codeden 0.1.1 → 0.2.0

package/dist/{main-BF0aQ9U8.js → main-pXwL7GDQ.js}

@@ -1,5 +1,5 @@
 import { n as __require, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-DegdyBIC.js";
-import { $ as RunAutomationRequest, $n as unknown, $t as Automation, A as SessionFileQuery, An as McpServerTarget, At as isNewerVersion, B as BrowserClientMessage, Bn as custom, Bt as TriageIssueRequest, C as import_websocket_server, Cn as InboxItemKind, Ct as HealthResponse, D as CODEDEN_VERSION, Dn as AgentConfigLocator, Dt as UpdateInstallRequest, E as TtsRequest, En as AgentConfigListQuery, Et as AppPointer, F as ListNoticesQuery, Fn as datetime, Ft as GithubIssue, G as BrowserOpenRequest, Gn as looseObject, Gt as FactoryTriageRequest, H as BrowserHistoryRequest, Hn as int, Ht as parseGithubPrId, I as ResolveConflictRequest, In as _enum, It as GithubLabelRequest, J as AutomationFileFrontmatter, Jn as optional, Jt as PutVisionRequest, K as BrowserViewportRequest, Kn as number, Kt as FactoryTuning, L as RoleMessageRequest, Ln as _null, Lt as GithubListQuery, M as RunnerToServerMessage, Mn as AutonomyLevel, Mt as NOTICE_BATCH_CODE, N as ServerLock, Nn as ProviderId, Nt as CreateGithubIssueRequest, O as UsageQuery, On as AgentConfigWriteRequest, Ot as UpdateStatus, P as ListConflictsQuery, Pn as ReasoningEffort, Pt as GithubCommentRequest, Q as ListAutomationsQuery, Qn as union$1, Qt as Artifact, R as UpdateSessionRequest, Rn as array, Rt as GithubPr, S as acquireInstallLock, Sn as InboxItem, St as UpdateProjectRequest, T as SttQuery, Tn as AgentConfigDiffRequest, Tt as Settings, U as BrowserNavigateRequest, Un as intersection, Ut as DiscoveryArea, V as BrowserDevServerRequest, Vn as discriminatedUnion, Vt as githubPrId, W as BrowserNewTabRequest, Wn as literal, Wt as FactoryCandidate, X as CreateAutomationRequest, Xn as record, Xt as SetAutonomyModeRequest, Y as AutomationProjectRequest, Yn as preprocess, Yt as ReviewVerdict, Z as ListAutomationRunsQuery, Zn as string, Zt as isFactoryMode, _ as importClaudeSdkFrom, _n as StartedBy, _t as SetSecretRequest, a as Hono, an as DiffScope, at as UpdateAutomationProjectSettingsRequest, b as runNpm, bn as DEFAULT_VISION_PATH, bt as ThreadItemsQuery, c as serve, cn as RestoreFilesRequest, ct as FileReadQuery, d as createImageEngineRegistry, dn as TerminalClientMessage, dt as ListSessionsQuery, en as AutomationGuards, er as ZodError, et as SetAutomationEnabledRequest, f as IMAGE_ASPECT_RATIOS, fn as TerminalQuery, ft as ResolveInboxRequest, g as CLAUDE_SDK_VERSION, gn as ConflictDecision, gt as SessionStartMeta, h as claudeSdkSource, hn as ProjectConfigFile, ht as SendMessageRequest, i as killTree$1, in as SessionStatus, it as UpcomingRunsQuery, j as RunnerLock, jn as McpServerUpsertRequest, jt as ConflictRecord, k as UsageSettings, kn as McpServerDiffRequest, kt as compareVersions, l as upgradeWebSocket, ln as SessionResult, lt as FileWriteRequest, m as ImageGenerationError, mn as SessionOptions, mt as SecretKey, n as readLock, nn as TriagePolicy, nr as safeParse$1, nt as TriageDecisionRequest, o as tryDecodeURIComponent, on as GitCommitRequest, ot as UpdateAutomationRequest, p as resolveImageOutput, pn as RunnerCommandResults, pt as RespondRequest, q as BrowserWsQuery, qn as object, qt as KillSwitchRequest, r as isAlive, rn as Session, rr as prettifyError, rt as TriageReport, s as bufferToFormData, sn as GitPushRequest, st as CreateProjectRequest, tn as AutomationRun, tr as toJSONSchema, tt as StarterSetRequest, u as ImageEngineRegistry, un as SpeechSummaryRequest, ut as ListInboxQuery, v as installClaudeSdk, vn as WorkKey, vt as StartSessionRequest, w as wrapper_default, wn as AgentConfigDeleteQuery, wt as agentEventToNewEvent, x as resolveNpm, xn as FactoryLimits, xt as UiClientMessage, y as isClaudeSdkInstalled, yn as Project, yt as SteerRequest, z as ImageTestRequest, zn as boolean, zt as MergePrRequest } from "./runner-D8m3WdtS.js";
+import { $ as ListAutomationRunsQuery, $n as literal, $t as FactoryTuning, A as SessionFileQuery, An as FactoryLimits, At as LocalSttModelParams, B as ImageTestRequest, Bn as McpServerUpsertRequest, Bt as CreateGithubIssueRequest, C as isElectronRuntime, Cn as ProjectConfigFile, Ct as ThreadItemsQuery, D as CODEDEN_VERSION, Dn as Project, Dt as agentEventToNewEvent, E as wrapper_default, En as WorkKey, Et as HealthResponse, F as ListConflictsQuery, Fn as AgentConfigListQuery, Ft as UpdateStatus, G as BrowserNavigateRequest, Gn as _enum, Gt as GithubPr, H as BrowserClientMessage, Hn as ProviderId, Ht as GithubIssue, I as ListNoticesQuery, In as AgentConfigLocator, It as compareVersions, J as BrowserViewportRequest, Jn as boolean, Jt as githubPrId, K as BrowserNewTabRequest, Kn as _null, Kt as MergePrRequest, L as ResolveConflictRequest, Ln as AgentConfigWriteRequest, Lt as isNewerVersion, M as RunnerToServerMessage, Mn as InboxItemKind, Mt as TtsRequest, N as ServerLock, Nn as AgentConfigDeleteQuery, Nt as AppPointer, O as UsageQuery, On as sortProjects, Ot as Settings, P as ArchiveSessionRequest, Pn as AgentConfigDiffRequest, Pt as UpdateInstallRequest, Q as CreateAutomationRequest, Qn as intersection, Qt as FactoryTriageRequest, R as RoleMessageRequest, Rn as McpServerDiffRequest, Rt as ConflictRecord, S as acquireInstallLock, Sn as SessionOptions, St as SteerRequest, T as import_websocket_server, Tn as StartedBy, Tt as UpdateProjectRequest, U as BrowserDevServerRequest, Un as ReasoningEffort, Ut as GithubLabelRequest, V as summarizeActivity, Vn as AutonomyLevel, Vt as GithubCommentRequest, W as BrowserHistoryRequest, Wn as datetime, Wt as GithubListQuery, X as AutomationFileFrontmatter, Xn as discriminatedUnion, Xt as DiscoveryArea, Y as BrowserWsQuery, Yn as custom, Yt as parseGithubPrId, Z as AutomationProjectRequest, Zn as int, Zt as FactoryCandidate, _ as importClaudeSdkFrom, _n as SessionResult, _t as SecretKey, a as Hono, an as Artifact, ar as record, at as TriageReport, b as runNpm, bn as TerminalQuery, bt as SetSecretRequest, c as serve, cn as AutomationRun, cr as unknown, ct as UpdateAutomationRequest, d as createImageEngineRegistry, dn as SessionStatus, dr as safeParse$1, dt as FileWriteRequest, en as KillSwitchRequest, er as looseObject, et as ListAutomationsQuery, f as IMAGE_ASPECT_RATIOS, fn as DiffScope, fr as prettifyError, ft as ListInboxQuery, g as CLAUDE_SDK_VERSION, gn as RestoreFilesRequest, gt as RespondRequest, h as claudeSdkSource, hn as GitPushRequest, ht as ResolveInboxRequest, i as killTree$1, in as isFactoryMode, ir as preprocess, it as TriageDecisionRequest, j as RunnerLock, jn as InboxItem, jt as SttQuery, k as UsageSettings, kn as DEFAULT_VISION_PATH, kt as LOCAL_STT_SAMPLE_RATE, l as upgradeWebSocket, ln as TriagePolicy, lr as ZodError, lt as CreateProjectRequest, m as ImageGenerationError, mn as GitCommitRequest, mt as ReorderProjectsRequest, n as readLock, nn as ReviewVerdict, nr as object, nt as SetAutomationEnabledRequest, o as tryDecodeURIComponent, on as Automation, or as string, ot as UpcomingRunsQuery, p as resolveImageOutput, pn as EditQueuedMessageRequest, pt as ListSessionsQuery, q as BrowserOpenRequest, qn as array, qt as TriageIssueRequest, r as isAlive, rn as SetAutonomyModeRequest, rr as optional, rt as StarterSetRequest, s as bufferToFormData, sn as AutomationGuards, sr as union$1, st as UpdateAutomationProjectSettingsRequest, tn as PutVisionRequest, tr as number, tt as RunAutomationRequest, u as ImageEngineRegistry, un as Session, ur as toJSONSchema, ut as FileReadQuery, v as installClaudeSdk, vn as SpeechSummaryRequest, vt as SendMessageRequest, w as ownNodeEnv, wn as ConflictDecision, wt as UiClientMessage, x as resolveNpm, xn as RunnerCommandResults, xt as StartSessionRequest, y as isClaudeSdkInstalled, yn as TerminalClientMessage, yt as SessionStartMeta, z as UpdateSessionRequest, zn as McpServerTarget, zt as NOTICE_BATCH_CODE } from "./runner-CJetH9jW.js";
 import { createRequire } from "node:module";
 import fs, { accessSync, closeSync, constants, copyFileSync, cpSync, createReadStream, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, watch, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
@@ -7,6 +7,8 @@ import { basename, delimiter, dirname, extname, isAbsolute, join, parse, relativ
 import { isDeepStrictEqual, parseArgs } from "node:util";
 import crypto$1, { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
+import { gunzipSync } from "node:zlib";
+import { open, rename } from "node:fs/promises";
 import { Readable } from "node:stream";
 import { DatabaseSync } from "node:sqlite";
 import { versions } from "node:process";
@@ -146,7 +148,9 @@ function homePaths(home) {
 		/** Copies of config files taken before the editors overwrite them (§12.4). */
 		backups: join(home, "backups"),
 		/** Dependencies installed on demand, e.g. Claude Code support (§14). */
-		deps: join(home, "deps")
+		deps: join(home, "deps"),
+		/** Models downloaded on demand, e.g. local Whisper for dictation (§11.3). */
+		models: join(home, "models")
 	};
 }
 /** Create the data directory layout if missing. */
@@ -7177,6 +7181,9 @@ const projects = sqliteTable("projects", {
 	factoryLimits: json$3("factory_limits"),
 	killSwitch: integer("kill_switch", { mode: "boolean" }).notNull().default(false),
 	timezone: text("timezone"),
+	pinned: integer("pinned", { mode: "boolean" }).notNull().default(false),
+	/** Manual list position (§13); the migration backfills it from the alphabetical order. */
+	sortOrder: integer("sort_order").notNull().default(0),
 	github: json$3("github"),
 	createdAt: text("created_at").notNull(),
 	updatedAt: text("updated_at").notNull(),
@@ -7211,6 +7218,8 @@ const sessions = sqliteTable("sessions", {
 	createdAt: text("created_at").notNull(),
 	updatedAt: text("updated_at").notNull(),
 	endedAt: text("ended_at"),
+	archivedAt: text("archived_at"),
+	worktreeRemovedAt: text("worktree_removed_at"),
 	/** Accumulated usage (server-side projection; not part of the `Session` entity). */
 	usage: json$3("usage"),
 	/** How the session was started (workspace fallback, forced conflict reason, queue). */
@@ -7342,6 +7351,8 @@ const queuedMessages = sqliteTable("queued_messages", {
 	id: text("id").primaryKey(),
 	sessionId: text("session_id").notNull(),
 	input: json$3("input").notNull(),
+	/** Who queued it; null for rows written before senders were recorded (the user). */
+	sender: text("sender").$type(),
 	createdAt: text("created_at").notNull()
 }, (t) => [index("queued_messages_session").on(t.sessionId, t.createdAt)]);
 /**
@@ -7541,6 +7552,8 @@ function projectToRow(p) {
 		factoryLimits: p.factoryLimits,
 		killSwitch: p.killSwitch,
 		timezone: p.timezone,
+		pinned: p.pinned,
+		sortOrder: p.sortOrder,
 		github: p.kind === "github" ? p.github : null,
 		createdAt: p.createdAt,
 		updatedAt: p.updatedAt,
@@ -7559,7 +7572,9 @@ function rowToProject(r) {
 function sessionToRow(s) {
 	return {
 		...s,
-		result: s.result ?? null
+		result: s.result ?? null,
+		archivedAt: s.archivedAt ?? null,
+		worktreeRemovedAt: s.worktreeRemovedAt ?? null
 	};
 }
 function rowToSession(r) {
@@ -8185,6 +8200,11 @@ function spawnRunner(config, home) {
 	const logs = join(home, "logs");
 	mkdirSync(logs, { recursive: true });
 	const log = openSync(join(logs, "runner.log"), "a");
+	const env = {
+		...process.env,
+		...config.env,
+		CODEDEN_HOME: home
+	};
 	const child = spawn(config.command, [
 		...config.args,
 		"--home",
@@ -8198,11 +8218,7 @@ function spawnRunner(config, home) {
 		],
 		windowsHide: true,
 		cwd: home,
-		env: {
-			...process.env,
-			...config.env,
-			CODEDEN_HOME: home
-		}
+		env: config.command === process.execPath ? ownNodeEnv(env) : env
 	});
 	child.unref();
 	return child.pid;
@@ -8438,6 +8454,12 @@ var RunnerClient = class {
 			case "stream":
 				this.opts.onStream?.(msg.stream);
 				return;
+			case "providers":
+				this.setStatus({
+					...this.current,
+					providers: msg.providers
+				});
+				return;
 			case "ping":
 				this.send({
 					type: "pong",
@@ -9411,6 +9433,7 @@ function applyWorkbenchProjection(tx, e) {
 				id: m.id,
 				sessionId: m.sessionId,
 				input: m.input,
+				sender: m.from,
 				createdAt: m.createdAt
 			}).onConflictDoNothing().run();
 			return;
@@ -9418,6 +9441,15 @@ function applyWorkbenchProjection(tx, e) {
 		case "message.dequeued":
 			tx.delete(queuedMessages).where(eq(queuedMessages.id, e.payload.messageId)).run();
 			return;
+		case "message.edited": {
+			const row = tx.select({ input: queuedMessages.input }).from(queuedMessages).where(eq(queuedMessages.id, e.payload.messageId)).get();
+			if (!row) return;
+			tx.update(queuedMessages).set({ input: {
+				...row.input,
+				text: e.payload.text
+			} }).where(eq(queuedMessages.id, e.payload.messageId)).run();
+			return;
+		}
 	}
 }
 /**
@@ -9467,6 +9499,11 @@ function applyProjection(tx, e) {
 				updatedAt: e.ts
 			}).where(eq(projects.id, e.payload.projectId)).run();
 			return [];
+		case "projects.reordered":
+			e.payload.projectIds.forEach((id, index) => {
+				tx.update(projects).set({ sortOrder: index }).where(eq(projects.id, id)).run();
+			});
+			return [];
 		case "session.created":
 		case "session.updated": {
 			const row = sessionToRow(e.payload.session);
@@ -9511,6 +9548,7 @@ function applyProjection(tx, e) {
 		case "checkpoint.created":
 		case "message.queued":
 		case "message.dequeued":
+		case "message.edited":
 			applyWorkbenchProjection(tx, e);
 			return [];
 		case "notice.created":
@@ -20727,6 +20765,16 @@ function toServiceError$1(error) {
 	if (code === "unknown_session" || code === "unsupported" || code === "no_turn") return new ServiceError(409, code, message);
 	return new ServiceError(502, code, message);
 }
+/**
+* Ask a connected runner to re-detect its providers, which also refreshes their model lists
+* (they come back as a runner status update). Fire and forget; failures are only logged.
