codeden 0.1.1 → 0.3.0

package/dist/{runner-D8m3WdtS.js → runner-DGomZl80.js}

@@ -1,13 +1,14 @@
 import { n as __require, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-DegdyBIC.js";
 import { createRequire } from "node:module";
-import { accessSync, appendFileSync, chmodSync, closeSync, constants, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
+import { accessSync, appendFileSync, chmodSync, closeSync, constants, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { pathToFileURL } from "node:url";
-import { homedir, tmpdir } from "node:os";
+import os, { homedir, tmpdir } from "node:os";
 import path, { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
+import { gunzipSync } from "node:zlib";
 import { createInterface } from "node:readline";
-import { copyFile, mkdir, readFile, rm, rmdir, stat, writeFile } from "node:fs/promises";
+import { chmod, copyFile, lstat, mkdir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, utimes, writeFile } from "node:fs/promises";
 import { STATUS_CODES, ServerResponse, createServer } from "node:http";
 import { Http2ServerRequest, constants as constants$1 } from "node:http2";
 import { Readable } from "node:stream";
@@ -3086,7 +3087,7 @@ function bucketFor(state, inst) {
 	return bucket;
 }
 let handoff;
-const open = [];
+const open$1 = [];
 const memo = {
 	alloc(_inst, payload, empty) {
 		const bucket = handoff;
@@ -3097,7 +3098,7 @@ const memo = {
 			issues: null
 		};
 		bucket.set(payload.value, entry);
-		open.push(entry);
+		open$1.push(entry);
 		return empty;
 	},
 	guard(inst) {
@@ -3163,10 +3164,10 @@ const memo = {
 					return payload;
 				}
 				handoff = bucket;
-				const depth = open.length;
+				const depth = open$1.length;
 				const result = base(payload, ctx);
 				handoff = void 0;
-				const entry = open.length > depth ? open.pop() : void 0;
+				const entry = open$1.length > depth ? open$1.pop() : void 0;
 				if (result instanceof Promise) return result.then((r) => {
 					if (entry) entry.issues = r.issues.length ? cloneIssues(r.issues) : NO_ISSUES;
 					return r;
@@ -6003,12 +6004,16 @@ const Role = _enum([
 	"agent"
 ]);
 /**
-* Autonomy levels (§11.2), mapped onto each provider's native enforcement.
+* Permission levels of an agent session (§11.2), mapped onto each provider's native enforcement.
+* Shown in the UI as "Permissions"; stored as `autonomy`.
+* - `read_only`: reads and runs checks, but never edits files, commits or pushes. Needs a
+*   provider with `ProviderCapabilities.readOnly`.
 * - `supervised`: every edit and command asks.
 * - `auto`: edits and normal commands in the worktree run freely; risky actions ask (default).
 * - `full`: no approvals inside the worktree.
 */
 const AutonomyLevel = _enum([
+	"read_only",
 	"supervised",
 	"auto",
 	"full"
@@ -6283,11 +6288,47 @@ const Attachment = discriminatedUnion("type", [object({
 	name: string().optional(),
 	mediaType: string().optional()
 })]);
+/**
+* Who sent a message to a session: the user, the orchestrator (to a PM), a PM (to its
+* sessions), an automation, or CodeDen itself (automatic wake-ups, the factory loop).
+*/
+const MessageSender = _enum([
+	"user",
+	"orchestrator",
+	"pm",
+	"automation",
+	"codeden"
+]);
 /** Input that starts or steers a turn: text plus optional image/file attachments. */
 const UserInput = object({
 	text: string(),
-	attachments: array(Attachment).default([])
+	attachments: array(Attachment).default([]),
+	/**
+	* Who wrote the message, when it was not the user: recorded so the transcript can show the
+	* sender without reading the text. Absent on the user's own messages and on every message
+	* stored before senders were recorded.
+	*/
+	from: MessageSender.optional()
 });
+/**
+* The first line of a message from a PM or the orchestrator, telling the agent who wrote it.
+* The only definition of these words: the server writes them, the UI recognises them.
+*/
+const SENDER_LINES = {
+	pm: "Message from your project manager:",
+	orchestrator: "Message from the orchestrator:"
+};
+/**
+* Input for a message from a PM or the orchestrator: the sender is recorded in `from` and
+* named for the agent in the text's first line (`SENDER_LINES`).
+*/
+function messageFrom(from, text) {
+	return {
+		text: `${SENDER_LINES[from]}\n${text}`,
+		attachments: [],
+		from
+	};
+}
 const itemBase = {
 	/** Unique within the session. */
 	id: Id,
@@ -6812,6 +6853,18 @@ const FactoryLoopState = _enum([
 	"stopped"
 ]);
 // ../../packages/contracts/src/entities/project.ts
+/**
+* Something re-detecting a project's folder found that CodeDen does not apply on its own (§9).
+* `github_remote_missing`: a `github` project's folder no longer has a GitHub `origin` (removed,
+* pointing at another host, or no git checkout at all). The project keeps its GitHub
+* coordinates until the user restores the remote or disconnects GitHub.
+*/
+const ProjectRemoteWarning = object({
+	code: literal("github_remote_missing"),
+	/** What `origin` points at now, credentials removed; null when there is no `origin`. */
+	remoteUrl: string().nullable(),
+	detectedAt: Timestamp
+});
 const projectBase = {
 	id: Id,
 	name: string().min(1),
@@ -6833,6 +6886,23 @@ const projectBase = {
 	killSwitch: boolean().default(false),
 	/** IANA timezone for cron automations; machine timezone when null. */
 	timezone: string().nullable(),
+	/**
+	* Pinned projects are listed above the rest (§13). Defaults to false so events written
+	* before pinning existed still parse.
+	*/
+	pinned: boolean().default(false),
+	/**
+	* Manual position in the project list, lowest first (§13). Only the relative order within
+	* the pinned and unpinned groups matters; ties fall back to the name. Set by
+	* `projects.reordered`; archived projects keep theirs.
+	*/
+	sortOrder: int().nonnegative().default(0),
+	/**
+	* Set when re-detection found the folder's git remote out of step with the project (see
+	* `ProjectRemoteWarning`); absent when all is well. Cleared by the next detection that finds
+	* the GitHub remote again, or by disconnecting GitHub.
+	*/
+	remoteWarning: ProjectRemoteWarning.optional(),
 	createdAt: Timestamp,
 	updatedAt: Timestamp,
 	archivedAt: Timestamp.nullable()
@@ -6847,6 +6917,9 @@ const GitHubRepo = object({
 /**
 * A project. `github` projects get the full issue/PR/evidence flow; `local` projects
 * (no GitHub remote) get sessions, worktrees, checkpoints, diffs and automations only (§9).
+* The kind is detected when the project is added and again later (on server start, after
+* agent turns in local projects, on demand): a folder that gains a GitHub `origin` becomes a
+* `github` project. Losing the remote never downgrades a project on its own.
