codeden 0.1.1 → 0.2.0

package/dist/{runner-D8m3WdtS.js → runner-CJetH9jW.js}

@@ -1,13 +1,14 @@
 import { n as __require, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-DegdyBIC.js";
 import { createRequire } from "node:module";
-import { accessSync, appendFileSync, chmodSync, closeSync, constants, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
+import { accessSync, appendFileSync, chmodSync, closeSync, constants, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { pathToFileURL } from "node:url";
-import { homedir, tmpdir } from "node:os";
+import os, { homedir, tmpdir } from "node:os";
 import path, { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
+import { gunzipSync } from "node:zlib";
 import { createInterface } from "node:readline";
-import { copyFile, mkdir, readFile, rm, rmdir, stat, writeFile } from "node:fs/promises";
+import { copyFile, mkdir, readFile, rm, rmdir, stat, utimes, writeFile } from "node:fs/promises";
 import { STATUS_CODES, ServerResponse, createServer } from "node:http";
 import { Http2ServerRequest, constants as constants$1 } from "node:http2";
 import { Readable } from "node:stream";
@@ -3086,7 +3087,7 @@ function bucketFor(state, inst) {
 	return bucket;
 }
 let handoff;
-const open = [];
+const open$1 = [];
 const memo = {
 	alloc(_inst, payload, empty) {
 		const bucket = handoff;
@@ -3097,7 +3098,7 @@ const memo = {
 			issues: null
 		};
 		bucket.set(payload.value, entry);
-		open.push(entry);
+		open$1.push(entry);
 		return empty;
 	},
 	guard(inst) {
@@ -3163,10 +3164,10 @@ const memo = {
 					return payload;
 				}
 				handoff = bucket;
-				const depth = open.length;
+				const depth = open$1.length;
 				const result = base(payload, ctx);
 				handoff = void 0;
-				const entry = open.length > depth ? open.pop() : void 0;
+				const entry = open$1.length > depth ? open$1.pop() : void 0;
 				if (result instanceof Promise) return result.then((r) => {
 					if (entry) entry.issues = r.issues.length ? cloneIssues(r.issues) : NO_ISSUES;
 					return r;
@@ -6833,6 +6834,17 @@ const projectBase = {
 	killSwitch: boolean().default(false),
 	/** IANA timezone for cron automations; machine timezone when null. */
 	timezone: string().nullable(),
+	/**
+	* Pinned projects are listed above the rest (§13). Defaults to false so events written
+	* before pinning existed still parse.
+	*/
+	pinned: boolean().default(false),
+	/**
+	* Manual position in the project list, lowest first (§13). Only the relative order within
+	* the pinned and unpinned groups matters; ties fall back to the name. Set by
+	* `projects.reordered`; archived projects keep theirs.
+	*/
+	sortOrder: int().nonnegative().default(0),
 	createdAt: Timestamp,
 	updatedAt: Timestamp,
 	archivedAt: Timestamp.nullable()
@@ -6856,6 +6868,20 @@ const Project = discriminatedUnion("kind", [object({
 	...projectBase,
 	kind: literal("local")
 })]);
+/**
+* The canonical project order (§13): pinned first, then `sortOrder`, then name, then id.
+* The server lists projects in this order and the UI keeps it when applying live events.
+*/
+function compareProjects(a, b) {
+	if (a.pinned !== b.pinned) return a.pinned ? -1 : 1;
+	if (a.sortOrder !== b.sortOrder) return a.sortOrder - b.sortOrder;
+	if (a.name !== b.name) return a.name < b.name ? -1 : 1;
+	return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+}
+/** A sorted copy of `projects` in the canonical order. */
+function sortProjects(projects) {
+	return [...projects].sort(compareProjects);
+}
 // ../../packages/contracts/src/work.ts
 /**
 * Situational awareness and conflict handling (§8.4). Every unit of work (a session or an
@@ -7013,7 +7039,12 @@ const ProviderCapabilities = object({
 	reasoningEffort: boolean(),
 	/** MCP servers can be injected (required for CodeDen tools). */
 	mcp: boolean(),
-	skills: boolean()
+	skills: boolean(),
+	/**
+	* An autonomy change reaches a running turn from its next tool call. When false (or absent),
+	* a running turn keeps its autonomy and the change applies from the next turn.
+	*/
+	liveAutonomy: boolean().optional()
 });
 /** A model a provider offers. */
 const ModelInfo = object({
@@ -7532,7 +7563,8 @@ const RunnerCommand = discriminatedUnion("name", [
 		name: literal("session.configure"),
 		sessionId: Id,
 		model: string().nullable().optional(),
-		effort: ReasoningEffort.nullable().optional()
+		effort: ReasoningEffort.nullable().optional(),
+		autonomy: AutonomyLevel.optional()
 	}),
 	object({
 		name: literal("pty.open"),
@@ -7780,8 +7812,23 @@ const QueuedMessage = object({
 	id: Id,
 	sessionId: Id,
 	input: UserInput,
+	/** Who queued it. Events written before senders were recorded were all the user's. */
+	from: _enum([
+		"user",
+		"orchestrator",
+		"pm",
+		"automation",
+		"codeden"
+	]).default("user"),
 	createdAt: Timestamp
 });
+object({ messages: array(QueuedMessage) });
+/**
+* `PATCH /api/sessions/:id/queue/:messageId`: replace a queued message's text (attachments
+* stay). Answers 409 `already_sent` once delivery has taken the message.
+*/
+const EditQueuedMessageRequest = object({ text: string().max(2e5) });
+object({ status: literal("steered") });
 /** Structured result an agent reports with the `finish` tool (§8.3). */
 const SessionResult = object({
 	outcome: _enum([
@@ -7981,6 +8028,13 @@ const Session = object({
 	rootThreadId: Id.nullable(),
 	/** Structured result from the agent's `finish` tool, once reported. */
 	result: SessionResult.nullable().optional(),
+	/** When the session was archived: hidden from the sidebar, its worktree cleaned up. */
+	archivedAt: Timestamp.nullable().optional(),
+	/**
+	* When CodeDen removed the session's worktree (archive or inactivity cleanup). The branch and
+	* checkpoints stay; the worktree is recreated from the branch on the next message.
+	*/
+	worktreeRemovedAt: Timestamp.nullable().optional(),
 	createdAt: Timestamp,
 	updatedAt: Timestamp,
 	endedAt: Timestamp.nullable()
@@ -9156,9 +9210,14 @@ const UpdateMode = _enum([
 /**
 * Where the running CodeDen came from. `packaged`: an npm install (`npx`, global or a
 * side-by-side version in `<home>/app`), which can update itself. `source`: the repository or
-* a workspace build, which never switches versions (pull and rebuild instead).
+* a workspace build, which never switches versions (pull and rebuild instead). `desktop`: the
+* desktop app, which updates itself from GitHub Releases (the npm path is off; §17).
 */
-const InstallSource = _enum(["packaged", "source"]);
+const InstallSource = _enum([
+	"packaged",
+	"source",
+	"desktop"
+]);
 /**
 * Self-update progress. `installing`: npm is fetching `target` into `<home>/app/<target>`;
 * `installed`: it is ready and starts on the next launch (or with a restart); `restarting`:
@@ -9290,6 +9349,138 @@ function comparePrerelease(a, b) {
 	}
 	return 0;
 }
+// ../../packages/contracts/src/voice-api.ts
+/**
+* Voice engines on the server (§11.3). The browser's speech APIs stay the default; these
+* routes proxy ElevenLabs (text to speech, Scribe) and OpenAI (transcription) with API keys
+* from the OS keychain, so keys never reach the browser, and run local Whisper with a
+* runtime and model downloaded on demand.
+*/
+/** ElevenLabs MP3 output formats (`codec_sampleRate_bitrate`). */
+const TtsOutputFormat = _enum([
+	"mp3_22050_32",
+	"mp3_44100_64",
+	"mp3_44100_128",
+	"mp3_44100_192"
+]);
+/**
+* `POST /api/tts`: streams `audio/mpeg`. `voiceId` defaults to
+* `settings.voice.readAloud.voice`, then a stock voice; `modelId` to a low-latency model.
+*/
+const TtsRequest = object({
+	text: string().min(1).max(5e3),
+	voiceId: string().min(1).max(100).optional(),
+	modelId: string().min(1).max(100).optional(),
+	outputFormat: TtsOutputFormat.optional()
+});
+object({ voices: array(object({
+	id: string(),
+	name: string(),
+	category: string().optional(),
+	description: string().optional(),
+	previewUrl: string().optional(),
+	labels: record(string(), string()).optional()
+})) });
+/** Engines that transcribe on the server: the cloud engines and local Whisper. */
+const SttEngine = _enum([
+	"elevenlabs",
+	"openai",
+	"local"
+]);
+/**
+* `POST /api/stt?engine=&language=`: the body is the recorded audio (raw bytes with an
+* `audio/*` content type, or multipart with a `file` field), up to 25 MB. `engine` defaults
+* to `settings.voice.dictation.engine` (when that is `browser`, ElevenLabs). The `local`
+* engine only takes WAV, 16-bit PCM, mono at `LOCAL_STT_SAMPLE_RATE`, at most
+* `LOCAL_STT_MAX_SECONDS` long (the UI converts the recording before uploading).
+*/
+const SttQuery = object({
+	engine: SttEngine.optional(),
+	/** ISO 639-1 hint, e.g. `en`. */
+	language: string().min(2).max(10).optional()
+});
+object({
+	text: string(),
+	language: string().nullable(),
+	engine: SttEngine,
+	/** How long the server spent transcribing, in milliseconds (local engine). */
+	elapsedMs: number$1().nonnegative().optional()
+});
+/**
+* Dictation engines (`settings.voice.dictation.engine`): the browser's speech recognition,
+* a cloud engine through the server, or `local` Whisper running on the CodeDen server.
+*/
+const DictationEngine = _enum([
+	"browser",
+	"elevenlabs",
+	"openai",
+	"local"
+]);
+/**
+* Local Whisper models CodeDen can download. `.en` models are English-only (more accurate
+* for English at the same size); the others detect or take a language.
+*/
+const WhisperModelId = _enum([
+	"tiny",
+	"tiny.en",
+	"base",
+	"base.en",
+	"small",
+	"small.en"
+]);
+/** Audio format the local engine accepts: WAV, 16-bit PCM, mono, at this sample rate. */
+const LOCAL_STT_SAMPLE_RATE = 16e3;
+const downloadFields = {
+	state: _enum([
+		"missing",
+		"downloading",
+		"installed",
+		"failed"
+	]),
+	/** Bytes received so far (while downloading). */
+	receivedBytes: int().nonnegative(),
+	/** Download size in bytes (pinned, so known before the download starts). */
+	totalBytes: int().nonnegative(),
+	/** Size on disk when installed. */
+	sizeOnDisk: int().nonnegative().nullable(),
+	/** Why the last attempt failed. */
+	error: string().nullable()
+};
+/** The Whisper runtime: a prebuilt native library for this platform, downloaded on demand. */
+const LocalSttRuntime = object({
+	/** Runtime version CodeDen pins. */
+	version: string(),
+	...downloadFields
+});
+/** One downloadable model, with a speed and accuracy hint for the picker. */
+const LocalSttModel = object({
+	id: WhisperModelId,
+	/** e.g. `Base (English)`. */
+	label: string(),
+	/** Speed and accuracy hint, e.g. `Fast, good accuracy`. */
+	hint: string(),
+	englishOnly: boolean(),
+	/** The suggested default. */
+	recommended: boolean(),
+	...downloadFields
+});
+object({
+	/** False on platforms without a prebuilt runtime (`unsupportedReason` says why). */
+	supported: boolean(),
+	/** `process.platform-process.arch` of the server, e.g. `win32-x64`. */
+	platform: string(),
+	unsupportedReason: string().nullable(),
+	runtime: LocalSttRuntime,
+	models: array(LocalSttModel),
+	/** Folder holding the models. */
+	location: string()
+});
+/**
+* `POST /api/voice/local/models/:id/download` starts (or joins) the download of the runtime
+* and that model; `DELETE /api/voice/local/models/:id` cancels or deletes it. Both return
+* the new `LocalSttStatus`. The UI polls `GET /api/voice/local` while anything downloads.
+*/
+const LocalSttModelParams = object({ id: WhisperModelId });
 // ../../packages/contracts/src/settings.ts
 /** `auto` lets CodeDen pick the first ready provider (Claude, then Codex). */
 const ProviderChoice = union([literal("auto"), ProviderId]);
@@ -9320,6 +9511,17 @@ const RoleDefaults = object({
 	model: string().nullable().default(null),
 	effort: ReasoningEffort.nullable().default(null)
 });
+/** A model named by its provider and the provider's model id. */
+const ModelRef = object({
+	provider: ProviderId,
+	model: string().min(1)
+});
+/** A provider's custom models: ids are unique. */
+const CustomModelList = array(object({
+	id: string().trim().min(1).max(200),
+	/** Shown instead of the id in the picker. */
+	label: string().trim().min(1).max(100).optional()
+})).refine((list) => new Set(list.map((m) => m.id)).size === list.length, { message: "Custom model ids must be unique" });
 /**
 * User settings persisted in `<home>/settings.json` (non-secret; API keys live in the OS
 * keychain). Every field has a default, so `Settings.parse({})` yields a complete object and
@@ -9350,6 +9552,25 @@ const Settings = object({
 			noticeSummaries: boolean().default(true)
 		}).prefault({})
 	}).prefault({}),
+	/** The model picker (§13). */
+	models: object({
+		/**
+		* Starred models, listed in this order in the picker's Favourites section. Entries whose
+		* model a provider no longer lists are kept (it may come back) but not shown.
+		*/
+		favorites: array(ModelRef).default([]),
+		/**
+		* Model ids left out of the picker, by provider id. A hidden model that is still chosen
+		* somewhere (a session, a default, an automation) keeps showing there.
+		*/
+		hidden: record(ProviderId, array(string().min(1))).default({}),
+		/**
+		* Model ids added by the user, by provider id, merged into the picker after the models
+		* the provider lists (a listed id wins). Their effort levels are those of the provider's
+		* default model, or none when the provider has no effort levels.
+		*/
+		custom: record(ProviderId, CustomModelList).default({})
+	}).prefault({}),
 	/** Follow-up prompt chips (§7.5). */
 	followups: object({
 		enabled: boolean().default(true),
@@ -9359,13 +9580,15 @@ const Settings = object({
 	/** Voice (§11.3). */
 	voice: object({
 		dictation: object({
-			engine: _enum([
-				"browser",
-				"elevenlabs",
-				"openai"
-			]).default("browser"),
+			engine: DictationEngine.default("browser"),
 			pushToTalkShortcut: string().nullable().default(null),
-			language: string().nullable().default(null)
+			/**
+			* BCP 47 tag such as `en-US`; null is auto (the browser engine follows the browser
+			* language, the server engines detect it). English-only Whisper models ignore it.
+			*/
+			language: string().nullable().default(null),
+			/** Local Whisper: which downloaded model transcribes (§11.3). */
+			local: object({ model: WhisperModelId.default("base.en") }).prefault({})
 		}).prefault({}),
 		readAloud: object({
 			enabled: boolean().default(false),
@@ -9393,12 +9616,23 @@ const Settings = object({
 	}).prefault({}),
 	notifications: object({
 		toasts: boolean().default(true),
-		browser: boolean().default(false)
+		browser: boolean().default(false),
+		/** A short chime when an agent is blocked on the user (an approval or a question). */
+		sound: boolean().default(true)
 	}).prefault({}),
 	/** Global factory controls (§10.1). */
 	factory: object({ 
 	/** Stops every project's factory loop and all factory sessions. */
 killSwitch: boolean().default(false) }).prefault({}),
+	/**
+	* Worktree cleanup (§9). Archiving a session always removes its worktree; with `cleanup` on,
+	* worktrees of sessions inactive for `afterDays` are removed too, unless the session's pull
+	* request is still open or the worktree has uncommitted changes.
+	*/
+	worktrees: object({
+		cleanup: boolean().default(true),
+		afterDays: int().min(1).max(365).default(7)
+	}).prefault({}),
 	/** Master switch; individual automations are still off by default (§10). */
 	automations: object({ enabled: boolean().default(true) }).prefault({}),
 	/**
@@ -9406,6 +9640,15 @@ killSwitch: boolean().default(false) }).prefault({}),
 	* `check: false` to turn checks off; that reads as `mode: "off"`.
