
+import "./versionChecker-9saemWzO.js";
+import { a as hasTodoStore, i as answerAsk, l as AgentContext, n as agentYes, o as listAsks, r as config, s as listAsksForProject, t as CLIS_CONFIG } from "./ts-DJQxNoOm.js";
 import { a as renderTree, c as describeBlock, i as renderDigest, l as monitorHint, o as unblockedTasks, r as openBlockers, t as reconcileTodos, u as removeControlCharacters } from "./todoAutomation-CbVVS4re.js";
 import "./JsonlStore-BqF7AQ6E.js";
 import "./globalPidIndex-CRH9L9tn.js";

package/dist/{notifyDaemon-lY7jeQcF.js → notifyDaemon-gpV6PTgB.js}

@@ -5,7 +5,7 @@ import "./pidStore-DXWqzTSz.js";
 import "./messageLog-Brx3w6zT.js";
 import "./e2e-z1xpwSAg.js";
 import "./configShared-DKTgiz7K.js";
-import { D as isPidAlive, F as listRecords, G as renderLogTailLines, h as deriveLiveState } from "./subcommands-CyhuIreR.js";
+import { D as isPidAlive, F as listRecords, G as renderLogTailLines, h as deriveLiveState } from "./subcommands-DpVf1Ip5.js";
 import { f as readInbox, g as daemonLockOwnerPath, h as daemonLockDir, i as gcInboxes, l as listInboxParents, m as shouldStealLock, n as appendEvent, s as hostId, u as liveWatchers, x as notifyDir } from "./notifyStore-2SWKGwZI.js";
 import "./webrtcLink-CnQf9pmu.js";
 import "./remotes-5P__pAXA.js";
@@ -879,4 +879,4 @@ async function ensureDaemon() {
 
 //#endregion
 export { daemonStatus, ensureDaemon, requestDaemonStop, runDaemon };
-//# sourceMappingURL=notifyDaemon-lY7jeQcF.js.map
+//# sourceMappingURL=notifyDaemon-gpV6PTgB.js.map

package/dist/{parentPingLoop-BNk9bmkL.js → parentPingLoop-D2zVOM17.js}

@@ -338,7 +338,7 @@ async function isParentWatching(parentWrapperPid, parentAgentPid, selfAgentPid,
 		logger.debug("[parent-ping] watcher lookup failed:", error);
 	}
 	try {
-		const { lastReadAt, READ_WINDOW_MS } = await import("./subcommands-CE0EOwno.js");
+		const { lastReadAt, READ_WINDOW_MS } = await import("./subcommands-BsC1OmsA.js");
 		const last = await lastReadAt(`agent:${parentAgentPid}`, selfAgentPid);
 		if (last !== null && now - last <= READ_WINDOW_MS) return true;
 	} catch (error) {
@@ -466,4 +466,4 @@ function startParentPingLoop(opts) {
 
 //#endregion
 export { startParentPingLoop };
-//# sourceMappingURL=parentPingLoop-BNk9bmkL.js.map
+//# sourceMappingURL=parentPingLoop-D2zVOM17.js.map

package/dist/{rustBinary-Wh9kNpga.js → rustBinary-BUabDlJS.js}

@@ -1,4 +1,4 @@
-import { i as getInstalledPackage, n as compareVersions } from "./versionChecker-CqaWZAm0.js";
+import { i as getInstalledPackage, n as compareVersions } from "./versionChecker-9saemWzO.js";
 import { execFileSync } from "child_process";
 import { existsSync, mkdirSync, readdirSync, rmSync, statSync, unlinkSync } from "fs";
 import { chmod, copyFile } from "fs/promises";
@@ -344,4 +344,4 @@ async function getRustBinary(options = {}) {
 
 //#endregion
 export { findSpawnHiddenLauncher as a, getBinDir as c, getRustBinary as d, findRustBinary as i, getBinaryName as l, downloadBinary as n, findTrayLauncher as o, findAyrsBinary as r, gcOldBinaryDirs as s, devBuildInfo as t, getDownloadUrl as u };
-//# sourceMappingURL=rustBinary-Wh9kNpga.js.map
+//# sourceMappingURL=rustBinary-BUabDlJS.js.map

package/dist/{rustBinary-DsxZnwXj.js → rustBinary-Bw54s74_.js}

@@ -1,4 +1,4 @@
-import "./versionChecker-CqaWZAm0.js";
-import { a as findSpawnHiddenLauncher, c as getBinDir, d as getRustBinary, i as findRustBinary, l as getBinaryName, n as downloadBinary, o as findTrayLauncher, r as findAyrsBinary, s as gcOldBinaryDirs, t as devBuildInfo, u as getDownloadUrl } from "./rustBinary-Wh9kNpga.js";
+import "./versionChecker-9saemWzO.js";
+import { a as findSpawnHiddenLauncher, c as getBinDir, d as getRustBinary, i as findRustBinary, l as getBinaryName, n as downloadBinary, o as findTrayLauncher, r as findAyrsBinary, s as gcOldBinaryDirs, t as devBuildInfo, u as getDownloadUrl } from "./rustBinary-BUabDlJS.js";
 
 export { findAyrsBinary, gcOldBinaryDirs };