 */
 const Project = discriminatedUnion("kind", [object({
 	...projectBase,
@@ -6856,6 +6929,20 @@ const Project = discriminatedUnion("kind", [object({
 	...projectBase,
 	kind: literal("local")
 })]);
+/**
+* The canonical project order (§13): pinned first, then `sortOrder`, then name, then id.
+* The server lists projects in this order and the UI keeps it when applying live events.
+*/
+function compareProjects(a, b) {
+	if (a.pinned !== b.pinned) return a.pinned ? -1 : 1;
+	if (a.sortOrder !== b.sortOrder) return a.sortOrder - b.sortOrder;
+	if (a.name !== b.name) return a.name < b.name ? -1 : 1;
+	return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+}
+/** A sorted copy of `projects` in the canonical order. */
+function sortProjects(projects) {
+	return [...projects].sort(compareProjects);
+}
 // ../../packages/contracts/src/work.ts
 /**
 * Situational awareness and conflict handling (§8.4). Every unit of work (a session or an
@@ -7013,7 +7100,18 @@ const ProviderCapabilities = object({
 	reasoningEffort: boolean(),
 	/** MCP servers can be injected (required for CodeDen tools). */
 	mcp: boolean(),
-	skills: boolean()
+	skills: boolean(),
+	/**
+	* An autonomy change reaches a running turn from its next tool call. When false (or absent),
+	* a running turn keeps its autonomy and the change applies from the next turn.
+	*/
+	liveAutonomy: boolean().optional(),
+	/**
+	* The `read_only` permission level is enforced natively: no file edits, no writing shell
+	* commands, no commits or pushes (§11.2). When false (or absent), sessions on this provider
+	* cannot use `read_only`.
+	*/
+	readOnly: boolean().optional()
 });
 /** A model a provider offers. */
 const ModelInfo = object({
@@ -7532,7 +7630,8 @@ const RunnerCommand = discriminatedUnion("name", [
 		name: literal("session.configure"),
 		sessionId: Id,
 		model: string().nullable().optional(),
-		effort: ReasoningEffort.nullable().optional()
+		effort: ReasoningEffort.nullable().optional(),
+		autonomy: AutonomyLevel.optional()
 	}),
 	object({
 		name: literal("pty.open"),
@@ -7671,7 +7770,11 @@ const RunnerCommandResults = {
 			ok: boolean()
 		})).optional()
 	}),
-	"workspace.remove": object({ removed: boolean() }),
+	"workspace.remove": object({
+		removed: boolean(),
+		/** A forced removal deleted uncommitted changes (absent from older runners). */
+		discardedChanges: boolean().optional()
+	}),
 	"session.start": object({ resumeToken: string().nullable() }),
 	"session.send": Empty,
 	"session.steer": Empty,
@@ -7780,8 +7883,17 @@ const QueuedMessage = object({
 	id: Id,
 	sessionId: Id,
 	input: UserInput,
+	/** Who queued it. Events written before senders were recorded were all the user's. */
+	from: MessageSender.default("user"),
 	createdAt: Timestamp
 });
+object({ messages: array(QueuedMessage) });
+/**
+* `PATCH /api/sessions/:id/queue/:messageId`: replace a queued message's text (attachments
+* stay). Answers 409 `already_sent` once delivery has taken the message.
+*/
+const EditQueuedMessageRequest = object({ text: string().max(2e5) });
+object({ status: literal("steered") });
 /** Structured result an agent reports with the `finish` tool (§8.3). */
 const SessionResult = object({
 	outcome: _enum([
@@ -7981,6 +8093,13 @@ const Session = object({
 	rootThreadId: Id.nullable(),
 	/** Structured result from the agent's `finish` tool, once reported. */
 	result: SessionResult.nullable().optional(),
+	/** When the session was archived: hidden from the sidebar, its worktree cleaned up. */
+	archivedAt: Timestamp.nullable().optional(),
+	/**
+	* When CodeDen removed the session's worktree (archive or inactivity cleanup). The branch and
+	* checkpoints stay; the worktree is recreated from the branch on the next message.
+	*/
+	worktreeRemovedAt: Timestamp.nullable().optional(),
 	createdAt: Timestamp,
 	updatedAt: Timestamp,
 	endedAt: Timestamp.nullable()
@@ -8117,6 +8236,12 @@ const AutomationGuards = object({
 	/** Run once for missed schedules after downtime. */
 	catchUpMissed: boolean().default(false)
 });
+/** Who created a database automation (§10). */
+const AutomationCreator = _enum([
+	"user",
+	"pm",
+	"import"
+]);
 /** An automation: trigger + action + target + guards. Off by default. */
 const Automation = object({
 	id: Id,
@@ -8142,6 +8267,11 @@ const Automation = object({
 	* `automation:<template id or name slug>`.
 	*/
 	workKey: string().min(1).max(200).optional(),
+	/**
+	* Who created a database automation: the user in the UI (`user`, the default when absent),
+	* a PM through `create_automation` (`pm`), or an import of shared files (`import`).
+	*/
+	createdBy: AutomationCreator.optional(),
 	createdAt: Timestamp,
 	updatedAt: Timestamp
 });
@@ -9156,9 +9286,14 @@ const UpdateMode = _enum([
 /**
 * Where the running CodeDen came from. `packaged`: an npm install (`npx`, global or a
 * side-by-side version in `<home>/app`), which can update itself. `source`: the repository or
-* a workspace build, which never switches versions (pull and rebuild instead).
+* a workspace build, which never switches versions (pull and rebuild instead). `desktop`: the
+* desktop app, which updates itself from GitHub Releases (the npm path is off; §17).
 */
-const InstallSource = _enum(["packaged", "source"]);
+const InstallSource = _enum([
+	"packaged",
+	"source",
+	"desktop"
+]);
 /**
 * Self-update progress. `installing`: npm is fetching `target` into `<home>/app/<target>`;
 * `installed`: it is ready and starts on the next launch (or with a restart); `restarting`:
@@ -9290,6 +9425,138 @@ function comparePrerelease(a, b) {
 	}
 	return 0;
 }
+// ../../packages/contracts/src/voice-api.ts
+/**
+* Voice engines on the server (§11.3). The browser's speech APIs stay the default; these
+* routes proxy ElevenLabs (text to speech, Scribe) and OpenAI (transcription) with API keys
+* from the OS keychain, so keys never reach the browser, and run local Whisper with a
+* runtime and model downloaded on demand.
+*/
+/** ElevenLabs MP3 output formats (`codec_sampleRate_bitrate`). */
+const TtsOutputFormat = _enum([
+	"mp3_22050_32",
+	"mp3_44100_64",
+	"mp3_44100_128",
+	"mp3_44100_192"
+]);
+/**
+* `POST /api/tts`: streams `audio/mpeg`. `voiceId` defaults to
+* `settings.voice.readAloud.voice`, then a stock voice; `modelId` to a low-latency model.