+*/
+function redetectProviders(runner, log) {
+	if (!runner.isConnected()) return;
+	runner.request({ name: "provider.detect" }, 6e4).catch((error) => {
+		log?.(`runner: provider re-detect failed: ${error instanceof Error ? error.message : error}`);
+	});
+}
 /** `RunnerPort` over the server's (possibly absent) `RunnerClient`. */
 function runnerPort(get) {
 	return {
@@ -21026,6 +21074,97 @@ function buffered(ws) {
 function send$1(ws, msg) {
 	if (ws.readyState === 1) ws.send(JSON.stringify(msg));
 }
+// ../server/src/services/sessions/preview.ts
+/** Tool output kept in transcript pages and live updates; the rest is fetched on demand (§6). */
+const OUTPUT_PREVIEW_CHARS = 16e3;
+/**
+* Trim large tool outputs to their last `max` characters (the end of command output is the
+* useful part) and mark them truncated with the full size. Pure.
+*/
+function previewRecord(record, max = OUTPUT_PREVIEW_CHARS) {
+	const { item } = record;
+	if (item.kind !== "tool_call" || !item.output || item.output.text.length <= max) return record;
+	const text = item.output.text;
+	return {
+		...record,
+		item: {
+			...item,
+			output: {
+				...item.output,
+				text: text.slice(text.length - max),
+				truncated: true,
+				totalBytes: item.output.totalBytes ?? Buffer.byteLength(text, "utf8")
+			}
+		}
+	};
+}
+// ../server/src/services/sessions/client-items.ts
+const isPathImage = (a) => a.type === "image" && a.source.type === "path";
+/** The last segment of a path, whichever separator it uses. */
+const fileName = (path) => path.split(/[\\/]/).pop() || "image";
+/**
+* Input as the browser sees it. Image attachments are handed to providers as file paths and
+* providers echo that input back, so a user message can hold a path into the artifacts folder
+* (older transcripts stored it that way too). Such a path becomes its artifact, which the UI
+* loads from `/api/artifacts/:id`; any other image path keeps only its file name, so no
+* filesystem path reaches the browser. Pure apart from the lookup.
+*/
+function clientInput(input, artifacts) {
+	if (!input.attachments.some(isPathImage)) return input;
+	const attachments = input.attachments.map((a) => {
+		if (a.type !== "image" || a.source.type !== "path") return a;
+		const artifact = artifacts.artifactForPath(a.source.path);
+		if (artifact) return {
+			...a,
+			source: {
+				type: "artifact",
+				artifactId: artifact.id
+			}
+		};
+		return {
+			...a,
+			source: {
+				type: "path",
+				path: fileName(a.source.path)
+			}
+		};
+	});
+	return {
+		...input,
+		attachments
+	};
+}
+/** An item record as served to the browser: large outputs previewed, attachments mapped. */
+function clientItemRecord(record, artifacts) {
+	const previewed = previewRecord(record);
+	const { item } = previewed;
+	if (item.kind !== "user_message" || !item.input.attachments.some(isPathImage)) return previewed;
+	return {
+		...previewed,
+		item: {
+			...item,
+			input: clientInput(item.input, artifacts)
+		}
+	};
+}
+/** A stored event as streamed to the browser: agent items carry mapped attachments too. */
+function clientEvent(event, artifacts) {
+	if (event.type !== "agent.item.started" && event.type !== "agent.item.updated" && event.type !== "agent.item.completed") return event;
+	const payload = event.payload;
+	if (!("item" in payload) || payload.item.kind !== "user_message") return event;
+	const { item } = payload;
+	if (!item.input.attachments.some(isPathImage)) return event;
+	return {
+		...event,
+		payload: {
+			...payload,
+			item: {
+				...item,
+				input: clientInput(item.input, artifacts)
+			}
+		}
+	};
+}
 // ../server/src/realtime/coalesce.ts
 function asDelta(e) {
 	return e.type === "agent.item.delta" ? e.payload : void 0;
@@ -21074,30 +21213,6 @@ function coalesceEvents(events) {
 	}
 	return out;
 }
-// ../server/src/services/sessions/preview.ts
-/** Tool output kept in transcript pages and live updates; the rest is fetched on demand (§6). */
-const OUTPUT_PREVIEW_CHARS = 16e3;
-/**
-* Trim large tool outputs to their last `max` characters (the end of command output is the
-* useful part) and mark them truncated with the full size. Pure.
-*/
-function previewRecord(record, max = OUTPUT_PREVIEW_CHARS) {
-	const { item } = record;
-	if (item.kind !== "tool_call" || !item.output || item.output.text.length <= max) return record;
-	const text = item.output.text;
-	return {
-		...record,
-		item: {
-			...item,
-			output: {
-				...item.output,
-				text: text.slice(text.length - max),
-				truncated: true,
-				totalBytes: item.output.totalBytes ?? Buffer.byteLength(text, "utf8")
-			}
-		}
-	};
-}
 // ../server/src/realtime/transcript.ts
 function emptyDirty() {
 	return {
@@ -21148,8 +21263,11 @@ function collectDirty(dirty, events, sessionId, threadIds) {
 		dirty.seq = Math.max(dirty.seq, e.seq);
 	}
 }
-/** Load the latest state of dirty rows as a `transcript` message (outputs previewed). */
-function loadTranscript(db, sessionId, dirty) {
+/**
+* Load the latest state of dirty rows as a `transcript` message (outputs previewed, image
+* paths mapped to artifacts, see `clientItemRecord`).
+*/
+function loadTranscript(db, sessionId, dirty, artifacts) {
 	const ids = (set) => [...set];
 	const msg = {
 		type: "transcript",
@@ -21157,7 +21275,7 @@ function loadTranscript(db, sessionId, dirty) {
 		seq: dirty.seq,
 		threads: dirty.threads.size === 0 ? [] : db.select().from(threads).where(and(eq(threads.sessionId, sessionId), inArray(threads.id, ids(dirty.threads)))).all().map(rowToThread),
 		turns: dirty.turns.size === 0 ? [] : db.select().from(turns).where(and(eq(turns.sessionId, sessionId), inArray(turns.id, ids(dirty.turns)))).all().map(rowToTurn),
-		items: dirty.items.size === 0 ? [] : db.select().from(items).where(and(eq(items.sessionId, sessionId), inArray(items.id, ids(dirty.items)))).all().map((r) => previewRecord(rowToItemRecord(r))).sort((a, b) => a.position - b.position)
+		items: dirty.items.size === 0 ? [] : db.select().from(items).where(and(eq(items.sessionId, sessionId), inArray(items.id, ids(dirty.items)))).all().map((r) => clientItemRecord(rowToItemRecord(r), artifacts)).sort((a, b) => a.position - b.position)
 	};
 	if (dirty.usage) {
 		const usage = db.select({ usage: sessions.usage }).from(sessions).where(eq(sessions.id, sessionId)).get()?.usage;
@@ -21173,6 +21291,7 @@ const MAX_WATCH_REPLAY = 2e4;
 /** A client with this many undelivered events is told to resync (it cannot keep up). */
 const MAX_PENDING = 1e4;
 const BATCH = 500;
+const noArtifacts = { artifactForPath: () => void 0 };
 /**
 * UI realtime hub (§6). Global stream: snapshot seq -> `subscribe { fromSeq }` -> catch-up ->
 * live `events`, batched every ~40ms with text deltas merged. Transcripts: `watch_session`
@@ -21187,12 +21306,14 @@ var WsHub = class {
 	clients = /* @__PURE__ */ new Set();
 	unsubscribe;
 	flushMs;
+	artifacts;
 	constructor(store, db, runnerStatus, opts = {}) {
 		this.store = store;
 		this.db = db;
 		this.runnerStatus = runnerStatus;
 		this.opts = opts;
 		this.flushMs = opts.flushMs ?? 40;
+		this.artifacts = opts.artifacts ?? noArtifacts;
 		this.unsubscribe = store.subscribe((events) => this.onEvents(events));
 	}
 	/** Handlers for `upgradeWebSocket`. */
@@ -21317,7 +21438,7 @@ var WsHub = class {
 			const visible = batch.filter((e) => this.visible(client, e));
 			if (visible.length > 0) send(client.ws, {
 				type: "events",
-				events: coalesceEvents(visible)
+				events: this.present(visible)
 			});
 			cursor = batch.at(-1)?.seq ?? cursor;
 			if (batch.length < BATCH) break;
@@ -21388,7 +21509,7 @@ var WsHub = class {
 		client.timer = void 0;
 		if (!this.clients.has(client)) return;
 		if (client.pending.length > 0) {
-			const events = coalesceEvents(client.pending);
+			const events = this.present(client.pending);
 			client.pending = [];
 			send(client.ws, {
 				type: "events",
@@ -21398,9 +21519,13 @@ var WsHub = class {
 		for (const [sessionId, watch] of client.watches) if (isDirty(watch.dirty)) this.sendTranscript(client, sessionId, watch);
 	}
 	sendTranscript(client, sessionId, watch) {
-		send(client.ws, loadTranscript(this.db, sessionId, watch.dirty));
+		send(client.ws, loadTranscript(this.db, sessionId, watch.dirty, this.artifacts));
 		watch.dirty = emptyDirty();
 	}
+	/** Events as sent to a client: deltas merged, attachment paths mapped. */
+	present(events) {
+		return coalesceEvents(events).map((e) => clientEvent(e, this.artifacts));
+	}
 };
 function send(ws, msg) {
 	if (ws.readyState === 1) ws.send(JSON.stringify(msg));
@@ -22069,15 +22194,15 @@ function conflictRoutes(s) {
 	return new Hono().get("/", queryOf(ListConflictsQuery), (c) => c.json(conflicts.list(c.req.valid("query")))).get("/:id", (c) => c.json(conflicts.get(c.req.param("id")))).post("/:id/resolve", jsonBody(ResolveConflictRequest), async (c) => c.json(await conflicts.resolve(c.req.param("id"), c.req.valid("json"))));
 }
 // ../server/src/routes/projects.ts
-/** `/api/projects`: add from a folder or clone, list, update, archive. */
+/** `/api/projects`: add from a folder or clone, list, reorder, update (and pin), archive. */
 function projectRoutes(s) {
-	return new Hono().get("/", queryOf(object({ archived: _enum(["true", "false"]).optional() })), (c) => c.json(s.projects.list({ includeArchived: c.req.valid("query").archived === "true" }))).post("/", jsonBody(CreateProjectRequest), async (c) => c.json(await s.projects.create(c.req.valid("json")), 201)).get("/:id", (c) => c.json(s.projects.get(c.req.param("id")))).patch("/:id", jsonBody(UpdateProjectRequest), (c) => c.json(s.projects.update(c.req.param("id"), c.req.valid("json")))).delete("/:id", (c) => {
+	return new Hono().get("/", queryOf(object({ archived: _enum(["true", "false"]).optional() })), (c) => c.json(s.projects.list({ includeArchived: c.req.valid("query").archived === "true" }))).post("/", jsonBody(CreateProjectRequest), async (c) => c.json(await s.projects.create(c.req.valid("json")), 201)).put("/order", jsonBody(ReorderProjectsRequest), (c) => c.json({ projects: s.projects.reorder(c.req.valid("json").projectIds) })).get("/:id", (c) => c.json(s.projects.get(c.req.param("id")))).patch("/:id", jsonBody(UpdateProjectRequest), (c) => c.json(s.projects.update(c.req.param("id"), c.req.valid("json")))).delete("/:id", (c) => {
 		s.projects.archive(c.req.param("id"));
 		return c.json({ ok: true });
 	});
 }
 // ../server/src/services/files/path-guard.ts
-const caseInsensitive = process.platform === "win32" || process.platform === "darwin";
+const caseInsensitive$1 = process.platform === "win32" || process.platform === "darwin";
 /** Real path of `p`, or of its nearest existing ancestor with the rest appended. */
 function realish(p) {
 	let current = p;
@@ -22093,8 +22218,8 @@ function realish(p) {
 }
 /** True when `child` is `root` or inside it (no `..` escape, no other drive). */
 function isInside$3(root, child) {
-	const a = caseInsensitive ? root.toLowerCase() : root;
-	const b = caseInsensitive ? child.toLowerCase() : child;
+	const a = caseInsensitive$1 ? root.toLowerCase() : root;
+	const b = caseInsensitive$1 ? child.toLowerCase() : child;
 	const rel = relative(a, b);
 	return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);
 }
@@ -22191,6 +22316,18 @@ function readSessionFile(root, path) {
 		truncated: stat.size > MAX_READ_BYTES$2
 	};
 }
+// ../server/src/services/sessions/workdir.ts
+/** Shown wherever a cleaned-up worktree is needed before the session is resumed. */
+const WORKTREE_REMOVED_MESSAGE = "This session's worktree was cleaned up. Send the session a message to recreate it from its branch.";
+/**
+* Directory a session's files, git commands and terminals use: its worktree, else its cwd.
+* Throws `worktree_removed` (409) once cleanup removed the worktree; the next message to the
+* session recreates it (§9).
+*/
+function sessionWorkdir(session) {
+	if (session.worktreePath && session.worktreeRemovedAt) throw conflict(WORKTREE_REMOVED_MESSAGE, "worktree_removed");
+	return session.worktreePath ?? session.cwd;
+}
 // ../server/src/services/workbench/diff-files.ts
 const CHANGE = {
 	added: "add",
@@ -22373,7 +22510,7 @@ var WorkbenchService = class {
 };
 /** Directory git commands run in: the session's worktree, else its cwd. */
 function workdir(session) {
-	return session.worktreePath ?? session.cwd;
+	return sessionWorkdir(session);
 }
 // ../server/src/routes/session-files.ts
 /** `/api/sessions/:id/files`: read-only file tree and viewer for the session's worktree (§12.3). */
@@ -22381,7 +22518,10 @@ function sessionFileRoutes(s) {
 	return new Hono().get("/:id/files", (c) => c.json(listSessionFiles(workdir(s.sessionRepo.get(c.req.param("id")))))).get("/:id/files/content", queryOf(SessionFileQuery), (c) => c.json(readSessionFile(workdir(s.sessionRepo.get(c.req.param("id"))), c.req.valid("query").path)));
 }
 // ../server/src/routes/sessions.ts
-/** `/api/sessions`: start (with conflict handling), message, steer, interrupt, respond, stop. */
+/**
+* `/api/sessions`: start (with conflict handling), message, steer, interrupt, respond, stop,
+* archive (removes the worktree, §9), unarchive and the queued-message tray.