package/dist/{schedule-yMAymlHZ.js → schedule-D2RwNrrX.js}

@@ -1,13 +1,13 @@
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-CqaWZAm0.js";
-import "./ts-DYKrhLtc.js";
+import "./versionChecker-9saemWzO.js";
+import "./ts-DJQxNoOm.js";
 import "./todoAutomation-CbVVS4re.js";
 import "./JsonlStore-BqF7AQ6E.js";
 import "./globalPidIndex-CRH9L9tn.js";
 import "./pidStore-DXWqzTSz.js";
 import "./messageLog-Brx3w6zT.js";
 import "./todoStore-DF6vxHgV.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-BxxxYx1J.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-Dy5HGJI8.js";
 import { f as resolveSpawnCwd } from "./workspaceConfig-DTvPtr5j.js";
 import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-CipjIwfO.js";
 import { createHash } from "node:crypto";
@@ -154,4 +154,4 @@ async function cmdSchedule(rest) {
 
 //#endregion
 export { cmdSchedule };
-//# sourceMappingURL=schedule-yMAymlHZ.js.map
+//# sourceMappingURL=schedule-D2RwNrrX.js.map

package/dist/{serve-Cn6LTsO5.js → serve-BzQQEsXT.js}

@@ -1,7 +1,7 @@
 import "./logger-CDIsZ-Pp.js";
-import { i as getInstalledPackage } from "./versionChecker-CqaWZAm0.js";
-import { a as findSpawnHiddenLauncher } from "./rustBinary-Wh9kNpga.js";
-import { c as permissionBadge, i as answerAsk, o as listAsks, u as CLAUDE_SESSION_PIN_ENV } from "./ts-DYKrhLtc.js";
+import { i as getInstalledPackage } from "./versionChecker-9saemWzO.js";
+import { a as findSpawnHiddenLauncher } from "./rustBinary-BUabDlJS.js";
+import { c as permissionBadge, i as answerAsk, o as listAsks, u as CLAUDE_SESSION_PIN_ENV } from "./ts-DJQxNoOm.js";
 import { t as agentYesHome$1 } from "./agentYesHome-BNtn19J4.js";
 import { u as removeControlCharacters } from "./todoAutomation-CbVVS4re.js";
 import "./JsonlStore-BqF7AQ6E.js";
@@ -12,19 +12,19 @@ import { t as pgidForWrapper } from "./reaper-UimuuTfO.js";
 import "./todoStore-DF6vxHgV.js";
 import "./e2e-z1xpwSAg.js";
 import "./configShared-DKTgiz7K.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-BxxxYx1J.js";
-import { B as readLogForRender, F as listRecords, G as renderLogTailLines, H as readPtysize, J as resolveOne, K as renderRawLog, M as isUserTyping, O as isSlashCommand, S as extractTaskCounts, U as recentMessageEdges, V as readNotes, W as recentReadEdges, ct as framePaste, et as snapshotStatus, g as deriveLiveStatus, lt as shouldFramePaste, ot as writeToIpc, p as controlCodeFromName, q as renderRawLogLines, st as withIpcLock, u as cliDefaults, ut as TYPING_BADGE, x as extractNeedsInput, y as extractBadges } from "./subcommands-CyhuIreR.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-Dy5HGJI8.js";
+import { B as readLogForRender, F as listRecords, G as renderLogTailLines, H as readPtysize, J as resolveOne, K as renderRawLog, M as isUserTyping, O as isSlashCommand, S as extractTaskCounts, U as recentMessageEdges, V as readNotes, W as recentReadEdges, ct as framePaste, et as snapshotStatus, g as deriveLiveStatus, lt as shouldFramePaste, ot as writeToIpc, p as controlCodeFromName, q as renderRawLogLines, st as withIpcLock, u as cliDefaults, ut as TYPING_BADGE, x as extractNeedsInput, y as extractBadges } from "./subcommands-DpVf1Ip5.js";
 import { c as isTransientLockMkdirError } from "./notifyStore-2SWKGwZI.js";
 import { i as toWebrtcUrl, n as isWebrtcSpec } from "./webrtcLink-CnQf9pmu.js";
 import "./remotes-5P__pAXA.js";
 import { i as frameVisitorMessage, s as verifyCapability, t as MAX_CALLBACK_MSG_BYTES } from "./callbackCore-Bl2gGcxg.js";
-import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-MneknqcS.js";
+import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-8NTUQZUU.js";
 import { n as sampleTrees } from "./procStats-CyD8h5nx.js";
 import { a as getProvisionRoot, d as isProvisionAllowed, f as resolveSpawnCwd, i as getProvisionHook, l as hasProvisionHook, o as getSpawnHook, t as allowsSkipPermissions, u as hasSpawnHook } from "./workspaceConfig-DTvPtr5j.js";
 import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-CipjIwfO.js";
-import { i as importProvisionModule } from "./ws-ClgsUOJu.js";
+import { i as importProvisionModule } from "./ws-zcY0e2HH.js";
 import { r as spawnRejectionReason } from "./spawnGate-YpHopveO.js";
-import { i as launchTray } from "./trayApp-C77uhW1i.js";
+import { i as launchTray } from "./trayApp-Do-QBGQX.js";
 import yargs from "yargs";
 import { appendFile, mkdir, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from "fs/promises";
 import { arch, cpus, freemem, homedir, hostname, loadavg, platform, totalmem, uptime, userInfo } from "os";
@@ -1516,6 +1516,22 @@ async function cmdServeDaemon(sub, args) {
 	}).exited ?? 1;
 	return 1;
 }
+/**
+* Content type for a `/vendor/<name>` console asset, or null when `name` is not
+* one we ship. The set is the exact list index.html loads (see lab/ui/vendor/