+*/
+const TtsRequest = object({
+	text: string().min(1).max(5e3),
+	voiceId: string().min(1).max(100).optional(),
+	modelId: string().min(1).max(100).optional(),
+	outputFormat: TtsOutputFormat.optional()
+});
+object({ voices: array(object({
+	id: string(),
+	name: string(),
+	category: string().optional(),
+	description: string().optional(),
+	previewUrl: string().optional(),
+	labels: record(string(), string()).optional()
+})) });
+/** Engines that transcribe on the server: the cloud engines and local Whisper. */
+const SttEngine = _enum([
+	"elevenlabs",
+	"openai",
+	"local"
+]);
+/**
+* `POST /api/stt?engine=&language=`: the body is the recorded audio (raw bytes with an
+* `audio/*` content type, or multipart with a `file` field), up to 25 MB. `engine` defaults
+* to `settings.voice.dictation.engine` (when that is `browser`, ElevenLabs). The `local`
+* engine only takes WAV, 16-bit PCM, mono at `LOCAL_STT_SAMPLE_RATE`, at most
+* `LOCAL_STT_MAX_SECONDS` long (the UI converts the recording before uploading).
+*/
+const SttQuery = object({
+	engine: SttEngine.optional(),
+	/** ISO 639-1 hint, e.g. `en`. */
+	language: string().min(2).max(10).optional()
+});
+object({
+	text: string(),
+	language: string().nullable(),
+	engine: SttEngine,
+	/** How long the server spent transcribing, in milliseconds (local engine). */
+	elapsedMs: number$1().nonnegative().optional()
+});
+/**
+* Dictation engines (`settings.voice.dictation.engine`): the browser's speech recognition,
+* a cloud engine through the server, or `local` Whisper running on the CodeDen server.
+*/
+const DictationEngine = _enum([
+	"browser",
+	"elevenlabs",
+	"openai",
+	"local"
+]);
+/**
+* Local Whisper models CodeDen can download. `.en` models are English-only (more accurate
+* for English at the same size); the others detect or take a language.
+*/
+const WhisperModelId = _enum([
+	"tiny",
+	"tiny.en",
+	"base",
+	"base.en",
+	"small",
+	"small.en"
+]);
+/** Audio format the local engine accepts: WAV, 16-bit PCM, mono, at this sample rate. */
+const LOCAL_STT_SAMPLE_RATE = 16e3;
+const downloadFields = {
+	state: _enum([
+		"missing",
+		"downloading",
+		"installed",
+		"failed"
+	]),
+	/** Bytes received so far (while downloading). */
+	receivedBytes: int().nonnegative(),
+	/** Download size in bytes (pinned, so known before the download starts). */
+	totalBytes: int().nonnegative(),
+	/** Size on disk when installed. */
+	sizeOnDisk: int().nonnegative().nullable(),
+	/** Why the last attempt failed. */
+	error: string().nullable()
+};
+/** The Whisper runtime: a prebuilt native library for this platform, downloaded on demand. */
+const LocalSttRuntime = object({
+	/** Runtime version CodeDen pins. */
+	version: string(),
+	...downloadFields
+});
+/** One downloadable model, with a speed and accuracy hint for the picker. */
+const LocalSttModel = object({
+	id: WhisperModelId,
+	/** e.g. `Base (English)`. */
+	label: string(),
+	/** Speed and accuracy hint, e.g. `Fast, good accuracy`. */
+	hint: string(),
+	englishOnly: boolean(),
+	/** The suggested default. */
+	recommended: boolean(),
+	...downloadFields
+});
+object({
+	/** False on platforms without a prebuilt runtime (`unsupportedReason` says why). */
+	supported: boolean(),
+	/** `process.platform-process.arch` of the server, e.g. `win32-x64`. */
+	platform: string(),
+	unsupportedReason: string().nullable(),
+	runtime: LocalSttRuntime,
+	models: array(LocalSttModel),
+	/** Folder holding the models. */
+	location: string()
+});
+/**
+* `POST /api/voice/local/models/:id/download` starts (or joins) the download of the runtime
+* and that model; `DELETE /api/voice/local/models/:id` cancels or deletes it. Both return
+* the new `LocalSttStatus`. The UI polls `GET /api/voice/local` while anything downloads.
+*/
+const LocalSttModelParams = object({ id: WhisperModelId });
 // ../../packages/contracts/src/settings.ts
 /** `auto` lets CodeDen pick the first ready provider (Claude, then Codex). */
 const ProviderChoice = union([literal("auto"), ProviderId]);
@@ -9320,6 +9587,17 @@ const RoleDefaults = object({
 	model: string().nullable().default(null),
 	effort: ReasoningEffort.nullable().default(null)
 });
+/** A model named by its provider and the provider's model id. */
+const ModelRef = object({
+	provider: ProviderId,
+	model: string().min(1)
+});
+/** A provider's custom models: ids are unique. */
+const CustomModelList = array(object({
+	id: string().trim().min(1).max(200),
+	/** Shown instead of the id in the picker. */
+	label: string().trim().min(1).max(100).optional()
+})).refine((list) => new Set(list.map((m) => m.id)).size === list.length, { message: "Custom model ids must be unique" });
 /**
 * User settings persisted in `<home>/settings.json` (non-secret; API keys live in the OS
 * keychain). Every field has a default, so `Settings.parse({})` yields a complete object and
@@ -9350,6 +9628,25 @@ const Settings = object({
 			noticeSummaries: boolean().default(true)
 		}).prefault({})
 	}).prefault({}),
+	/** The model picker (§13). */
+	models: object({
+		/**
+		* Starred models, listed in this order in the picker's Favourites section. Entries whose
+		* model a provider no longer lists are kept (it may come back) but not shown.
+		*/
+		favorites: array(ModelRef).default([]),
+		/**
+		* Model ids left out of the picker, by provider id. A hidden model that is still chosen
+		* somewhere (a session, a default, an automation) keeps showing there.
+		*/
+		hidden: record(ProviderId, array(string().min(1))).default({}),
+		/**
+		* Model ids added by the user, by provider id, merged into the picker after the models
+		* the provider lists (a listed id wins). Their effort levels are those of the provider's
+		* default model, or none when the provider has no effort levels.
+		*/
+		custom: record(ProviderId, CustomModelList).default({})
+	}).prefault({}),
 	/** Follow-up prompt chips (§7.5). */
 	followups: object({
 		enabled: boolean().default(true),
@@ -9359,13 +9656,15 @@ const Settings = object({
 	/** Voice (§11.3). */
 	voice: object({
 		dictation: object({
-			engine: _enum([
-				"browser",
-				"elevenlabs",
-				"openai"
-			]).default("browser"),
+			engine: DictationEngine.default("browser"),
 			pushToTalkShortcut: string().nullable().default(null),
-			language: string().nullable().default(null)
+			/**
+			* BCP 47 tag such as `en-US`; null is auto (the browser engine follows the browser
+			* language, the server engines detect it). English-only Whisper models ignore it.