 	*/
 	updates: preprocess((value) => typeof value === "object" && value !== null && !("mode" in value) && value.check === false ? { mode: "off" } : value, object({ mode: UpdateMode.default("notify") }).prefault({})),
+	/** The desktop app (§17). Read by the desktop app only; `npx codeden` ignores it. */
+	desktop: object({
+		/** Start CodeDen (in the tray, window hidden) when you log in. */
+		launchAtLogin: boolean().default(false),
+		/** Closing the window keeps CodeDen running in the tray / menu bar; Quit really quits. */
+		closeToTray: boolean().default(true),
+		/** Keep the computer from sleeping while an agent is running. */
+		keepAwake: boolean().default(true)
+	}).prefault({}),
 	/** First-run setup (§14): set once the user finishes the detection checklist. */
 	setup: object({
 		completed: boolean().default(false),
@@ -9467,6 +9710,7 @@ discriminatedUnion("type", [
 	globalEvent("project.created", object({ project: Project })),
 	globalEvent("project.updated", object({ project: Project })),
 	globalEvent("project.archived", object({ projectId: Id })),
+	globalEvent("projects.reordered", object({ projectIds: array(Id) })),
 	globalEvent("session.created", object({ session: Session })),
 	globalEvent("session.updated", object({ session: Session })),
 	globalEvent("inbox.created", object({ item: InboxItem })),
@@ -9502,7 +9746,17 @@ discriminatedUnion("type", [
 	globalEvent("message.dequeued", object({
 		sessionId: Id,
 		messageId: Id,
-		reason: _enum(["sent", "dropped"])
+		reason: _enum([
+			"sent",
+			"dropped",
+			"deleted"
+		])
+	})),
+	globalEvent("message.edited", object({
+		sessionId: Id,
+		messageId: Id,
+		text: string(),
+		at: Timestamp
 	})),
 	globalEvent("notice.created", object({ notice: Notice })),
 	globalEvent("notice.delivered", object({
@@ -9695,9 +9949,17 @@ const UpdateProjectRequest = object({
 	defaultProvider: ProviderId.nullable().optional(),
 	autonomy: AutonomyLevel.nullable().optional(),
 	timezone: string().nullable().optional(),
-	defaultBranch: string().nullable().optional()
+	defaultBranch: string().nullable().optional(),
+	/** Pin or unpin the project in the project list (§13). */
+	pinned: boolean().optional()
 });
 /**
+* `PUT /api/projects/order`: the new manual order of the project list (§13). Lists every
+* non-archived project exactly once; the server rejects anything else (`invalid_order`).
+*/
+const ReorderProjectsRequest = object({ projectIds: array(Id).max(1e3) });
+object({ projects: array(Project) });
+/**
 * Where a session runs (§9): a fresh worktree (default for agents), the repo root, or an
 * existing directory (`path`).
 */
@@ -10392,6 +10654,125 @@ discriminatedUnion("type", [
 		message: string()
 	})
 ]);
+object({
+	/** Sessions with a turn starting or in progress. */
+	running: int().nonnegative(),
+	/** Sessions blocked on the user (an approval or a question). */
+	waiting: int().nonnegative(),
+	/** Open inbox items (questions, approvals, PRs to review, failures, ...). */
+	inbox: int().nonnegative()
+});
+/** Count running and waiting sessions and open inbox items. */
+function summarizeActivity(sessions, inbox) {
+	let running = 0;
+	let waiting = 0;
+	for (const s of sessions) if (s.status === "running" || s.status === "starting") running++;
+	else if (s.status === "waiting") waiting++;
+	return {
+		running,
+		waiting,
+		inbox: inbox.filter((i) => i.status === "open").length
+	};
+}
+/** The desktop updater's state, mirrored into `GET /api/updates` for the update banner. */
+const DesktopUpdateState = object({
+	phase: _enum([
+		"idle",
+		"checking",
+		"available",
+		"downloading",
+		"downloaded",
+		"installing",
+		"error"
+	]),
+	/** The running app version. */
+	current: string(),
+	/** The newest release found, null until a check succeeded. */
+	latest: string().nullable(),
+	checkedAt: Timestamp.nullable(),
+	/** Download progress (0-100) while `downloading`. */
+	percent: number$1().min(0).max(100).nullable(),
+	/** Why the last check or download failed. */
+	error: string().nullable(),
+	/** Set when this build cannot update itself (a development run, an unsigned macOS app). */
+	unsupported: string().nullable()
+});
+/** What the server asks the desktop updater to do (driven by the update banner and policy). */
+const DesktopUpdateCommand = _enum([
+	"check",
+	"download",
+	"install"
+]);
+discriminatedUnion("type", [
+	object({
+		type: literal("ready"),
+		url: string(),
+		port: int().min(1).max(65535),
+		launchUrl: string(),
+		version: string()
+	}),
+	object({
+		type: literal("failed"),
+		message: string(),
+		code: string().nullable()
+	}),
+	object({
+		type: literal("update.command"),
+		id: string(),
+		command: DesktopUpdateCommand
+	})
+]);
+discriminatedUnion("type", [
+	object({
+		type: literal("update.state"),
+		state: DesktopUpdateState
+	}),
+	object({
+		type: literal("update.done"),
+		id: string(),
+		error: string().nullable()
+	}),
+	object({
+		type: literal("shutdown"),
+		stopRunner: boolean()
+	})
+]);
+discriminatedUnion("kind", [
+	object({ kind: literal("home") }),
+	object({ kind: literal("inbox") }),
+	object({
+		kind: literal("session"),
+		sessionId: Id
+	}),
+	object({
+		kind: literal("project"),
+		projectId: Id
+	}),
+	object({
+		kind: literal("settings"),
+		section: string().nullable()
+	})
+]);
+object({
+	version: string(),
+	platform: _enum([
+		"win32",
+		"darwin",
+		"linux"
+	]),
+	/** True for an installed build (false when run from the repository). */
+	packaged: boolean(),
+	/** The app started this server (false when it attached to one started by `codeden`). */
+	ownsServer: boolean(),
+	/** The OS lets the app start at login (not on Linux AppImage, for example). */
+	launchAtLoginSupported: boolean()
+});
+object({
+	title: string().min(1).max(200),
+	body: string().max(2e3).optional(),
+	/** Passed back to `onNotificationClick` when the user clicks it. */
+	tag: string().max(200).optional()
+});
 // ../../packages/contracts/src/images-api.ts
 /**
 * Image generation settings screen and test button (§12.5). The `generate_image` MCP tool
@@ -10496,14 +10877,40 @@ object({
 	result: StartSessionResponse
 });
 /**
-* `PATCH /api/sessions/:id`: change the model or effort mid-session. Applied on the next turn
-* (a running turn keeps its settings). `null` returns to the role default.
+* `PATCH /api/sessions/:id`: change the model, effort, autonomy or title mid-session.
+* Model and effort apply on the next turn (a running turn keeps its settings); `null` returns
+* to the role default.
 */
 const UpdateSessionRequest = object({
 	model: string().min(1).nullable().optional(),
 	effort: ReasoningEffort.nullable().optional(),
+	/**
+	* Autonomy level (§11.2), saved on the session and pushed to the live provider session.
+	* It applies from the next tool call when the provider reports `liveAutonomy`, otherwise
+	* from the next turn. Approvals already waiting stay waiting.
+	*/
+	autonomy: AutonomyLevel.optional(),
 	title: string().trim().min(1).max(200).optional()
-}).refine((r) => r.model !== void 0 || r.effort !== void 0 || r.title !== void 0, { message: "Nothing to change" });
+}).refine((r) => r.model !== void 0 || r.effort !== void 0 || r.autonomy !== void 0 || r.title !== void 0, { message: "Nothing to change" });
+/**
+* `POST /api/sessions/:id/archive`: stop the session if it is running, hide it from the
+* sidebar and remove its worktree. The branch and checkpoints stay.
+*/
+const ArchiveSessionRequest = object({ 
+/** Remove the worktree even when it has uncommitted changes (those changes are lost). */
+force: boolean().default(false) });
+object({
+	session: Session,
+	worktree: object({
+		status: _enum([
+			"removed",
+			"kept_changes",
+			"none",
+			"failed"
+		]),
+		message: string().nullable()
+	})
+});
 // ../../packages/contracts/src/runner/events.ts
 /**
 * Durable runner -> server events. Journaled by the runner and delivered with a `seq`
@@ -10608,8 +11015,9 @@ const RunnerStream = discriminatedUnion("kind", [
 *   4. runner replays journaled events with `seq > lastAckedSeq`, then streams live.
 *
 * After the handshake the server sends `command`s (answered by `result` with the same `id`)
-* and cumulative `ack`s; the runner sends `event`s (durable, with `seq`) and `stream`s
-* (ephemeral). Either side may `ping`.
+* and cumulative `ack`s; the runner sends `event`s (durable, with `seq`), `stream`s
+* (ephemeral) and `providers` (the current provider list, whenever it changes). Either side
+* may `ping`.
 */
 /** Request id correlating a `command` with its `result`. */
 const RequestId = string().min(1).max(100);
@@ -10708,6 +11116,10 @@ const RunnerToServerMessage = discriminatedUnion("type", [
 		ts: Timestamp,
 		stream: RunnerStream
 	}),
+	object({
+		type: literal("providers"),
+		providers: array(ProviderInfo)
+	}),
 	Ping,
 	Pong
 ]);
@@ -11027,57 +11439,11 @@ object({
 * rest of the bundle, so the package version is the single source of truth at runtime;
 * everywhere else (workspace, tests) it is `SOURCE_VERSION`.
 */
-const CODEDEN_VERSION = packageVersion() ?? "0.1.1";
+const CODEDEN_VERSION = packageVersion() ?? "0.2.0";
 function packageVersion() {
 	const value = globalThis.__CODEDEN_PACKAGE_VERSION__;
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-// ../../packages/contracts/src/voice-api.ts
-/**
-* Optional cloud voice engines (§11.3). The browser's speech APIs stay the default; these
-* routes proxy ElevenLabs (text to speech, Scribe) and OpenAI (transcription) with API keys
-* from the OS keychain, so keys never reach the browser.
-*/
-/** ElevenLabs MP3 output formats (`codec_sampleRate_bitrate`). */
-const TtsOutputFormat = _enum([
-	"mp3_22050_32",
-	"mp3_44100_64",
-	"mp3_44100_128",
-	"mp3_44100_192"
-]);
-/**
-* `POST /api/tts`: streams `audio/mpeg`. `voiceId` defaults to
-* `settings.voice.readAloud.voice`, then a stock voice; `modelId` to a low-latency model.
-*/
-const TtsRequest = object({
-	text: string().min(1).max(5e3),
-	voiceId: string().min(1).max(100).optional(),
-	modelId: string().min(1).max(100).optional(),
-	outputFormat: TtsOutputFormat.optional()
-});
-object({ voices: array(object({
-	id: string(),
-	name: string(),
-	category: string().optional(),
-	description: string().optional(),
-	previewUrl: string().optional(),
-	labels: record(string(), string()).optional()
-})) });
-/**
-* `POST /api/stt?engine=&language=`: the body is the recorded audio (raw bytes with an
-* `audio/*` content type, or multipart with a `file` field), up to 25 MB. `engine` defaults
-* to `settings.voice.dictation.engine` (when that is `browser`, ElevenLabs).
-*/
-const SttQuery = object({
-	engine: _enum(["elevenlabs", "openai"]).optional(),
-	/** ISO 639-1 hint, e.g. `en`. */
-	language: string().min(2).max(10).optional()
-});
-object({
-	text: string(),
-	language: string().nullable(),
-	engine: _enum(["elevenlabs", "openai"])
-});
 // ../../node_modules/.pnpm/ws@8.22.1/node_modules/ws/lib/constants.js
 var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const BINARY_TYPES = [
@@ -14828,6 +15194,43 @@ var AsyncQueue = class {
 		};
 	}
 };
+// ../../packages/providers/src/models.ts
+function copy(m) {
+	return {
+		...m,
+		efforts: [...m.efforts]
+	};
+}
+/**
+* An adapter's current model list. It starts from a fallback and is replaced by what the
+* provider reports (model discovery, a running session). Listeners hear about real changes
+* only, so the runner can forward them to the server (§4.3).
+*/
+var ModelCatalog = class {
+	models;
+	listeners = /* @__PURE__ */ new Set();
+	constructor(fallback) {
+		this.models = fallback.map(copy);
+	}
+	/** A copy of the current list. */
+	list() {
+		return this.models.map(copy);
+	}
+	/** Replace the list. Returns false (and notifies nobody) when nothing changed. */
+	set(models) {
+		if (JSON.stringify(models) === JSON.stringify(this.models)) return false;
+		this.models = models.map(copy);
+		for (const listener of this.listeners) try {
+			listener();
+		} catch {}
+		return true;
+	}
+	/** Call `listener` after every change. Returns the unsubscribe function. */
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => this.listeners.delete(listener);
+	}
+};
 // ../../packages/providers/src/util/exec.ts
 function isFile(candidate) {
 	try {
@@ -14899,11 +15302,51 @@ function scriptFromCmdShim(shimPath, content) {
 	if (content === void 0 && !existsSync(script)) return void 0;
 	return script;
 }
+/** True inside the desktop app, where `process.execPath` is the Electron binary (§17). */
+function isElectronRuntime(versions = process.versions) {
+	return typeof versions.electron === "string";
+}
+/**
+* Environment for running one of CodeDen's own scripts (the runner, npm, Playwright's CLI)
+* with `process.execPath`. In the desktop app that is the Electron binary, which only acts
+* as Node.js with `ELECTRON_RUN_AS_NODE=1`; elsewhere the environment is returned unchanged.
+*/
+function ownNodeEnv(env = process.env, versions = process.versions) {
+	return isElectronRuntime(versions) ? {
+		...env,
+		ELECTRON_RUN_AS_NODE: "1"
+	} : env;
+}
+let systemNode;
+/**
+* The Node.js that runs `node-script` commands (npm-style shims of the user's own tools, such
+* as a globally installed Codex on Windows). Normally the Node running CodeDen. In the desktop
+* app the user's `node` from PATH is preferred, so their tools run exactly as in a terminal
+* and `ELECTRON_RUN_AS_NODE` never leaks into agent processes; without one, the Electron
+* binary runs them as Node.js.
+*/
+function scriptRuntime() {
+	if (!isElectronRuntime()) return {
+		path: process.execPath,
+		electron: false
+	};
+	if (systemNode === void 0) {
+		const found = resolveExecutable("node");
+		systemNode = found?.kind === "native" ? found.path : null;
+	}
+	return systemNode ? {
+		path: systemNode,
+		electron: false
+	} : {
+		path: process.execPath,
+		electron: true
+	};
+}
 /** The `[command, args]` to pass to `spawn` for a resolved executable (never needs `shell`). */
 function spawnArgs(cmd, args) {
 	switch (cmd.kind) {
 		case "native": return [cmd.path, [...args]];
-		case "node-script": return [process.execPath, [cmd.script, ...args]];
+		case "node-script": return [scriptRuntime().path, [cmd.script, ...args]];
 		case "shell-script": return [process.env.ComSpec ?? "cmd.exe", [
 			"/d",
 			"/s",
@@ -14920,9 +15363,11 @@ function quoteCmdArg(arg) {
 /** Spawn a resolved executable. Uses `windowsVerbatimArguments` for the cmd.exe fallback. */
 function spawnResolved(cmd, args, options = {}) {
 	const [file, argv] = spawnArgs(cmd, args);
+	const asNode = cmd.kind === "node-script" && scriptRuntime().electron;
 	return spawn(file, argv, {
 		windowsHide: true,
 		...options,
+		...asNode ? { env: ownNodeEnv(options.env ?? process.env) } : {},
 		...cmd.kind === "shell-script" ? { windowsVerbatimArguments: true } : {}
 	});
 }
@@ -15135,6 +15580,9 @@ function parseClaudeAuthStatus(stdout) {
 		return unknown;
 	}
 }
+// ../../packages/providers/src/util/model.ts
+/** The id the model pickers use for "the provider's own default model". */
+const DEFAULT_MODEL_ID = "default";
 /**
 * The model to pass to a provider, or undefined to leave it out so the provider uses its own
 * default (the user's config). `"default"` and empty values are never sent as model ids.
@@ -15143,24 +15591,161 @@ function explicitModel(model) {
 	const id = model?.trim();
 	return id && id !== "default" ? id : void 0;
 }
-// ../../packages/providers/src/util/text.ts
-/** Max characters of tool output kept inline in an item (§6: larger outputs are truncated). */
-const TOOL_OUTPUT_PREVIEW_CHARS = 16e3;
-/** Build a `ToolOutput` preview, truncating long text. */
-function toolOutput(text, max = TOOL_OUTPUT_PREVIEW_CHARS) {
-	const totalBytes = Buffer.byteLength(text, "utf8");
-	if (text.length <= max) return {
-		text,
-		truncated: false,
-		totalBytes
-	};
-	return {
-		text: `${text.slice(0, max)}\n...`,
-		truncated: true,
-		totalBytes
-	};
-}
-/** One-line summary for titles: first line, trimmed and shortened. */
+// ../../packages/providers/src/policy/read-only.ts
+/**
+* Read-only sessions (the orchestrator and PMs, §11.2) may inspect a repository but never
+* change it. This allowlist decides which shell commands they may run: commands that only
+* read, with no output redirection and no command substitution. Anything else is denied.
+*/
+/**
+* Split on every `;`, `&&`, `||`, `|` and newline, even inside quotes. Deliberately cruder
+* than the risk classifier's lexer: for an allowlist, over-splitting only denies more.