+* and #317): a request for anything else — a traversal attempt, a stray file
+* in the directory — is a 404, never a read.
+*/
+function vendorAssetType(name) {
+	switch (name) {
+		case "xterm.min.css": return "text/css; charset=utf-8";
+		case "xterm.min.js":
+		case "addon-fit.min.js":
+		case "addon-web-links.min.js":
+		case "addon-clipboard.min.js": return "text/javascript; charset=utf-8";
+		default: return null;
+	}
+}
 function shareLinkStatus(shareLink, installed, webrtcish) {
 	if (!shareLink) return {
 		link: null,
@@ -1655,7 +1671,7 @@ Options:
 		const { planRustServe } = await import("./serveRust-DDQiZmMf.js");
 		const plan = planRustServe(rest);
 		if (plan.kind === "rust") {
-			const { findAyrsBinary } = await import("./rustBinary-DsxZnwXj.js");
+			const { findAyrsBinary } = await import("./rustBinary-Bw54s74_.js");
 			const ayrs = findAyrsBinary();
 			if (ayrs) return runAyrsServe(ayrs, plan.argv);
 			process.stderr.write("ay serve: ayrs binary not found — running the TypeScript server (bun run build:rs, or reinstall, to get the Rust daemon)\n");
@@ -2630,7 +2646,7 @@ Options:
 			}
 		});
 		if (req.method === "GET" && p === "/api/ws") {
-			const ws = await import("./ws-Dsu27GmE.js");
+			const ws = await import("./ws-CsaGPxUn.js");
 			try {
 				await ws.loadProvision();
 			} catch (e) {
@@ -2650,7 +2666,7 @@ Options:
 		if (req.method === "GET" && p === "/api/ws/status") {
 			const dirRaw = url.searchParams.get("path");
 			if (!dirRaw) return new Response("missing ?path=<workspace dir>", { status: 400 });
-			const ws = await import("./ws-Dsu27GmE.js");
+			const ws = await import("./ws-CsaGPxUn.js");
 			let prov;
 			try {
 				prov = await ws.loadProvision();
@@ -2672,7 +2688,7 @@ Options:
 			}
 		}
 		if (req.method === "GET" && p === "/api/ws/repos") {
-			const ws = await import("./ws-Dsu27GmE.js");
+			const ws = await import("./ws-CsaGPxUn.js");
 			try {
 				await ws.loadProvision();
 			} catch (e) {
@@ -2753,7 +2769,7 @@ Options:
 			const m = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(repoParam);
 			if (!m || m[1] === "." || m[1] === ".." || m[2] === "." || m[2] === "..") return new Response("missing/invalid ?repo=<owner>/<repo>", { status: 400 });
 			const [, owner, repo] = m;
-			const ws = await import("./ws-Dsu27GmE.js");
+			const ws = await import("./ws-CsaGPxUn.js");
 			let prov;
 			try {
 				prov = await ws.loadProvision();
@@ -3671,7 +3687,7 @@ Options:
 			const perm = body.perm ?? "r";
 			if (perm !== "r" && perm !== "rw") return new Response(`invalid perm ${perm} (want r or rw)`, { status: 400 });
 			try {
-				const { createScopedShare } = await import("./agentShare-BXg5zEtW.js");
+				const { createScopedShare } = await import("./agentShare-D5mMch-V.js");
 				const share = await createScopedShare({
 					agent: body.agent,
 					perm,
@@ -3686,12 +3702,12 @@ Options:
 			}
 		}
 		if (req.method === "GET" && p === "/api/shares") {
-			const { listShares } = await import("./agentShare-BXg5zEtW.js");
+			const { listShares } = await import("./agentShare-D5mMch-V.js");
 			return Response.json(listShares());
 		}
 		const revokeM = /^\/api\/share\/([^/]+)$/.exec(p);
 		if (req.method === "DELETE" && revokeM) {
-			const { revokeShare } = await import("./agentShare-BXg5zEtW.js");
+			const { revokeShare } = await import("./agentShare-D5mMch-V.js");
 			const ok = revokeShare(decodeURIComponent(revokeM[1]));
 			return new Response(ok ? "revoked" : "no such share", { status: ok ? 200 : 404 });
 		}
@@ -3843,6 +3859,12 @@ Options:
 		if (req.method === "GET" && p === "/sw.js") return serveUiFile("sw.js", "text/javascript; charset=utf-8");
 		if (req.method === "GET" && p === "/manifest.webmanifest") return serveUiFile("manifest.webmanifest", "application/manifest+json");
 		if (req.method === "GET" && p === "/icon.svg") return serveUiFile("icon.svg", "image/svg+xml");
+		if (req.method === "GET" && p.startsWith("/vendor/")) {
+			const name = p.slice(8);
+			const type = vendorAssetType(name);
+			if (type) return serveUiFile(`vendor/${name}`, type);
+			return new Response("not found", { status: 404 });
+		}
 		if (req.method === "GET" && p === "/favicon.ico") return new Response(null, { status: 204 });
 		if (p.startsWith("/cb/")) return handleCallback(req, p);
 		return withTermCors(req, await apiFetch(req, srv));
@@ -3997,7 +4019,7 @@ Options:
 	const shutdown = (resolve) => {
 		if (heartbeat) clearInterval(heartbeat);
 		closeShare?.();
-		import("./agentShare-BXg5zEtW.js").then((m) => m.revokeAllShares()).catch(() => {});
+		import("./agentShare-D5mMch-V.js").then((m) => m.revokeAllShares()).catch(() => {});
 		server?.stop();
 		Promise.resolve(releaseHostLock?.()).catch(() => {}).then(resolve);
 	};
@@ -4010,4 +4032,4 @@ Options:
 