+			*/
+			language: string().nullable().default(null),
+			/** Local Whisper: which downloaded model transcribes (§11.3). */
+			local: object({ model: WhisperModelId.default("base.en") }).prefault({})
 		}).prefault({}),
 		readAloud: object({
 			enabled: boolean().default(false),
@@ -9393,12 +9692,23 @@ const Settings = object({
 	}).prefault({}),
 	notifications: object({
 		toasts: boolean().default(true),
-		browser: boolean().default(false)
+		browser: boolean().default(false),
+		/** A short chime when an agent is blocked on the user (an approval or a question). */
+		sound: boolean().default(true)
 	}).prefault({}),
 	/** Global factory controls (§10.1). */
 	factory: object({ 
 	/** Stops every project's factory loop and all factory sessions. */
 killSwitch: boolean().default(false) }).prefault({}),
+	/**
+	* Worktree cleanup (§9). Archiving a session removes its worktree (unless it has uncommitted changes and isn't forced); with `cleanup` on,
+	* worktrees of sessions inactive for `afterDays` are removed too, unless the session's pull
+	* request is still open or the worktree has uncommitted changes.
+	*/
+	worktrees: object({
+		cleanup: boolean().default(true),
+		afterDays: int().min(1).max(365).default(7)
+	}).prefault({}),
 	/** Master switch; individual automations are still off by default (§10). */
 	automations: object({ enabled: boolean().default(true) }).prefault({}),
 	/**
@@ -9406,6 +9716,15 @@ killSwitch: boolean().default(false) }).prefault({}),
 	* `check: false` to turn checks off; that reads as `mode: "off"`.
 	*/
 	updates: preprocess((value) => typeof value === "object" && value !== null && !("mode" in value) && value.check === false ? { mode: "off" } : value, object({ mode: UpdateMode.default("notify") }).prefault({})),
+	/** The desktop app (§17). Read by the desktop app only; `npx codeden` ignores it. */
+	desktop: object({
+		/** Start CodeDen (in the tray, window hidden) when you log in. */
+		launchAtLogin: boolean().default(false),
+		/** Closing the window keeps CodeDen running in the tray / menu bar; Quit really quits. */
+		closeToTray: boolean().default(true),
+		/** Keep the computer from sleeping while an agent is running. */
+		keepAwake: boolean().default(true)
+	}).prefault({}),
 	/** First-run setup (§14): set once the user finishes the detection checklist. */
 	setup: object({
 		completed: boolean().default(false),
@@ -9467,6 +9786,7 @@ discriminatedUnion("type", [
 	globalEvent("project.created", object({ project: Project })),
 	globalEvent("project.updated", object({ project: Project })),
 	globalEvent("project.archived", object({ projectId: Id })),
+	globalEvent("projects.reordered", object({ projectIds: array(Id) })),
 	globalEvent("session.created", object({ session: Session })),
 	globalEvent("session.updated", object({ session: Session })),
 	globalEvent("inbox.created", object({ item: InboxItem })),
@@ -9502,7 +9822,17 @@ discriminatedUnion("type", [
 	globalEvent("message.dequeued", object({
 		sessionId: Id,
 		messageId: Id,
-		reason: _enum(["sent", "dropped"])
+		reason: _enum([
+			"sent",
+			"dropped",
+			"deleted"
+		])
+	})),
+	globalEvent("message.edited", object({
+		sessionId: Id,
+		messageId: Id,
+		text: string(),
+		at: Timestamp
 	})),
 	globalEvent("notice.created", object({ notice: Notice })),
 	globalEvent("notice.delivered", object({
@@ -9674,20 +10004,22 @@ const CreateProjectRequest = object({
 	defaultProvider: ProviderId.nullable().optional(),
 	autonomy: AutonomyLevel.nullable().optional()
 });
+/** What CodeDen found in a project folder. */
+const ProjectDetection = object({
+	isGitRepo: boolean(),
+	/** Top level of the git checkout (may differ from the chosen folder). */
+	gitRoot: string().nullable(),
+	remoteUrl: string().nullable(),
+	github: GitHubRepo.nullable(),
+	defaultBranch: string().nullable(),
+	currentBranch: string().nullable(),
+	packageManager: PackageManager.nullable(),
+	/** Suggested worktree setup commands, e.g. `pnpm install`. */
+	suggestedSetupCommands: array(string())
+});
 object({
 	project: Project,
-	detected: object({
-		isGitRepo: boolean(),
-		/** Top level of the git checkout (may differ from the chosen folder). */
-		gitRoot: string().nullable(),
-		remoteUrl: string().nullable(),
-		github: GitHubRepo.nullable(),
-		defaultBranch: string().nullable(),
-		currentBranch: string().nullable(),
-		packageManager: PackageManager.nullable(),
-		/** Suggested worktree setup commands, e.g. `pnpm install`. */
-		suggestedSetupCommands: array(string())
-	})
+	detected: ProjectDetection
 });
 /** `PATCH /api/projects/:id`. */
 const UpdateProjectRequest = object({
@@ -9695,9 +10027,17 @@ const UpdateProjectRequest = object({
 	defaultProvider: ProviderId.nullable().optional(),
 	autonomy: AutonomyLevel.nullable().optional(),
 	timezone: string().nullable().optional(),
-	defaultBranch: string().nullable().optional()
+	defaultBranch: string().nullable().optional(),
+	/** Pin or unpin the project in the project list (§13). */
+	pinned: boolean().optional()
 });
 /**
+* `PUT /api/projects/order`: the new manual order of the project list (§13). Lists every
+* non-archived project exactly once; the server rejects anything else (`invalid_order`).
+*/
+const ReorderProjectsRequest = object({ projectIds: array(Id).max(1e3) });
+object({ projects: array(Project) });
+/**
 * Where a session runs (§9): a fresh worktree (default for agents), the repo root, or an
 * existing directory (`path`).
 */
@@ -10278,6 +10618,97 @@ object({
 	/** The session start when accepted (possibly `conflict`); null when declined. */
 	start: StartSessionResponse.nullable()
 });
+// ../../packages/contracts/src/automations-sharing.ts
+/**
+* Sharing automations (§10): duplicate, export as the Markdown + YAML frontmatter file format
+* (one `.md`, or all of a project's as a `.zip`), and import those files back. Imports are
+* parsed with the same parser and validation as automation files, never run anything and
+* always start off.