+*/
 function sessionRoutes(s) {
 	return new Hono().get("/", queryOf(ListSessionsQuery), (c) => c.json(s.sessionRepo.list(c.req.valid("query")))).post("/", jsonBody(StartSessionRequest), async (c) => {
 		const req = c.req.valid("json");
@@ -22392,7 +22532,7 @@ function sessionRoutes(s) {
 			...result,
 			conflictId: record.id
 		}, 409);
-	}).get("/:id", (c) => c.json(s.sessions.detail(c.req.param("id")))).patch("/:id", jsonBody(UpdateSessionRequest), (c) => c.json(s.sessions.update(c.req.param("id"), c.req.valid("json")))).post("/:id/messages", jsonBody(SendMessageRequest), async (c) => c.json(await s.sessions.send(c.req.param("id"), c.req.valid("json")))).post("/:id/steer", jsonBody(SteerRequest), async (c) => {
+	}).get("/:id", (c) => c.json(s.sessions.detail(c.req.param("id")))).patch("/:id", jsonBody(UpdateSessionRequest), async (c) => c.json(await s.sessions.update(c.req.param("id"), c.req.valid("json")))).post("/:id/messages", jsonBody(SendMessageRequest), async (c) => c.json(await s.sessions.send(c.req.param("id"), c.req.valid("json")))).post("/:id/steer", jsonBody(SteerRequest), async (c) => {
 		await s.sessions.steer(c.req.param("id"), c.req.valid("json").input);
 		return c.json({ ok: true });
 	}).post("/:id/interrupt", async (c) => {
@@ -22401,13 +22541,19 @@ function sessionRoutes(s) {
 	}).post("/:id/respond", jsonBody(RespondRequest), async (c) => {
 		await s.sessions.respond(c.req.param("id"), c.req.valid("json"));
 		return c.json({ ok: true });
-	}).post("/:id/stop", async (c) => c.json(await s.sessions.stop(c.req.param("id")))).get("/:id/threads/:threadId/items", queryOf(ThreadItemsQuery), (c) => {
+	}).post("/:id/stop", async (c) => c.json(await s.sessions.stop(c.req.param("id")))).post("/:id/archive", jsonBody(ArchiveSessionRequest), async (c) => c.json(await s.worktreeCleanup.archive(c.req.param("id"), c.req.valid("json")))).post("/:id/unarchive", (c) => c.json(s.worktreeCleanup.unarchive(c.req.param("id")))).get("/:id/queue", (c) => {
+		const body = { messages: s.queue.list(c.req.param("id")) };
+		return c.json(body);
+	}).patch("/:id/queue/:messageId", jsonBody(EditQueuedMessageRequest), (c) => c.json(s.queue.edit(c.req.param("id"), c.req.param("messageId"), c.req.valid("json").text))).delete("/:id/queue/:messageId", (c) => {
+		s.queue.delete(c.req.param("id"), c.req.param("messageId"));
+		return c.json({ ok: true });
+	}).post("/:id/queue/:messageId/send-now", async (c) => c.json(await s.queue.sendNow(c.req.param("id"), c.req.param("messageId")))).get("/:id/threads/:threadId/items", queryOf(ThreadItemsQuery), (c) => {
 		const id = c.req.param("id");
 		s.sessionRepo.get(id);
 		const page = s.sessionRepo.threadPage(id, c.req.param("threadId"), c.req.valid("query"));
 		return c.json({
 			...page,
-			items: page.items.map((r) => previewRecord(r))
+			items: page.items.map((r) => clientItemRecord(r, s.artifacts))
 		});
 	}).get("/:id/items/:itemId/output", (c) => {
 		const record = s.sessionRepo.item(c.req.param("id"), c.req.param("itemId"));
@@ -22801,13 +22947,20 @@ var VoiceService = class {
 			signal
 		});
 	}
-	/** Transcribe recorded audio with the chosen (or configured) cloud engine. */
+	/** Transcribe recorded audio with the chosen (or configured) engine. */
 	async transcribe(audio, opts) {
 		if (audio.bytes.length === 0) throw new ServiceError(400, "empty_audio", "No audio was sent");
 		if (audio.bytes.length > 26214400) throw new ServiceError(413, "audio_too_large", "Audio is larger than 25 MB");
 		const configured = this.deps.settings.get().voice.dictation;
-		const engine = opts.engine ?? (configured.engine === "openai" ? "openai" : "elevenlabs");
+		const engine = opts.engine ?? (configured.engine === "openai" || configured.engine === "local" ? configured.engine : "elevenlabs");
 		const language = opts.language ?? configured.language ?? void 0;
+		if (engine === "local") {
+			if (!this.deps.local) throw new ServiceError(503, "local_unavailable", "Local Whisper is not available");
+			return this.deps.local.transcribe(audio.bytes, {
+				language,
+				signal: opts.signal
+			});
+		}
 		const form = new FormData();
 		form.append("file", new Blob([audio.bytes], { type: audio.mediaType }), audio.fileName);
 		if (engine === "elevenlabs") {
@@ -22874,14 +23027,25 @@ const AUDIO_EXTENSIONS = [
 	[/mp4|m4a|aac/, ".m4a"],
 	[/mpeg|mp3/, ".mp3"]
 ];
-/** `/api/voice/voices`: the ElevenLabs voice picker (§11.3). */
+function modelId(raw) {
+	const parsed = LocalSttModelParams.safeParse({ id: raw });
+	if (!parsed.success) throw badRequest(`Unknown Whisper model: ${raw}`, "unknown_model");
+	return parsed.data.id;
+}
+/**
+* `/api/voice/*` (§11.3): the ElevenLabs voice picker, and local Whisper's status, downloads
+* and deletes.
+*/
 function voiceRoutes(s) {
 	return new Hono().get("/voices", async (c) => {
 		const body = { voices: await s.voice.voices() };
 		return c.json(body);
-	});
+	}).get("/local", (c) => c.json(s.localStt.status())).post("/local/models/:id/download", (c) => c.json(s.localStt.download(modelId(c.req.param("id"))))).delete("/local/models/:id", async (c) => c.json(await s.localStt.remove(modelId(c.req.param("id")))));
 }
-/** `POST /api/tts` (streamed MP3) and `POST /api/stt` (transcription), both opt-in cloud engines. */
+/**
+* `POST /api/tts` (streamed MP3) and `POST /api/stt` (transcription with a cloud engine or
+* local Whisper).
+*/
 function speechRoutes(s) {
 	return new Hono().post("/tts", jsonBody(TtsRequest), async (c) => {
 		const upstream = await s.voice.speak(c.req.valid("json"), c.req.raw.signal);
@@ -22948,7 +23112,7 @@ function createApi(ctx) {
 			uptimeSec: (Date.now() - ctx.startedAt) / 1e3
 		};
 		return c.json(body);
-	}).get("/snapshot", (c) => c.json(buildSnapshot(ctx))).get("/sessions/:id/snapshot", (c) => c.json(buildSessionSnapshot(s, c.req.param("id")))).route("/projects", projectRoutes(s)).route("/projects", projectGithubRoutes(s)).route("/projects", projectFactoryRoutes(s)).route("/factory", factoryRoutes(s)).route("/prs", prRoutes(s)).route("/github", githubRoutes(s)).route("/sessions", sessionGithubRoutes(s)).route("/sessions", sessionRoutes(s)).route("/sessions", workbenchRoutes(s)).route("/sessions", sessionBrowserRoutes(s)).route("/browser", browserRoutes(s)).route("/images", imageRoutes(s)).route("/agent-config", agentConfigRoutes(s)).route("/voice", voiceRoutes(s)).route("/", speechRoutes(s)).route("/sessions", sessionAgentConfigRoutes(s)).route("/sessions", sessionFileRoutes(s)).route("/utility", utilityRoutes(s)).route("/inbox", inboxRoutes(s)).route("/orchestration", orchestrationRoutes(s)).route("/conflicts", conflictRoutes(s)).route("/automations", automationRoutes(s)).route("/projects", projectAutomationRoutes(s)).route("/usage", usageRoutes(s)).route("/setup", setupRoutes(s)).route("/updates", updateRoutes(s)).route("/artifacts", artifactRoutes(s)).route("/secrets", secretRoutes(s)).route("/", fileRoutes(s)).get("/settings", (c) => c.json(s.settings.get())).patch("/settings", async (c) => {
+	}).get("/snapshot", (c) => c.json(buildSnapshot(ctx))).get("/activity", (c) => c.json(buildActivity(s))).get("/sessions/:id/snapshot", (c) => c.json(buildSessionSnapshot(s, c.req.param("id")))).route("/projects", projectRoutes(s)).route("/projects", projectGithubRoutes(s)).route("/projects", projectFactoryRoutes(s)).route("/factory", factoryRoutes(s)).route("/prs", prRoutes(s)).route("/github", githubRoutes(s)).route("/sessions", sessionGithubRoutes(s)).route("/sessions", sessionRoutes(s)).route("/sessions", workbenchRoutes(s)).route("/sessions", sessionBrowserRoutes(s)).route("/browser", browserRoutes(s)).route("/images", imageRoutes(s)).route("/agent-config", agentConfigRoutes(s)).route("/voice", voiceRoutes(s)).route("/", speechRoutes(s)).route("/sessions", sessionAgentConfigRoutes(s)).route("/sessions", sessionFileRoutes(s)).route("/utility", utilityRoutes(s)).route("/inbox", inboxRoutes(s)).route("/orchestration", orchestrationRoutes(s)).route("/conflicts", conflictRoutes(s)).route("/automations", automationRoutes(s)).route("/projects", projectAutomationRoutes(s)).route("/usage", usageRoutes(s)).route("/setup", setupRoutes(s)).route("/updates", updateRoutes(s)).route("/artifacts", artifactRoutes(s)).route("/secrets", secretRoutes(s)).route("/", fileRoutes(s)).get("/settings", (c) => c.json(s.settings.get())).patch("/settings", async (c) => {
 		const patch = await c.req.json().catch(() => void 0);
 		if (!patch || typeof patch !== "object" || Array.isArray(patch)) throw badRequest("Expected a JSON object");
 		let settings;
@@ -22989,6 +23153,16 @@ function buildSnapshot(ctx) {
 		runner: ctx.runnerStatus()
 	};
 }
+/** Running and waiting sessions and open inbox items, for the desktop tray and badge (§17). */
+function buildActivity(s) {
+	const active = s.db.select({ status: sessions.status }).from(sessions).where(inArray(sessions.status, [
+		"starting",
+		"running",
+		"waiting"
+	])).all();
+	const open = s.db.select({ status: inboxItems.status }).from(inboxItems).where(eq(inboxItems.status, "open")).all();
+	return summarizeActivity(active, open);
+}
 /** A whole transcript in one response (prefer the paginated thread items route). */
 function buildSessionSnapshot(s, sessionId) {
 	const seq = s.store.headSeq();
@@ -22999,7 +23173,7 @@ function buildSessionSnapshot(s, sessionId) {
 		session: rowToSession(row),
 		threads: s.db.select().from(threads).where(eq(threads.sessionId, sessionId)).all().map(rowToThread),
 		turns: s.db.select().from(turns).where(eq(turns.sessionId, sessionId)).all().map(rowToTurn),
-		items: s.db.select().from(items).where(eq(items.sessionId, sessionId)).orderBy(asc(items.threadId), asc(items.position)).all().map((r) => previewRecord(rowToItemRecord(r)))
+		items: s.db.select().from(items).where(eq(items.sessionId, sessionId)).orderBy(asc(items.threadId), asc(items.position)).all().map((r) => clientItemRecord(rowToItemRecord(r), s.artifacts))
 	};
 }
 // ../../node_modules/.pnpm/@hono+node-server@2.1.6_hono@4.13.17/node_modules/@hono/node-server/dist/utils/stream.mjs
@@ -24229,7 +24403,7 @@ const githubTools = [
 * text form, prepended to every orchestrator and PM wake so they know the current state
 * without spending a tool call.
 */
-const DAY_MS = 864e5;
+const DAY_MS$1 = 864e5;
 function buildProjectStatus(input) {
 	const recent = input.outcomes.flatMap((n) => {
 		if (n.type === "session.finished") return [{
@@ -24324,18 +24498,29 @@ function projectLines(s, now, indent = "") {
 	}
 	return lines;
 }
+/**
+* CodeDen's own tags (`<codeden_status>`, `<codeden_updates>`) inside free text (a purpose, a
+* quoted PM message) get a look-alike bracket, so only CodeDen's real tags open and close a
+* block and the UI can fold exactly the injected part away.
+*/
+const OWN_TAG = /<(\/?codeden_(?:status|updates))/gi;
+const neutralizeTags = (line) => line.replace(OWN_TAG, "‹$1");
+/** A tagged block: the opening tag, the escaped lines, the closing tag. */
+function block(open, close, lines) {
+	return [
+		open,
+		...lines.map(neutralizeTags),
+		close
+	].join("\n");
+}
 /** The PM's digest for its project. */
 function renderProjectDigest(s, now = Date.now()) {
 	const at = new Date(now).toISOString();
-	return [
-		`<codeden_status project=${quote(s.project.name)} at="${at}">`,
-		...projectLines(s, now),
-		"</codeden_status>"
-	].join("\n");
+	return block(`<codeden_status project=${quote(neutralizeTags(s.project.name))} at="${at}">`, "</codeden_status>", projectLines(s, now));
 }
 /** The orchestrator's digest: every project rolled up. */
 function renderOverviewDigest(o, now = Date.now()) {
-	const lines = [`<codeden_status scope="all projects" at="${new Date(now).toISOString()}">`];
+	const lines = [];
 	if (o.projects.length === 0) lines.push("No projects yet.");
 	for (const p of o.projects) {
 		lines.push(`## ${p.project.name} (${p.project.id})`);
@@ -24346,17 +24531,20 @@ function renderOverviewDigest(o, now = Date.now()) {
 		lines.push("Informational PM messages:");
 		for (const m of o.pmMessages) lines.push(`- ${m.projectId ?? "?"}: ${quote(m.text, 300)}`);
 	}
-	lines.push("</codeden_status>");
-	return lines.join("\n");
+	return block(`<codeden_status scope="all projects" at="${new Date(now).toISOString()}">`, "</codeden_status>", lines);
 }
-/** "Updates since your last turn": one line per notice, for the model. */
+/**
+* "Updates since your last turn": one entry per notice, for the model, inside
+* `<codeden_updates>`. A notice can quote several paragraphs (a PM message), so the tags,
+* not a blank line, mark where the injected part ends and the sender's own text begins.
+*/
 function renderNotices(list, projectName) {
 	const lines = ["Updates since your last turn:"];
 	for (const n of list) {
 		const where = n.projectId && projectName ? ` [${projectName(n.projectId)}]` : "";
 		lines.push(`- (${n.type})${where} ${n.title}${noticeDetail(n)}`);
 	}
-	return lines.join("\n");
+	return block("<codeden_updates>", "</codeden_updates>", lines);
 }
 function noticeDetail(n) {
 	switch (n.type) {
@@ -24377,7 +24565,7 @@ function noticeDetail(n) {
 }
 /** The day window for recent outcomes, from `now`. */
 function dayAgo(now = Date.now()) {
-	return (/* @__PURE__ */ new Date(now - DAY_MS)).toISOString();
+	return (/* @__PURE__ */ new Date(now - DAY_MS$1)).toISOString();
 }
 // ../server/src/mcp/tools/shared/helpers.ts
 /** A project by id, as a tool error when it does not exist or is archived. */
@@ -24950,7 +25138,7 @@ const messageSession = defineTool({
 				attachments: []
 			},
 			whenBusy: whenBusy ?? "queue"
-		})).status}.`;
+		}, "pm")).status}.`;
 	}
 });
 /** `stop_session` (§8.4, always loaded): stop one of the project's agents. */
@@ -25139,9 +25327,9 @@ var ArtifactService = class {
 		return this.dir;
 	}
 	get(id) {
-		const row = this.db.select().from(artifacts).where(eq(artifacts.id, id)).get();
-		if (!row) throw notFound(`No artifact ${id}`, "artifact_not_found");
-		return rowToArtifact(row);
+		const artifact = this.find(id);
+		if (!artifact) throw notFound(`No artifact ${id}`, "artifact_not_found");
+		return artifact;
 	}
 	list(filter = {}) {
 		const conditions = [];
@@ -25154,10 +25342,13 @@ var ArtifactService = class {
 		return resolveInside(this.dir, artifact.path);
 	}
 	/**
-	* Store pasted (base64) images as artifacts and point the attachment at the file, so large
-	* payloads never land in the event log. The runner reads the file by path.