 //#endregion
 export { cmdServe, loadTokenReadOnly, mintScopedTermToken, resolveDaemonHttpBase, resolveLocalServeUrl };
-//# sourceMappingURL=serve-Cn6LTsO5.js.map
+//# sourceMappingURL=serve-BzQQEsXT.js.map

package/dist/{setup-DAKtsxiB.js → setup-DF6Jrjn0.js}

@@ -97,7 +97,7 @@ async function cmdSetup(rest) {
 	} catch {}
 	if (noShare) return 0;
 	process.stdout.write(`\nsharing this machine to agent-yes.com…\n`);
-	const { cmdServe } = await import("./serve-Cn6LTsO5.js");
+	const { cmdServe } = await import("./serve-BzQQEsXT.js");
 	return cmdServe([
 		"install",
 		"--share",
@@ -107,4 +107,4 @@ async function cmdSetup(rest) {
 
 //#endregion
 export { cmdSetup };
-//# sourceMappingURL=setup-DAKtsxiB.js.map
+//# sourceMappingURL=setup-DF6Jrjn0.js.map

package/dist/{subcommands-CE0EOwno.js → subcommands-BsC1OmsA.js}

@@ -5,7 +5,7 @@ import "./pidStore-DXWqzTSz.js";
 import "./messageLog-Brx3w6zT.js";
 import "./e2e-z1xpwSAg.js";
 import "./configShared-DKTgiz7K.js";
-import { $ as sendPayloadCapError, A as isUnknownManagerToken, B as readLogForRender, C as finalizedLines, D as isPidAlive, E as isExitRequest, F as listRecords, G as renderLogTailLines, H as readPtysize, I as matchKeyword, J as resolveOne, K as renderRawLog, L as menuSelectKeys, M as isUserTyping, N as lastReadAt, O as isSlashCommand, P as lastStdinAt, Q as runSubcommand, R as probeStdinReachable, S as extractTaskCounts, T as isBareManagerInvocation, U as recentMessageEdges, V as readNotes, W as recentReadEdges, X as resolveResumeArgs, Y as resolveReadWindow, Z as restartHintLines, _ as envelopeAttribution, a as SEND_BODY_MAX_CHARS, at as writeKeysPaced, b as extractMenu, c as backoffWhileTyping, d as cmdHelp, et as snapshotStatus, f as confirmStdinUnreachable, g as deriveLiveStatus, h as deriveLiveState, i as READ_WINDOW_MS, it as waitForLogQuiet, j as isUnreachableWriteErrno, k as isSubcommand, l as buildEnvelope, m as cursorAbs, n as MAX_RENDER_BYTES, nt as stopTipForCli, o as SEND_EXIT_UNREACHABLE, ot as writeToIpc, p as controlCodeFromName, q as renderRawLogLines, r as READ_PAGE_DEFAULT, rt as submitAndConfirm, s as TYPING_WINDOW_MS, t as GRACEFUL_EXIT_COMMANDS, tt as stdinActivityPath, u as cliDefaults, v as envelopeCostFor, w as isAgentStuck, x as extractNeedsInput, y as extractBadges, z as readAgentPtysize } from "./subcommands-CyhuIreR.js";
+import { $ as sendPayloadCapError, A as isUnknownManagerToken, B as readLogForRender, C as finalizedLines, D as isPidAlive, E as isExitRequest, F as listRecords, G as renderLogTailLines, H as readPtysize, I as matchKeyword, J as resolveOne, K as renderRawLog, L as menuSelectKeys, M as isUserTyping, N as lastReadAt, O as isSlashCommand, P as lastStdinAt, Q as runSubcommand, R as probeStdinReachable, S as extractTaskCounts, T as isBareManagerInvocation, U as recentMessageEdges, V as readNotes, W as recentReadEdges, X as resolveResumeArgs, Y as resolveReadWindow, Z as restartHintLines, _ as envelopeAttribution, a as SEND_BODY_MAX_CHARS, at as writeKeysPaced, b as extractMenu, c as backoffWhileTyping, d as cmdHelp, et as snapshotStatus, f as confirmStdinUnreachable, g as deriveLiveStatus, h as deriveLiveState, i as READ_WINDOW_MS, it as waitForLogQuiet, j as isUnreachableWriteErrno, k as isSubcommand, l as buildEnvelope, m as cursorAbs, n as MAX_RENDER_BYTES, nt as stopTipForCli, o as SEND_EXIT_UNREACHABLE, ot as writeToIpc, p as controlCodeFromName, q as renderRawLogLines, r as READ_PAGE_DEFAULT, rt as submitAndConfirm, s as TYPING_WINDOW_MS, t as GRACEFUL_EXIT_COMMANDS, tt as stdinActivityPath, u as cliDefaults, v as envelopeCostFor, w as isAgentStuck, x as extractNeedsInput, y as extractBadges, z as readAgentPtysize } from "./subcommands-DpVf1Ip5.js";
 import "./notifyStore-2SWKGwZI.js";
 import "./webrtcLink-CnQf9pmu.js";
 import "./remotes-5P__pAXA.js";