+*/
+/** Size limits for an import, checked by the server before anything is parsed. */
+const AUTOMATION_IMPORT_LIMITS = {
+	/** Automation files in one import (Markdown files, zip entries or pasted text). */
+	maxFiles: 50,
+	/** One file's text, in UTF-16 code units (about bytes for ASCII). */
+	maxFileChars: 131072,
+	/** All files together, after unzipping. */
+	maxTotalChars: 1048576,
+	/** A zip as uploaded, before base64 (base64 makes it about a third bigger). */
+	maxZipBytes: 1048576,
+	/** Entries a zip may list, `.md` or not (more is refused before inflating anything). */
+	maxZipEntries: 200
+};
+/** What to import: Markdown files, a zip of them (base64) and/or pasted Markdown. */
+const AutomationImportSource = object({
+	files: array(object({
+		/** File name, e.g. `release-notes.md`; its stem becomes the default work key. */
+		name: string().trim().min(1).max(255),
+		content: string().max(AUTOMATION_IMPORT_LIMITS.maxFileChars)
+	})).max(AUTOMATION_IMPORT_LIMITS.maxFiles).optional(),
+	/** A `.zip` of `.md` files, base64-encoded. Other entries are ignored. */
+	zipBase64: string().max(Math.ceil(AUTOMATION_IMPORT_LIMITS.maxZipBytes / 3) * 4 + 4).optional(),
+	/** One automation pasted as text. */
+	text: string().max(AUTOMATION_IMPORT_LIMITS.maxFileChars).optional()
+}).refine((s) => Boolean(s.files?.length || s.zipBase64 || s.text?.trim()), { message: "Pass files, a zip or pasted text" });
+/** The definition an import would create (no id, target or switch yet). */
+const AutomationDraft = object({
+	name: string().min(1),
+	description: string().nullable(),
+	trigger: AutomationTrigger,
+	action: AutomationAction,
+	guards: AutomationGuards,
+	workKey: string().min(1).max(200)
+});
+object({ items: array(object({
+	/** File name, unique within the import (duplicates get ` (2)`). */
+	fileName: string(),
+	/** Null when the file is invalid. */
+	automation: AutomationDraft.nullable(),
+	/** Validation error (bad YAML, unknown fields, invalid cron, ...); null when importable. */
+	error: string().nullable(),
+	/** Runs with Full permissions: it never asks before acting. */
+	fullPermissions: boolean()
+})) });
+/**
+* `POST /api/automations/import`: re-parse the same source and create the selected files as
+* database automations, always off. `projectId` targets one project; omitted, all projects.
+*/
+const ImportAutomationsRequest = object({
+	source: AutomationImportSource,
+	projectId: Id.optional(),
+	/** File names (from the preview) to import; omitted, every valid file. */
+	select: array(string()).max(AUTOMATION_IMPORT_LIMITS.maxFiles).optional()
+});
+object({
+	/** The new automations, all off. */
+	created: array(AutomationListItem),
+	/** Selected files that could not be imported, with the reason. */
+	failed: array(object({
+		fileName: string(),
+		error: string()
+	}))
+});
+object({
+	/** `<slug>.md`. */
+	fileName: string().min(1),
+	markdown: string()
+});
+/** `GET /api/automations/export?projectId=`: the query; without a project, every automation. */
+const ExportAutomationsQuery = object({ projectId: Id.optional() });
+object({
+	fileName: string().min(1),
+	/** The zip, base64-encoded. */
+	zipBase64: string(),
+	count: int().nonnegative()
+});
+/**
+* `POST /api/automations/:id/duplicate`: an editable copy (also of file-based and built-in
+* automations), off. `projectId` targets one project; omitted, the original's target.
+*/
+const DuplicateAutomationRequest = object({
+	projectId: Id.optional(),
+	name: string().trim().min(1).max(200).optional()
+});
 // ../../packages/contracts/src/browser-api.ts
 /**
 * Browser panel HTTP and WebSocket shapes (§12.2). Routes live under
@@ -10392,6 +10823,125 @@ discriminatedUnion("type", [
 		message: string()
 	})
 ]);
+object({
+	/** Sessions with a turn starting or in progress. */
+	running: int().nonnegative(),
+	/** Sessions blocked on the user (an approval or a question). */
+	waiting: int().nonnegative(),
+	/** Open inbox items (questions, approvals, PRs to review, failures, ...). */
+	inbox: int().nonnegative()
+});
+/** Count running and waiting sessions and open inbox items. */
+function summarizeActivity(sessions, inbox) {
+	let running = 0;
+	let waiting = 0;
+	for (const s of sessions) if (s.status === "running" || s.status === "starting") running++;
+	else if (s.status === "waiting") waiting++;
+	return {
+		running,
+		waiting,
+		inbox: inbox.filter((i) => i.status === "open").length
+	};
+}
+/** The desktop updater's state, mirrored into `GET /api/updates` for the update banner. */
+const DesktopUpdateState = object({
+	phase: _enum([
+		"idle",
+		"checking",
+		"available",
+		"downloading",
+		"downloaded",
+		"installing",
+		"error"
+	]),
+	/** The running app version. */
+	current: string(),
+	/** The newest release found, null until a check succeeded. */
+	latest: string().nullable(),
+	checkedAt: Timestamp.nullable(),
+	/** Download progress (0-100) while `downloading`. */
+	percent: number$1().min(0).max(100).nullable(),
+	/** Why the last check or download failed. */
+	error: string().nullable(),
+	/** Set when this build cannot update itself (a development run, an unsigned macOS app). */
+	unsupported: string().nullable()
+});
+/** What the server asks the desktop updater to do (driven by the update banner and policy). */
+const DesktopUpdateCommand = _enum([
+	"check",
+	"download",
+	"install"
+]);
+discriminatedUnion("type", [
+	object({
+		type: literal("ready"),
+		url: string(),
+		port: int().min(1).max(65535),
+		launchUrl: string(),
+		version: string()
+	}),
+	object({
+		type: literal("failed"),
+		message: string(),
+		code: string().nullable()
+	}),
+	object({
+		type: literal("update.command"),
+		id: string(),
+		command: DesktopUpdateCommand
+	})
+]);
+discriminatedUnion("type", [
+	object({
+		type: literal("update.state"),
+		state: DesktopUpdateState
+	}),
+	object({
+		type: literal("update.done"),
+		id: string(),
+		error: string().nullable()
+	}),
+	object({
+		type: literal("shutdown"),
+		stopRunner: boolean()
+	})
+]);
+discriminatedUnion("kind", [
+	object({ kind: literal("home") }),
+	object({ kind: literal("inbox") }),
+	object({
+		kind: literal("session"),
+		sessionId: Id
+	}),
+	object({
+		kind: literal("project"),
+		projectId: Id
+	}),
+	object({
+		kind: literal("settings"),
+		section: string().nullable()
+	})
+]);
+object({
+	version: string(),
+	platform: _enum([
+		"win32",
+		"darwin",
+		"linux"
+	]),
+	/** True for an installed build (false when run from the repository). */
+	packaged: boolean(),
+	/** The app started this server (false when it attached to one started by `codeden`). */
+	ownsServer: boolean(),
+	/** The OS lets the app start at login (not on Linux AppImage, for example). */
+	launchAtLoginSupported: boolean()
+});
+object({
+	title: string().min(1).max(200),
+	body: string().max(2e3).optional(),
+	/** Passed back to `onNotificationClick` when the user clicks it. */
+	tag: string().max(200).optional()
+});
 // ../../packages/contracts/src/images-api.ts
 /**
 * Image generation settings screen and test button (§12.5). The `generate_image` MCP tool
@@ -10496,14 +11046,59 @@ object({
 	result: StartSessionResponse
 });
 /**
-* `PATCH /api/sessions/:id`: change the model or effort mid-session. Applied on the next turn
-* (a running turn keeps its settings). `null` returns to the role default.