+	* Store pasted (base64) images as artifacts and point the attachment at the artifact, so
+	* large payloads never land in the event log and stored input (queued messages, pending
+	* starts) never carries a filesystem path. `resolveAttachments` turns the reference into a
+	* file path when the input is handed to the runner.
 	*/
 	externalizeAttachments(input, owner) {
+		if (!input.attachments.some((a) => a.type === "image" && a.source.type === "base64")) return input;
 		const attachments = input.attachments.map((a) => {
 			if (a.type !== "image" || a.source.type !== "base64") return a;
 			const bytes = Buffer.from(a.source.data, "base64");
@@ -25169,6 +25360,29 @@ var ArtifactService = class {
 				kind: "image",
 				...owner
 			});
+			return {
+				...a,
+				source: {
+					type: "artifact",
+					artifactId: artifact.id
+				}
+			};
+		});
+		return {
+			...input,
+			attachments
+		};
+	}
+	/**
+	* Point artifact image attachments at their file, for the runner: providers read images by
+	* path. Only call this on input that goes to the runner, never on what the browser sees.
+	*/
+	resolveAttachments(input) {
+		if (!input.attachments.some((a) => a.type === "image" && a.source.type === "artifact")) return input;
+		const attachments = input.attachments.map((a) => {
+			if (a.type !== "image" || a.source.type !== "artifact") return a;
+			const artifact = this.find(a.source.artifactId);
+			if (!artifact) throw badRequest(`No artifact ${a.source.artifactId}`, "unknown_artifact");
 			return {
 				...a,
 				source: {
@@ -25182,7 +25396,27 @@ var ArtifactService = class {
 			attachments
 		};
 	}
+	/**
+	* The artifact whose own file is `path`, or `undefined`. Providers echo the input they were
+	* given, so a user message's image comes back as the resolved path (and older transcripts
+	* stored it that way); this maps it back to the artifact the browser can load. Only an exact
+	* match with an artifact's file inside the artifacts folder counts; nothing is read from disk.
+	*/
+	artifactForPath(path) {
+		const id = (path.split(/[\\/]/).pop() ?? "").replace(/\.[^.]*$/, "");
+		if (!id) return void 0;
+		const artifact = this.find(id);
+		if (!artifact) return void 0;
+		const expected = resolve(this.dir, artifact.path);
+		return comparable(resolve(path)) === comparable(expected) ? artifact : void 0;
+	}
+	find(id) {
+		const row = this.db.select().from(artifacts).where(eq(artifacts.id, id)).get();
+		return row ? rowToArtifact(row) : void 0;
+	}
 };
+const caseInsensitive = process.platform === "win32" || process.platform === "darwin";
+const comparable = (p) => caseInsensitive ? p.toLowerCase() : p;
 // ../server/src/mcp/tools/share-to-chat.ts
 const MEDIA_TYPES$1 = {
 	".png": "image/png",
@@ -42247,7 +42481,7 @@ var AutomationExecutor = class {
 					const res = await this.deps.orchestration().sendToRole("pm", project.id, {
 						text: `Automation "${automation.name}" (${TRIGGER_TEXT[triggeredBy]}):\n\n${text}`,
 						attachments: []
-					});
+					}, "queue", "automation");
 					return this.finished(run, res.sessionId);
 				}
 				case "triage": {
@@ -42736,7 +42970,7 @@ var TriageService = class {
 		return (await this.deps.orchestration().sendToRole("pm", project.id, {
 			text,
 			attachments: []
-		})).sessionId;
+		}, "queue", "automation")).sessionId;
 	}
 	/** The PM's `report_triage`. */
 	async report(project, report) {
@@ -43909,7 +44143,7 @@ function triageInstructions(items) {
 	].join("\n");
 }
 // ../server/src/services/factory/progress.ts
-const BUSY$1 = /* @__PURE__ */ new Set([
+const BUSY$2 = /* @__PURE__ */ new Set([
 	"created",
 	"queued",
 	"starting",
@@ -43923,7 +44157,7 @@ const BUSY$1 = /* @__PURE__ */ new Set([
 async function advanceBuilding(ctx, project, loop, item) {
 	const s = item.builderSessionId ? ctx.repo.find(item.builderSessionId)?.session : void 0;
 	if (!s) return failItem(ctx, loop, item, "The builder session is gone");
-	if (BUSY$1.has(s.status)) return loop;
+	if (BUSY$2.has(s.status)) return loop;
 	const fixAt = item.attempts > 0 ? item.nudges[`fix_${item.attempts}`] : void 0;
 	if (fixAt && Date.parse(s.updatedAt) <= Date.parse(fixAt) && s.status === "idle") return loop;
 	const pr = s.pr ?? ctx.github.prForSession(project.id, s.id, s.branch);
@@ -45151,7 +45385,7 @@ var FactorySessions = class {
 				attachments: []
 			},
 			whenBusy: "queue"
-		});
+		}, "codeden");
 	}
 	/** Stop every live factory session of a project (kill switch). Returns the stopped ids. */
 	async stopAll(projectId) {
@@ -46441,7 +46675,7 @@ function isInside$1(root, path) {
 /** Read evidence sources, confined to the session's worktree, the temp folder and its artifacts. */
 function readEvidence(session, artifacts, sources) {
 	if (sources.length > 10) throw badRequest(`Attach at most 10 files at once`);
-	const cwd = session.worktreePath ?? session.cwd;
+	const cwd = sessionWorkdir(session);
 	const roots = [cwd, tmpdir()].filter(existsSync).map((p) => realpathSync(p));
 	return sources.map((source) => {
 		let file;
@@ -49709,7 +49943,7 @@ function pullRequestBody(text, issue, session) {
 * §9). The PR is projected right away (`pr.opened` / `pr.updated`) and linked to the session.
 */
 async function createPullRequest(deps, session, repo, input) {
-	const cwd = session.worktreePath ?? session.cwd;
+	const cwd = sessionWorkdir(session);
 	const branch = session.branch;
 	if (!branch) throw conflict("This session has no branch to open a pull request from", "no_branch");
 	const base = input.base ?? session.baseBranch ?? repo.defaultBranch;
@@ -50659,7 +50893,7 @@ var ImageService = class {
 		const eff = this.effective(session.projectId);
 		const pick = await this.pick(eff.engine);
 		if (!pick.engine) throw new ServiceError(409, "no_image_engine", pick.reason);
-		const cwd = realpathSync(session.worktreePath ?? session.cwd);
+		const cwd = realpathSync(sessionWorkdir(session));
 		const root = req.role === "agent" ? cwd : this.ensureDir(join(this.deps.generatedDir, session.id));
 		let target;
 		try {
@@ -51822,13 +52056,16 @@ var OrchestrationService = class {
 			return input;
 		}
 	}
-	/** Send a message to the orchestrator or a project's PM, creating the session if needed. */
-	async sendToRole(role, projectId, input, whenBusy = "queue") {
+	/**
+	* Send a message to the orchestrator or a project's PM, creating the session if needed.
+	* `from` labels the message in the queue tray when it has to wait for a running turn.
+	*/
+	async sendToRole(role, projectId, input, whenBusy = "queue", from = "user") {
 		const session = await this.roles.ensure(role, projectId);
 		const res = await this.deps.sessions.send(session.id, {
 			input,
 			whenBusy
-		});
+		}, from);
 		return {
 			sessionId: session.id,
 			status: res.status
@@ -51840,7 +52077,7 @@ var OrchestrationService = class {
 		return this.sendToRole("pm", projectId, {
 			text: `Message from the orchestrator:\n${text}`,
 			attachments: []
-		});
+		}, "queue", "orchestrator");
 	}
 	/** `ask_pm`: ask a PM and wait (up to `timeoutMs`) for the answer. */
 	async askPm(projectId, question, opts) {
@@ -51865,7 +52102,7 @@ var OrchestrationService = class {
 				attachments: []
 			},
 			whenBusy: "queue"
-		});
+		}, "orchestrator");
 		return {
 			...await answer,
 			pmSessionId: pm.id
@@ -51975,7 +52212,7 @@ var OrchestrationService = class {
 				attachments: []
 			},
 			whenBusy: "reject"
-		});
+		}, "codeden");
 		return "sent";
 	}
 	projectName(id) {
@@ -52122,8 +52359,10 @@ var ProjectService = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
+	/** Projects in the canonical order (§13): pinned first, then manual order, then name. */
 	list(opts = {}) {
-		return this.deps.db.select().from(projects).orderBy(asc(projects.name)).all().map(rowToProject).filter((p) => opts.includeArchived || p.archivedAt === null);
+		const all = this.deps.db.select().from(projects).all().map(rowToProject);
+		return sortProjects(all.filter((p) => opts.includeArchived || p.archivedAt === null));
 	}
 	get(id) {
 		const row = this.deps.db.select().from(projects).where(eq(projects.id, id)).get();
@@ -52181,6 +52420,7 @@ var ProjectService = class {
 		if (patch.autonomy !== void 0) next.autonomy = patch.autonomy;
 		if (patch.timezone !== void 0) next.timezone = patch.timezone;
 		if (patch.defaultBranch !== void 0) next.defaultBranch = patch.defaultBranch;
+		if (patch.pinned !== void 0) next.pinned = patch.pinned;
 		this.deps.store.append([{
 			type: "project.updated",
 			sessionId: null,
@@ -52188,6 +52428,37 @@ var ProjectService = class {
 		}]);
 		return next;
 	}
+	/**
+	* Set the manual order of the project list (§13). `projectIds` must name every non-archived
+	* project exactly once. Pinned projects still list first; within each group the order given
+	* here applies.
+	*/
+	reorder(projectIds) {
+		const active = this.list();
+		const known = new Set(active.map((p) => p.id));
+		const seen = /* @__PURE__ */ new Set();
+		const duplicates = /* @__PURE__ */ new Set();
+		for (const id of projectIds) {
+			if (seen.has(id)) duplicates.add(id);
+			seen.add(id);
+		}
+		const unknown = [...seen].filter((id) => !known.has(id));
+		const missing = active.filter((p) => !seen.has(p.id)).map((p) => p.id);
+		if (duplicates.size > 0 || unknown.length > 0 || missing.length > 0) {
+			const problems = [
+				duplicates.size > 0 && `listed more than once: ${[...duplicates].join(", ")}`,
+				unknown.length > 0 && `not active projects: ${unknown.join(", ")}`,
+				missing.length > 0 && `missing: ${missing.join(", ")}`
+			].filter(Boolean);
+			throw badRequest(`The order must list every active project exactly once (${problems.join("; ")})`, "invalid_order");
+		}
+		this.deps.store.append([{
+			type: "projects.reordered",
+			sessionId: null,
+			payload: { projectIds }
+		}]);
+		return this.list();
+	}
 	archive(id) {
 		this.get(id);
 		this.deps.store.append([{
@@ -52211,6 +52482,8 @@ var ProjectService = class {
 			factoryLimits: FactoryLimits.parse({}),
 			killSwitch: false,
 			timezone: null,
+			pinned: false,
+			sortOrder: this.nextSortOrder(),
 			createdAt: now,
 			updatedAt: now,
 			archivedAt: null
@@ -52224,6 +52497,11 @@ var ProjectService = class {
 			kind: "local"
 		};
 	}
+	/** New projects go to the end of the unpinned group, after every slot (archived included). */
+	nextSortOrder() {
+		const row = this.deps.db.select({ last: max(projects.sortOrder) }).from(projects).get();
+		return typeof row?.last === "number" ? row.last + 1 : 0;
+	}
 	uniqueSlug(base) {
 		const taken = new Set(this.list({ includeArchived: true }).map((p) => p.slug));
 		if (!taken.has(base)) return base;
@@ -52265,7 +52543,8 @@ function redactUrls(text) {
 const SHARED = `## How CodeDen keeps you informed
 
 - Every message you receive starts with a \`<codeden_status>\` block: a fresh digest of running and queued work (work key, purpose, status, progress, age), the next scheduled automation runs, open inbox items and recent finishes and failures. Trust it; you do not need a tool call to learn the current state.
-- Messages may also start with "Updates since your last turn": typed notices (session finished, needs input, failed, PR opened, checks failed, automation skipped, conflict). React to the ones that need action and ignore routine ones.
+- After it may come a \`<codeden_updates>\` block, "Updates since your last turn": typed notices (session finished, needs input, failed, PR opened, checks failed, automation skipped, conflict, PM messages). React to the ones that need action and ignore routine ones.
+- Everything after the last of these blocks is what the sender actually wrote.
 - You have no write access to project code. You act only through CodeDen tools on the \`codeden\` MCP server; reading files and read-only git commands are fine.
 - Never start work that duplicates running or queued work. Check the digest first; starting tools return \`conflict\` with the existing work instead of starting. Then choose one resolution and say why: \`wait\` (queue behind it), \`skip\`, \`join\` (send your request to the existing session as a follow-up) or \`force\` (only with a concrete reason, which is recorded).`;
 const ORCHESTRATOR_PROMPT = `# You are the CodeDen orchestrator
@@ -52395,11 +52674,12 @@ var SessionLauncher = class {
 	*/
 	async resume(session, input) {
 		await this.requireRunner();
+		const current = await this.restoreWorktree(session);
 		const result = await this.deps.runner.request({
 			name: "session.start",
-			sessionId: session.id,
-			providerId: session.provider,
-			options: this.sessionOptions(session),
+			sessionId: current.id,
+			providerId: current.provider,
+			options: this.sessionOptions(current),
 			input
 		}, START_TIMEOUT_MS);
 		this.deps.repo.update(session.id, (s) => ({
@@ -52408,6 +52688,32 @@ var SessionLauncher = class {
 			runnerId: this.deps.runner.runnerId()
 		}));
 	}
+	/**
+	* Recreate a worktree that cleanup removed (§9), at the same path from the session's branch,
+	* running the project's setup again. A no-op for sessions that still have their worktree.
+	*/
+	async restoreWorktree(session) {
+		if (!session.worktreeRemovedAt || !session.worktreePath || !session.projectId) return session;
+		const project = this.deps.projects.get(session.projectId);
+		const result = await this.deps.runner.request({
+			name: "workspace.prepare",
+			sessionId: session.id,
+			repoPath: project.path,
+			strategy: "worktree",
+			path: session.worktreePath,
+			branch: session.branch ?? void 0,
+			baseRef: session.baseBranch ?? project.defaultBranch ?? void 0,
+			setupCommands: []
+		}, PREPARE_TIMEOUT_MS);
+		this.deps.log?.(`session ${session.id}: recreated worktree ${result.cwd}`);
+		return this.deps.repo.update(session.id, (s) => ({
+			...s,
+			cwd: result.cwd,
+			worktreePath: result.cwd,
+			branch: result.branch ?? s.branch,
+			worktreeRemovedAt: null
+		}));
+	}
 	/** Mark a session failed with an inbox item explaining why. */
 	fail(sessionId, key, error) {
 		const message = errorMessage(error);
@@ -52655,24 +52961,39 @@ var SessionLifecycle = class {
 	}
 };
 // ../server/src/services/sessions/outbox.ts
+const toMessage = (r) => ({
+	id: r.id,
+	sessionId: r.sessionId,
+	input: r.input,
+	from: r.sender ?? "user",
+	createdAt: r.createdAt
+});
 /**
 * Messages sent while a turn runs, delivered one at a time when the session goes idle.
-* Stored through `message.queued` / `message.dequeued` events, so the queue survives server
-* restarts and can be rebuilt from the log.
+* Stored through `message.queued` / `message.dequeued` / `message.edited` events, so the queue
+* survives server restarts and can be rebuilt from the log.