package/dist/{subcommands-CyhuIreR.js → subcommands-DpVf1Ip5.js}

@@ -1546,7 +1546,7 @@ async function runSubcommand(argv) {
 		switch (sub) {
 			case "ls":
 			case "list": return await cmdLs(rest);
-			case "ps": return await (await import("./cmdPs-BwDyVmFi.js")).cmdPs(rest);
+			case "ps": return await (await import("./cmdPs-CXWn0bk5.js")).cmdPs(rest);
 			case "status": return await cmdStatus(rest);
 			case "whoami": return await cmdWhoami(rest);
 			case "result": return await cmdResult(rest);
@@ -1593,35 +1593,35 @@ async function runSubcommand(argv) {
 				return cmdCh(rest);
 			}
 			case "term": {
-				const { cmdTerm } = await import("./terminal-D7G7Ngnj.js");
+				const { cmdTerm } = await import("./terminal-C6VXRv5m.js");
 				return cmdTerm(rest);
 			}
 			case "widget": {
-				const { cmdWidget } = await import("./widget-D2sc3bde.js");
+				const { cmdWidget } = await import("./widget-NZQ3rBTG.js");
 				return cmdWidget(rest);
 			}
 			case "mint": {
-				const { cmdMint } = await import("./widget-D2sc3bde.js");
+				const { cmdMint } = await import("./widget-NZQ3rBTG.js");
 				return cmdMint(rest);
 			}
 			case "serve": {
-				const { cmdServe } = await import("./serve-Cn6LTsO5.js");
+				const { cmdServe } = await import("./serve-BzQQEsXT.js");
 				return cmdServe(rest);
 			}
 			case "tray": {
-				const { cmdTray } = await import("./trayApp-i6201tMp.js");
+				const { cmdTray } = await import("./trayApp-fUf54eO5.js");
 				return cmdTray(rest);
 			}
 			case "setup": {
-				const { cmdSetup } = await import("./setup-DAKtsxiB.js");
+				const { cmdSetup } = await import("./setup-DF6Jrjn0.js");
 				return cmdSetup(rest);
 			}
 			case "ws": {
-				const { cmdWs } = await import("./ws-Dsu27GmE.js");
+				const { cmdWs } = await import("./ws-CsaGPxUn.js");
 				return cmdWs(rest);
 			}
 			case "schedule": {
-				const { cmdSchedule } = await import("./schedule-yMAymlHZ.js");
+				const { cmdSchedule } = await import("./schedule-D2RwNrrX.js");
 				return cmdSchedule(rest);
 			}
 			case "remote": {
@@ -1633,7 +1633,7 @@ async function runSubcommand(argv) {
 				return cmdExpose(rest);
 			}
 			case "callback": {
-				const { cmdCallback } = await import("./callback-TqS7f7-H.js");
+				const { cmdCallback } = await import("./callback-BILMv2RY.js");
 				return cmdCallback(rest);
 			}
 			case "reap":
@@ -1644,7 +1644,7 @@ async function runSubcommand(argv) {
 				return await cmdDsh(rest);
 			}
 			case "gc": {
-				const { gcOldBinaryDirs } = await import("./rustBinary-DsxZnwXj.js");
+				const { gcOldBinaryDirs } = await import("./rustBinary-Bw54s74_.js");
 				const { gcLogs } = await import("./globalPidIndex-DC93JhHQ.js");
 				const bins = gcOldBinaryDirs();
 				const logs = await gcLogs();
@@ -4351,7 +4351,7 @@ async function cmdAttach(rest) {
 	const winsizeDir = path.join(ayHome, "winsize");
 	await mkdir(winsizeDir, { recursive: true });
 	const winsizePath = path.join(winsizeDir, String(record.pid));
-	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-Cn6LTsO5.js");
+	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-BzQQEsXT.js");
 	const daemonBase = await resolveDaemonHttpBase().catch(() => null);
 	const daemonToken = daemonBase ? await loadTokenReadOnly().catch(() => null) ?? "" : "";
 	const capViewer = `attach:${process.pid}`;
@@ -5078,7 +5078,7 @@ async function cmdNotify(rest) {
 	}
 	const ensure = async () => {
 		if (!argv["ensure-daemon"]) return;
-		const { ensureDaemon } = await import("./notifyDaemon-lY7jeQcF.js");
+		const { ensureDaemon } = await import("./notifyDaemon-gpV6PTgB.js");
 		await ensureDaemon().catch(() => null);
 	};
 	await heartbeatWatcher(parent, selfStartedAt);
@@ -5152,7 +5152,7 @@ async function cmdNotifyCursor(args) {
 }
 async function cmdNotifyd(rest) {
 	const sub = rest[0] ?? "status";
-	const daemon = await import("./notifyDaemon-lY7jeQcF.js");
+	const daemon = await import("./notifyDaemon-gpV6PTgB.js");
 	switch (sub) {
 		case "run": return daemon.runDaemon();
 		case "once": return daemon.runDaemon({ once: true });
@@ -5179,4 +5179,4 @@ async function cmdNotifyd(rest) {
 