+* `PATCH /api/sessions/:id`: change the model, effort, autonomy or title mid-session.
+* Model and effort apply on the next turn (a running turn keeps its settings); `null` returns
+* to the role default.
 */
 const UpdateSessionRequest = object({
 	model: string().min(1).nullable().optional(),
 	effort: ReasoningEffort.nullable().optional(),
+	/**
+	* Autonomy level (§11.2), saved on the session and pushed to the live provider session.
+	* It applies from the next tool call when the provider reports `liveAutonomy`, otherwise
+	* from the next turn. Approvals already waiting stay waiting.
+	*/
+	autonomy: AutonomyLevel.optional(),
 	title: string().trim().min(1).max(200).optional()
-}).refine((r) => r.model !== void 0 || r.effort !== void 0 || r.title !== void 0, { message: "Nothing to change" });
+}).refine((r) => r.model !== void 0 || r.effort !== void 0 || r.autonomy !== void 0 || r.title !== void 0, { message: "Nothing to change" });
+/**
+* `POST /api/sessions/:id/archive`: stop the session if it is running, hide it from the
+* sidebar and remove its worktree. The branch and checkpoints stay.
+*/
+const ArchiveSessionRequest = object({ 
+/** Remove the worktree even when it has uncommitted changes (those changes are lost). */
+force: boolean().default(false) });
+object({
+	session: Session,
+	worktree: object({
+		status: _enum([
+			"removed",
+			"kept_changes",
+			"none",
+			"failed"
+		]),
+		message: string().nullable()
+	})
+});
+object({
+	/** The project after the check (unchanged unless `changed`). */
+	project: Project,
+	outcome: _enum([
+		"unchanged",
+		"git_detected",
+		"github_connected",
+		"github_changed",
+		"github_remote_missing",
+		"folder_missing"
+	]),
+	/** True when the check updated the project (a `project.updated` event was appended). */
+	changed: boolean(),
+	/** One line for the UI, e.g. "Connected to octo/app" or "Still no GitHub remote on origin". */
+	message: string(),
+	/** What was found in the folder; null when the folder is missing. */
+	detected: ProjectDetection.nullable()
+});
+object({ project: Project });
 // ../../packages/contracts/src/runner/events.ts
 /**
 * Durable runner -> server events. Journaled by the runner and delivered with a `seq`
@@ -10608,8 +11203,9 @@ const RunnerStream = discriminatedUnion("kind", [
 *   4. runner replays journaled events with `seq > lastAckedSeq`, then streams live.
 *
 * After the handshake the server sends `command`s (answered by `result` with the same `id`)
-* and cumulative `ack`s; the runner sends `event`s (durable, with `seq`) and `stream`s
-* (ephemeral). Either side may `ping`.
+* and cumulative `ack`s; the runner sends `event`s (durable, with `seq`), `stream`s
+* (ephemeral) and `providers` (the current provider list, whenever it changes). Either side
+* may `ping`.
 */
 /** Request id correlating a `command` with its `result`. */
 const RequestId = string().min(1).max(100);
@@ -10708,6 +11304,10 @@ const RunnerToServerMessage = discriminatedUnion("type", [
 		ts: Timestamp,
 		stream: RunnerStream
 	}),
+	object({
+		type: literal("providers"),
+		providers: array(ProviderInfo)
+	}),
 	Ping,
 	Pong
 ]);
@@ -11027,57 +11627,11 @@ object({
 * rest of the bundle, so the package version is the single source of truth at runtime;
 * everywhere else (workspace, tests) it is `SOURCE_VERSION`.
 */
-const CODEDEN_VERSION = packageVersion() ?? "0.1.1";
+const CODEDEN_VERSION = packageVersion() ?? "0.3.0";
 function packageVersion() {
 	const value = globalThis.__CODEDEN_PACKAGE_VERSION__;
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-// ../../packages/contracts/src/voice-api.ts
-/**
-* Optional cloud voice engines (§11.3). The browser's speech APIs stay the default; these
-* routes proxy ElevenLabs (text to speech, Scribe) and OpenAI (transcription) with API keys
-* from the OS keychain, so keys never reach the browser.
-*/
-/** ElevenLabs MP3 output formats (`codec_sampleRate_bitrate`). */
-const TtsOutputFormat = _enum([
-	"mp3_22050_32",
-	"mp3_44100_64",
-	"mp3_44100_128",
-	"mp3_44100_192"
-]);
-/**
-* `POST /api/tts`: streams `audio/mpeg`. `voiceId` defaults to
-* `settings.voice.readAloud.voice`, then a stock voice; `modelId` to a low-latency model.
-*/
-const TtsRequest = object({
-	text: string().min(1).max(5e3),
-	voiceId: string().min(1).max(100).optional(),
-	modelId: string().min(1).max(100).optional(),
-	outputFormat: TtsOutputFormat.optional()
-});
-object({ voices: array(object({
-	id: string(),
-	name: string(),
-	category: string().optional(),
-	description: string().optional(),
-	previewUrl: string().optional(),
-	labels: record(string(), string()).optional()
-})) });
-/**
-* `POST /api/stt?engine=&language=`: the body is the recorded audio (raw bytes with an
-* `audio/*` content type, or multipart with a `file` field), up to 25 MB. `engine` defaults
-* to `settings.voice.dictation.engine` (when that is `browser`, ElevenLabs).
-*/
-const SttQuery = object({
-	engine: _enum(["elevenlabs", "openai"]).optional(),
-	/** ISO 639-1 hint, e.g. `en`. */
-	language: string().min(2).max(10).optional()
-});
-object({
-	text: string(),
-	language: string().nullable(),
-	engine: _enum(["elevenlabs", "openai"])
-});
 // ../../node_modules/.pnpm/ws@8.22.1/node_modules/ws/lib/constants.js
 var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const BINARY_TYPES = [
@@ -14828,6 +15382,43 @@ var AsyncQueue = class {
 		};
 	}
 };
+// ../../packages/providers/src/models.ts
+function copy(m) {
+	return {
+		...m,
+		efforts: [...m.efforts]
+	};
+}
+/**
+* An adapter's current model list. It starts from a fallback and is replaced by what the
+* provider reports (model discovery, a running session). Listeners hear about real changes
+* only, so the runner can forward them to the server (§4.3).