+*
+* Every method is synchronous. Delivery takes a message out with `remove(…, "sent")` before
+* it awaits anything, so an edit or delete either lands before delivery (and is what gets
+* sent) or finds the message gone; a half-edited message can never be sent.
 */
 var Outbox = class {
 	db;
 	store;
+	/** Last `createdAt` handed out (ms), so timestamps strictly increase. */
+	lastAt = 0;
 	constructor(db, store) {
 		this.db = db;
 		this.store = store;
 	}
-	push(sessionId, input) {
+	push(sessionId, input, from = "user") {
+		this.lastAt = Math.max(Date.now(), this.lastAt + 1);
 		const message = {
 			id: randomUUID(),
 			sessionId,
 			input,
-			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			from,
+			createdAt: new Date(this.lastAt).toISOString()
 		};
 		this.store.append([{
 			type: "message.queued",
@@ -52681,9 +53002,17 @@ var Outbox = class {
 		}]);
 		return message;
 	}
+	/** A session's queued messages, next to be delivered first. */
+	list(sessionId) {
+		return this.db.select().from(queuedMessages).where(eq(queuedMessages.sessionId, sessionId)).orderBy(asc(queuedMessages.createdAt), asc(sql`rowid`)).all().map(toMessage);
+	}
 	/** Oldest queued message of a session, if any. */
 	peek(sessionId) {
-		return this.db.select().from(queuedMessages).where(eq(queuedMessages.sessionId, sessionId)).orderBy(asc(queuedMessages.createdAt)).limit(1).get() ?? void 0;
+		return this.list(sessionId)[0];
+	}
+	get(sessionId, messageId) {
+		const row = this.db.select().from(queuedMessages).where(and(eq(queuedMessages.sessionId, sessionId), eq(queuedMessages.id, messageId))).get();
+		return row ? toMessage(row) : void 0;
 	}
 	count(sessionId) {
 		return this.db.select({ id: queuedMessages.id }).from(queuedMessages).where(eq(queuedMessages.sessionId, sessionId)).all().length;
@@ -52692,6 +53021,26 @@ var Outbox = class {
 	sessionsWithMessages() {
 		return this.db.selectDistinct({ id: queuedMessages.sessionId }).from(queuedMessages).all().map((r) => r.id);
 	}
+	/** Replace a queued message's text; its attachments stay. */
+	edit(message, text) {
+		this.store.append([{
+			type: "message.edited",
+			sessionId: message.sessionId,
+			payload: {
+				sessionId: message.sessionId,
+				messageId: message.id,
+				text,
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		}]);
+		return {
+			...message,
+			input: {
+				...message.input,
+				text
+			}
+		};
+	}
 	remove(message, reason) {
 		this.store.append([{
 			type: "message.dequeued",
@@ -52703,11 +53052,19 @@ var Outbox = class {
 			}
 		}]);
 	}
-	/** Drop every queued message of a session (interrupt, stop). */
+	/** Put a message taken out for delivery back in its place (the delivery failed). */
+	restore(message) {
+		this.store.append([{
+			type: "message.queued",
+			sessionId: message.sessionId,
+			payload: { message }
+		}]);
+	}
+	/** Drop every queued message of a session (interrupt, stop). Returns what was dropped. */
 	clear(sessionId) {
-		const rows = this.db.select().from(queuedMessages).where(eq(queuedMessages.sessionId, sessionId)).all();
-		if (rows.length === 0) return;
-		this.store.append(rows.map((m) => ({
+		const dropped = this.list(sessionId);
+		if (dropped.length === 0) return [];
+		this.store.append(dropped.map((m) => ({
 			type: "message.dequeued",
 			sessionId,
 			payload: {
@@ -52716,6 +53073,11 @@ var Outbox = class {
 				reason: "dropped"
 			}
 		})));
+		return dropped;
+	}
+	/** Why a message is no longer queued, from the log; `undefined` if it never was. */
+	dequeuedReason(sessionId, messageId) {
+		return (this.db.select({ payload: events.payload }).from(events).where(and(eq(events.sessionId, sessionId), eq(events.type, "message.dequeued"), sql`json_extract(${events.payload}, '$.messageId') = ${messageId}`)).orderBy(desc(events.seq)).limit(1).get()?.payload)?.reason;
 	}
 };
 // ../server/src/services/sessions/questions.ts
@@ -52815,6 +53177,71 @@ var QuestionBroker = class {
 function formatAnswers(item, answers) {
 	return item.questions.map((q) => `Q: ${q.question}\nA: ${(answers[q.id] ?? []).join(", ") || "(no answer)"}`).join("\n\n");
 }
+// ../server/src/services/sessions/queue.ts
+const BUSY$1 = /* @__PURE__ */ new Set(["running", "waiting"]);
+/**
+* The queued-message tray (`/api/sessions/:id/queue`): list, edit, delete and send-now.
+* Messages are taken from the `Outbox` synchronously, so a request racing delivery either
+* wins or answers 409 `already_sent`; it never acts on a message that is being delivered.
+*/
+var QueueService = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** A session's queued messages as the browser sees them, next first. */
+	list(sessionId) {
+		this.deps.repo.get(sessionId);
+		return this.deps.outbox.list(sessionId).map((m) => this.present(m));
+	}
+	edit(sessionId, messageId, text) {
+		const message = this.require(sessionId, messageId);
+		if (!text.trim() && message.input.attachments.length === 0) throw badRequest("A queued message needs text or an attachment", "empty_message");
+		return this.present(this.deps.outbox.edit(message, text));
+	}
+	delete(sessionId, messageId) {
+		this.deps.outbox.remove(this.require(sessionId, messageId), "deleted");
+	}
+	/**
+	* Steer the running turn with a queued message, ahead of its place. Only a running turn
+	* can take it (409 `no_turn` otherwise; the queue sends it next, in order), and only on a
+	* provider that can steer. If the steer fails the message goes back in its place.
+	*/
+	async sendNow(sessionId, messageId) {
+		const message = this.require(sessionId, messageId);
+		const session = this.deps.repo.get(sessionId);
+		if (!BUSY$1.has(session.status)) {
+			this.deps.sessions.flushOutbox(sessionId).catch(() => void 0);
+			throw conflict("No turn is running: the queue sends this message next", "no_turn");
+		}
+		if (!this.deps.providers().find((p) => p.id === session.provider)?.capabilities.steer) throw conflict("This provider cannot steer a running turn", "unsupported");
+		this.deps.outbox.remove(message, "sent");
+		try {
+			await this.deps.sessions.steer(sessionId, message.input);
+			return { status: "steered" };
+		} catch (error) {
+			this.deps.outbox.restore(message);
+			this.deps.sessions.flushOutbox(sessionId).catch(() => void 0);
+			throw error;
+		}
+	}
+	/** The queued message, or 409 `already_sent` / 404 when it is no longer queued. */
+	require(sessionId, messageId) {
+		this.deps.repo.get(sessionId);
+		const message = this.deps.outbox.get(sessionId, messageId);
+		if (message) return message;
+		const reason = this.deps.outbox.dequeuedReason(sessionId, messageId);
+		if (reason === "sent") throw conflict("This message was already sent", "already_sent");
+		if (reason) throw conflict("This message is no longer queued", "no_longer_queued");
+		throw notFound("No such queued message", "queued_message_not_found");
+	}
+	present(message) {
+		return {
+			...message,
+			input: clientInput(message.input, this.deps.artifacts)
+		};
+	}
+};
 // ../server/src/services/sessions/recovery.ts
 /** The message sent to an agent whose turn was cut off by a restart (§4.2). */
 const RESTART_CONTINUE_MESSAGE = "You were interrupted by a CodeDen restart; continue where you left off.";
@@ -53023,6 +53450,8 @@ function projectDefaultProvider(project) {
 	return project.defaultProvider ?? readProjectConfig(project.path)?.defaultProvider ?? null;
 }
 // ../server/src/services/sessions/reconfigure.ts
+/** How long `PATCH` waits for the runner to take an autonomy change. */
+const AUTONOMY_TIMEOUT_MS = 1e4;
 function fallbackMeta$1() {
 	return {
 		workspaceMode: "worktree",
@@ -53031,12 +53460,32 @@ function fallbackMeta$1() {
 		queuedBehind: []
 	};
 }
+/** Merge `change` into the pending config (keys set to undefined are removed). */
+function setPending(repo, id, change) {
+	repo.setStartMeta(id, (m) => {
+		const { pendingConfig, ...meta } = m ?? fallbackMeta$1();
+		const next = {
+			...pendingConfig,
+			...change
+		};
+		for (const key of Object.keys(next)) if (next[key] === void 0) delete next[key];
+		return Object.keys(next).length > 0 ? {
+			...meta,
+			pendingConfig: next
+		} : meta;
+	});
+}
 /**
-* `PATCH /api/sessions/:id`: update model, effort or title. Model and effort changes are
-* remembered as pending and applied right before the next turn (`applyPendingConfig`), so a
-* running turn keeps its settings.
+* `PATCH /api/sessions/:id`: update model, effort, autonomy or title. Every change is saved
+* on the session (`session.updated`), so it survives a restart and later starts and resumes
+* use it.
+* - Model and effort are remembered as pending and applied right before the next turn
+*   (`applyPendingConfig`), so a running turn keeps its settings.
+* - Autonomy is pushed to the live provider session at once: from the next tool call where
+*   the provider supports it, otherwise from the next turn. If the runner cannot take it now,
+*   it is retried before the next turn.
 */
-function updateSession(repo, id, req) {
+async function updateSession(repo, runner, id, req) {
 	const change = {};
 	if (req.model !== void 0) change.model = req.model;
 	if (req.effort !== void 0) change.effort = req.effort;
@@ -53044,24 +53493,34 @@ function updateSession(repo, id, req) {
 		...s,
 		...change.model !== void 0 ? { model: change.model } : {},
 		...change.effort !== void 0 ? { effort: change.effort } : {},
+		...req.autonomy !== void 0 ? { autonomy: req.autonomy } : {},
 		...req.title !== void 0 ? { title: req.title } : {}
 	}));
-	if (Object.keys(change).length > 0) repo.setStartMeta(id, (m) => {
-		const meta = m ?? fallbackMeta$1();
-		return {
-			...meta,
-			pendingConfig: {
-				...meta.pendingConfig,
-				...change
-			}
-		};
-	});
+	if (Object.keys(change).length > 0) setPending(repo, id, change);
+	if (req.autonomy !== void 0) await applyAutonomy(repo, runner, session);
 	return session;
 }
 /**
-* Apply a pending model/effort change on the runner before the next turn. When the runner no
-* longer hosts the session, the resume that follows opens it with the new settings anyway.
-* Returns a warning when the provider cannot change them live (they apply on the next resume).
+* Tell the runner about the session's autonomy. When the runner does not host the session,
+* or cannot be reached, the level stays pending; a later start or resume reads it from the
+* session anyway.
+*/
+async function applyAutonomy(repo, runner, session) {
+	try {
+		await runner.request({
+			name: "session.configure",
+			sessionId: session.id,
+			autonomy: session.autonomy
+		}, AUTONOMY_TIMEOUT_MS);
+		setPending(repo, session.id, { autonomy: void 0 });
+	} catch {
+		setPending(repo, session.id, { autonomy: session.autonomy });
+	}
+}
+/**
+* Apply pending settings on the runner before the next turn. When the runner no longer hosts
+* the session, the resume that follows opens it with the new settings anyway. Returns a
+* warning when the provider cannot change them live (they apply on the next resume).
 */
 async function applyPendingConfig(repo, runner, session) {
 	const pending = (repo.find(session.id)?.startMeta)?.pendingConfig;
@@ -53084,7 +53543,7 @@ async function applyPendingConfig(repo, runner, session) {
 			clear();
 			return;
 		}
-		return `Model/effort change not applied live (${code ?? "error"}); it applies when the session is resumed.`;
+		return `Session settings not applied live (${code ?? "error"}); they apply when the session is resumed.`;
 	}
 }
 // ../server/src/services/sessions/session-service.ts
@@ -53113,9 +53572,9 @@ var SessionService = class {
 	setInputDecorator(fn) {
 		this.inputDecorator = fn;
 	}
-	/** Model, effort (applied on the next turn) or title. */
+	/** Model and effort (applied on the next turn), autonomy (pushed to the runner) or title. */
 	update(id, req) {
-		return updateSession(this.deps.repo, id, req);
+		return updateSession(this.deps.repo, this.deps.runner, id, req);
 	}
 	detail(id) {
 		const found = this.deps.repo.find(id);
@@ -53163,7 +53622,7 @@ var SessionService = class {
 					if (req.input) await this.send(target.id, {
 						input: req.input,
 						whenBusy: "queue"
-					});
+					}, req.startedBy.kind);
 					return {
 						status: "joined",
 						sessionId: target.id
@@ -53220,16 +53679,17 @@ var SessionService = class {
 		} : s);
 		this.launchInBackground(session.id, pending.input, pending.workspace);
 	}
-	async send(id, req) {
+	/** Send now, steer or queue (`whenBusy`); `from` labels the message if it is queued. */
+	async send(id, req, from = "user") {
 		const session = this.deps.repo.get(id);
-		if (NOT_STARTED.has(session.status)) return this.enqueue(id, req.input);
+		if (NOT_STARTED.has(session.status)) return this.enqueue(id, req.input, from);
 		if (BUSY.has(session.status)) {
 			if (req.whenBusy === "reject") throw conflict("A turn is running", "turn_running");
 			if (req.whenBusy === "steer") {
 				await this.steer(id, req.input);
 				return { status: "steered" };
 			}
-			return this.enqueue(id, req.input);
+			return this.enqueue(id, req.input, from);
 		}
 		await this.sendNow(session, req.input);
 		return { status: "sent" };
@@ -53238,7 +53698,7 @@ var SessionService = class {
 		const session = this.deps.repo.get(id);
 		if (!BUSY.has(session.status)) throw conflict("No turn is running", "no_turn");
 		if (!this.provider(session.provider)?.capabilities.steer) throw conflict("This provider cannot steer a running turn", "unsupported");
-		const input = this.externalize(session, raw);
+		const input = this.forRunner(session, raw);
 		await this.deps.runner.request({
 			name: "session.steer",
 			sessionId: id,
@@ -53324,15 +53784,20 @@ var SessionService = class {
 		return this.deps.outbox.count(id) > 0;
 	}
 	async sendNow(session, raw) {
-		const input = this.externalize(session, this.inputDecorator?.(session, raw) ?? raw);
+		const input = this.forRunner(session, this.inputDecorator?.(session, raw) ?? raw);
 		await applyPendingConfig(this.deps.repo, this.deps.runner, session);
 		const previous = session.status;
 		this.deps.repo.update(session.id, (s) => ({
 			...s,
 			status: "running",
-			endedAt: null
+			endedAt: null,
+			archivedAt: null
 		}));
 		try {
+			if (session.worktreeRemovedAt) {
+				await this.deps.launcher.resume(this.deps.repo.get(session.id), input);
+				return;
+			}
 			try {
 				await this.deps.runner.request({
 					name: "session.send",
@@ -53351,20 +53816,25 @@ var SessionService = class {
 			throw toServiceError$1(error);
 		}
 	}
-	enqueue(id, input) {
+	enqueue(id, input, from) {
 		const session = this.deps.repo.get(id);
-		this.deps.outbox.push(id, this.externalize(session, input));
+		this.deps.outbox.push(id, this.externalize(session, input), from);
 		return { status: "queued" };
 	}
+	/** Pasted images saved as artifacts: the form CodeDen stores (queued messages). */
 	externalize(session, input) {
 		return this.deps.artifacts.externalizeAttachments(input, {
 			sessionId: session.id,
 			projectId: session.projectId
 		});
 	}
+	/** Input handed to the runner: artifacts resolved to the file paths providers read. */
+	forRunner(session, input) {
+		return this.deps.artifacts.resolveAttachments(this.externalize(session, input));
+	}
 	launchInBackground(id, input, workspace) {
 		const session = this.deps.repo.get(id);
-		const prepared = input ? this.externalize(session, input) : void 0;
+		const prepared = input ? this.forRunner(session, input) : void 0;
 		const promise = this.deps.launcher.launch(id, {
 			input: prepared,
 			workspace
@@ -53432,6 +53902,176 @@ function fallbackMeta() {
 		queuedBehind: []
 	};
 }
+// ../server/src/services/sessions/worktree-cleanup.ts
+const DAY_MS = 864e5;
+const REMOVE_TIMEOUT_MS = 12e4;
+/** Sessions that may be using their worktree right now; never cleaned up. */
+const IN_USE = /* @__PURE__ */ new Set([
+	"created",
+	"queued",
+	"starting",
+	"running",
+	"waiting"
+]);
+const outcome = (status, message = null) => ({
+	status,
+	message
+});
+/**
+* Whether the sweep should remove a session's worktree now: an agent session that owns a
+* worktree it is not using, and is either archived or has been inactive for `afterDays`
+* without an open pull request. Archived sessions are retried even with cleanup off.