+*/
+function splitCommands(command) {
+	return command.split(/\r?\n|;|&&|\|\||\|/).map((s) => s.trim()).filter(Boolean);
+}
+/** Tokenize one simple command, honouring single and double quotes. */
+function tokenize(command) {
+	const tokens = [];
+	for (const m of command.matchAll(/"((?:[^"\\]|\\.)*)"|'([^']*)'|(\S+)/g)) tokens.push(m[1] ?? m[2] ?? m[3] ?? "");
+	return tokens;
+}
+/** Programs that only read (or print). */
+const READ_ONLY_BINS = /* @__PURE__ */ new Set([
+	"ls",
+	"dir",
+	"cat",
+	"type",
+	"head",
+	"tail",
+	"less",
+	"more",
+	"wc",
+	"grep",
+	"egrep",
+	"fgrep",
+	"rg",
+	"find",
+	"fd",
+	"tree",
+	"pwd",
+	"echo",
+	"printf",
+	"which",
+	"where",
+	"whoami",
+	"date",
+	"stat",
+	"file",
+	"du",
+	"df",
+	"sort",
+	"uniq",
+	"cut",
+	"diff",
+	"jq",
+	"basename",
+	"dirname",
+	"realpath",
+	"true",
+	"get-childitem",
+	"gci",
+	"get-content",
+	"gc",
+	"get-item",
+	"gi",
+	"get-location",
+	"gl",
+	"select-string",
+	"sls",
+	"measure-object",
+	"test-path",
+	"resolve-path",
+	"write-output",
+	"write-host",
+	"select-object",
+	"where-object",
+	"format-list",
+	"format-table",
+	"out-string",
+	"sort-object",
+	"gh"
+]);
+/** Git subcommands that never change the repository. */
+const READ_ONLY_GIT = /* @__PURE__ */ new Set([
+	"status",
+	"log",
+	"show",
+	"diff",
+	"blame",
+	"grep",
+	"ls-files",
+	"ls-tree",
+	"rev-parse",
+	"rev-list",
+	"describe",
+	"shortlog",
+	"cat-file",
+	"remote",
+	"branch",
+	"tag",
+	"config",
+	"reflog",
+	"merge-base",
+	"name-rev",
+	"for-each-ref",
+	"worktree"
+]);
+/** `gh` subcommand verbs that only read. */
+const READ_ONLY_GH = /* @__PURE__ */ new Set([
+	"view",
+	"list",
+	"status",
+	"diff",
+	"checks"
+]);
+const bin = (token) => (token ?? "").replace(/\\/g, "/").split("/").pop()?.toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/, "") ?? "";
+/** Why a command is refused in a read-only session, or undefined when it may run. */
+function readOnlyCommandDenial(command) {
+	if (/\$\(|`|<\(|>\(/.test(command)) return "Command substitution is not allowed in a read-only session";
+	for (const simple of splitCommands(command)) {
+		if (/(^|[^0-9&<])>>?(?!\s*(&\d|\/dev\/null|nul\b|\$null))/i.test(simple)) return "Writing files is not allowed in a read-only session";
+		const tokens = tokenize(simple);
+		const name = bin(tokens[0]);
+		const args = tokens.slice(1).map((a) => a.toLowerCase());
+		if (name === "git") {
+			const sub = args.find((a) => !a.startsWith("-"));
+			if (!sub || !READ_ONLY_GIT.has(sub)) return `git ${sub ?? ""} may change the repository`;
+			if ((sub === "branch" || sub === "tag" || sub === "remote" || sub === "worktree") && args.some((a) => /^-(d|D|m|M|f|-delete|-move|-force)$/.test(a) || a === "add")) return `git ${sub} with these options changes the repository`;
+			if (sub === "config" && !args.some((a) => a === "--get" || a === "--list" || a === "-l")) return "Only reading git config is allowed";
+			continue;
+		}
+		if (name === "gh") {
+			if (!args.some((a) => READ_ONLY_GH.has(a)) || args.includes("api")) return "Only read-only gh commands are allowed (view, list, status, diff, checks)";
+			continue;
+		}
+		if (name === "find" && args.some((a) => a === "-delete" || a === "-exec" || a === "-execdir")) return "find with -delete or -exec is not allowed in a read-only session";
+		if (!READ_ONLY_BINS.has(name)) return `${name || "This command"} is not on the read-only allowlist`;
+	}
+}
+// ../../packages/providers/src/util/text.ts
+/** Max characters of tool output kept inline in an item (§6: larger outputs are truncated). */
+const TOOL_OUTPUT_PREVIEW_CHARS = 16e3;
+/** Build a `ToolOutput` preview, truncating long text. */
+function toolOutput(text, max = TOOL_OUTPUT_PREVIEW_CHARS) {
+	const totalBytes = Buffer.byteLength(text, "utf8");
+	if (text.length <= max) return {
+		text,
+		truncated: false,
+		totalBytes
+	};
+	return {
+		text: `${text.slice(0, max)}\n...`,
+		truncated: true,
+		totalBytes
+	};
+}
+/** One-line summary for titles: first line, trimmed and shortened. */
 function shorten(text, max = 80) {
 	const line = text.trim().split(/\r?\n/)[0] ?? "";
 	return line.length > max ? `${line.slice(0, max - 1)}…` : line;
@@ -15197,50 +15782,110 @@ function unixToIso(value) {
 	const ms = value < 0xe8d4a51000 ? value * 1e3 : value;
 	return new Date(ms).toISOString();
 }
-// ../../packages/providers/src/utility.ts
-/** Abort signal that fires on the caller's signal or after `timeoutMs`. */
-function oneShotSignal(request) {
-	const controller = new AbortController();
-	const timer = setTimeout(() => controller.abort(/* @__PURE__ */ new Error("Utility model timed out")), request.timeoutMs ?? 6e4);
-	const onAbort = () => controller.abort(request.signal?.reason);
-	request.signal?.addEventListener("abort", onAbort, { once: true });
-	return {
-		signal: controller.signal,
-		dispose: () => {
-			clearTimeout(timer);
-			request.signal?.removeEventListener("abort", onAbort);
-		}
-	};
-}
 // ../../packages/providers/src/policy/paths.ts
+const isWin = (ctx) => (ctx.platform ?? process.platform) === "win32";
 function pathApi(ctx) {
-	return (ctx.platform ?? process.platform) === "win32" ? path.win32 : path.posix;
+	return isWin(ctx) ? path.win32 : path.posix;
+}
+function homeOf(ctx) {
+	return ctx.home ?? process.env.HOME ?? process.env.USERPROFILE ?? "";
+}
+function tempRootsOf(ctx) {
+	return ctx.tempRoots ?? osTempRoots(ctx.platform);
 }
-/** Resolve `target` (absolute, relative to cwd, or `~`-prefixed) to an absolute path. */
+const HOME_VARS = /^(\$HOME|\$\{HOME\}|\$env:USERPROFILE|%USERPROFILE%)(?=$|[\\/])/i;
+const TEMP_VARS = /^(\$TMPDIR|\$\{TMPDIR\}|\$TEMP|\$TMP|\$env:TEMP|\$env:TMP|%TEMP%|%TMP%)(?=$|[\\/])/i;
+/**
+* Git Bash paths on Windows: `/c/Users/x` is `C:\Users\x`, and `/tmp` is the user's temp
+* directory.
+*/
+function fromGitBash(value, temp) {
+	if (temp && /^\/tmp(?=$|\/)/.test(value)) return temp + value.slice(4);
+	const drive = /^\/([a-z])(?=$|\/)/i.exec(value);
+	if (drive?.[1]) return `${drive[1].toUpperCase()}:\\${value.slice(3)}`;
+	return value;
+}
+/**
+* Resolve `target` (absolute, relative to `dir`, `~`-prefixed, or starting with a home or
+* temp variable) to an absolute path.
+*/
 function resolveAgainst(target, ctx) {
 	const p = pathApi(ctx);
 	let value = target.trim().replace(/^["']|["']$/g, "");
-	const home = ctx.home ?? process.env.HOME ?? process.env.USERPROFILE ?? "";
+	const home = homeOf(ctx);
 	if (value === "~" || value.startsWith("~/") || value.startsWith("~\\")) value = home + value.slice(1);
-	value = value.replace(/^\$HOME(?=$|[\\/])/, home).replace(/^\$env:USERPROFILE(?=$|[\\/])/i, home);
-	return p.resolve(ctx.cwd, value);
+	value = value.replace(HOME_VARS, home);
+	const temp = tempRootsOf(ctx)[0];
+	if (temp) value = value.replace(TEMP_VARS, temp);
+	if (isWin(ctx)) value = fromGitBash(value, temp);
+	return p.resolve(ctx.dir ?? ctx.cwd, value);
 }
 /** True when `target` resolves inside `root` (or equals it). Case-insensitive on Windows. */
 function isInside$1(target, root, ctx) {
+	const rel = relative$1(root, target, ctx);
+	return rel === "" || !rel.startsWith("..") && !pathApi(ctx).isAbsolute(rel);
+}
+function relative$1(root, target, ctx) {
 	const p = pathApi(ctx);
-	const win = (ctx.platform ?? process.platform) === "win32";
-	const norm = (s) => {
-		const r = p.resolve(s);
-		return win ? r.toLowerCase() : r;
-	};
-	const rel = p.relative(norm(root), norm(target));
-	return rel === "" || !rel.startsWith("..") && !p.isAbsolute(rel);
+	const norm = (s) => isWin(ctx) ? p.resolve(s).toLowerCase() : p.resolve(s);
+	return p.relative(norm(root), norm(target));
 }
 /** True when `target` is inside the worktree or one of the extra roots. */
 function isInWorkspace(target, ctx) {
 	const abs = resolveAgainst(target, ctx);
 	return [ctx.cwd, ...ctx.extraRoots ?? []].some((root) => isInside$1(abs, root, ctx));
 }
+/** True when `target` is strictly inside one of the OS temp directories (never the root). */
+function isInTemp(target, ctx) {
+	const abs = resolveAgainst(target, ctx);
+	return tempRootsOf(ctx).some((root) => {
+		return relative$1(root, abs, ctx) !== "" && isInside$1(abs, root, ctx);
+	});
+}
+/** True when agents may write `target` without asking: the worktree, extra roots or temp. */
+function isWritable(target, ctx) {
+	return isInWorkspace(target, ctx) || isInTemp(target, ctx);
+}
+/**
+* Usable temp roots from `candidates`: absolute, deduplicated, and never a filesystem root,
+* the home directory or one of its parents (a stray `TMPDIR=/` must not open everything).
+*/
+function tempRootsFrom(candidates, platform, home) {
+	const ctx = {
+		cwd: "/",
+		platform
+	};
+	const p = pathApi(ctx);
+	const out = [];
+	for (const candidate of candidates) {
+		if (!candidate || !p.isAbsolute(candidate)) continue;
+		const root = p.resolve(candidate);
+		if (p.parse(root).root === root || p.dirname(root) === root) continue;
+		if (home && isInside$1(home, root, ctx)) continue;
+		if (!out.some((r) => relative$1(r, root, ctx) === "")) out.push(root);
+	}
+	return out;
+}
+const realpath = (p) => {
+	try {
+		return realpathSync.native(p);
+	} catch {
+		return;
+	}
+};
+let cachedTempRoots;
+/**
+* The OS temp directories for the running platform: `os.tmpdir()`, `%TEMP%` and `%TMP%` on
+* Windows, `$TMPDIR` and `/tmp` elsewhere, each also by its real path (macOS symlinks
+* `/tmp`, Windows may report a short 8.3 name). Empty when asked about another platform.
+*/
+function osTempRoots(platform = process.platform) {
+	if (platform !== process.platform) return [];
+	if (cachedTempRoots) return cachedTempRoots;
+	const env = process.env;
+	cachedTempRoots = tempRootsFrom([os.tmpdir(), ...platform === "win32" ? [env.TEMP, env.TMP] : [env.TMPDIR, "/tmp"]].flatMap((c) => c ? [c, realpath(c)] : []), platform, os.homedir());
+	return cachedTempRoots;
+}
 const SECRET_BASENAMES = /* @__PURE__ */ new Set([
 	".env",
 	".npmrc",
@@ -15284,6 +15929,254 @@ function isSecretPath(target) {
 	if (SECRET_EXTENSIONS.some((ext) => base.endsWith(ext))) return true;
 	return /(^|\/)\.(ssh|aws|gnupg|docker)\//i.test(normalized) && !base.endsWith(".pub");
 }
+// ../../packages/providers/src/policy/shell.ts
+/** Parse a command line into its simple commands. */
+function parseShell(src, dialect = "auto") {
+	return new Lexer(src, dialect).list(null);
+}
+/** Placeholder for heredoc and here-string bodies, which are data, never commands. */
+const BODY = "<body>";
+/** The command being built and the word being read. */
+var Builder = class {
+	out;
+	cmd = {
+		words: [],
+		writes: [],
+		nested: []
+	};
+	word = "";
+	inWord = false;
+	/** Where the current word goes: an argument, a redirect target or a heredoc delimiter. */
+	target = "word";
+	heredocStrip = false;
+	heredocs = [];
+	constructor(out) {
+		this.out = out;
+	}
+	add(text) {
+		this.word += text;
+		this.inWord = true;
+	}
+	endWord() {
+		if (!this.inWord) return;
+		if (this.target === "write") this.cmd.writes.push(this.word);
+		else if (this.target === "heredoc") this.heredocs.push({
+			delim: this.word.replace(/\\/g, ""),
+			strip: this.heredocStrip
+		});
+		else if (this.target === "word") this.cmd.words.push(this.word);
+		this.target = "word";
+		this.word = "";
+		this.inWord = false;
+	}
+	endCommand() {
+		this.endWord();
+		this.target = "word";
+		const { cmd } = this;
+		if (cmd.words.length || cmd.writes.length || cmd.nested.length) this.out.push(cmd);
+		this.cmd = {
+			words: [],
+			writes: [],
+			nested: []
+		};
+	}
+};
+var Lexer = class {
+	src;
+	dialect;
+	i = 0;
+	constructor(src, dialect) {
+		this.src = src;
+		this.dialect = dialect;
+	}
+	/** Read simple commands until `closer` (`)` or a backtick) or the end of the input. */
+	list(closer) {
+		const out = [];
+		const b = new Builder(out);
+		const { src } = this;
+		while (this.i < src.length) {
+			const c = src[this.i];
+			const next = src[this.i + 1];
+			if (closer && c === closer) {
+				this.i += 1;
+				b.endCommand();
+				return out;
+			}
+			if (c === "\n" || c === "\r") {
+				b.endCommand();
+				this.i += c === "\r" && next === "\n" ? 2 : 1;
+				this.skipHeredocs(b.heredocs.splice(0));
+			} else if (c === " " || c === "	") {
+				b.endWord();
+				this.i += 1;
+			} else if (c === "#" && !b.inWord) while (this.i < src.length && src[this.i] !== "\n" && src[this.i] !== "\r") this.i += 1;
+			else if (c === ";") {
+				b.endCommand();
+				this.i += 1;
+			} else if (c === "|") {
+				b.endCommand();
+				this.i += next === "|" || next === "&" ? 2 : 1;
+			} else if (c === "&" && next === ">") {
+				b.endWord();
+				b.target = "write";
+				this.i += src[this.i + 2] === ">" ? 3 : 2;
+			} else if (c === "&") {
+				b.endCommand();
+				this.i += next === "&" ? 2 : 1;
+			} else if (c === ">" || c === "<") this.redirect(b, c);
+			else if (c === "'" || c === "\"") {
+				if (b.inWord && b.word.endsWith("@") && this.lineEndsAt(this.i + 1)) {
+					this.skipHereString(c);
+					b.add(BODY);
+				} else if (c === "'") b.add(this.readSingle());
+				else b.add(this.readDouble(b));
+			} else if (c === "\\" && this.dialect !== "powershell") {
+				if (next === "\n" || next === "\r") this.i += next === "\r" && src[this.i + 2] === "\n" ? 3 : 2;
+				else {
+					b.add(src.slice(this.i, this.i + 2));
+					this.i += 2;
+				}
+			} else if (c === "`") this.backtick(b);
+			else if (c === "(") {
+				const start = this.i;
+				this.i += 1;
+				b.cmd.nested.push(this.list(")"));
+				b.add(src.slice(start, this.i));
+			} else {
+				b.add(c);
+				this.i += 1;
+			}
+		}
+		b.endCommand();
+		return out;
+	}
+	/** `>`, `>>`, `>|`, `2>`, `*>`, `2>&1`, `<`, `<<EOF`, `<<-EOF`, `<<<`, `<(…)`, `>(…)`. */
+	redirect(b, c) {
+		const { src } = this;
+		if (b.inWord && /^(\d+|\*)$/.test(b.word)) {
+			b.word = "";
+			b.inWord = false;
+		} else b.endWord();
+		const next = src[this.i + 1];
+		if (next === "(") {
+			const start = this.i;
+			this.i += 2;
+			b.cmd.nested.push(this.list(")"));
+			b.add(src.slice(start, this.i));
+			return;
+		}
+		if (c === "<") {
+			if (next === "<" && src[this.i + 2] === "<") {
+				b.target = "skip";
+				this.i += 3;
+			} else if (next === "<") {
+				this.i += 2;
+				b.heredocStrip = src[this.i] === "-";
+				if (b.heredocStrip) this.i += 1;
+				b.target = "heredoc";
+			} else this.i += 1;
+			return;
+		}
+		let j = this.i + 1;
+		if (src[j] === ">") j += 1;
+		if (src[j] === "|") j += 1;
+		if (src[j] === "&") {
+			const dup = /^&(\d+|-)/.exec(src.slice(j));
+			if (dup) {
+				this.i = j + dup[0].length;
+				return;
+			}
+			j += 1;
+		}
+		b.target = "write";
+		this.i = j;
+	}
+	/**
+	* PowerShell escapes the next character; POSIX starts a command substitution. (A closing
+	* backtick never gets here: `list` checks for its closer first.)