+*/
+var ModelCatalog = class {
+	models;
+	listeners = /* @__PURE__ */ new Set();
+	constructor(fallback) {
+		this.models = fallback.map(copy);
+	}
+	/** A copy of the current list. */
+	list() {
+		return this.models.map(copy);
+	}
+	/** Replace the list. Returns false (and notifies nobody) when nothing changed. */
+	set(models) {
+		if (JSON.stringify(models) === JSON.stringify(this.models)) return false;
+		this.models = models.map(copy);
+		for (const listener of this.listeners) try {
+			listener();
+		} catch {}
+		return true;
+	}
+	/** Call `listener` after every change. Returns the unsubscribe function. */
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => this.listeners.delete(listener);
+	}
+};
 // ../../packages/providers/src/util/exec.ts
 function isFile(candidate) {
 	try {
@@ -14899,11 +15490,51 @@ function scriptFromCmdShim(shimPath, content) {
 	if (content === void 0 && !existsSync(script)) return void 0;
 	return script;
 }
+/** True inside the desktop app, where `process.execPath` is the Electron binary (§17). */
+function isElectronRuntime(versions = process.versions) {
+	return typeof versions.electron === "string";
+}
+/**
+* Environment for running one of CodeDen's own scripts (the runner, npm, Playwright's CLI)
+* with `process.execPath`. In the desktop app that is the Electron binary, which only acts
+* as Node.js with `ELECTRON_RUN_AS_NODE=1`; elsewhere the environment is returned unchanged.
+*/
+function ownNodeEnv(env = process.env, versions = process.versions) {
+	return isElectronRuntime(versions) ? {
+		...env,
+		ELECTRON_RUN_AS_NODE: "1"
+	} : env;
+}
+let systemNode;
+/**
+* The Node.js that runs `node-script` commands (npm-style shims of the user's own tools, such
+* as a globally installed Codex on Windows). Normally the Node running CodeDen. In the desktop
+* app the user's `node` from PATH is preferred, so their tools run exactly as in a terminal
+* and `ELECTRON_RUN_AS_NODE` never leaks into agent processes; without one, the Electron
+* binary runs them as Node.js.
+*/
+function scriptRuntime() {
+	if (!isElectronRuntime()) return {
+		path: process.execPath,
+		electron: false
+	};
+	if (systemNode === void 0) {
+		const found = resolveExecutable("node");
+		systemNode = found?.kind === "native" ? found.path : null;
+	}
+	return systemNode ? {
+		path: systemNode,
+		electron: false
+	} : {
+		path: process.execPath,
+		electron: true
+	};
+}
 /** The `[command, args]` to pass to `spawn` for a resolved executable (never needs `shell`). */
 function spawnArgs(cmd, args) {
 	switch (cmd.kind) {
 		case "native": return [cmd.path, [...args]];
-		case "node-script": return [process.execPath, [cmd.script, ...args]];
+		case "node-script": return [scriptRuntime().path, [cmd.script, ...args]];
 		case "shell-script": return [process.env.ComSpec ?? "cmd.exe", [
 			"/d",
 			"/s",
@@ -14920,9 +15551,11 @@ function quoteCmdArg(arg) {
 /** Spawn a resolved executable. Uses `windowsVerbatimArguments` for the cmd.exe fallback. */
 function spawnResolved(cmd, args, options = {}) {
 	const [file, argv] = spawnArgs(cmd, args);
+	const asNode = cmd.kind === "node-script" && scriptRuntime().electron;
 	return spawn(file, argv, {
 		windowsHide: true,
 		...options,
+		...asNode ? { env: ownNodeEnv(options.env ?? process.env) } : {},
 		...cmd.kind === "shell-script" ? { windowsVerbatimArguments: true } : {}
 	});
 }
@@ -15135,6 +15768,9 @@ function parseClaudeAuthStatus(stdout) {
 		return unknown;
 	}
 }
+// ../../packages/providers/src/util/model.ts
+/** The id the model pickers use for "the provider's own default model". */
+const DEFAULT_MODEL_ID = "default";
 /**
 * The model to pass to a provider, or undefined to leave it out so the provider uses its own
 * default (the user's config). `"default"` and empty values are never sent as model ids.
@@ -15143,6 +15779,213 @@ function explicitModel(model) {
 	const id = model?.trim();
 	return id && id !== "default" ? id : void 0;
 }
+// ../../packages/providers/src/policy/read-only.ts
+/**
+* Read-only sessions (the orchestrator and PMs, and agent sessions with the `read_only`
+* permission level, §11.2) may inspect a repository but never change it. This allowlist decides
+* which shell commands they may run: commands that only read, with no output redirection and no
+* command substitution. Agent sessions may also run the project's checks (tests, lint, type
+* checks) without fix or update flags. Anything else is denied.
+*/
+/**
+* Split on every `;`, `&&`, `||`, `|` and newline, even inside quotes. Deliberately cruder
+* than the risk classifier's lexer: for an allowlist, over-splitting only denies more.