+*/
+function cleanupDue(session, now, settings) {
+	if (session.role !== "agent" || !session.projectId) return false;
+	if (!session.worktreePath || session.worktreeRemovedAt) return false;
+	if (IN_USE.has(session.status)) return false;
+	if (session.archivedAt) return true;
+	if (!settings.cleanup) return false;
+	if (session.pr && (session.pr.state === "open" || session.pr.state === "draft")) return false;
+	return now.getTime() - Date.parse(session.updatedAt) >= settings.afterDays * DAY_MS;
+}
+/**
+* Worktree cleanup (§9). Archiving a session removes its worktree right away; an hourly sweep
+* removes worktrees of sessions inactive for the configured number of days; archiving a project
+* cleans up its sessions. Everything goes through the runner's workspace commands, so a remote
+* runner cleans up its own storage. Uncommitted changes always keep a worktree unless forced.
+* The branch and checkpoints stay, and the next message recreates the worktree.
+*/
+var WorktreeCleanup = class {
+	deps;
+	timer;
+	unsubscribe;
+	sweeping = false;
+	/** Sessions the sweep could not clean (dirty, locked), keyed to the `updatedAt` it saw. */
+	kept = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	start() {
+		this.unsubscribe = this.deps.store.subscribe((events) => {
+			setImmediate(() => this.onEvents(events));
+		});
+		const interval = this.deps.intervalMs ?? 36e5;
+		const first = setTimeout(() => {
+			this.sweep();
+			this.timer = setInterval(() => void this.sweep(), interval);
+			this.timer.unref?.();
+		}, this.deps.initialDelayMs ?? 6e4);
+		first.unref?.();
+		this.timer = first;
+	}
+	stop() {
+		this.unsubscribe?.();
+		clearTimeout(this.timer);
+		clearInterval(this.timer);
+	}
+	/** Stop the session if needed, hide it from the sidebar and remove its worktree. */
+	async archive(id, opts = {}) {
+		const current = this.deps.repo.get(id);
+		if (current.role !== "agent") throw badRequest("Only agent sessions can be archived", "not_archivable");
+		if (IN_USE.has(current.status) || current.status === "idle") await this.deps.stopSession(id);
+		this.deps.repo.update(id, (s) => s.archivedAt ? s : {
+			...s,
+			archivedAt: this.now().toISOString()
+		});
+		const worktree = await this.removeWorktree(id, { force: opts.force === true });
+		return {
+			session: this.deps.repo.get(id),
+			worktree
+		};
+	}
+	/** Show an archived session again. Its worktree comes back with the next message. */
+	unarchive(id) {
+		return this.deps.repo.update(id, (s) => s.archivedAt ? {
+			...s,
+			archivedAt: null
+		} : s);
+	}
+	/**
+	* Remove a session's worktree through the runner. Refuses while the session is in use, and
+	* keeps a worktree with uncommitted changes unless `force`.
+	*/
+	async removeWorktree(id, opts) {
+		const session = this.deps.repo.get(id);
+		if (!session.worktreePath || session.worktreeRemovedAt || !session.projectId) return outcome("none");
+		if (IN_USE.has(session.status)) return outcome("failed", "The session is still working; stop it first");
+		let repoPath;
+		try {
+			repoPath = this.deps.projects.get(session.projectId).path;
+		} catch {
+			return outcome("none");
+		}
+		if (!this.deps.runner.isConnected()) return outcome("failed", "The runner is not connected; cleanup will retry later");
+		await this.deps.runner.request({
+			name: "session.stop",
+			sessionId: id
+		}, 15e3).catch(() => void 0);
+		try {
+			await this.deps.runner.request({
+				name: "workspace.remove",
+				repoPath,
+				path: session.worktreePath,
+				force: opts.force
+			}, REMOVE_TIMEOUT_MS);
+		} catch (error) {
+			const message = errorMessage(error);
+			if (runnerErrorCode(error) === "worktree_dirty" || /modified or untracked/.test(message)) return outcome("kept_changes", "The worktree has uncommitted changes, so it was kept");
+			return outcome("failed", message);
+		}
+		this.deps.repo.update(id, (s) => ({
+			...s,
+			worktreeRemovedAt: this.now().toISOString()
+		}));
+		this.kept.delete(id);
+		this.deps.log?.(`worktree cleanup: removed ${session.worktreePath}`);
+		return outcome("removed");
+	}
+	/** Remove every worktree that is due (see `cleanupDue`). Returns the cleaned session ids. */
+	async sweep() {
+		if (this.sweeping || !this.deps.runner.isConnected()) return [];
+		this.sweeping = true;
+		const removed = [];
+		try {
+			const now = this.now();
+			const settings = this.deps.settings().worktrees;
+			for (const session of this.deps.repo.list({ role: "agent" })) {
+				if (!cleanupDue(session, now, settings)) continue;
+				if (this.kept.get(session.id) === session.updatedAt) continue;
+				const result = await this.removeWorktree(session.id, { force: false });
+				if (result.status === "removed") removed.push(session.id);
+				else if (result.status !== "none") this.kept.set(session.id, this.deps.repo.get(session.id).updatedAt);
+			}
+		} catch (error) {
+			this.deps.log?.(`worktree cleanup failed: ${errorMessage(error)}`);
+		} finally {
+			this.sweeping = false;
+		}
+		return removed;
+	}
+	/** Clean up the worktrees of an archived project's sessions that are not in use. */
+	async cleanProject(projectId) {
+		const removed = [];
+		for (const session of this.deps.repo.list({
+			projectId,
+			role: "agent"
+		})) {
+			if (!session.worktreePath || session.worktreeRemovedAt || IN_USE.has(session.status)) continue;
+			if ((await this.removeWorktree(session.id, { force: false })).status === "removed") removed.push(session.id);
+		}
+		return removed;
+	}
+	onEvents(events) {
+		for (const e of events) {
+			if (e.type !== "project.archived") continue;
+			const projectId = e.payload.projectId;
+			if (typeof projectId === "string") this.cleanProject(projectId).catch((error) => this.deps.log?.(`worktree cleanup for project ${projectId}: ${errorMessage(error)}`));
+		}
+	}
+	now() {
+		return this.deps.now?.() ?? /* @__PURE__ */ new Date();
+	}
+};
 // ../server/src/services/setup/claude-sdk.ts
 /**
 * Claude Code support (§14): reports and installs the Claude Agent SDK into `<home>/deps`.
@@ -53907,6 +54547,11 @@ async function checkNode({ nodeVersion, platform }) {
 		message: `Node.js 24+ is required`,
 		fix: installFix("node", platform)
 	};
+	if (isElectronRuntime()) return {
+		...check,
+		state: "ok",
+		message: `Node.js ${check.version} (built into the app)`
+	};
 	return {
 		...check,
 		state: "ok",
@@ -53998,6 +54643,9 @@ var SetupService = class {
 			warnings
 		};
 		this.cached = status;
+		try {
+			this.deps.onChecked?.(status);
+		} catch {}
 		return status;
 	}
 	regressed(previous, check) {
@@ -54119,6 +54767,178 @@ function changelogSection(markdown, version) {
 	const end = rest.findIndex((line) => /^##\s/.test(line));
 	return (end === -1 ? rest : rest.slice(0, end)).join("\n").trim() || null;
 }
+// ../server/src/services/updates/desktop.ts
+const SIX_HOURS$1 = 216e5;
+const DESKTOP_RELEASES_URL = "https://github.com/leonvanzyl/codeden/releases/latest";
+/**
+* Update checks for the desktop app (§17). Same contract and policy as the npm self-update
+* (`UpdateService`): check on start and every 6 hours unless the mode is `off`, offer the
+* update in `notify` mode, download it in the background in `auto` mode (it installs when
+* the app quits). The work itself (GitHub Releases, download, installer) happens in the
+* desktop main process; this class drives it and maps its state onto `UpdateStatus`, so the
+* existing update banner and About page work unchanged.
+*/
+var DesktopUpdateService = class {
+	deps;
+	timer;
+	restartWhenDownloaded = false;
+	/** The last command that failed was a download or install (an "update failed", not a check). */
+	installFailed = false;
+	listeners = /* @__PURE__ */ new Set();
+	notesCache = /* @__PURE__ */ new Map();
+	stopDesktopEvents;
+	constructor(deps) {
+		this.deps = deps;
+		this.stopDesktopEvents = deps.desktop.onChange((state) => this.onDesktopState(state));
+	}
+	get current() {
+		return this.deps.current ?? CODEDEN_VERSION;
+	}
+	get enabled() {
+		return this.deps.mode() !== "off" && !this.deps.checksDisabled;
+	}
+	start() {
+		this.checkAndMaybeDownload();
+		this.timer = setInterval(() => void this.checkAndMaybeDownload(), this.deps.intervalMs ?? SIX_HOURS$1);
+		this.timer.unref();
+	}
+	stop() {
+		clearInterval(this.timer);
+		this.timer = void 0;
+		this.stopDesktopEvents();
+	}
+	onChange(listener) {
+		this.listeners.add(listener);
+		return () => this.listeners.delete(listener);
+	}
+	async status(opts = {}) {
+		if (this.enabled) {
+			const { checkedAt, phase } = this.deps.desktop.state();
+			const last = checkedAt ? Date.parse(checkedAt) : null;
+			const stale = last === null || this.now() - last > SIX_HOURS$1;
+			if ((opts.refresh || stale) && isQuiet(phase)) await this.check();
+		}
+		return this.snapshot();
+	}
+	snapshot() {
+		const d = this.deps.desktop.state();
+		const enabled = this.enabled;
+		const latestIsNewer = d.latest !== null && isNewerVersion(d.latest, this.current);
+		let state = "idle";
+		let progress = null;
+		if (d.phase === "downloading") {
+			state = "installing";
+			progress = d.percent === null ? "Downloading" : `Downloading ${Math.floor(d.percent)}%`;
+		} else if (d.phase === "downloaded") state = "installed";
+		else if (d.phase === "installing") state = "restarting";
+		else if (d.phase === "error" && this.installFailed) state = "failed";
+		const checkError = d.phase === "error" && !this.installFailed ? d.error : null;
+		return {
+			current: this.current,
+			latest: d.latest,
+			updateAvailable: enabled && latestIsNewer && d.unsupported === null,
+			enabled,
+			mode: this.deps.mode(),
+			checkedAt: d.checkedAt,
+			error: enabled ? d.unsupported ?? checkError : null,
+			command: DESKTOP_RELEASES_URL,
+			source: "desktop",
+			state,
+			target: state === "idle" ? null : d.latest,
+			progress,
+			installError: state === "failed" ? d.error ?? "The update could not be downloaded" : null,
+			canRestart: d.unsupported === null,
+			restartCommand: "Quit CodeDen from the tray and open it again",
+			installed: [],
+			rollbackTo: null,
+			canRollback: false,
+			warning: null
+		};
+	}
+	/**
+	* Download the latest release and, unless `restart` is false, install it and restart the
+	* app once downloaded. Returns at once; progress follows through `onChange`.
+	*/
+	install(opts = {}) {
+		const d = this.deps.desktop.state();
+		if (d.unsupported) throw conflict(d.unsupported, "updates_unsupported");
+		if (opts.version && d.latest && opts.version !== d.latest) throw conflict(`The desktop app installs the latest release (${d.latest}); download older versions from GitHub.`, "version_unavailable");
+		if (d.phase === "downloading" || d.phase === "installing") return this.snapshot();
+		const restart = opts.restart !== false;
+		if (d.phase === "downloaded") {
+			if (restart) this.runCommand("install");
+			return this.snapshot();
+		}
+		this.restartWhenDownloaded = restart;
+		this.runCommand("download");
+		return this.snapshot();
+	}
+	/** Install the downloaded update and restart the app. */
+	restartNow() {
+		if (this.deps.desktop.state().phase !== "downloaded") throw conflict("No downloaded update is waiting for a restart", "nothing_to_restart");
+		this.runCommand("install");
+		return this.snapshot();
+	}
+	rollback() {
+		throw conflict("The desktop app can't roll back by itself; install an older release from GitHub.", "nothing_to_roll_back");
+	}
+	notes(version) {
+		let cached = this.notesCache.get(version);
+		if (!cached) {
+			cached = fetchReleaseNotes(version, this.deps.notes, this.deps.fetch);
+			cached.catch(() => this.notesCache.delete(version));
+			this.notesCache.set(version, cached);
+		}
+		return cached;
+	}
+	async checkAndMaybeDownload() {
+		if (!this.enabled || !isQuiet(this.deps.desktop.state().phase)) return;
+		await this.check();
+		const d = this.deps.desktop.state();
+		if (this.deps.mode() === "auto" && d.phase === "available" && d.unsupported === null) {
+			this.deps.log?.(`updates: downloading ${d.latest} in the background (auto mode)`);
+			this.restartWhenDownloaded = false;
+			this.runCommand("download");
+		}
+	}
+	async check() {
+		try {
+			await this.deps.desktop.run("check");
+			this.installFailed = false;
+		} catch (error) {
+			this.deps.log?.(`updates: check failed: ${errorMessage(error)}`);
+		}
+		this.emit();
+	}
+	runCommand(command) {
+		this.installFailed = false;
+		this.deps.desktop.run(command).catch((error) => {
+			this.installFailed = true;
+			this.restartWhenDownloaded = false;
+			this.deps.log?.(`updates: ${command} failed: ${errorMessage(error)}`);
+			this.emit();
+		});
+	}
+	onDesktopState(state) {
+		if (state.phase === "downloaded" && this.restartWhenDownloaded) {
+			this.restartWhenDownloaded = false;
+			this.runCommand("install");
+		}
+		this.emit();
+	}
+	emit() {
+		if (this.listeners.size === 0) return;
+		const status = this.snapshot();
+		for (const listener of this.listeners) listener(status);
+	}
+	now() {
+		return this.deps.now?.() ?? Date.now();
+	}
+};
+/** No check, download or install is in flight. */
+function isQuiet(phase) {
+	return phase === "idle" || phase === "available" || phase === "error";
+}
 // ../server/src/services/updates/installer.ts
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /**
@@ -54197,10 +55017,10 @@ async function installAppVersion(opts) {
 function reportedVersion(entry) {
 	return new Promise((resolve, reject) => {
 		execFile(process.execPath, [entry, "--version"], {
-			env: {
+			env: ownNodeEnv({
 				...process.env,
 				CODEDEN_NO_SWITCH: "1"
-			},
+			}),
 			timeout: 6e4,
 			windowsHide: true
 		}, (error, stdout, stderr) => {
@@ -54357,7 +55177,7 @@ var UpdateService = class {
 	* Returns at once with the `installing` status; progress follows through `onChange`.