+	*/
+	backtick(b) {
+		const { src } = this;
+		const next = src[this.i + 1];
+		if (this.dialect === "powershell" || this.dialect === "auto" && (next === void 0 || /\s/.test(next))) {
+			if (next === "\n" || next === "\r") this.i += next === "\r" && src[this.i + 2] === "\n" ? 3 : 2;
+			else {
+				b.add(src.slice(this.i + 1, this.i + 2));
+				this.i += 2;
+			}
+			return;
+		}
+		const start = this.i;
+		this.i += 1;
+		b.cmd.nested.push(this.list("`"));
+		b.add(src.slice(start, this.i));
+	}
+	readSingle() {
+		const end = this.src.indexOf("'", this.i + 1);
+		const stop = end === -1 ? this.src.length : end;
+		const text = this.src.slice(this.i + 1, stop);
+		this.i = stop + 1;
+		return text;
+	}
+	/** A double-quoted string: escapes, and `$(…)` substitutions run as nested commands. */
+	readDouble(b) {
+		const { src } = this;
+		let text = "";
+		this.i += 1;
+		while (this.i < src.length) {
+			const c = src[this.i];
+			const next = src[this.i + 1];
+			if (c === "\"") {
+				this.i += 1;
+				return text;
+			}
+			if (c === "\\" && this.dialect !== "powershell" && next && "\"\\$`\n".includes(next)) {
+				text += next;
+				this.i += 2;
+			} else if (c === "`" && this.dialect !== "posix" && next !== void 0) {
+				text += next;
+				this.i += 2;
+			} else if (c === "`") {
+				const start = this.i;
+				this.i += 1;
+				b.cmd.nested.push(this.list("`"));
+				text += src.slice(start, this.i);
+			} else if (c === "$" && next === "(") {
+				const start = this.i;
+				this.i += 2;
+				b.cmd.nested.push(this.list(")"));
+				text += src.slice(start, this.i);
+			} else {
+				text += c;
+				this.i += 1;
+			}
+		}
+		return text;
+	}
+	/** True when only spaces or tabs remain before the end of the line at `j`. */
+	lineEndsAt(j) {
+		return /^[ \t]*(\r?\n|$)/.exec(this.src.slice(j)) !== null;
+	}
+	/** Skip a PowerShell here-string (`@'` … `'@`) whose opening quote is at `this.i`. */
+	skipHereString(quote) {
+		const close = new RegExp(`(^|\\n)${quote}@`, "g");
+		close.lastIndex = this.i + 1;
+		const m = close.exec(this.src);
+		this.i = m ? m.index + m[0].length : this.src.length;
+	}
+	/** Skip the bodies of heredocs opened on the line that just ended. */
+	skipHeredocs(pending) {
+		const { src } = this;
+		for (const { delim, strip } of pending) while (this.i < src.length) {
+			const nl = src.indexOf("\n", this.i);
+			const end = nl === -1 ? src.length : nl;
+			let line = src.slice(this.i, end).replace(/\r$/, "");
+			if (strip) line = line.replace(/^\t+/, "");
+			this.i = nl === -1 ? src.length : nl + 1;
+			if (line === delim) break;
+		}
+	}
+};
 // ../../packages/providers/src/policy/risk.ts
 const SAFE = { risky: false };
 const risky = (action, reason) => ({
@@ -15291,26 +16184,22 @@ const risky = (action, reason) => ({
 	action,
 	reason
 });
-/** Split a shell command line into simple commands (on `;`, `&&`, `||`, `|`, newlines). */
-function splitCommands(command) {
-	return command.split(/\r?\n|;|&&|\|\||\|/).map((s) => s.trim()).filter(Boolean);
-}
-/** Tokenize one simple command, honouring single and double quotes. */
-function tokenize(command) {
-	const tokens = [];
-	for (const m of command.matchAll(/"((?:[^"\\]|\\.)*)"|'([^']*)'|(\S+)/g)) tokens.push(m[1] ?? m[2] ?? m[3] ?? "");
-	return tokens;
-}
-/** Strip wrappers that don't change what runs (`sudo`, `env X=1`, `command`, `exec`). */
-function unwrap(tokens) {
+/** How deep `bash -c "…"` style inline scripts are followed. */
+const MAX_DEPTH = 4;
+/**
+* Words that don't change what runs: elevation (`sudo`), wrappers (`env X=1`, `command`,
+* `exec`) and shell keywords that start a compound command (`if`, `then`, `do`, `{`, ...).
+*/
+function unwrap(words) {
 	let elevated = false;
-	let rest = tokens;
+	let rest = words;
 	for (;;) {
 		const head = rest[0]?.toLowerCase();
 		if (head === "sudo" || head === "doas" || head === "runas" || head === "gsudo") {
 			elevated = true;
 			rest = rest.slice(1).filter((t, i) => !(i === 0 && t.startsWith("-")));
 		} else if (head === "env" || head === "command" || head === "exec" || head === "nohup") rest = rest.slice(1);
+		else if (head && KEYWORDS.has(head)) rest = rest.slice(1);
 		else if (head && /^[A-Za-z_][A-Za-z0-9_]*=/.test(head)) rest = rest.slice(1);
 		else break;
 	}
@@ -15319,6 +16208,18 @@ function unwrap(tokens) {
 		elevated
 	};
 }
+const KEYWORDS = /* @__PURE__ */ new Set([
+	"if",
+	"then",
+	"else",
+	"elif",
+	"do",
+	"while",
+	"until",
+	"time",
+	"!",
+	"{"
+]);
 const binName = (token) => (token ?? "").replace(/\\/g, "/").split("/").pop()?.toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/, "") ?? "";
 const DOWNLOADERS = /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b|downloadstring/i;
 const SHELLS = /^\s*(sudo\s+)?(sh|bash|zsh|fish|dash|ksh|iex|invoke-expression|python3?|node|pwsh|powershell|perl|ruby)(\s|$)/i;
@@ -15328,18 +16229,109 @@ function classifyCommand(command, ctx) {
 	for (let i = 1; i < pipeline.length; i += 1) if (DOWNLOADERS.test(pipeline[i - 1] ?? "") && SHELLS.test(pipeline[i] ?? "")) return risky("network", "Pipes a downloaded script straight into a shell");
 	if (/\b(iex|invoke-expression)\b[^|]*\b(irm|iwr|invoke-restmethod|invoke-webrequest|downloadstring)\b/i.test(command)) return risky("network", "Executes a downloaded script");
 	if (/\b(bash|sh|zsh)\s+(-c\s+)?["']?\$\(\s*(curl|wget)\b/i.test(command) || /<\(\s*(curl|wget)\b/i.test(command)) return risky("network", "Executes a downloaded script");
-	for (const simple of splitCommands(command)) {
-		const result = classifySimple(simple, ctx);
+	return classifyList(parseShell(command, ctx.shell ?? "auto"), ctx, 0);
+}
+/**
+* Classify commands in order. A `cd` moves where later relative paths resolve; commands in
+* substitutions and subshells are classified too, without their `cd` leaking out.
+*/
+function classifyList(list, ctx, depth) {
+	let here = ctx;
+	for (const cmd of list) {
+		for (const nested of cmd.nested) {
+			const result = classifyList(nested, here, depth);
+			if (result.risky) return result;
+		}
+		const result = classifySimple(cmd, here, depth);
 		if (result.risky) return result;
+		here = afterCd(cmd, here);
 	}
 	return SAFE;
 }
-function classifySimple(simple, ctx) {
-	const { tokens, elevated } = unwrap(tokenize(simple));
+const CD = /* @__PURE__ */ new Set([
+	"cd",
+	"pushd",
+	"chdir",
+	"set-location",
+	"sl",
+	"push-location"
+]);
+/** The context after `cmd` when it changes directory (`cd dir`, `Set-Location -Path dir`). */
+function afterCd(cmd, ctx) {
+	const { tokens } = unwrap(cmd.words);
+	if (!CD.has(binName(tokens[0]))) return ctx;
+	const args = tokens.slice(1);
+	if (args.includes("-")) return ctx;
+	const target = namedArg(args, ["-path", "-literalpath"]) ?? args.find((a) => !a.startsWith("-")) ?? "~";
+	return {
+		...ctx,
+		dir: resolveAgainst(target, ctx)
+	};
+}
+/** The value after a PowerShell-style named parameter (`-Path x`), if present. */
+function namedArg(args, names) {
+	const i = args.findIndex((a) => names.includes(a.toLowerCase()));
+	return i >= 0 ? args[i + 1] : void 0;
+}
+/** The script of an inline shell invocation (`bash -c "…"`, `pwsh -Command …`, `cmd /c …`). */
+function inlineScript(bin, args) {
+	if ([
+		"sh",
+		"bash",
+		"zsh",
+		"dash",
+		"ksh",
+		"ash",
+		"fish"
+	].includes(bin)) {
+		const flag = args.findIndex((a) => /^-[a-z]*c[a-z]*$/i.test(a));
+		const text = flag >= 0 ? args.slice(flag + 1).find((a) => !a.startsWith("-")) : void 0;
+		return text ? {
+			text,
+			dialect: "posix"
+		} : void 0;
+	}
+	if (bin === "pwsh" || bin === "powershell") {
+		const flag = args.findIndex((a) => /^-(c|command)$/i.test(a));
+		return flag >= 0 ? {
+			text: args.slice(flag + 1).join(" "),
+			dialect: "powershell"
+		} : void 0;
+	}
+	if (bin === "cmd") {
+		const flag = args.findIndex((a) => /^\/[ck]$/i.test(a));
+		return flag >= 0 ? {
+			text: args.slice(flag + 1).join(" "),
+			dialect: "auto"
+		} : void 0;
+	}
+}
+/**
+* The argument as a path, or undefined when it can't be one: inline code, multi-line text
+* or anything with shell or code punctuation (`selected={row.key`) is not a file name.
+*/
+function asPath(arg) {
+	const value = arg.replace(/^-+[a-z-]*=/i, "");
+	if (!value || /[\n\r{}()<>|;=`]/.test(value)) return void 0;
+	return value;
+}
+const DISCARD = /^(\/dev\/(null|stdout|stderr|tty)|nul|\$null)$/i;
+function classifySimple(cmd, ctx, depth) {
+	const { tokens, elevated } = unwrap(cmd.words);
 	if (elevated) return risky("other", "Runs a command with elevated privileges");
 	const bin = binName(tokens[0]);
 	const args = tokens.slice(1);
 	const lower = args.map((a) => a.toLowerCase());
+	const script = inlineScript(bin, args);
+	if (script && depth < MAX_DEPTH) {
+		const inner = classifyList(parseShell(script.text, script.dialect), ctx, depth + 1);
+		if (inner.risky) return inner;
+	}
+	for (const target of cmd.writes) {
+		if (DISCARD.test(target)) continue;
+		const write = classifyWrite(target, ctx);
+		if (write.risky) return write;
+	}
 	if (bin === "git") return classifyGit(lower);
 	const install = classifyInstall(bin, lower);
 	if (install.risky) return install;
@@ -15357,44 +16349,51 @@ function classifySimple(simple, ctx) {
 		const targets = args.filter((a) => !a.startsWith("-") && !/^\/[a-z]$/i.test(a));
 		for (const target of targets) {
 			if (target === "*" || /^[\\/]$/.test(target) || /^[a-z]:[\\/]?$/i.test(target)) return risky("outside_worktree", `Deletes ${target}`);
-			if (!isInWorkspace(target, ctx)) return risky("outside_worktree", `Deletes ${target}, outside the worktree`);
+			if (!isWritable(target, ctx)) return risky("outside_worktree", `Deletes ${target}, outside the worktree`);
 		}
 	}
-	for (const m of simple.matchAll(/(?:^|[^0-9&])>>?\s*("[^"]+"|'[^']+'|[^\s;&|]+)/g)) {
-		const target = m[1] ?? "";
-		if (/^(\/dev\/null|nul|\$null)$/i.test(target) || /^&\d$/.test(target)) continue;
-		if (!isInWorkspace(target, ctx)) return risky("outside_worktree", `Writes ${target}, outside the worktree`);
-		if (isSecretPath(target)) return risky("secrets", `Writes the secrets file ${target}`);
+	const dest = copyDestination(bin, args);
+	if (dest) {
+		const write = classifyWrite(dest, ctx);
+		if (write.risky) return write;
 	}
-	if ([
-		"cp",
-		"mv",
-		"copy",
-		"move",
-		"copy-item",
-		"move-item",
-		"xcopy",
-		"robocopy",
-		"tee",
-		"set-content",
-		"out-file",
-		"add-content"
-	].includes(bin)) {
-		const positional = args.filter((a) => !a.startsWith("-") && !/^\/[a-z]+$/i.test(a));
-		const dest = [
-			"tee",
-			"set-content",
-			"out-file",
-			"add-content"
-		].includes(bin) ? positional[0] : positional.at(-1);
-		if (dest && !isInWorkspace(dest, ctx)) return risky("outside_worktree", `Writes ${dest}, outside the worktree`);
-	}
-	const secret = args.find((a) => isSecretPath(a.replace(/^-+[a-z-]*=/i, "")));
+	const secret = args.find((a) => {
+		const value = asPath(a);
+		return value !== void 0 && isSecretPath(value);
+	});
 	if (secret) return risky("secrets", `Accesses the secrets file ${secret}`);
 	const listsEnvDrive = /^(get-childitem|gci|ls|dir)$/.test(bin) && lower.some((a) => a.startsWith("env:"));
 	if (bin === "printenv" || listsEnvDrive) return risky("secrets", "Dumps environment variables");
 	return SAFE;
 }
+const COPIES = [
+	"cp",
+	"mv",
+	"copy",
+	"move",
+	"copy-item",
+	"move-item",
+	"xcopy",
+	"robocopy"
+];
+const WRITERS = [
+	"tee",
+	"set-content",
+	"out-file",
+	"add-content"
+];
+/** Where a copy, move or file-writing command writes. */
+function copyDestination(bin, args) {
+	if (!COPIES.includes(bin) && !WRITERS.includes(bin)) return void 0;
+	const named = WRITERS.includes(bin) ? namedArg(args, [
+		"-path",
+		"-filepath",
+		"-literalpath"
+	]) : namedArg(args, ["-destination"]);
+	if (named) return named;
+	const positional = args.filter((a) => !a.startsWith("-") && !/^\/[a-z]+$/i.test(a));
+	return WRITERS.includes(bin) ? positional[0] : positional.at(-1);
+}
 function classifyGit(args) {
 	let i = 0;
 	while (i < args.length && args[i]?.startsWith("-")) i += args[i] === "-c" || args[i] === "-C" ? 2 : 1;
@@ -15471,11 +16470,16 @@ function classifyInstall(bin, args) {
 	if (bin === "install-module" || bin === "install-package") return risky("other", `Installs a system-wide module (${bin})`);
 	return SAFE;
 }
-/** Classify a file write/edit. */
+/**
+* Classify a file write/edit. The worktree, extra roots and OS temp are fine; secrets ask. A
+* secrets file in temp counts as outside the worktree, so Full autonomy (which only asks for
+* writes outside the worktree) still asks for it.
+*/
 function classifyWrite(target, ctx) {
-	if (!isInWorkspace(target, ctx)) return risky("outside_worktree", `Writes ${target}, outside the worktree`);
-	if (isSecretPath(target)) return risky("secrets", `Writes the secrets file ${target}`);
-	return SAFE;
+	if (!isWritable(target, ctx)) return risky("outside_worktree", `Writes ${target}, outside the worktree`);
+	if (!isSecretPath(target)) return SAFE;
+	if (!isInWorkspace(target, ctx)) return risky("outside_worktree", `Writes the secrets file ${target} in the temp directory`);
+	return risky("secrets", `Writes the secrets file ${target}`);
 }
 /** Classify a file read or search. Reads anywhere are fine except credential files. */
 function classifyRead(target, _ctx) {
@@ -15496,130 +16500,6 @@ function classifyFetch(url, ctx) {
 		return rule.startsWith("*.") ? host.endsWith(rule.slice(1)) : host === rule;
 	}) ? SAFE : risky("network", `Fetches ${host}, which is not on the allowed host list`);
 }
-// ../../packages/providers/src/policy/read-only.ts
-/**
-* Read-only sessions (the orchestrator and PMs, §11.2) may inspect a repository but never
-* change it. This allowlist decides which shell commands they may run: commands that only
-* read, with no output redirection and no command substitution. Anything else is denied.