 //#endregion
 export { sendPayloadCapError as $, isUnknownManagerToken as A, readLogForRender as B, finalizedLines as C, isPidAlive as D, isExitRequest as E, listRecords as F, renderLogTailLines as G, readPtysize as H, matchKeyword as I, resolveOne as J, renderRawLog as K, menuSelectKeys as L, isUserTyping as M, lastReadAt as N, isSlashCommand as O, lastStdinAt as P, runSubcommand as Q, probeStdinReachable as R, extractTaskCounts as S, isBareManagerInvocation as T, recentMessageEdges as U, readNotes as V, recentReadEdges as W, resolveResumeArgs as X, resolveReadWindow as Y, restartHintLines as Z, envelopeAttribution as _, SEND_BODY_MAX_CHARS as a, writeKeysPaced as at, extractMenu as b, backoffWhileTyping as c, framePaste as ct, cmdHelp as d, buildAgentForest as dt, snapshotStatus as et, confirmStdinUnreachable as f, flattenForest as ft, deriveLiveStatus as g, deriveLiveState as h, READ_WINDOW_MS as i, waitForLogQuiet as it, isUnreachableWriteErrno as j, isSubcommand as k, buildEnvelope as l, shouldFramePaste as lt, cursorAbs as m, MAX_RENDER_BYTES as n, stopTipForCli as nt, SEND_EXIT_UNREACHABLE as o, writeToIpc as ot, controlCodeFromName as p, renderRawLogLines as q, READ_PAGE_DEFAULT as r, submitAndConfirm as rt, TYPING_WINDOW_MS as s, withIpcLock as st, GRACEFUL_EXIT_COMMANDS as t, stdinActivityPath as tt, cliDefaults as u, TYPING_BADGE as ut, envelopeCostFor as v, isAgentStuck as w, extractNeedsInput as x, extractBadges as y, readAgentPtysize as z };
-//# sourceMappingURL=subcommands-CyhuIreR.js.map
+//# sourceMappingURL=subcommands-DpVf1Ip5.js.map

package/dist/{terminal-D7G7Ngnj.js → terminal-C6VXRv5m.js}

@@ -98,7 +98,7 @@ async function cmdTermMint(args) {
 	if (flags.ro && flags.interactive) throw new Error("--ro and --interactive are mutually exclusive");
 	const ttlSec = parseTtlSec(typeof flags.ttl === "string" ? flags.ttl : "15m");
 	const canSend = flags.interactive === true;
-	const { mintScopedTermToken } = await import("./serve-Cn6LTsO5.js");
+	const { mintScopedTermToken } = await import("./serve-BzQQEsXT.js");
 	const r = await mintScopedTermToken(pid, {
 		ttlSec,
 		canSend
@@ -135,4 +135,4 @@ async function cmdTerm(args) {
 
 //#endregion
 export { cmdTerm };
-//# sourceMappingURL=terminal-D7G7Ngnj.js.map
+//# sourceMappingURL=terminal-C6VXRv5m.js.map

package/dist/{trayApp-C77uhW1i.js → trayApp-Do-QBGQX.js}

@@ -1,4 +1,4 @@
-import { o as findTrayLauncher } from "./rustBinary-Wh9kNpga.js";
+import { o as findTrayLauncher } from "./rustBinary-BUabDlJS.js";
 import { t as agentYesHome } from "./agentYesHome-BNtn19J4.js";
 import { existsSync } from "node:fs";
 import path from "node:path";
@@ -97,4 +97,4 @@ async function cmdTray(args) {
 
 //#endregion
 export { trayHiddenMarker as a, launchTray as i, hasDesktop as n, isTrayHidden as r, cmdTray as t };
-//# sourceMappingURL=trayApp-C77uhW1i.js.map
+//# sourceMappingURL=trayApp-Do-QBGQX.js.map

package/dist/trayApp-fUf54eO5.js

@@ -0,0 +1,5 @@
+import "./versionChecker-9saemWzO.js";
+import "./rustBinary-BUabDlJS.js";
+import { a as trayHiddenMarker, i as launchTray, n as hasDesktop, r as isTrayHidden, t as cmdTray } from "./trayApp-Do-QBGQX.js";
+
+export { cmdTray };

package/dist/{ts-DYKrhLtc.js → ts-DJQxNoOm.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin, r as __exportAll } from "./chunk-cZBX9HZv.js";
 import { n as logger, t as addTransport } from "./logger-CDIsZ-Pp.js";
-import { i as getInstalledPackage } from "./versionChecker-CqaWZAm0.js";
+import { i as getInstalledPackage } from "./versionChecker-9saemWzO.js";
 import { t as agentYesHome } from "./agentYesHome-BNtn19J4.js";
 import { u as removeControlCharacters } from "./todoAutomation-CbVVS4re.js";
 import { i as shouldUseLock, r as releaseLock, t as acquireLock } from "./runningLock-BOIPD_Vs.js";
@@ -2086,7 +2086,7 @@ async function agentYes({ cli, cliArgs = [], skipPermissions = false, prompt, ro
 	}, 100);
 	const cleanupHeartbeat = () => clearInterval(heartbeatInterval);
 	shell.onExit(cleanupHeartbeat);
-	const { startParentPingLoop } = await import("./parentPingLoop-BNk9bmkL.js");
+	const { startParentPingLoop } = await import("./parentPingLoop-D2zVOM17.js");
 	const parentPingLoop = startParentPingLoop({
 		parentPid,
 		selfWrapperPid: process.pid,
@@ -2349,4 +2349,4 @@ function sleep(ms) {
 