 	*/
 	install(opts = {}) {
-		if (this.host.source === "source") throw conflict("You're running CodeDen from source: pull and rebuild to update.", "running_from_source");
+		if (this.host.source !== "packaged") throw conflict("You're running CodeDen from source: pull and rebuild to update.", "running_from_source");
 		if (this.state === "installing" || this.state === "restarting") return this.snapshot();
 		const restart = opts.restart !== false;
 		this.state = "installing";
@@ -55783,6 +56603,532 @@ var ProviderUtilityService = class {
 function clip(text, max) {
 	return text.length > max ? `${text.slice(0, max)}...` : text;
 }
+// ../server/src/services/voice/local/catalog.ts
+const WHISPER_RUNTIME_VERSION = "1.1.3";
+const runtime = (target, sha256, bytes) => ({
+	version: WHISPER_RUNTIME_VERSION,
+	url: `https://registry.npmjs.org/@fugood/node-whisper-${target}/-/node-whisper-${target}-${WHISPER_RUNTIME_VERSION}.tgz`,
+	sha256,
+	bytes,
+	entry: "package/index.node"
+});
+/** Prebuilt runtimes by `process.platform-process.arch`. */
+const RUNTIME_PINS = {
+	"win32-x64": runtime("win32-x64", "25d54aff191d51833a4941ed77d54beeef034fad585c485938fb34e59f32cb4a", 1205460),
+	"win32-arm64": runtime("win32-arm64", "c6e36608d32aaec62e6f07bdfd7a29576c12b0eb2cf396bed6f6b5ee236a1342", 1226903),
+	"darwin-x64": runtime("darwin-x64", "8f9af3930e94f7b4123cc39ae8fea2554477404e65d4d5ad6a0ca142a6add591", 1642873),
+	"darwin-arm64": runtime("darwin-arm64", "cb54d7e9050a896d794193367769b0c93e77c51e34861d521140c2dd8cc501dc", 1516419),
+	"linux-x64": runtime("linux-x64", "d847231487492e4bcaef2d6d47e06e4b4ea872ee621fc988d01b7f0733006224", 1279405),
+	"linux-arm64": runtime("linux-arm64", "f392eacef6c773442e5c427a6dca5ab6cd3f4f104ca8d609c27c7cf97e6e2a4a", 1199206)
+};
+/** Hugging Face revision of `ggerganov/whisper.cpp` the checksums below belong to. */
+const MODEL_REVISION = "5359861c739e955e79d9a303bcbc70fb988958b1";
+const model = (id, sha256, bytes, info) => {
+	const file = `ggml-${id}-q5_1.bin`;
+	return {
+		id,
+		file,
+		url: `https://huggingface.co/ggerganov/whisper.cpp/resolve/${MODEL_REVISION}/${file}`,
+		sha256,
+		bytes,
+		englishOnly: id.endsWith(".en"),
+		...info
+	};
+};
+/** The models offered in Settings, smallest first. */
+const MODEL_PINS = [
+	model("tiny.en", "c77c5766f1cef09b6b7d47f21b546cbddd4157886b3b5d6d4f709e91e66c7c2b", 32166155, {
+		label: "Tiny (English)",
+		hint: "Fastest, lower accuracy",
+		recommended: false
+	}),
+	model("tiny", "818710568da3ca15689e31a743197b520007872ff9576237bda97bd1b469c3d7", 32152673, {
+		label: "Tiny",
+		hint: "Fastest, lower accuracy, many languages",
+		recommended: false
+	}),
+	model("base.en", "4baf70dd0d7c4247ba2b81fafd9c01005ac77c2f9ef064e00dcf195d0e2fdd2f", 59721011, {
+		label: "Base (English)",
+		hint: "Fast, good accuracy",
+		recommended: true
+	}),
+	model("base", "422f1ae452ade6f30a004d7e5c6a43195e4433bc370bf23fac9cc591f01a8898", 59707625, {
+		label: "Base",
+		hint: "Fast, good accuracy, many languages",
+		recommended: false
+	}),
+	model("small.en", "bfdff4894dcb76bbf647d56263ea2a96645423f1669176f4844a1bf8e478ad30", 190098681, {
+		label: "Small (English)",
+		hint: "Slower, best accuracy",
+		recommended: false
+	}),
+	model("small", "ae85e4a935d7a567bd102fe55afc16bb595bdb618e11b2fc7591bc08120411bb", 190085487, {
+		label: "Small",
+		hint: "Slower, best accuracy, many languages",
+		recommended: false
+	})
+];
+/** `win32-x64` style key for the current process. */
+function currentPlatform() {
+	return `${process.platform}-${process.arch}`;
+}
+// ../server/src/services/voice/local/download.ts
+/** Why a download failed; `incomplete` leaves the partial file so the next try resumes. */
+var DownloadError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "DownloadError";
+	}
+};
+/** The partial file a download writes to. */
+const partialPath = (dest) => `${dest}.partial`;
+async function hashExisting(path, hash) {
+	for await (const chunk of createReadStream(path)) hash.update(chunk);
+}
+/**
+* Download a pinned file to `dest`, resuming a previous partial download with an HTTP range
+* request when the server allows it (and starting over when it does not). The file only
+* becomes `dest` once its size and SHA-256 match the pin; a mismatch deletes it.
+*/
+async function downloadVerified(opts) {
+	const { file, dest } = opts;
+	const fetchImpl = opts.fetch ?? ((input, init) => fetch(input, init));
+	const partial = partialPath(dest);
+	mkdirSync(dirname(dest), { recursive: true });
+	let hash = createHash("sha256");
+	let received = 0;
+	if (existsSync(partial)) {
+		const size = statSync(partial).size;
+		if (size > file.bytes) rmSync(partial, { force: true });
+		else if (size > 0) {
+			await hashExisting(partial, hash);
+			received = size;
+		}
+	}
+	if (received < file.bytes) {
+		const res = await fetchImpl(file.url, {
+			headers: received > 0 ? { range: `bytes=${received}-` } : {},
+			signal: opts.signal
+		});
+		if (!(res.status === 206 && (res.headers.get("content-range") ?? "").startsWith(`bytes ${received}-`))) {
+			if (res.status === 206 || res.status === 416) {
+				await res.body?.cancel();
+				rmSync(partial, { force: true });
+				return downloadVerified(opts);
+			}
+			if (!res.ok) {
+				await res.body?.cancel();
+				throw new DownloadError("http", `Download failed: ${res.status} ${res.statusText}`);
+			}
+			hash = createHash("sha256");
+			received = 0;
+		}
+		if (!res.body) throw new DownloadError("http", "Download failed: empty response");
+		const out = await open(partial, received > 0 ? "a" : "w");
+		let failure;
+		try {
+			opts.onProgress?.(received, file.bytes);
+			for await (const chunk of res.body) {
+				received += chunk.length;
+				if (received > file.bytes) throw new DownloadError("size_mismatch", "The download is larger than expected");
+				hash.update(chunk);
+				await out.write(chunk);
+				opts.onProgress?.(received, file.bytes);
+			}
+		} catch (error) {
+			failure = error;
+		} finally {
+			await out.close();
+		}
+		if (failure) {
+			if (failure instanceof DownloadError) rmSync(partial, { force: true });
+			throw failure;
+		}
+	}
+	if (received !== file.bytes) throw new DownloadError("incomplete", `The download stopped at ${received} of ${file.bytes} bytes; try again to resume`);
+	if (hash.digest("hex") !== file.sha256) {
+		rmSync(partial, { force: true });
+		throw new DownloadError("checksum_mismatch", "The download did not match its pinned SHA-256 checksum and was deleted");
+	}
+	await rename(partial, dest);
+}
+// ../server/src/services/voice/local/runtime.ts
+/** An addon is loaded once per process; loading the same file twice is not allowed. */
+const loaded = /* @__PURE__ */ new Map();
+function loadAddon(addonPath) {
+	const cached = loaded.get(addonPath);
+	if (cached) return cached;
+	const mod = { exports: {} };
+	process.dlopen(mod, addonPath);
+	const ctor = mod.exports.WhisperContext;
+	if (typeof ctor !== "function") throw new Error(`${addonPath} is not a Whisper runtime`);
+	loaded.set(addonPath, ctor);
+	return ctor;
+}
+/** The real runtime: whisper.cpp's Node-API addon, loaded in the server process. */
+const loadNativeRuntime = async (addonPath) => {
+	const Context = loadAddon(addonPath);
+	return { async loadModel(modelPath) {
+		const ctx = new Context({
+			filePath: modelPath,
+			useGpu: true
+		});
+		return {
+			async transcribe(pcm, { language, signal }) {
+				const job = ctx.transcribeData(pcm, { language });
+				const stop = () => void job.stop();
+				signal?.addEventListener("abort", stop, { once: true });
+				try {
+					const result = await job.promise;
+					if (result.isAborted) throw new Error("Transcription was cancelled");
+					return {
+						text: result.result,
+						language: result.language || null
+					};
+				} finally {
+					signal?.removeEventListener("abort", stop);
+				}
+			},
+			release: () => ctx.release()
+		};
+	} };
+};
+// ../server/src/services/voice/local/tgz.ts
+const BLOCK = 512;
+function field(header, start, length) {
+	const raw = header.subarray(start, start + length).toString("utf8");
+	const nul = raw.indexOf("\0");
+	return nul === -1 ? raw : raw.slice(0, nul);
+}
+/**
+* Read one regular file out of a gzipped tar archive (an npm package tarball). Only the
+* named entry is returned, so nothing in the archive decides where files are written.
+*/
+function extractTgzEntry(archive, entry) {
+	const tar = gunzipSync(archive);
+	let offset = 0;
+	while (offset + BLOCK <= tar.length) {
+		const header = tar.subarray(offset, offset + BLOCK);
+		const name = field(header, 0, 100);
+		if (!name) break;
+		const size = Number.parseInt(field(header, 124, 12).trim() || "0", 8);
+		if (!Number.isFinite(size) || size < 0) throw new Error("Corrupt archive header");
+		const type = String.fromCharCode(header[156] ?? 0);
+		const prefix = field(header, 257, 6).startsWith("ustar") ? field(header, 345, 155) : "";
+		const path = prefix ? `${prefix}/${name}` : name;
+		const start = offset + BLOCK;
+		if ((type === "0" || type === "\0") && path === entry) {
+			if (start + size > tar.length) throw new Error("Archive is truncated");
+			return Buffer.from(tar.subarray(start, start + size));
+		}
+		offset = start + Math.ceil(size / BLOCK) * BLOCK;
+	}
+	throw new Error(`${entry} is not in the archive`);
+}
+// ../server/src/services/voice/local/wav.ts
+/** Shortest clip worth transcribing. */
+const MIN_SECONDS = .1;
+const BYTES_PER_SECOND = LOCAL_STT_SAMPLE_RATE * 2;
+const FORMAT_HELP = `The local engine takes WAV audio: 16-bit PCM, mono, ${LOCAL_STT_SAMPLE_RATE / 1e3} kHz`;
+const unsupported = (detail) => new ServiceError(415, "unsupported_audio", `${FORMAT_HELP} (${detail}).`);
+/**
+* Validate an uploaded WAV file for the local engine and return its samples. The browser
+* converts recordings to this format, so the server needs no audio decoder.
+*/
+function parseWav(bytes) {
+	if (bytes.length === 0) throw new ServiceError(400, "empty_audio", "No audio was sent");
+	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	const ascii = (at) => at + 4 <= bytes.length ? String.fromCharCode(...bytes.subarray(at, at + 4)) : "";
+	if (ascii(0) !== "RIFF" || ascii(8) !== "WAVE") throw unsupported("not a WAV file");
+	let format = null;
+	let offset = 12;
+	while (offset + 8 <= bytes.length) {
+		const id = ascii(offset);
+		const declared = view.getUint32(offset + 4, true);
+		const body = offset + 8;
+		if (id === "fmt " && body + 16 <= bytes.length) format = {
+			tag: view.getUint16(body, true),
+			channels: view.getUint16(body + 2, true),
+			rate: view.getUint32(body + 4, true),
+			bits: view.getUint16(body + 14, true)
+		};
+		else if (id === "data") {
+			if (!format) throw unsupported("the format chunk is missing");
+			if (format.tag !== 1 && format.tag !== 65534) throw unsupported("not PCM");
+			if (format.bits !== 16) throw unsupported(`${format.bits}-bit samples`);
+			if (format.channels !== 1) throw unsupported(`${format.channels} channels`);
+			if (format.rate !== 16e3) throw unsupported(`${format.rate} Hz`);
+			let length = Math.min(declared, bytes.length - body);
+			length -= length % 2;
+			const durationSec = length / BYTES_PER_SECOND;
+			if (durationSec > 120) throw new ServiceError(413, "audio_too_long", `Audio is longer than 120 seconds`);
+			if (durationSec < MIN_SECONDS) throw new ServiceError(400, "empty_audio", "The recording is too short to transcribe");
+			const pcm = new Uint8Array(length);
+			pcm.set(bytes.subarray(body, body + length));
+			return {
+				pcm: pcm.buffer,
+				durationSec
+			};
+		}
+		offset = body + declared + declared % 2;
+	}
+	throw unsupported("no audio data");
+}
+// ../server/src/services/voice/local/local-stt-service.ts
+const RUNTIME = "runtime";
+/** Strip Whisper's non-speech markers such as `[BLANK_AUDIO]` or `(silence)`. */
+function cleanTranscript(text) {
+	return text.replace(/\[[^\]]*\]|\((?:silence|blank[ _]audio|music|inaudible|noise)[^)]*\)/gi, " ").replace(/\s+/g, " ").trim();
+}
+/** Stop waiting for `promise` when `signal` aborts (the work itself carries on). */
+function abortable(promise, signal) {
+	if (signal.aborted) return Promise.reject(signal.reason);
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(signal.reason);
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+	});
+}
+/** `en-US` -> `en`. */
+const isoLanguage = (language) => language?.split("-")[0]?.toLowerCase() || null;
+function fileSize(path) {
+	try {
+		return statSync(path).size;
+	} catch {
+		return null;
+	}
+}
+/** Why the prebuilt runtime cannot load on this Linux (it needs glibc 2.34 or newer). */
+function linuxProblem() {
+	const glibc = (process.report?.getReport())?.header?.glibcVersionRuntime;
+	if (!glibc) return "Local Whisper needs a glibc-based Linux (musl is not supported)";
+	const [major = 0, minor = 0] = glibc.split(".").map(Number);
+	return major > 2 || major === 2 && minor >= 34 ? null : `Local Whisper needs glibc 2.34 or newer (this system has ${glibc})`;
+}
+/**
+* Local Whisper (§11.3): downloads the runtime and models into the CodeDen home on demand,
+* with progress, resume and checksum checks, and transcribes uploaded WAV audio in the
+* server process. Downloads run in the background; the UI polls `status()`.