-*/
-/** Programs that only read (or print). */
-const READ_ONLY_BINS = /* @__PURE__ */ new Set([
-	"ls",
-	"dir",
-	"cat",
-	"type",
-	"head",
-	"tail",
-	"less",
-	"more",
-	"wc",
-	"grep",
-	"egrep",
-	"fgrep",
-	"rg",
-	"find",
-	"fd",
-	"tree",
-	"pwd",
-	"echo",
-	"printf",
-	"which",
-	"where",
-	"whoami",
-	"date",
-	"stat",
-	"file",
-	"du",
-	"df",
-	"sort",
-	"uniq",
-	"cut",
-	"diff",
-	"jq",
-	"basename",
-	"dirname",
-	"realpath",
-	"true",
-	"get-childitem",
-	"gci",
-	"get-content",
-	"gc",
-	"get-item",
-	"gi",
-	"get-location",
-	"gl",
-	"select-string",
-	"sls",
-	"measure-object",
-	"test-path",
-	"resolve-path",
-	"write-output",
-	"write-host",
-	"select-object",
-	"where-object",
-	"format-list",
-	"format-table",
-	"out-string",
-	"sort-object",
-	"gh"
-]);
-/** Git subcommands that never change the repository. */
-const READ_ONLY_GIT = /* @__PURE__ */ new Set([
-	"status",
-	"log",
-	"show",
-	"diff",
-	"blame",
-	"grep",
-	"ls-files",
-	"ls-tree",
-	"rev-parse",
-	"rev-list",
-	"describe",
-	"shortlog",
-	"cat-file",
-	"remote",
-	"branch",
-	"tag",
-	"config",
-	"reflog",
-	"merge-base",
-	"name-rev",
-	"for-each-ref",
-	"worktree"
-]);
-/** `gh` subcommand verbs that only read. */
-const READ_ONLY_GH = /* @__PURE__ */ new Set([
-	"view",
-	"list",
-	"status",
-	"diff",
-	"checks"
-]);
-const bin = (token) => (token ?? "").replace(/\\/g, "/").split("/").pop()?.toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/, "") ?? "";
-/** Why a command is refused in a read-only session, or undefined when it may run. */
-function readOnlyCommandDenial(command) {
-	if (/\$\(|`|<\(|>\(/.test(command)) return "Command substitution is not allowed in a read-only session";
-	for (const simple of splitCommands(command)) {
-		if (/(^|[^0-9&<])>>?(?!\s*(&\d|\/dev\/null|nul\b|\$null))/i.test(simple)) return "Writing files is not allowed in a read-only session";
-		const tokens = tokenize(simple);
-		const name = bin(tokens[0]);
-		const args = tokens.slice(1).map((a) => a.toLowerCase());
-		if (name === "git") {
-			const sub = args.find((a) => !a.startsWith("-"));
-			if (!sub || !READ_ONLY_GIT.has(sub)) return `git ${sub ?? ""} may change the repository`;
-			if ((sub === "branch" || sub === "tag" || sub === "remote" || sub === "worktree") && args.some((a) => /^-(d|D|m|M|f|-delete|-move|-force)$/.test(a) || a === "add")) return `git ${sub} with these options changes the repository`;
-			if (sub === "config" && !args.some((a) => a === "--get" || a === "--list" || a === "-l")) return "Only reading git config is allowed";
-			continue;
-		}
-		if (name === "gh") {
-			if (!args.some((a) => READ_ONLY_GH.has(a)) || args.includes("api")) return "Only read-only gh commands are allowed (view, list, status, diff, checks)";
-			continue;
-		}
-		if (name === "find" && args.some((a) => a === "-delete" || a === "-exec" || a === "-execdir")) return "find with -delete or -exec is not allowed in a read-only session";
-		if (!READ_ONLY_BINS.has(name)) return `${name || "This command"} is not on the read-only allowlist`;
-	}
-}
 // ../../packages/providers/src/claude/tools.ts
 /** Claude tools that are not rendered as `tool_call` items. */
 const SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
@@ -15818,7 +16698,13 @@ function completeToolCall(item, result) {
 }
 /** Risk of a Claude tool call under the `auto` policy (§11.2). */
 function assessClaudeTool(name, input, ctx) {
-	if (COMMAND_TOOLS.has(name)) return classifyCommand(str(input, "command") ?? "", ctx);
+	if (COMMAND_TOOLS.has(name)) {
+		const shell = name === "PowerShell" ? "powershell" : "posix";
+		return classifyCommand(str(input, "command") ?? "", {
+			...ctx,
+			shell
+		});
+	}
 	if (EDIT_TOOLS.has(name)) return classifyWrite(editPath(input), ctx);
 	if (name === "Read") return classifyRead(str(input, "file_path") ?? "", ctx);
 	if (name === "Grep" || name === "Glob") {
@@ -15855,7 +16741,8 @@ function approvalTitle(name, input) {
 * Native permission mode per autonomy level (§11.2):
 * - supervised -> `default`, and every edit/command is forced to ask via a PreToolUse hook
 * - auto       -> `acceptEdits`, plus the risky-action classifier
-* - full       -> `bypassPermissions`, asking only for writes outside the worktree
+* - full       -> `bypassPermissions`, asking only for writes outside the worktree (the OS
+*                 temp directory counts as inside, except for secrets files there)
 * Plan mode overrides all of them with `plan`.
 */
 function permissionModeFor(autonomy, planMode) {
@@ -15879,6 +16766,13 @@ var ClaudePolicy = class {
 		this.ctx = ctx;
 		this.readOnly = readOnly;
 	}
+	get level() {
+		return this.autonomy;
+	}
+	/** Switch the level; the next `gate()` uses it. `allow_session` decisions are kept. */
+	setAutonomy(level) {
+		this.autonomy = level;
+	}
 	/** Why a call is refused outright (read-only sessions), or undefined. */
 	denial(toolName, input) {
 		if (!this.readOnly) return void 0;
@@ -15888,7 +16782,11 @@ var ClaudePolicy = class {
 			return reason ? `This session is read-only: ${reason}.` : void 0;
 		}
 	}
-	gate(toolName, input) {
+	/**
+	* Decide one tool call. `dir` is the shell's current directory as Claude reports it (an
+	* earlier `cd` persists between Bash calls); relative paths resolve from it.
+	*/
+	gate(toolName, input, dir) {
 		if (toolName === "AskUserQuestion") return {
 			ask: true,
 			action: "other",
@@ -15900,7 +16798,10 @@ var ClaudePolicy = class {
 			reason: "The agent finished planning"
 		};
 		if (this.sessionAllow.has(this.key(toolName, input))) return { ask: false };
-		const risk = assessClaudeTool(toolName, input, this.ctx);
+		const risk = assessClaudeTool(toolName, input, dir ? {
+			...this.ctx,
+			dir
+		} : this.ctx);
 		if (this.autonomy === "supervised") {
 			if (risk.risky) return {
 				ask: true,
@@ -15926,8 +16827,8 @@ var ClaudePolicy = class {
 	* Whether a `canUseTool` call (Claude's own permission prompt) needs the user. In supervised
 	* mode everything Claude asks about goes to the user; otherwise only gated calls do.
 	*/
-	needsUser(toolName, input) {
-		const gate = this.gate(toolName, input);
+	needsUser(toolName, input, dir) {
+		const gate = this.gate(toolName, input, dir);
 		if (gate.ask || this.autonomy !== "supervised") return gate;
 		if (this.sessionAllow.has(this.key(toolName, input))) return gate;
 		return {
@@ -16063,6 +16964,83 @@ function toSdkUserMessage(input) {
 		parent_tool_use_id: null
 	};
 }
+/** The SDK's model rows as CodeDen models. The first row is Claude Code's default. */
+function toModelInfos(models) {
+	return models.map((m, i) => ({
+		id: m.value,
+		label: m.displayName || m.value,
+		...m.description ? { description: m.description } : {},
+		efforts: m.supportedEffortLevels ?? [],
+		...i === 0 ? { isDefault: true } : {}
+	}));
+}
+/**
+* List Claude Code's models without a turn. `query()` with a streaming prompt that never
+* yields starts the CLI and sends only the `initialize` control request, whose answer carries
+* the model list (`supportedModels()`); no user message is sent, so no model request is made.
+* Nothing from the user's or a project's settings is loaded (no hooks run), nothing is
+* persisted, and the CLI is closed as soon as the list arrives or `timeoutMs` passes.
+* Rejects on timeout or when the CLI fails to start.
+*/
+async function listClaudeModels(query, executable, opts = {}) {
+	const timeoutMs = opts.timeoutMs ?? 3e4;
+	const abortController = new AbortController();
+	const stopped = new Promise((resolve) => abortController.signal.addEventListener("abort", () => resolve(), { once: true }));
+	const idle = () => ({ [Symbol.asyncIterator]: () => ({ next: async () => {
+		await stopped;
+		return {
+			done: true,
+			value: void 0
+		};
+	} }) });
+	let q;
+	let timer;
+	try {
+		q = query({
+			prompt: idle(),
+			options: {
+				...executableOptions(executable),
+				cwd: tmpdir(),
+				settingSources: [],
+				persistSession: false,
+				tools: [],
+				mcpServers: {},
+				strictMcpConfig: true,
+				env: claudeEnv(void 0),
+				abortController
+			}
+		});
+		const stream = q;
+		(async () => {
+			for await (const _message of stream);
+		})().catch(() => void 0);
+		const timeout = new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`Claude Code did not list its models within ${timeoutMs}ms`)), timeoutMs);
+		});
+		return toModelInfos(await Promise.race([q.supportedModels(), timeout]));
+	} finally {
+		clearTimeout(timer);
+		abortController.abort();
+		try {
+			q?.close();
+		} catch {}
+	}
+}
+// ../../packages/providers/src/utility.ts
+/** Abort signal that fires on the caller's signal or after `timeoutMs`. */
+function oneShotSignal(request) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(/* @__PURE__ */ new Error("Utility model timed out")), request.timeoutMs ?? 6e4);
+	const onAbort = () => controller.abort(request.signal?.reason);
+	request.signal?.addEventListener("abort", onAbort, { once: true });
+	return {
+		signal: controller.signal,
+		dispose: () => {
+			clearTimeout(timer);
+			request.signal?.removeEventListener("abort", onAbort);
+		}
+	};
+}
 // ../../packages/providers/src/util/install-lock.ts
 function isAlive$1(pid) {
 	try {
@@ -16196,6 +17174,163 @@ function npmFailure(output) {
 	if (summary) return summary;
 	return output.trim().split(/\r?\n/).slice(-3).join(" ").slice(0, 500);
 }
+// ../../packages/providers/src/util/tar.ts
+const BLOCK = 512;
+/**
+* Extract a gzipped tarball (an npm package) into `dest`, dropping the first `strip` path
+* components (`package/` in npm tarballs). Only regular files and directories are written;
+* links and devices are skipped. Entries that would land outside `dest` (absolute paths,
+* `..`) fail the whole extraction. Returns the relative paths written.
+*/
+function extractTarGz(archive, dest, opts = {}) {
+	const tar = gunzipSync(archive);
+	const root = path.resolve(dest);
+	const written = [];
+	let offset = 0;
+	let longName = null;
+	let paxPath = null;
+	while (offset + BLOCK <= tar.length) {
+		const header = tar.subarray(offset, offset + BLOCK);
+		if (header.every((b) => b === 0)) break;
+		if (!checksumOk(header)) throw new Error("Corrupt tarball (bad header checksum)");
+		const size = readOctal(header, 124, 12);
+		const type = String.fromCharCode(header[156] ?? 0);
+		const dataStart = offset + BLOCK;
+		const data = tar.subarray(dataStart, dataStart + size);
+		if (data.length < size) throw new Error("Corrupt tarball (truncated entry)");
+		offset = dataStart + Math.ceil(size / BLOCK) * BLOCK;
+		if (type === "L") {
+			longName = cString(data);
+			continue;
+		}
+		if (type === "x") {
+			paxPath = paxRecord(data, "path");
+			continue;
+		}
+		if (type === "g") continue;
+		const name = paxPath ?? longName ?? headerName(header);
+		longName = null;
+		paxPath = null;
+		if (!(type === "0" || type === "\0" || type === "7") && type !== "5") continue;
+		const rel = stripComponents(name, opts.strip ?? 0);
+		if (!rel) continue;
+		const target = path.resolve(root, rel);
+		if (target !== root && !target.startsWith(root + path.sep)) throw new Error(`Unsafe path in tarball: ${name}`);
+		if (type === "5") {
+			mkdirSync(target, { recursive: true });
+			continue;
+		}
+		mkdirSync(path.dirname(target), { recursive: true });
+		writeFileSync(target, data);
+		written.push(rel);
+	}
+	return written;
+}
+function stripComponents(name, strip) {
+	const parts = name.replace(/\\/g, "/").split("/").filter(Boolean);
+	if (name.startsWith("/") || /^[A-Za-z]:/.test(name)) throw new Error(`Unsafe path in tarball: ${name}`);
+	if (parts.includes("..")) throw new Error(`Unsafe path in tarball: ${name}`);
+	const rest = parts.slice(strip).filter((p) => p !== ".");
+	return rest.length ? rest.join("/") : null;
+}
+function headerName(header) {
+	const name = cString(header.subarray(0, 100));
+	if (!header.subarray(257, 263).toString("latin1").startsWith("ustar")) return name;
+	const prefix = cString(header.subarray(345, 500));
+	return prefix ? `${prefix}/${name}` : name;
+}
+function cString(buf) {
+	const end = buf.indexOf(0);
+	return buf.subarray(0, end === -1 ? buf.length : end).toString("utf8");
+}
+function readOctal(buf, start, length) {
+	const text = cString(buf.subarray(start, start + length)).trim();
+	const value = text ? Number.parseInt(text, 8) : 0;
+	if (!Number.isFinite(value) || value < 0) throw new Error("Corrupt tarball (bad size)");
+	return value;
+}
+function checksumOk(header) {
+	const expected = readOctal(header, 148, 8);
+	let sum = 0;
+	for (let i = 0; i < BLOCK; i++) sum += i >= 148 && i < 156 ? 32 : header[i] ?? 0;
+	return sum === expected;
+}
+/** One `key=value` record from a pax extended header (`<len> <key>=<value>\n` lines). */
+function paxRecord(data, key) {
+	let i = 0;
+	while (i < data.length) {
+		const space = data.indexOf(32, i);
+		if (space === -1) break;
+		const len = Number.parseInt(data.subarray(i, space).toString("latin1"), 10);
+		if (!Number.isFinite(len) || len <= 0) break;
+		const record = data.subarray(space + 1, i + len - 1).toString("utf8");
+		const eq = record.indexOf("=");
+		if (eq !== -1 && record.slice(0, eq) === key) return record.slice(eq + 1);
+		i += len;
+	}
+	return null;
+}
+/** The registry to use: an explicit one, npm's configured one, or the public registry. */
+function registryUrl(explicit, env = process.env) {
+	return (explicit ?? env.npm_config_registry ?? "https://registry.npmjs.org").replace(/\/+$/, "");
+}
+/**
+* Install one exact package version straight from an npm registry, without npm (the desktop
+* app has no npm, §17): read the version manifest, download the tarball, check it against the
+* manifest's `dist.integrity` (sha512), extract it into a staging folder and move it into
+* `<nodeModules>/<name>`. Dependencies are not installed: use it only for packages whose
+* runtime needs none (the Claude Agent SDK, installed without optional and peer deps).