 //#endregion
 export { hasTodoStore as a, permissionBadge as c, answerAsk as i, AgentContext as l, agentYes as n, listAsks as o, config as r, listAsksForProject as s, CLIS_CONFIG as t, CLAUDE_SESSION_PIN_ENV as u };
-//# sourceMappingURL=ts-DYKrhLtc.js.map
+//# sourceMappingURL=ts-DJQxNoOm.js.map

package/dist/{versionChecker-CqaWZAm0.js → versionChecker-9saemWzO.js}

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 
 //#region package.json
 var name = "agent-yes";
-var version = "1.294.0";
+var version = "1.294.1";
 
 //#endregion
 //#region ts/versionChecker.ts
@@ -285,4 +285,4 @@ async function displayVersion() {
 
 //#endregion
 export { versionString as a, getInstalledPackage as i, compareVersions as n, displayVersion as r, checkAndAutoUpdate as t };
-//# sourceMappingURL=versionChecker-CqaWZAm0.js.map
+//# sourceMappingURL=versionChecker-9saemWzO.js.map

package/dist/{widget-D2sc3bde.js → widget-NZQ3rBTG.js}

@@ -28,7 +28,7 @@ function parseFlags(args, known) {
 }
 /** Resolve the local daemon base URL + token (flags override discovery). */
 async function daemonTarget(flags) {
-	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-Cn6LTsO5.js");
+	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-BzQQEsXT.js");
 	const base = typeof flags.base === "string" ? flags.base : await resolveDaemonHttpBase();
 	if (!base) throw new Error("no running ay serve daemon found — start `ay serve` or pass --base <url> (e.g. http://127.0.0.1:PORT)");
 	const token = typeof flags.token === "string" ? flags.token : await loadTokenReadOnly() ?? "";
@@ -186,7 +186,7 @@ async function cmdMint(args) {
 	const bad = caps.filter((c) => !KNOWN_CAPS.has(c));
 	if (bad.length) throw new Error(`unknown cap(s): ${bad.join(", ")} (valid: ${[...KNOWN_CAPS].join(", ")})`);
 	const ttlSec = parseTtlSec(typeof flags.ttl === "string" ? flags.ttl : "15m");
-	const { mintScopedTermToken } = await import("./serve-Cn6LTsO5.js");
+	const { mintScopedTermToken } = await import("./serve-BzQQEsXT.js");
 	const r = await mintScopedTermToken(target, {
 		ttlSec,
 		caps
@@ -202,4 +202,4 @@ async function cmdMint(args) {
 
 //#endregion
 export { cmdMint, cmdWidget };
-//# sourceMappingURL=widget-D2sc3bde.js.map
+//# sourceMappingURL=widget-NZQ3rBTG.js.map

package/dist/{ws-Dsu27GmE.js → ws-CsaGPxUn.js}

@@ -5,10 +5,10 @@ import "./pidStore-DXWqzTSz.js";
 import "./messageLog-Brx3w6zT.js";
 import "./e2e-z1xpwSAg.js";
 import "./configShared-DKTgiz7K.js";
-import "./subcommands-CyhuIreR.js";
+import "./subcommands-DpVf1Ip5.js";
 import "./notifyStore-2SWKGwZI.js";
 import "./webrtcLink-CnQf9pmu.js";
 import "./remotes-5P__pAXA.js";
-import { a as isPathInside, c as walkWorkspaces, i as importProvisionModule, l as workspaceStatus, n as cmdWs, o as loadProvision, r as collectWorkspaces, s as resolveOperand, t as WS_JSON_SCHEMA } from "./ws-ClgsUOJu.js";
+import { a as isPathInside, c as walkWorkspaces, i as importProvisionModule, l as workspaceStatus, n as cmdWs, o as loadProvision, r as collectWorkspaces, s as resolveOperand, t as WS_JSON_SCHEMA } from "./ws-zcY0e2HH.js";
 
 export { WS_JSON_SCHEMA, cmdWs, collectWorkspaces, isPathInside, loadProvision, walkWorkspaces, workspaceStatus };

package/dist/{ws-ClgsUOJu.js → ws-zcY0e2HH.js}

@@ -1,4 +1,4 @@
-import { F as listRecords } from "./subcommands-CyhuIreR.js";
+import { F as listRecords } from "./subcommands-DpVf1Ip5.js";
 import { a as getProvisionRoot } from "./workspaceConfig-DTvPtr5j.js";
 import { existsSync } from "fs";
 import { lstat, opendir } from "fs/promises";
@@ -424,4 +424,4 @@ async function cmdWs(args) {
 