+*/
+var LocalSttService = class {
+	deps;
+	platform;
+	runtimePin;
+	models;
+	problem;
+	jobs = /* @__PURE__ */ new Map();
+	errors = /* @__PURE__ */ new Map();
+	loaded = null;
+	queue = Promise.resolve();
+	idleTimer;
+	constructor(deps) {
+		this.deps = deps;
+		this.platform = deps.platform ?? currentPlatform();
+		this.runtimePin = (deps.runtimePins ?? RUNTIME_PINS)[this.platform];
+		this.models = deps.models ?? MODEL_PINS;
+		this.problem = !this.runtimePin ? `No prebuilt Whisper runtime for ${this.platform}` : !deps.platform && process.platform === "linux" ? linuxProblem() : null;
+	}
+	get addonPath() {
+		const version = this.runtimePin?.version ?? "1.1.3";
+		return join(this.deps.runtimeDir, `${version}-${this.platform}`, "whisper.node");
+	}
+	modelPath(pin) {
+		return join(this.deps.modelsDir, pin.file);
+	}
+	pin(id) {
+		const pin = this.models.find((m) => m.id === id);
+		if (!pin) throw new ServiceError(404, "unknown_model", `Unknown Whisper model: ${id}`);
+		return pin;
+	}
+	runtimeInstalled() {
+		return existsSync(this.addonPath);
+	}
+	modelInstalled(pin) {
+		return fileSize(this.modelPath(pin)) === pin.bytes;
+	}
+	status() {
+		const entry = (key, total, installedPath, partial) => {
+			const job = this.jobs.get(key);
+			const sizeOnDisk = installedPath ? fileSize(installedPath) : null;
+			const state = job ? "downloading" : sizeOnDisk !== null ? "installed" : this.errors.has(key) ? "failed" : "missing";
+			return {
+				state,
+				receivedBytes: job?.received ?? (state === "installed" ? total : fileSize(partial) ?? 0),
+				totalBytes: total,
+				sizeOnDisk,
+				error: state === "failed" ? this.errors.get(key) ?? null : null
+			};
+		};
+		const runtime = this.runtimePin;
+		return {
+			supported: this.problem === null,
+			platform: this.platform,
+			unsupportedReason: this.problem,
+			runtime: {
+				version: runtime?.version ?? "1.1.3",
+				...entry(RUNTIME, runtime?.bytes ?? 0, this.runtimeInstalled() ? this.addonPath : null, partialPath(this.archivePath()))
+			},
+			models: this.models.map((m) => ({
+				id: m.id,
+				label: m.label,
+				hint: m.hint,
+				englishOnly: m.englishOnly,
+				recommended: m.recommended,
+				...entry(m.id, m.bytes, this.modelInstalled(m) ? this.modelPath(m) : null, partialPath(this.modelPath(m)))
+			})),
+			location: this.deps.modelsDir
+		};
+	}
+	/** Start (or join) downloading the runtime and a model; returns right away. */
+	download(id) {
+		if (this.problem) throw new ServiceError(409, "unsupported_platform", this.problem);
+		const pin = this.pin(id);
+		if (!this.jobs.has(id) && !(this.runtimeInstalled() && this.modelInstalled(pin))) this.track(id, async (signal, progress) => {
+			await abortable(this.ensureRuntime(), signal);
+			if (this.modelInstalled(pin)) return;
+			await downloadVerified({
+				file: pin,
+				dest: this.modelPath(pin),
+				fetch: this.deps.fetch,
+				signal,
+				onProgress: progress
+			});
+			this.deps.log?.(`Whisper model ${pin.id} downloaded`);
+		}).catch(() => {});
+		return this.status();
+	}
+	/** Cancel a running download or delete a downloaded model (and its partial file). */
+	async remove(id) {
+		const pin = this.pin(id);
+		const job = this.jobs.get(id);
+		if (job) {
+			job.abort.abort();
+			await job.promise.catch(() => {});
+		}
+		if (this.loaded?.id === id) await this.serially(() => this.unload());
+		rmSync(this.modelPath(pin), { force: true });
+		rmSync(partialPath(this.modelPath(pin)), { force: true });
+		this.errors.delete(id);
+		return this.status();
+	}
+	/** Transcribe a WAV upload with the model chosen in Settings. */
+	async transcribe(audio, opts = {}) {
+		if (this.problem) throw new ServiceError(409, "unsupported_platform", this.problem);
+		const { pcm } = parseWav(audio);
+		const pin = this.pin(this.deps.settings.get().voice.dictation.local.model);
+		if (!this.runtimeInstalled() || !this.modelInstalled(pin)) throw new ServiceError(409, "model_not_installed", `The ${pin.label} Whisper model isn't downloaded yet. Download it in Settings > Voice.`);
+		const language = pin.englishOnly ? "en" : isoLanguage(opts.language) ?? "auto";
+		return this.serially(async () => {
+			const model = await this.model(pin);
+			const started = performance.now();
+			try {
+				const result = await model.transcribe(pcm, {
+					language,
+					signal: opts.signal
+				});
+				return {
+					text: cleanTranscript(result.text),
+					language: result.language ?? (language === "auto" ? null : language),
+					engine: "local",
+					elapsedMs: Math.round(performance.now() - started)
+				};
+			} catch (error) {
+				if (opts.signal?.aborted) throw new ServiceError(400, "aborted", "Cancelled");
+				throw new ServiceError(500, "transcription_failed", errorMessage(error));
+			} finally {
+				this.armIdleUnload();
+			}
+		});
+	}
+	/** Resolves when no download is running (tests). */
+	async settled() {
+		while (this.jobs.size > 0) await Promise.allSettled([...this.jobs.values()].map((j) => j.promise));
+	}
+	/** Cancel downloads and free the model (server shutdown). */
+	async stop() {
+		for (const job of this.jobs.values()) job.abort.abort();
+		await this.settled();
+		await this.unload();
+	}
+	archivePath() {
+		const name = this.runtimePin?.url.split("/").pop() ?? "runtime.tgz";
+		return join(this.deps.runtimeDir, ".downloads", name);
+	}
+	ensureRuntime() {
+		const pin = this.runtimePin;
+		if (!pin) return Promise.reject(new Error(this.problem ?? "No runtime"));
+		if (this.runtimeInstalled()) return Promise.resolve();
+		return this.track(RUNTIME, async (signal, progress) => {
+			const archive = this.archivePath();
+			await downloadVerified({
+				file: pin,
+				dest: archive,
+				fetch: this.deps.fetch,
+				signal,
+				onProgress: progress
+			});
+			const addon = extractTgzEntry(readFileSync(archive), pin.entry);
+			mkdirSync(join(this.addonPath, ".."), { recursive: true });
+			const staging = `${this.addonPath}.tmp`;
+			writeFileSync(staging, addon, { mode: 493 });
+			renameSync(staging, this.addonPath);
+			rmSync(archive, { force: true });
+			this.deps.log?.(`Whisper runtime ${pin.version} installed for ${this.platform}`);
+		});
+	}
+	/** Run one download at a time per key; callers join a running one. */
+	track(key, work) {
+		const running = this.jobs.get(key);
+		if (running) return running.promise;
+		const abort = new AbortController();
+		const job = {
+			received: 0,
+			abort,
+			promise: Promise.resolve()
+		};
+		this.errors.delete(key);
+		job.promise = work(abort.signal, (received) => {
+			job.received = received;
+		}).catch((error) => {
+			if (!abort.signal.aborted) {
+				this.errors.set(key, errorMessage(error));
+				this.deps.log?.(`Whisper download (${key}) failed: ${errorMessage(error)}`);
+			}
+			throw error;
+		}).finally(() => this.jobs.delete(key));
+		this.jobs.set(key, job);
+		return job.promise;
+	}
+	serially(fn) {
+		const next = this.queue.then(fn, fn);
+		this.queue = next.catch(() => {});
+		return next;
+	}
+	async model(pin) {
+		clearTimeout(this.idleTimer);
+		if (this.loaded?.id === pin.id) return this.loaded.model;
+		await this.unload();
+		const model = await (await (this.deps.loadRuntime ?? loadNativeRuntime)(this.addonPath)).loadModel(this.modelPath(pin));
+		this.loaded = {
+			id: pin.id,
+			model
+		};
+		return model;
+	}
+	armIdleUnload() {
+		clearTimeout(this.idleTimer);
+		this.idleTimer = setTimeout(() => void this.serially(() => this.unload()), this.deps.idleUnloadMs ?? 6e5);
+		this.idleTimer.unref();
+	}
+	async unload() {
+		clearTimeout(this.idleTimer);
+		const current = this.loaded;
+		this.loaded = null;
+		await current?.model.release().catch(() => {});
+	}
+};
 // ../server/src/services/container.ts
 function createServices(opts) {
 	const exec = opts.exec ?? runTool;
@@ -55845,6 +57191,13 @@ function createServices(opts) {
 		outbox,
 		questions
 	});
+	const queue = new QueueService({
+		outbox,
+		repo: sessionRepo,
+		sessions,
+		artifacts,
+		providers: () => opts.runner.providers()
+	});
 	const lifecycle = new SessionLifecycle({
 		db: opts.db,
 		store: opts.store,
@@ -55870,12 +57223,20 @@ function createServices(opts) {
 	});
 	const setup = new SetupService({
 		exec,
-		settings: opts.settings
+		settings: opts.settings,
+		onChecked: () => redetectProviders(opts.runner, opts.log)
 	});
 	const claudeSdk = new ClaudeSdkService({
 		depsDir: opts.paths.deps,
 		log: opts.log
 	});
+	const localStt = new LocalSttService({
+		runtimeDir: join(opts.paths.deps, "whisper"),
+		modelsDir: join(opts.paths.models, "whisper"),
+		settings: opts.settings,
+		...opts.localStt,
+		log: opts.log
+	});
 	const automations = new AutomationService({
 		db: opts.db,
 		store: opts.store,
@@ -55924,6 +57285,16 @@ function createServices(opts) {
 		options: opts.factory,
 		log: opts.log
 	});
+	const worktreeCleanup = new WorktreeCleanup({
+		repo: sessionRepo,
+		projects,
+		runner: opts.runner,
+		store: opts.store,
+		settings: () => opts.settings.get(),
+		stopSession: (id) => sessions.stop(id),
+		...opts.worktreeCleanup,
+		log: opts.log
+	});
 	const services = {
 		db: opts.db,
 		store: opts.store,
@@ -55935,6 +57306,7 @@ function createServices(opts) {
 		projects,
 		sessionRepo,
 		sessions,
+		queue,
 		lifecycle,
 		recovery: new SessionRecovery({
 			repo: sessionRepo,
@@ -55949,17 +57321,7 @@ function createServices(opts) {
 			runner: opts.runner,
 			repo: sessionRepo
 		}),
-		updates: new UpdateService({
-			home: opts.paths.home,
-			mode: () => opts.settings.get().updates.mode,
-			checksDisabled: process.env.CODEDEN_UPDATE_CHECK === "0",
-			host: opts.selfUpdate,
-			registry: updateRegistry(),
-			notes: notesSources(),
-			fetch: opts.updates?.fetch,
-			intervalMs: opts.updates?.intervalMs,
-			log: opts.log
-		}),
+		updates: createUpdates(opts),
 		images: new ImageService({
 			registry: opts.imageEngines ?? defaultImageEngines(opts.secrets),
 			settings: opts.settings,
@@ -55972,12 +57334,15 @@ function createServices(opts) {
 		voice: new VoiceService({
 			secrets: opts.secrets,
 			settings: opts.settings,
+			local: localStt,
 			...opts.voice
 		}),
+		localStt,
 		setup,
 		claudeSdk,
 		usage,
 		factory,
+		worktreeCleanup,
 		configFiles: new ConfigFiles({
 			projects,
 			home: userHome,
@@ -56014,6 +57379,28 @@ function defaultImageEngines(secrets) {
 		openai: { apiKey: key("openai.apiKey") }
 	});
 }
+/** npm self-update for `codeden`, or the desktop app's own updater when it hosts the server. */
+function createUpdates(opts) {
+	const common = {
+		mode: () => opts.settings.get().updates.mode,
+		checksDisabled: process.env.CODEDEN_UPDATE_CHECK === "0",
+		notes: notesSources(),
+		fetch: opts.updates?.fetch,
+		intervalMs: opts.updates?.intervalMs,
+		log: opts.log
+	};
+	const desktop = opts.selfUpdate?.desktop;
+	if (desktop) return new DesktopUpdateService({
+		...common,
+		desktop
+	});
+	return new UpdateService({
+		...common,
+		home: opts.paths.home,
+		host: opts.selfUpdate,
+		registry: updateRegistry()
+	});
+}
 // ../server/src/services/secrets.ts
 /** In-memory store for tests and machines without a usable keychain. */
 var MemorySecretStore = class {
@@ -56140,7 +57527,8 @@ async function startServer(opts) {
 	const runnerStatus = () => runner?.status ?? disabledStatus;
 	const hub = new WsHub(store, database.db, runnerStatus, {
 		flushMs: opts.realtimeFlushMs,
-		updateStatus: () => services.updates.snapshot()
+		updateStatus: () => services.updates.snapshot(),
+		artifacts: { artifactForPath: (path) => services.artifacts.artifactForPath(path) }
 	});
 	const secrets = opts.secrets === "memory" ? new MemorySecretStore() : opts.secrets ?? await createSecretStore(log);
 	const builtin = opts.builtinProviders ?? process.env.CODEDEN_BUILTIN_PROVIDERS !== "0";
@@ -56158,12 +57546,14 @@ async function startServer(opts) {
 		askUserWaitMs: opts.askUserWaitMs,
 		imageEngines: opts.imageEngines ?? (builtin ? void 0 : new ImageEngineRegistry([])),
 		voice: opts.voice,
+		localStt: opts.localStt,
 		orchestration: opts.orchestration,
 		github: opts.github,
 		automations: opts.automations,
 		factory: opts.factory,
 		selfUpdate: opts.selfUpdate,
 		updates: opts.updates,
+		worktreeCleanup: opts.worktreeCleanup,
 		log
 	});
 	services.images.refresh();
@@ -56173,6 +57563,7 @@ async function startServer(opts) {
 	services.usage.start();
 	services.automations.start();
 	services.factory.start();
+	services.worktreeCleanup.start();
 	const stopUpdateEvents = services.updates.onChange((status) => hub.broadcastUpdate(status));
 	services.updates.start();
 	let origins = /* @__PURE__ */ new Set();
@@ -56206,7 +57597,7 @@ async function startServer(opts) {
 		runner: services.runner,
 		cwdFor: (sessionId) => {
 			const session = sessionId ? services.sessionRepo.find(sessionId)?.session : void 0;
-			return session ? session.worktreePath ?? session.cwd : paths.home;
+			return session ? sessionWorkdir(session) : paths.home;
 		},
 		log
 	});
@@ -56288,7 +57679,9 @@ async function startServer(opts) {
 			services.usage.stop();
 			services.automations.stop();
 			services.factory.stop();
+			services.worktreeCleanup.stop();
 			services.updates.stop();
+			await services.localStt.stop();
 			stopUpdateEvents();
 			stopTerminalEvents();
 			if (runner) {
@@ -56706,6 +58099,8 @@ async function stopRunner(lockFile, timeoutMs = 1e4) {
 	return lock.pid;
 }
 // src/stop.ts
+/** How long to keep watching for a runner the server was starting as it shut down. */
+const LATE_RUNNER_MS = 2e3;
 async function waitForExit(pid, timeoutMs) {
 	const deadline = Date.now() + timeoutMs;
 	while (Date.now() < deadline) {
@@ -56740,6 +58135,17 @@ async function stop(home) {
 		if (!await waitForExit(runner.pid, 5e3)) await stopRunner(paths.runnerLock);
 		console.log(`Stopped runner (pid ${runner.pid}).`);
 	}
+	const deadline = Date.now() + LATE_RUNNER_MS;
+	while (Date.now() < deadline) {
+		const late = readLiveRunnerLock(paths.runnerLock);
+		if (late && late.pid !== runner?.pid) {
+			await stopRunner(paths.runnerLock);
+			console.log(`Stopped runner (pid ${late.pid}).`);
+			break;
+		}
+		if (!late && !server) break;
+		await new Promise((r) => setTimeout(r, 250));
+	}
 	return 0;
 }
 // src/update-command.ts
@@ -57009,4 +58415,4 @@ main().then((code) => process.exit(code), (error) => {
 });
 export {};
 
-//# sourceMappingURL=main-BF0aQ9U8.js.map
+//# sourceMappingURL=main-pXwL7GDQ.js.map