+*/
+async function installFromRegistry(opts) {
+	const doFetch = opts.fetch ?? fetch;
+	const progress = opts.onProgress ?? (() => {});
+	const signal = AbortSignal.timeout(opts.timeoutMs ?? 3e5);
+	const base = registryUrl(opts.registry);
+	const spec = `${opts.name}@${opts.version}`;
+	const manifestUrl = `${base}/${opts.name.replace("/", "%2f")}/${encodeURIComponent(opts.version)}`;
+	progress(`Looking up ${spec}`);
+	const res = await doFetch(manifestUrl, {
+		headers: { accept: "application/json" },
+		signal
+	});
+	if (!res.ok) throw new Error(`the registry answered ${res.status} for ${spec}`);
+	const manifest = await res.json();
+	if (manifest.name !== opts.name || manifest.version !== opts.version) throw new Error(`the registry returned the wrong package for ${spec}`);
+	const tarball = manifest.dist?.tarball;
+	const integrity = manifest.dist?.integrity;
+	if (typeof tarball !== "string" || !/^https?:\/\//.test(tarball)) throw new Error(`${spec} has no tarball URL`);
+	const expected = typeof integrity === "string" ? sha512Of(integrity) : null;
+	if (!expected) throw new Error(`${spec} has no sha512 integrity to check the download against`);
+	progress(`Downloading ${spec}`);
+	const download = await doFetch(tarball, { signal });
+	if (!download.ok) throw new Error(`downloading ${spec} failed (${download.status})`);
+	const archive = Buffer.from(await download.arrayBuffer());
+	if (createHash("sha512").update(archive).digest("base64") !== expected) throw new Error(`the download of ${spec} does not match its published integrity (sha512)`);
+	progress(`Unpacking ${spec}`);
+	const target = path.join(opts.nodeModules, ...opts.name.split("/"));
+	const staging = `${target}.staging-${randomBytes(4).toString("hex")}`;
+	try {
+		mkdirSync(staging, { recursive: true });
+		extractTarGz(archive, staging, { strip: 1 });
+		rmSync(target, {
+			recursive: true,
+			force: true,
+			maxRetries: 3
+		});
+		renameSync(staging, target);
+	} finally {
+		rmSync(staging, {
+			recursive: true,
+			force: true,
+			maxRetries: 2
+		});
+	}
+}
+/** The base64 sha512 digest in a Subresource Integrity string (`sha512-<base64> ...`). */
+function sha512Of(integrity) {
+	for (const part of integrity.trim().split(/\s+/)) if (part.startsWith("sha512-")) return part.slice(7).replace(/\?.*$/, "");
+	return null;
+}
 // ../../packages/providers/src/claude/sdk/install.ts
 /** The Claude Agent SDK package. */
 const CLAUDE_SDK_PACKAGE = "@anthropic-ai/claude-agent-sdk";
@@ -16222,6 +17357,18 @@ async function importClaudeSdkFrom(depsDir) {
 	if (typeof sdk.query !== "function") throw new Error(`${entry} does not export query()`);
 	return sdk;
 }
+/** Which installer `installClaudeSdk` uses, and the npm to run when it is npm. */
+function chooseInstaller(opts, env = process.env) {
+	const wanted = opts.installer ?? env.CODEDEN_DEPS_INSTALLER;
+	if (wanted === "registry") return { kind: "registry" };
+	const npm = opts.npm ?? resolveNpm(env);
+	if (npm) return {
+		kind: "npm",
+		npm
+	};
+	if (wanted === "npm") throw new Error("npm was not found; install Node.js with npm and try again");
+	return { kind: "registry" };
+}
 const inflight = /* @__PURE__ */ new Map();
 /**
 * Install the tested SDK version into `depsDir` with npm, skipping its optional platform
@@ -16249,25 +17396,37 @@ async function runInstall(opts) {
 			name: "codeden-deps",
 			private: true
 		}, null, 2)}\n`);
-		const npm = opts.npm ?? resolveNpm();
-		if (!npm) throw new Error("npm was not found; install Node.js with npm and try again");
+		const installer = chooseInstaller(opts);
 		const spec = `${CLAUDE_SDK_PACKAGE}@${CLAUDE_SDK_VERSION}`;
-		progress(`Downloading ${spec} from npm`);
-		await runNpm(npm, [
-			"install",
-			spec,
-			"--omit=optional",
-			"--omit=peer",
-			"--no-audit",
-			"--no-fund",
-			"--save-exact",
-			"--prefix",
-			opts.depsDir
-		], {
-			cwd: opts.depsDir,
-			timeoutMs: opts.timeoutMs ?? 3e5,
-			onLine: progress
-		});
+		if (installer.kind === "registry") {
+			await installFromRegistry({
+				name: CLAUDE_SDK_PACKAGE,
+				version: CLAUDE_SDK_VERSION,
+				nodeModules: join(opts.depsDir, "node_modules"),
+				registry: opts.registry,
+				fetch: opts.fetch,
+				timeoutMs: opts.timeoutMs,
+				onProgress: progress
+			});
+			recordDependency(manifest, CLAUDE_SDK_PACKAGE, CLAUDE_SDK_VERSION);
+		} else {
+			progress(`Downloading ${spec} from npm`);
+			await runNpm(installer.npm, [
+				"install",
+				spec,
+				"--omit=optional",
+				"--omit=peer",
+				"--no-audit",
+				"--no-fund",
+				"--save-exact",
+				"--prefix",
+				opts.depsDir
+			], {
+				cwd: opts.depsDir,
+				timeoutMs: opts.timeoutMs ?? 3e5,
+				onLine: progress
+			});
+		}
 		if (installedClaudeSdkVersion(opts.depsDir) !== "0.3.318") throw new Error(`npm finished but ${spec} is not in ${opts.depsDir}`);
 		progress("Checking the install");
 		await importClaudeSdkFrom(opts.depsDir);
@@ -16276,6 +17435,19 @@ async function runInstall(opts) {
 		release();
 	}
 }
+/** Note the installed package in `<deps>/package.json`, as `npm install --save-exact` would. */
+function recordDependency(manifest, name, version) {
+	let pkg = {};
+	try {
+		pkg = JSON.parse(readFileSync(manifest, "utf8"));
+	} catch {}
+	const deps = typeof pkg.dependencies === "object" && pkg.dependencies || {};
+	pkg.dependencies = {
+		...deps,
+		[name]: version
+	};
+	writeFileSync(manifest, `${JSON.stringify(pkg, null, 2)}\n`);
+}
 // ../../packages/providers/src/claude/sdk/load.ts
 /** Where the SDK comes from in this process. `CODEDEN_CLAUDE_SDK=deps|workspace` overrides. */
 function claudeSdkSource() {
@@ -16293,6 +17465,15 @@ function configureClaudeSdk(opts) {
 	loaded = void 0;
 }
 /**
+* True when the SDK can be loaded without installing it first: from the workspace, already
+* loaded, or already installed in the deps folder. Background work (model discovery) checks
+* this so it never triggers the on-demand install by itself.
+*/
+function claudeSdkReady() {
+	if (claudeSdkSource() === "workspace" || loaded) return true;
+	return depsDir !== void 0 && isClaudeSdkInstalled(depsDir);
+}
+/**
 * The Claude Agent SDK module, installed first when needed. Failures are not cached, so the
 * next session retries the install.
 */
@@ -17170,6 +18351,10 @@ var ClaudeSession = class {
 	abort;
 	stderrTail = "";
 	closed = false;
+	/** The shell's current directory from the latest PreToolUse hook, for relative paths. */
+	shellDir;
+	/** Current autonomy: a query restarted after the CLI exits starts with it. */
+	autonomy;
 	constructor(opts, config) {
 		this.opts = opts;
 		this.config = config;
@@ -17180,6 +18365,7 @@ var ClaudeSession = class {
 			emit
 		});
 		this.broker = new ApprovalBroker(emit);
+		this.autonomy = opts.autonomy;
 		this.policy = new ClaudePolicy(opts.autonomy, {
 			cwd: opts.cwd,
 			extraRoots: opts.additionalDirectories
@@ -17190,6 +18376,26 @@ var ClaudeSession = class {
 	resumeToken() {
 		return this.mapper.resumeToken ?? this.opts.resumeToken;
 	}
+	/**
+	* Switch autonomy. The policy changes at once, so the next tool call (even in a running
+	* turn) follows the new level; approvals already waiting stay waiting. The CLI's own
+	* permission mode follows where it can (`setPermissionMode`); when the CLI refuses a mode
+	* (`bypassPermissions` needs a launch flag), it keeps `acceptEdits` and CodeDen's policy
+	* decides through the PreToolUse hook and `canUseTool` either way. Plan mode is left alone.
+	*/
+	async setAutonomy(level) {
+		this.autonomy = level;
+		this.policy.setAutonomy(level);
+		const q = this.q;
+		if (!q || this.opts.planMode) return;
+		const mode = permissionModeFor(level, false);
+		try {
+			await q.setPermissionMode(mode);
+		} catch {
+			if (mode !== "bypassPermissions") return;
+			await q.setPermissionMode("acceptEdits").catch(() => {});
+		}
+	}
 	/** Model/effort for the following turns, applied live through the SDK's streaming query. */
 	async configure(change) {
 		const q = this.q;
@@ -17263,13 +18469,15 @@ var ClaudeSession = class {
 		const preToolUse = async (hookInput) => {
 			const name = str(hookInput, "tool_name") ?? "";
 			const toolInput = hookInput.tool_input ?? {};
+			const cwd = str(hookInput, "cwd");
+			if (cwd && (path.isAbsolute(cwd) || path.win32.isAbsolute(cwd))) this.shellDir = cwd;
 			const denied = this.policy.denial(name, toolInput);
 			if (denied) return { hookSpecificOutput: {
 				hookEventName: "PreToolUse",
 				permissionDecision: "deny",
 				permissionDecisionReason: denied
 			} };
-			const gate = this.policy.gate(name, toolInput);
+			const gate = this.policy.gate(name, toolInput, this.shellDir);
 			if (!gate.ask) return {};
 			return { hookSpecificOutput: {
 				hookEventName: "PreToolUse",
@@ -17280,7 +18488,10 @@ var ClaudeSession = class {
 		const q = this.config.query({
 			prompt: prompts,
 			options: buildQueryOptions({
-				session: this.opts,
+				session: {
+					...this.opts,
+					autonomy: this.autonomy
+				},
 				executable: this.config.executable,
 				canUseTool: this.canUseTool,
 				hooks: { PreToolUse: [{ hooks: [preToolUse] }] },
@@ -17331,7 +18542,7 @@ var ClaudeSession = class {
 			behavior: "deny",
 			message: denied
 		};
-		const gate = this.policy.needsUser(toolName, input);
+		const gate = this.policy.needsUser(toolName, input, this.shellDir);
 		if (!gate.ask) return {
 			behavior: "allow",
 			updatedInput: input
@@ -17437,7 +18648,8 @@ const capabilities$2 = {
 	planMode: true,
 	reasoningEffort: true,
 	mcp: true,
-	skills: true
+	skills: true,
+	liveAutonomy: true
 };
 const EFFORTS = [
 	"low",
@@ -17446,8 +18658,8 @@ const EFFORTS = [
 	"xhigh",
 	"max"
 ];
-/** Fallback model list (CLI aliases) until a session reports the real one. */
-const FALLBACK_MODELS$1 = [
+/** Fallback model list (CLI aliases) until discovery or a session reports the real one. */
+const FALLBACK_MODELS = [
 	{
 		id: "default",
 		label: "Default",
@@ -17476,7 +18688,8 @@ var ClaudeAdapter = class {
 	options;
 	id = CLAUDE_PROVIDER_ID;
 	displayName = "Claude Code";
-	modelList = FALLBACK_MODELS$1;
+	catalog = new ModelCatalog(FALLBACK_MODELS);
+	refreshing;
 	cachedExe;
 	constructor(options = {}) {
 		this.options = options;
@@ -17493,7 +18706,22 @@ var ClaudeAdapter = class {
 		return { ...capabilities$2 };
 	}
 	models() {
-		return this.modelList.map((m) => ({ ...m }));
+		return this.catalog.list();
+	}
+	onModelsChanged(listener) {
+		return this.catalog.subscribe(listener);
+	}
+	/**
+	* Load Claude Code's model list without a turn (`listClaudeModels`: the CLI starts and
+	* answers `initialize`; no message is sent). Concurrent calls share one discovery; a failed
+	* discovery keeps the last list. Skipped when Claude Code is not installed, or when the SDK
+	* would have to be installed first. Never throws.
+	*/
+	refreshModels() {
+		this.refreshing ??= this.discoverModels().finally(() => {
+			this.refreshing = void 0;
+		});
+		return this.refreshing;
 	}
 	async openSession(opts) {
 		const executable = this.executable();
@@ -17503,20 +18731,24 @@ var ClaudeAdapter = class {
 			executable,
 			query,
 			onModels: (models) => {
-				if (!models.length) return;
-				this.modelList = models.map((m, i) => ({
-					id: m.value,
-					label: m.displayName || m.value,
-					...m.description ? { description: m.description } : {},
-					efforts: m.supportedEffortLevels ?? [],
-					...i === 0 ? { isDefault: true } : {}
-				}));
+				if (models.length) this.catalog.set(toModelInfos(models));
 			}
 		});
 	}
 	utilityModel() {
 		return new ClaudeUtilityModel(() => this.executable());
 	}
+	async discoverModels() {
+		const exe = this.executable();
+		if (!exe) return;
+		const load = this.options.loadSdk ?? (claudeSdkReady() ? loadClaudeSdk : void 0);
+		if (!load) return;
+		try {
+			const { query } = await load();
+			const models = await listClaudeModels(query, exe, { timeoutMs: this.options.modelListTimeoutMs });
+			if (models.length) this.catalog.set(models);
+		} catch {}
+	}
 };
 // ../../packages/providers/src/codex/detect.ts
 /** Oldest Codex version whose app-server protocol matches the generated types. */
@@ -17766,7 +18998,10 @@ const OPT_OUT = [
 	"fuzzyFileSearch/sessionUpdated",
 	"fuzzyFileSearch/sessionCompleted"
 ];
-/** Spawn `codex app-server` (stdio) and complete the `initialize` handshake. */
+/**
+* Spawn `codex app-server` (stdio) and complete the `initialize` handshake. Aborting `signal`
+* stops the process at any point, including during the handshake.
+*/
 async function startAppServer(exe, handlers, opts = {}) {
 	const rpc = new CodexRpc(spawnResolved(exe, ["app-server"], {
 		stdio: [
@@ -17780,6 +19015,10 @@ async function startAppServer(exe, handlers, opts = {}) {
 		},
 		...opts.cwd ? { cwd: opts.cwd } : {}
 	}), handlers);
+	if (opts.signal) {
+		if (opts.signal.aborted) rpc.close();
+		else opts.signal.addEventListener("abort", () => void rpc.close(), { once: true });
+	}
 	const params = {
 		clientInfo: {
 			name: "codeden",
@@ -17804,6 +19043,69 @@ async function startAppServer(exe, handlers, opts = {}) {
 		throw error;
 	}
 }
+/** `model/list` pages are followed up to this many (a guard against a looping cursor). */
+const MAX_PAGES = 20;
+/**
+* Map an app-server `Model` to CodeDen's `ModelInfo`. The id is the model slug Codex accepts
+* in `thread/start` and `turn/start`. Efforts CodeDen does not know are dropped, and missing
+* fields (older app-servers) are tolerated.
+*/
+function modelInfoFromCodex(m) {
+	const efforts = (m.supportedReasoningEfforts ?? []).map((e) => e.reasoningEffort).filter((e) => ReasoningEffort.safeParse(e).success);
+	const defaultEffort = ReasoningEffort.safeParse(m.defaultReasoningEffort);
+	return {
+		id: m.model,
+		label: m.displayName || m.model,
+		...m.description ? { description: m.description } : {},
+		efforts,
+		...defaultEffort.success ? { defaultEffort: defaultEffort.data } : {},
+		...m.isDefault ? { isDefault: true } : {}
+	};
+}
+/** The models Codex shows in its own picker, as `ModelInfo`. */
+function visibleCodexModels(models) {
+	return models.filter((m) => !m.hidden && m.model).map(modelInfoFromCodex);
+}
+/**
+* Ask a short-lived `codex app-server` for its model list (`model/list`, every page). No
+* thread is started and no turn runs. Rejects on failure or after `timeoutMs`; the process
+* is stopped either way.
+*/
+async function listCodexModels(exe, opts = {}) {
+	const timeoutMs = opts.timeoutMs ?? 2e4;
+	const abort = new AbortController();
+	let timer;
+	const timeout = new Promise((_, reject) => {
+		timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`codex app-server did not list models within ${timeoutMs}ms`)), timeoutMs);
+	});
+	try {
+		return await Promise.race([fetchModels(exe, abort.signal), timeout]);
+	} finally {
+		clearTimeout(timer);
+		abort.abort();
+	}
+}
+async function fetchModels(exe, signal) {
+	const { rpc } = await startAppServer(exe, {
+		onNotification: () => {},
+		onRequest: async () => {
+			throw new Error("CodeDen's model discovery answers no requests");
+		},
+		onExit: () => {}
+	}, {
+		cwd: tmpdir(),
+		signal
+	});
+	const models = [];
+	let cursor = null;
+	for (let page = 0; page < MAX_PAGES; page += 1) {
+		const res = await rpc.request("model/list", cursor ? { cursor } : {});
+		models.push(...res.data ?? []);
+		cursor = res.nextCursor ?? null;
+		if (!cursor) break;
+	}
+	return visibleCodexModels(models);
+}
 /**
 * One-shot Codex call for the utility model: an ephemeral thread in a read-only sandbox with
 * approvals off, low reasoning effort, and no MCP servers. Returns the final agent message.
@@ -18001,10 +19303,11 @@ async function handleServerRequest(req, ac) {
 /**
 * Native sandbox + approval policy per autonomy level (§11.2):
 * - supervised -> `untrusted`: every command that isn't known-safe and every patch asks
-* - auto       -> workspace-write sandbox + `on-request`: the sandbox confines writes and
-*                 network; escaping it (outside the worktree, network, force pushes) asks
+* - auto       -> workspace-write sandbox + `on-request`: the sandbox confines writes (to the
+*                 worktree, extra roots and the OS temp directory) and network; escaping it
+*                 (outside the worktree, network, force pushes) asks
 * - full       -> workspace-write + `never`, with network on: no approvals, still confined
-*                 to the worktree
+*                 to the worktree, extra roots and temp
 */
 function codexPolicy(autonomy, readOnly = false) {
 	if (readOnly) return {
@@ -18029,13 +19332,41 @@ function codexPolicy(autonomy, readOnly = false) {
 	};
 }
 /**
+* Extra writable roots for the workspace-write sandbox: the session's additional directories,
+* plus the OS temp directories in `auto` and `full`, so writing a log or scratch file there
+* never needs an approval (§11.2).
+*/
+function codexWritableRoots(opts, tempRoots = osTempRoots()) {
+	const temp = opts.readOnly || opts.autonomy === "supervised" ? [] : tempRoots;
+	return [.../* @__PURE__ */ new Set([...opts.additionalDirectories, ...temp])];
+}
+/**
+* The `turn/start` sandbox override for an autonomy level: the same sandbox `thread/start`
+* configures, so a mid-session change applies from the next turn.