 //#endregion
 export { isPathInside as a, walkWorkspaces as c, importProvisionModule as i, workspaceStatus as l, cmdWs as n, loadProvision as o, collectWorkspaces as r, resolveOperand as s, WS_JSON_SCHEMA as t };
-//# sourceMappingURL=ws-ClgsUOJu.js.map
+//# sourceMappingURL=ws-zcY0e2HH.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-yes",
-  "version": "1.294.0",
+  "version": "1.294.1",
   "description": "A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.",
   "keywords": [
     "ai",

package/ts/serve.spec.ts

@@ -8,6 +8,7 @@ import {
   parseGitUrl,
   portlessConsoleUrl,
   shareLinkStatus,
+  vendorAssetType,
 } from "./serve.ts";
 
 describe("portlessConsoleUrl", () => {
@@ -197,11 +198,33 @@ describe("oxmgrCmd", () => {
     expect(oxmgrCmd([String.raw`C:\x\ay.exe`, "serve", "--share"])).toBe(
       String.raw`"C:\x\ay.exe" serve --share`,
     );
-    expect(oxmgrCmd(["/usr/bin/bun", "/x/a b/ay", "serve"])).toBe(
-      '/usr/bin/bun "/x/a b/ay" serve',
-    );
+    expect(oxmgrCmd(["/usr/bin/bun", "/x/a b/ay", "serve"])).toBe('/usr/bin/bun "/x/a b/ay" serve');
   });
   it("escapes an embedded double quote inside a quoted arg", () => {
     expect(oxmgrCmd(['say "hi"'])).toBe(String.raw`"say \"hi\""`);
   });
 });
+
+// The console self-hosts xterm from ./vendor/ (#317), but the TS daemon's
+// static allowlist never routed /vendor/*, so those render-blocking scripts
+// fell through to the token-gated API and came back 401 — the terminal pane
+// sat on "connecting…" with `Terminal is not defined`. Exactly the shipped
+// files are served; anything else (a traversal, a stray file) is a 404.
+describe("vendorAssetType", () => {
+  it("types the pinned xterm builds the page loads", () => {
+    expect(vendorAssetType("xterm.min.css")).toBe("text/css; charset=utf-8");
+    for (const js of [
+      "xterm.min.js",
+      "addon-fit.min.js",
+      "addon-web-links.min.js",
+      "addon-clipboard.min.js",
+    ]) {
+      expect(vendorAssetType(js)).toBe("text/javascript; charset=utf-8");
+    }
+  });
+  it("refuses anything that is not a shipped vendor asset", () => {
+    expect(vendorAssetType("../index.html")).toBeNull();
+    expect(vendorAssetType("xterm.min.js.map")).toBeNull();
+    expect(vendorAssetType("")).toBeNull();
+  });
+});

package/ts/serve.ts

@@ -1534,6 +1534,26 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
   return 1;
 }
 
+/**
+ * Content type for a `/vendor/<name>` console asset, or null when `name` is not
+ * one we ship. The set is the exact list index.html loads (see lab/ui/vendor/
+ * and #317): a request for anything else — a traversal attempt, a stray file
+ * in the directory — is a 404, never a read.
+ */
+export function vendorAssetType(name: string): string | null {
+  switch (name) {
+    case "xterm.min.css":
+      return "text/css; charset=utf-8";
+    case "xterm.min.js":
+    case "addon-fit.min.js":
+    case "addon-web-links.min.js":
+    case "addon-clipboard.min.js":
+      return "text/javascript; charset=utf-8";
+    default:
+      return null;
+  }
+}
+
 // How `ay serve status` should report the persisted share link. The link file
 // outlives the daemon config that minted it: `ay serve install` (no --share)
 // over an older --share install leaves ~/.agent-yes/.share-link in place while
@@ -5018,6 +5038,17 @@ export async function cmdServe(rest: string[]): Promise<number> {
     if (req.method === "GET" && p === "/manifest.webmanifest")
       return serveUiFile("manifest.webmanifest", "application/manifest+json");
     if (req.method === "GET" && p === "/icon.svg") return serveUiFile("icon.svg", "image/svg+xml");
+    // Self-hosted xterm (lab/ui/vendor/*, #317). The page loads these
+    // same-origin and render-blocking, so a 401 here — which is what the
+    // token-gated API fallthrough returned — leaves the terminal pane on
+    // "connecting…" forever with `Terminal is not defined`. Allowlisted by
+    // basename (no directory walk): the CSS and the pinned xterm builds only.
+    if (req.method === "GET" && p.startsWith("/vendor/")) {
+      const name = p.slice("/vendor/".length);
+      const type = vendorAssetType(name);
+      if (type) return serveUiFile(`vendor/${name}`, type);
+      return new Response("not found", { status: 404 });
+    }
     if (req.method === "GET" && p === "/favicon.ico") return new Response(null, { status: 204 });
     if (p.startsWith("/cb/")) return handleCallback(req, p);
     // CORS-open the embeddable terminal routes (tail/size/send) so a cross-origin

package/dist/trayApp-i6201tMp.js

@@ -1,5 +0,0 @@
-import "./versionChecker-CqaWZAm0.js";
-import "./rustBinary-Wh9kNpga.js";
-import { a as trayHiddenMarker, i as launchTray, n as hasDesktop, r as isTrayHidden, t as cmdTray } from "./trayApp-C77uhW1i.js";
-
-export { cmdTray };