+*/
+function codexSandboxPolicy(opts, tempRoots = osTempRoots()) {
+	const { sandbox, networkAccess } = codexPolicy(opts.autonomy, opts.readOnly);
+	if (sandbox === "read-only") return {
+		type: "readOnly",
+		networkAccess
+	};
+	return {
+		type: "workspaceWrite",
+		writableRoots: codexWritableRoots(opts, tempRoots),
+		networkAccess,
+		excludeTmpdirEnvVar: false,
+		excludeSlashTmp: false
+	};
+}
+/**
 * Config overrides for `thread/start` / `thread/resume` (same semantics as `-c key=value`).
 * Sent over stdin as JSON, so MCP bearer tokens never appear on a command line.
 */
-function codexConfigOverrides(opts) {
+function codexConfigOverrides(opts, tempRoots = osTempRoots()) {
 	const { networkAccess } = codexPolicy(opts.autonomy, opts.readOnly);
 	const config = { "sandbox_workspace_write.network_access": networkAccess };
-	if (opts.additionalDirectories.length) config["sandbox_workspace_write.writable_roots"] = [...opts.additionalDirectories];
+	const roots = codexWritableRoots(opts, tempRoots);
+	if (roots.length) config["sandbox_workspace_write.writable_roots"] = roots;
 	for (const server of opts.mcpServers) Object.assign(config, mcpOverride(server));
 	return config;
 }
@@ -18690,10 +20021,14 @@ function rateLimits(snapshot) {
 	return { rateLimits: out };
 }
 // ../../packages/providers/src/codex/session.ts
-/** CodeDen effort -> Codex reasoning effort (Codex tops out at `xhigh`). */
-function codexEffort(effort) {
+/**
+* CodeDen effort -> Codex reasoning effort. `max` is sent only to models that list it
+* (`supported`); older models top out at `xhigh`.
+*/
+function codexEffort(effort, supported) {
 	if (!effort) return void 0;
-	return effort === "max" ? "xhigh" : effort;
+	if (effort !== "max") return effort;
+	return supported?.includes("max") ? "max" : "xhigh";
 }
 /**
 * A Codex session over `codex app-server` (§7.2): one app-server process and one thread per
@@ -18710,7 +20045,12 @@ var CodexSession = class {
 	turnPending = false;
 	/** Model/effort changes from `configure`, applied on every following turn. */
 	nextTurn = {};
+	/** Current autonomy; after `setAutonomy`, every following `turn/start` carries it. */
+	autonomy;
+	autonomyChanged = false;
 	closed = false;
+	/** The model the thread started with (the user's Codex config when none was chosen). */
+	threadModel;
 	filePaths = /* @__PURE__ */ new Map();
 	constructor(opts, config) {
 		this.opts = opts;
@@ -18722,6 +20062,7 @@ var CodexSession = class {
 		this.mapper = new CodexEventMapper(opts.sessionId, emit);
 		this.mapper.codexThreadId = opts.resumeToken;
 		this.broker = new ApprovalBroker(emit);
+		this.autonomy = opts.autonomy;
 	}
 	/** Start the app-server and the thread. Called by the adapter before returning the session. */
 	async start() {
@@ -18741,19 +20082,29 @@ var CodexSession = class {
 			...change
 		};
 	}
+	/**
+	* Autonomy from the next `turn/start` on, as approval-policy and sandbox overrides. A running
+	* turn keeps the policy it started with (the app-server fixes it per turn).
+	*/
+	async setAutonomy(level) {
+		this.autonomy = level;
+		this.autonomyChanged = true;
+	}
 	async send(input) {
 		if (this.closed) throw new ProviderSessionError("closed", "Session is closed");
 		if (this.turnPending || this.mapper.currentTurnId) throw new ProviderSessionError("turn_running", "A turn is already running");
 		this.turnPending = true;
 		try {
 			const rpc = await this.ensureServer();
-			const effort = codexEffort(this.nextTurn.effort !== void 0 ? this.nextTurn.effort ?? void 0 : this.opts.effort);
 			const model = await this.turnModel(rpc);
+			const inUse = model ?? explicitModel(this.opts.model) ?? this.threadModel;
+			const effort = codexEffort(this.nextTurn.effort !== void 0 ? this.nextTurn.effort ?? void 0 : this.opts.effort, inUse ? this.config.modelEfforts?.(inUse) : void 0);
 			const res = await rpc.request("turn/start", {
 				threadId: this.threadId(),
 				input: toCodexInput(input),
 				...effort ? { effort } : {},
-				...model !== void 0 ? { model } : {}
+				...model !== void 0 ? { model } : {},
+				...this.autonomyChanged ? this.policyOverride() : {}
 			});
 			this.mapper.beginTurn(res.turn.id);
 		} catch (error) {
@@ -18795,6 +20146,21 @@ var CodexSession = class {
 		this.events.close();
 		await this.rpc?.close();
 	}
+	/** Session options with the current autonomy (a restarted app-server resumes with it). */
+	currentOptions() {
+		return {
+			...this.opts,
+			autonomy: this.autonomy
+		};
+	}
+	/** `turn/start` overrides that carry the current autonomy (§11.2). */
+	policyOverride() {
+		const opts = this.currentOptions();
+		return {
+			approvalPolicy: codexPolicy(opts.autonomy, opts.readOnly).approvalPolicy,
+			sandboxPolicy: codexSandboxPolicy(opts)
+		};
+	}
 	threadId() {
 		const id = this.mapper.codexThreadId;
 		if (!id) throw new ProviderSessionError("not_started", "Codex thread is not started");
@@ -18828,12 +20194,13 @@ var CodexSession = class {
 			cwd: this.opts.cwd
 		});
 		this.rpc = rpc;
-		const { approvalPolicy, sandbox } = codexPolicy(this.opts.autonomy, this.opts.readOnly);
+		const opts = this.currentOptions();
+		const { approvalPolicy, sandbox } = codexPolicy(opts.autonomy, opts.readOnly);
 		const common = {
 			cwd: this.opts.cwd,
 			approvalPolicy,
 			sandbox,
-			config: codexConfigOverrides(this.opts),
+			config: codexConfigOverrides(opts),
 			...explicitModel(this.opts.model) ? { model: explicitModel(this.opts.model) } : {},
 			...this.opts.systemPrompt ? { developerInstructions: this.opts.systemPrompt } : {}
 		};
@@ -18860,6 +20227,7 @@ var CodexSession = class {
 		}
 		res ??= await rpc.request("thread/start", common);
 		this.mapper.codexThreadId = res.thread.id;
+		this.threadModel = res.model || void 0;
 		this.events.push({
 			type: "session.updated",
 			resumeToken: res.thread.id,
@@ -18940,40 +20308,38 @@ const capabilities$1 = {
 	planMode: false,
 	reasoningEffort: true,
 	mcp: true,
-	skills: true
+	skills: true,
+	liveAutonomy: false
 };
-const FALLBACK_MODELS = [{
-	id: "default",
-	label: "Default",
-	description: "The model configured in ~/.codex/config.toml",
-	efforts: [
-		"minimal",
-		"low",
-		"medium",
-		"high",
-		"xhigh"
-	],
-	isDefault: true
-}];
-/** Map an app-server `Model` to CodeDen's `ModelInfo`. */
-function modelInfoFromCodex(m) {
-	const efforts = m.supportedReasoningEfforts.map((e) => e.reasoningEffort).filter((e) => ReasoningEffort.safeParse(e).success);
-	const defaultEffort = ReasoningEffort.safeParse(m.defaultReasoningEffort);
-	return {
-		id: m.model,
-		label: m.displayName || m.model,
-		...m.description ? { description: m.description } : {},
-		efforts,
-		...defaultEffort.success ? { defaultEffort: defaultEffort.data } : {},
-		...m.isDefault ? { isDefault: true } : {}
-	};
+const CONFIGURED_MODEL = "The model configured in ~/.codex/config.toml";
+/**
+* Until Codex has listed its models, one entry that leaves the choice to the user's Codex
+* config. `note` says why the real list is missing when discovery failed.
+*/
+function fallbackModels(note) {
+	return [{
+		id: DEFAULT_MODEL_ID,
+		label: "Default",
+		description: note ? `${CONFIGURED_MODEL}. ${note}` : CONFIGURED_MODEL,
+		efforts: [
+			"minimal",
+			"low",
+			"medium",
+			"high",
+			"xhigh"
+		],
+		isDefault: true
+	}];
 }
 /** Codex through `codex app-server` JSON-RPC (§7.2). */
 var CodexAdapter = class {
 	options;
 	id = CODEX_PROVIDER_ID;
 	displayName = "Codex";
-	modelList = FALLBACK_MODELS;
+	catalog = new ModelCatalog(fallbackModels());
+	/** True once Codex reported a real model list (discovery or a session). */
+	listed = false;
+	refreshing;
 	cachedExe;
 	constructor(options = {}) {
 		this.options = options;
@@ -18990,7 +20356,20 @@ var CodexAdapter = class {
 		return { ...capabilities$1 };
 	}
 	models() {
-		return this.modelList.map((m) => ({ ...m }));
+		return this.catalog.list();
+	}
+	onModelsChanged(listener) {
+		return this.catalog.subscribe(listener);
+	}
+	/**
+	* Load Codex's model list through a short-lived `codex app-server` (`model/list`; no thread,
+	* no turn). Concurrent calls share one discovery. Never throws.
+	*/
+	refreshModels() {
+		this.refreshing ??= this.discoverModels().finally(() => {
+			this.refreshing = void 0;
+		});
+		return this.refreshing;
 	}
 	async openSession(opts) {
 		const executable = this.executable();
@@ -18998,9 +20377,10 @@ var CodexAdapter = class {
 		const session = new CodexSession(opts, {
 			executable,
 			onModels: (models) => {
-				const visible = models.filter((m) => !m.hidden).map(modelInfoFromCodex);
-				if (visible.length) this.modelList = visible;
-			}
+				const visible = visibleCodexModels(models);
+				if (visible.length) this.setModels(visible);
+			},
+			modelEfforts: (model) => this.catalog.list().find((m) => m.id === model)?.efforts
 		});
 		try {
 			await session.start();
@@ -19013,7 +20393,65 @@ var CodexAdapter = class {
 	utilityModel() {
 		return new CodexUtilityModel(() => this.executable());
 	}
+	async discoverModels() {
+		const exe = this.executable();
+		if (!exe) return;
+		try {
+			const models = await listCodexModels(exe, { timeoutMs: this.options.modelListTimeoutMs });
+			if (models.length) this.setModels(models);
+			else this.discoveryFailed("Codex listed no models.");
+		} catch (error) {
+			const reason = (error instanceof Error ? error.message : String(error)).slice(0, 200);
+			this.discoveryFailed(`Codex's model list could not be loaded: ${reason}`);
+		}
+	}
+	setModels(models) {
+		this.listed = true;
+		this.catalog.set(models);
+	}
+	/** Keep the last real list; without one, say why only the configured default is offered. */
+	discoveryFailed(note) {
+		if (!this.listed) this.catalog.set(fallbackModels(note));
+	}
+};
+// ../../packages/providers/src/fake/mcp-result.ts
+/** A long, unbroken token, like the ids, hashes and base64 blobs real tool results carry. */
+const blob = "c0de".repeat(12) + "d3n".repeat(60);
+/** Input of the scripted `[mcp]` tool call: an issue reference with a long unbroken URL. */
+const fakeMcpInput = {
+	issue: {
+		number: 3,
+		url: `https://github.com/codeden-e2e/demo-repo/issues/3?trace=${blob}`
+	},
+	priority: "low"
 };
+/**
+* Result text of the scripted `[mcp]` tool call: one compact line of JSON, several kilobytes
+* long, shaped like a triage result. Lets tests check that long tool output stays inside the
+* transcript column.
+*/
+function fakeMcpResult() {
+	const body = Array.from({ length: 12 }, (_, i) => `Step ${i + 1}: list the models the provider reports before a session starts.`).join(" ");
+	return JSON.stringify({ issue: {
+		projectId: "a72f9074-7b37-4693-bbae-8b108576aefc",
+		number: 3,
+		title: "Discover the real model list without running a session first",
+		state: "open",
+		url: `https://github.com/codeden-e2e/demo-repo/issues/3?trace=${blob}`,
+		labels: [
+			"enhancement",
+			"providers",
+			"low-priority"
+		],
+		body,
+		trace: blob,
+		blockedBy: [{
+			number: 2,
+			title: "Model picker redesign",
+			state: "open"
+		}]
+	} });
+}
 // ../../packages/providers/src/fake/session.ts
 var Interrupted$1 = class extends Error {};
 /** A scripted, deterministic session. Ids are counters scoped to the session. */
@@ -19029,6 +20467,7 @@ var FakeSession = class {
 	constructor(opts, fake) {
 		this.opts = opts;
 		this.fake = fake;
+		this.autonomy = opts.autonomy;
 		this.token = opts.resumeToken ?? `fake-${opts.sessionId}`;
 		this.rootThreadId = `${opts.sessionId}:thread-root`;
 		this.events.push({
@@ -19056,6 +20495,11 @@ var FakeSession = class {
 			model: change.model ?? "fake-1"
 		});
 	}
+	/** Current autonomy. Full skips the scripted command approval, as it would for real. */
+	autonomy;
+	async setAutonomy(level) {
+		this.autonomy = level;
+	}
 	async send(input) {
 		if (this.events.isClosed) throw new ProviderSessionError("closed", "Session is closed");
 		if (this.turn) throw new ProviderSessionError("turn_running", "A turn is already running");
@@ -19137,7 +20581,8 @@ var FakeSession = class {
 			}
 			await this.streamAssistant(turn, threadId, this.replyFor(prompt));
 			await this.todoList(turn);
-			if (this.fake.approval || prompt.includes("[approval]") ? await this.approval(turn) : true) await this.commandToolCall(turn);
+			if (prompt.includes("[mcp]")) await this.mcpToolCall(turn);
+			if ((this.fake.approval || prompt.includes("[approval]")) && this.autonomy !== "full" ? await this.approval(turn) : true) await this.commandToolCall(turn);
 			if (this.fake.subagent || prompt.includes("[subagent]")) await this.subagent(turn);
 			if (this.fake.followups ?? true) {
 				await this.step(turn);
@@ -19322,6 +20767,45 @@ var FakeSession = class {
 		});
 		return allowed;
 	}
+	/** An MCP tool call with a long, one-line JSON result (`[mcp]` in the prompt). */
+	async mcpToolCall(turn) {
+		const { threadId, turnId } = turn;
+		const base = {
+			id: this.nextId("item"),
+			kind: "tool_call",
+			toolKind: "mcp",
+			toolName: "mcp__codeden__triage_issue",
+			server: "codeden",
+			tool: "triage_issue",
+			title: "codeden: triage_issue",
+			input: fakeMcpInput
+		};
+		await this.step(turn);
+		this.emit({
+			type: "item.started",
+			threadId,
+			turnId,
+			item: {
+				...base,
+				status: "in_progress"
+			}
+		});
+		await this.step(turn);
+		this.emit({
+			type: "item.completed",
+			threadId,
+			turnId,
+			item: {
+				...base,
+				status: "completed",
+				output: {
+					text: fakeMcpResult(),
+					truncated: false
+				},
+				durationMs: 12
+			}
+		});
+	}
 	async commandToolCall(turn) {
 		const { threadId, turnId } = turn;
 		const id = this.nextId("item");
@@ -19490,13 +20974,15 @@ const capabilities = {
 	planMode: false,
 	reasoningEffort: false,
 	mcp: false,
-	skills: false
+	skills: false,
+	liveAutonomy: true
 };
 /**
 * Deterministic scripted provider for demos and tests (§7.2). Every turn streams:
 * user message, assistant message (word deltas), a todo list, a command tool call,
 * optionally an approval request (waits for `respond`) and a subagent child thread,
-* followups, usage, then `turn.completed`. Prompts containing `[fail]` fail the turn.
+* followups, usage, then `turn.completed`. Prompts containing `[fail]` fail the turn;
+* `[mcp]` adds an MCP tool call with a long JSON result before the command.
 */
 var FakeProvider = class {
 	options;
@@ -20449,12 +21935,14 @@ function createImageEngineRegistry(opts = {}) {
 /** The set of adapters a runner has loaded, keyed by id. */
 var ProviderRegistry = class {
 	adapters = /* @__PURE__ */ new Map();
+	listeners = /* @__PURE__ */ new Set();
 	constructor(adapters = []) {
 		for (const adapter of adapters) this.register(adapter);
 	}
 	register(adapter) {
 		if (this.adapters.has(adapter.id)) throw new Error(`Provider "${adapter.id}" is already registered`);
 		this.adapters.set(adapter.id, adapter);
+		adapter.onModelsChanged?.(() => this.notify());
 	}
 	get(id) {
 		return this.adapters.get(id);
@@ -20465,6 +21953,24 @@ var ProviderRegistry = class {
 	info() {
 		return this.list().map(providerInfo);
 	}
+	/**
+	* Refresh the model lists of all adapters (or those in `ids`) that support it. Never throws;
+	* changes reach `onChange` listeners.
+	*/
+	async refreshModels(ids) {
+		const adapters = ids ? this.list().filter((a) => ids.includes(a.id)) : this.list();
+		await Promise.all(adapters.map((a) => a.refreshModels?.().catch(() => void 0)));
+	}
+	/** Call `listener` whenever `info()` changes (a provider's models). Returns unsubscribe. */
+	onChange(listener) {
+		this.listeners.add(listener);
+		return () => this.listeners.delete(listener);
+	}
+	notify() {
+		for (const listener of this.listeners) try {
+			listener();
+		} catch {}
+	}
 };
 /** Fresh instances of the built-in real providers (Claude Code, Codex). */
 function builtinProviders() {
@@ -23983,7 +25489,8 @@ function installChromium(log) {
 			"chromium"
 		], {
 			windowsHide: true,
-			timeout: 6e5
+			timeout: 6e5,
+			env: ownNodeEnv()
 		}, (error) => error ? reject(error) : resolve());
 	});
 }
@@ -24022,13 +25529,18 @@ function firstLine(error) {
 /** Names of CodeDen-internal variables that must never reach agents, shells or setup scripts. */
 const SECRET = /^CODEDEN_.*(TOKEN|SECRET|KEY|PASSWORD)/i;
 /**
+* Set when the desktop app runs CodeDen's own processes on its Electron binary (§17). It must
+* not reach the user's shells and agents: an Electron app started there would run as Node.js.
+*/
+const RUNTIME_ONLY = /* @__PURE__ */ new Set(["ELECTRON_RUN_AS_NODE"]);
+/**
 * Environment for child processes (§15): the user's environment minus CodeDen's own
 * secrets. `CODEDEN_HOME` and similar non-secret variables are kept.
 */
 function childEnv(extra = {}) {
 	const out = {};
 	for (const [key, value] of Object.entries(process.env)) {
-		if (value === void 0 || SECRET.test(key)) continue;
+		if (value === void 0 || SECRET.test(key) || RUNTIME_ONLY.has(key)) continue;
 		out[key] = value;
 	}
 	return {
@@ -24345,6 +25857,22 @@ async function topLevel(cwd) {
 	return resolve(await gitText(cwd, ["rev-parse", "--show-toplevel"]));
 }
 /**
+* Copy the index for use as a temporary index, keeping its modification time. Git trusts an
+* entry's cached stat data only when the entry is older than the index file; an entry written
+* in the same timestamp tick as the index is "racily clean" and its content is re-read. A
+* copy stamped with the current time (Linux `copyFile` does that) would make such entries
+* look safe, and a same-size rewrite in that tick would be missed by diffs and checkpoints.
+*/
+async function copyIndex(realIndex, tmp) {
+	try {
+		await copyFile(realIndex, tmp);
+	} catch {
+		return;
+	}
+	const { atime, mtime } = await stat(realIndex);
+	await utimes(tmp, atime, mtime);
+}
+/**
 * Write the full working tree (tracked + untracked, minus ignored files) as a tree object
 * using a temporary index seeded from a copy of the real one (for its stat cache). The
 * user's index, HEAD and branch are never modified.
@@ -24359,7 +25887,7 @@ async function snapshotTree(cwd) {
 	]);
 	const tmp = join(tmpdir(), `codeden-index-${randomBytes(8).toString("hex")}`);
 	try {
-		await copyFile(realIndex, tmp).catch(() => void 0);
+		await copyIndex(realIndex, tmp);
 		const env = { GIT_INDEX_FILE: tmp };
 		await git(top, [
 			"add",
@@ -25008,6 +26536,15 @@ async function prepareWorkspace(cmd, ctx) {
 		setup
 	};
 }
+/**
+* Refuse to remove a worktree with uncommitted changes (`worktree_dirty`) unless forced. Runs
+* before terminals and processes in the worktree are stopped, so a dirty worktree is left
+* exactly as it was. Ignored files (build output, `node_modules`) don't count.
+*/
+async function assertRemovable(cmd) {
+	if (cmd.force || !existsSync(cmd.path) || !await isWorkTree(cmd.path)) return;
+	if ((await git(cmd.path, ["status", "--porcelain"])).stdout.toString("utf8").trim()) throw new CommandError("worktree_dirty", `${cmd.path} has uncommitted changes; commit them or remove it with force`);
+}
 /** `workspace.remove`: remove a worktree (retrying briefly for Windows file locks). */
 async function removeWorkspace(cmd) {
 	const path = resolve(cmd.path);
@@ -25069,7 +26606,9 @@ async function executeCommand(core, command) {
 			return {};
 		case "provider.detect": {
 			const adapters = command.providerId ? registry.list().filter((a) => a.id === command.providerId) : registry.list();
-			return { statuses: await Promise.all(adapters.map((a) => a.detect())) };
+			const statuses = await Promise.all(adapters.map((a) => a.detect()));
+			registry.refreshModels(adapters.map((a) => a.id));
+			return { statuses };
 		}
 		case "provider.oneShot": {
 			const utility = registry.get(command.providerId)?.utilityModel?.();
@@ -25093,6 +26632,7 @@ async function executeCommand(core, command) {
 				emit: core.emit
 			});
 		case "workspace.remove":
+			await assertRemovable(command);
 			await terminals.closeUnder(command.path);
 			await core.supervisor.killUnder(command.path);
 			return removeWorkspace(command);
@@ -26808,6 +28348,10 @@ var ServerConnection = class {
 				for (const event of this.core.journal.after(msg.lastAckedSeq)) this.send(event);
 				this.attached = true;
 				this.onAttach(this);
+				this.send({
+					type: "providers",
+					providers: this.core.registry.info()
+				});
 				return;
 			case "ack":
 				this.core.journal.ack(msg.seq);
@@ -26967,14 +28511,20 @@ var SessionHost = class {
 	async interrupt(sessionId) {
 		await this.get(sessionId).session.interrupt();
 	}
-	/** Model/effort for the next turn, when the provider can change them live. */
+	/**
+	* Model/effort for the next turn and the autonomy level, when the provider can change them
+	* live. Checks every requested setting before applying any.
+	*/
 	async configure(cmd) {
 		const { session } = this.get(cmd.sessionId);
-		if (!session.configure) throw new CommandError("unsupported", "This provider cannot change model or effort live");
 		const change = {};
 		if (cmd.model !== void 0) change.model = cmd.model;
 		if (cmd.effort !== void 0) change.effort = cmd.effort;
-		await session.configure(change);
+		const modelOrEffort = Object.keys(change).length > 0;
+		if (modelOrEffort && !session.configure) throw new CommandError("unsupported", "This provider cannot change model or effort live");
+		if (cmd.autonomy !== void 0 && !session.setAutonomy) throw new CommandError("unsupported", "This provider cannot change autonomy live");
+		if (modelOrEffort) await session.configure?.(change);
+		if (cmd.autonomy !== void 0) await session.setAutonomy?.(cmd.autonomy);
 	}
 	async respond(cmd) {
 		await this.get(cmd.sessionId).session.respond(cmd.requestId, cmd.response);
@@ -27141,6 +28691,12 @@ async function startRunner(opts) {
 			stream: data
 		});
 	};
+	const stopProviderUpdates = registry.onChange(() => {
+		if (!stopped) attached?.deliver({
+			type: "providers",
+			providers: registry.info()
+		});
+	});
 	const supervisor = new ProcessSupervisor();
 	const host = new SessionHost(registry, emit, { log });
 	const terminals = new TerminalHost({
@@ -27237,11 +28793,13 @@ async function startRunner(opts) {
 	writeFileSync(tmp, `${JSON.stringify(lock, null, 2)}\n`, { mode: 384 });
 	renameSync(tmp, lockFile);
 	log(`runner ${journal.runnerId} listening on 127.0.0.1:${port}`);
+	registry.refreshModels();
 	const removeLock = () => removeOwnLock(lockFile);
 	process.once("exit", removeLock);
 	async function close() {
 		closing ??= (async () => {
 			removeLock();
+			stopProviderUpdates();
 			await host.closeAll();
 			await terminals.closeAll();
 			await browserManager.shutdown().catch((error) => log(`browser: ${String(error)}`));
@@ -27266,6 +28824,6 @@ async function startRunner(opts) {
 		close
 	};
 }
-export { RunAutomationRequest as $, unknown as $n, Automation as $t, SessionFileQuery as A, McpServerTarget as An, isNewerVersion as At, BrowserClientMessage as B, custom as Bn, TriageIssueRequest as Bt, import_websocket_server as C, InboxItemKind as Cn, HealthResponse as Ct, CODEDEN_VERSION as D, AgentConfigLocator as Dn, UpdateInstallRequest as Dt, TtsRequest as E, AgentConfigListQuery as En, AppPointer as Et, ListNoticesQuery as F, datetime as Fn, GithubIssue as Ft, BrowserOpenRequest as G, looseObject as Gn, FactoryTriageRequest as Gt, BrowserHistoryRequest as H, int as Hn, parseGithubPrId as Ht, ResolveConflictRequest as I, _enum as In, GithubLabelRequest as It, AutomationFileFrontmatter as J, optional as Jn, PutVisionRequest as Jt, BrowserViewportRequest as K, number$1 as Kn, FactoryTuning as Kt, RoleMessageRequest as L, _null as Ln, GithubListQuery as Lt, RunnerToServerMessage as M, AutonomyLevel as Mn, NOTICE_BATCH_CODE as Mt, ServerLock as N, ProviderId as Nn, CreateGithubIssueRequest as Nt, UsageQuery as O, AgentConfigWriteRequest as On, UpdateStatus as Ot, ListConflictsQuery as P, ReasoningEffort as Pn, GithubCommentRequest as Pt, ListAutomationsQuery as Q, union as Qn, Artifact as Qt, UpdateSessionRequest as R, array as Rn, GithubPr as Rt, acquireInstallLock as S, InboxItem as Sn, UpdateProjectRequest as St, SttQuery as T, AgentConfigDiffRequest as Tn, Settings as Tt, BrowserNavigateRequest as U, intersection as Un, DiscoveryArea as Ut, BrowserDevServerRequest as V, discriminatedUnion as Vn, githubPrId as Vt, BrowserNewTabRequest as W, literal as Wn, FactoryCandidate as Wt, CreateAutomationRequest as X, record as Xn, SetAutonomyModeRequest as Xt, AutomationProjectRequest as Y, preprocess as Yn, ReviewVerdict as Yt, ListAutomationRunsQuery as Z, string as Zn, isFactoryMode as Zt, importClaudeSdkFrom as _, StartedBy as _n, SetSecretRequest as _t, Hono as a, DiffScope as an, UpdateAutomationProjectSettingsRequest as at, runNpm as b, DEFAULT_VISION_PATH as bn, ThreadItemsQuery as bt, serve as c, RestoreFilesRequest as cn, FileReadQuery as ct, createImageEngineRegistry as d, TerminalClientMessage as dn, ListSessionsQuery as dt, AutomationGuards as en, ZodError as er, SetAutomationEnabledRequest as et, IMAGE_ASPECT_RATIOS as f, TerminalQuery as fn, ResolveInboxRequest as ft, CLAUDE_SDK_VERSION as g, ConflictDecision as gn, SessionStartMeta as gt, claudeSdkSource as h, ProjectConfigFile as hn, SendMessageRequest as ht, killTree as i, SessionStatus as in, UpcomingRunsQuery as it, RunnerLock as j, McpServerUpsertRequest as jn, ConflictRecord as jt, UsageSettings as k, McpServerDiffRequest as kn, compareVersions$1 as kt, upgradeWebSocket as l, SessionResult as ln, FileWriteRequest as lt, ImageGenerationError as m, SessionOptions as mn, SecretKey as mt, readLock as n, TriagePolicy as nn, safeParse$1 as nr, TriageDecisionRequest as nt, tryDecodeURIComponent as o, GitCommitRequest as on, UpdateAutomationRequest as ot, resolveImageOutput as p, RunnerCommandResults as pn, RespondRequest as pt, BrowserWsQuery as q, object as qn, KillSwitchRequest as qt, isAlive as r, Session as rn, prettifyError as rr, TriageReport as rt, bufferToFormData as s, GitPushRequest as sn, CreateProjectRequest as st, startRunner as t, AutomationRun as tn, toJSONSchema as tr, StarterSetRequest as tt, ImageEngineRegistry as u, SpeechSummaryRequest as un, ListInboxQuery as ut, installClaudeSdk as v, WorkKey as vn, StartSessionRequest as vt, wrapper_default as w, AgentConfigDeleteQuery as wn, agentEventToNewEvent as wt, resolveNpm as x, FactoryLimits as xn, UiClientMessage as xt, isClaudeSdkInstalled as y, Project as yn, SteerRequest as yt, ImageTestRequest as z, boolean as zn, MergePrRequest as zt };
+export { ListAutomationRunsQuery as $, literal as $n, FactoryTuning as $t, SessionFileQuery as A, FactoryLimits as An, LocalSttModelParams as At, ImageTestRequest as B, McpServerUpsertRequest as Bn, CreateGithubIssueRequest as Bt, isElectronRuntime as C, ProjectConfigFile as Cn, ThreadItemsQuery as Ct, CODEDEN_VERSION as D, Project as Dn, agentEventToNewEvent as Dt, wrapper_default as E, WorkKey as En, HealthResponse as Et, ListConflictsQuery as F, AgentConfigListQuery as Fn, UpdateStatus as Ft, BrowserNavigateRequest as G, _enum as Gn, GithubPr as Gt, BrowserClientMessage as H, ProviderId as Hn, GithubIssue as Ht, ListNoticesQuery as I, AgentConfigLocator as In, compareVersions$1 as It, BrowserViewportRequest as J, boolean as Jn, githubPrId as Jt, BrowserNewTabRequest as K, _null as Kn, MergePrRequest as Kt, ResolveConflictRequest as L, AgentConfigWriteRequest as Ln, isNewerVersion as Lt, RunnerToServerMessage as M, InboxItemKind as Mn, TtsRequest as Mt, ServerLock as N, AgentConfigDeleteQuery as Nn, AppPointer as Nt, UsageQuery as O, sortProjects as On, Settings as Ot, ArchiveSessionRequest as P, AgentConfigDiffRequest as Pn, UpdateInstallRequest as Pt, CreateAutomationRequest as Q, intersection as Qn, FactoryTriageRequest as Qt, RoleMessageRequest as R, McpServerDiffRequest as Rn, ConflictRecord as Rt, acquireInstallLock as S, SessionOptions as Sn, SteerRequest as St, import_websocket_server as T, StartedBy as Tn, UpdateProjectRequest as Tt, BrowserDevServerRequest as U, ReasoningEffort as Un, GithubLabelRequest as Ut, summarizeActivity as V, AutonomyLevel as Vn, GithubCommentRequest as Vt, BrowserHistoryRequest as W, datetime as Wn, GithubListQuery as Wt, AutomationFileFrontmatter as X, discriminatedUnion as Xn, DiscoveryArea as Xt, BrowserWsQuery as Y, custom as Yn, parseGithubPrId as Yt, AutomationProjectRequest as Z, int as Zn, FactoryCandidate as Zt, importClaudeSdkFrom as _, SessionResult as _n, SecretKey as _t, Hono as a, Artifact as an, record as ar, TriageReport as at, runNpm as b, TerminalQuery as bn, SetSecretRequest as bt, serve as c, AutomationRun as cn, unknown as cr, UpdateAutomationRequest as ct, createImageEngineRegistry as d, SessionStatus as dn, safeParse$1 as dr, FileWriteRequest as dt, KillSwitchRequest as en, looseObject as er, ListAutomationsQuery as et, IMAGE_ASPECT_RATIOS as f, DiffScope as fn, prettifyError as fr, ListInboxQuery as ft, CLAUDE_SDK_VERSION as g, RestoreFilesRequest as gn, RespondRequest as gt, claudeSdkSource as h, GitPushRequest as hn, ResolveInboxRequest as ht, killTree as i, isFactoryMode as in, preprocess as ir, TriageDecisionRequest as it, RunnerLock as j, InboxItem as jn, SttQuery as jt, UsageSettings as k, DEFAULT_VISION_PATH as kn, LOCAL_STT_SAMPLE_RATE as kt, upgradeWebSocket as l, TriagePolicy as ln, ZodError as lr, CreateProjectRequest as lt, ImageGenerationError as m, GitCommitRequest as mn, ReorderProjectsRequest as mt, readLock as n, ReviewVerdict as nn, object as nr, SetAutomationEnabledRequest as nt, tryDecodeURIComponent as o, Automation as on, string as or, UpcomingRunsQuery as ot, resolveImageOutput as p, EditQueuedMessageRequest as pn, ListSessionsQuery as pt, BrowserOpenRequest as q, array as qn, TriageIssueRequest as qt, isAlive as r, SetAutonomyModeRequest as rn, optional as rr, StarterSetRequest as rt, bufferToFormData as s, AutomationGuards as sn, union as sr, UpdateAutomationProjectSettingsRequest as st, startRunner as t, PutVisionRequest as tn, number$1 as tr, RunAutomationRequest as tt, ImageEngineRegistry as u, Session as un, toJSONSchema as ur, FileReadQuery as ut, installClaudeSdk as v, SpeechSummaryRequest as vn, SendMessageRequest as vt, ownNodeEnv as w, ConflictDecision as wn, UiClientMessage as wt, resolveNpm as x, RunnerCommandResults as xn, StartSessionRequest as xt, isClaudeSdkInstalled as y, TerminalClientMessage as yn, SessionStartMeta as yt, UpdateSessionRequest as z, McpServerTarget as zn, NOTICE_BATCH_CODE as zt };
 
-//# sourceMappingURL=runner-D8m3WdtS.js.map
+//# sourceMappingURL=runner-CJetH9jW.js.map