+*/
+function splitCommands(command) {
+	return command.split(/\r?\n|;|&&|\|\||\|/).map((s) => s.trim()).filter(Boolean);
+}
+/** Tokenize one simple command, honouring single and double quotes. */
+function tokenize(command) {
+	const tokens = [];
+	for (const m of command.matchAll(/"((?:[^"\\]|\\.)*)"|'([^']*)'|(\S+)/g)) tokens.push(m[1] ?? m[2] ?? m[3] ?? "");
+	return tokens;
+}
+/** Programs that only read (or print). */
+const READ_ONLY_BINS = /* @__PURE__ */ new Set([
+	"ls",
+	"dir",
+	"cat",
+	"type",
+	"head",
+	"tail",
+	"less",
+	"more",
+	"wc",
+	"grep",
+	"egrep",
+	"fgrep",
+	"rg",
+	"find",
+	"fd",
+	"tree",
+	"pwd",
+	"echo",
+	"printf",
+	"which",
+	"where",
+	"whoami",
+	"date",
+	"stat",
+	"file",
+	"du",
+	"df",
+	"sort",
+	"uniq",
+	"cut",
+	"diff",
+	"jq",
+	"basename",
+	"dirname",
+	"realpath",
+	"true",
+	"get-childitem",
+	"gci",
+	"get-content",
+	"gc",
+	"get-item",
+	"gi",
+	"get-location",
+	"gl",
+	"select-string",
+	"sls",
+	"measure-object",
+	"test-path",
+	"resolve-path",
+	"write-output",
+	"write-host",
+	"select-object",
+	"where-object",
+	"format-list",
+	"format-table",
+	"out-string",
+	"sort-object",
+	"gh"
+]);
+/** Git subcommands that never change the repository. */
+const READ_ONLY_GIT = /* @__PURE__ */ new Set([
+	"status",
+	"log",
+	"show",
+	"diff",
+	"blame",
+	"grep",
+	"ls-files",
+	"ls-tree",
+	"rev-parse",
+	"rev-list",
+	"describe",
+	"shortlog",
+	"cat-file",
+	"remote",
+	"branch",
+	"tag",
+	"config",
+	"reflog",
+	"merge-base",
+	"name-rev",
+	"for-each-ref",
+	"worktree"
+]);
+/** `gh` subcommand verbs that only read. */
+const READ_ONLY_GH = /* @__PURE__ */ new Set([
+	"view",
+	"list",
+	"status",
+	"diff",
+	"checks"
+]);
+const bin = (token) => (token ?? "").replace(/\\/g, "/").split("/").pop()?.toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/, "") ?? "";
+/** Package managers whose `test`, `lint`, ... scripts count as checks. */
+const PACKAGE_MANAGERS = /* @__PURE__ */ new Set([
+	"npm",
+	"pnpm",
+	"yarn",
+	"bun"
+]);
+/** Script names a package manager may run as a check (`pnpm test`, `npm run lint`). */
+const CHECK_SCRIPTS = /* @__PURE__ */ new Set([
+	"test",
+	"tests",
+	"lint",
+	"typecheck",
+	"type-check",
+	"check",
+	"types",
+	"vitest",
+	"jest",
+	"biome",
+	"eslint",
+	"tsc"
+]);
+/** Programs (null: any arguments) and `<program> <subcommand>` pairs that run checks. */
+const CHECK_COMMANDS = {
+	tsc: null,
+	vitest: null,
+	jest: null,
+	eslint: null,
+	pytest: null,
+	mypy: null,
+	pyright: null,
+	biome: [
+		"check",
+		"lint",
+		"ci"
+	],
+	ruff: ["check"],
+	cargo: [
+		"test",
+		"check",
+		"clippy"
+	],
+	go: ["test", "vet"],
+	dotnet: ["test"],
+	mvn: ["test", "verify"],
+	gradle: ["test", "check"]
+};
+/** Flags that turn a check into a write (fixing, formatting, updating snapshots, watching). */
+const WRITING_FLAG = /^(--fix|--fix-type=.*|--write|--apply|--apply-unsafe|--unsafe|-u|--update|--update-snapshots?|--updatesnapshot|--watch|-w)(=.*)?$/;
+/** True when `name args` runs a known check without writing flags. */
+function isCheck(name, args) {
+	if (args.some((a) => WRITING_FLAG.test(a))) return false;
+	const positional = args.filter((a) => !a.startsWith("-"));
+	if (PACKAGE_MANAGERS.has(name)) {
+		const script = positional[0] === "run" ? positional[1] : positional[0];
+		return script !== void 0 && CHECK_SCRIPTS.has(script);
+	}
+	if (name === "npx" || name === "pnpx" || name === "bunx") {
+		const tool = positional[0];
+		return tool !== void 0 && isCheck(bin(tool), args.slice(args.indexOf(tool) + 1));
+	}
+	if (name === "python" || name === "python3" || name === "py") return args[0] === "-m" && (args[1] === "pytest" || args[1] === "mypy");
+	if (!Object.hasOwn(CHECK_COMMANDS, name)) return false;
+	const subs = CHECK_COMMANDS[name];
+	if (!subs) return true;
+	return positional[0] !== void 0 && subs.includes(positional[0]);
+}
+/** Why a command is refused in a read-only session, or undefined when it may run. */
+function readOnlyCommandDenial(command, options = {}) {
+	if (/\$\(|`|<\(|>\(/.test(command)) return "Command substitution is not allowed in a read-only session";
+	for (const simple of splitCommands(command)) {
+		if (/(^|[^0-9&<])>>?(?!\s*(&\d|\/dev\/null|nul\b|\$null))/i.test(simple)) return "Writing files is not allowed in a read-only session";
+		const tokens = tokenize(simple);
+		const name = bin(tokens[0]);
+		const args = tokens.slice(1).map((a) => a.toLowerCase());
+		if (name === "git") {
+			const sub = args.find((a) => !a.startsWith("-"));
+			if (!sub || !READ_ONLY_GIT.has(sub)) return `git ${sub ?? ""} may change the repository`;
+			if ((sub === "branch" || sub === "tag" || sub === "remote" || sub === "worktree") && args.some((a) => /^-(d|D|m|M|f|-delete|-move|-force)$/.test(a) || a === "add")) return `git ${sub} with these options changes the repository`;
+			if (sub === "config" && !args.some((a) => a === "--get" || a === "--list" || a === "-l")) return "Only reading git config is allowed";
+			continue;
+		}
+		if (name === "gh") {
+			if (!args.some((a) => READ_ONLY_GH.has(a)) || args.includes("api")) return "Only read-only gh commands are allowed (view, list, status, diff, checks)";
+			continue;
+		}
+		if (name === "find" && args.some((a) => a === "-delete" || a === "-exec" || a === "-execdir")) return "find with -delete or -exec is not allowed in a read-only session";
+		if (options.allowChecks && isCheck(name, args)) continue;
+		if (!READ_ONLY_BINS.has(name)) return `${name || "This command"} is not on the read-only allowlist`;
+	}
+}
 // ../../packages/providers/src/util/text.ts
 /** Max characters of tool output kept inline in an item (§6: larger outputs are truncated). */
 const TOOL_OUTPUT_PREVIEW_CHARS = 16e3;
@@ -15197,50 +16040,110 @@ function unixToIso(value) {
 	const ms = value < 0xe8d4a51000 ? value * 1e3 : value;
 	return new Date(ms).toISOString();
 }
-// ../../packages/providers/src/utility.ts
-/** Abort signal that fires on the caller's signal or after `timeoutMs`. */
-function oneShotSignal(request) {
-	const controller = new AbortController();
-	const timer = setTimeout(() => controller.abort(/* @__PURE__ */ new Error("Utility model timed out")), request.timeoutMs ?? 6e4);
-	const onAbort = () => controller.abort(request.signal?.reason);
-	request.signal?.addEventListener("abort", onAbort, { once: true });
-	return {
-		signal: controller.signal,
-		dispose: () => {
-			clearTimeout(timer);
-			request.signal?.removeEventListener("abort", onAbort);
-		}
-	};
-}
 // ../../packages/providers/src/policy/paths.ts
+const isWin = (ctx) => (ctx.platform ?? process.platform) === "win32";
 function pathApi(ctx) {
-	return (ctx.platform ?? process.platform) === "win32" ? path.win32 : path.posix;
+	return isWin(ctx) ? path.win32 : path.posix;
+}
+function homeOf(ctx) {
+	return ctx.home ?? process.env.HOME ?? process.env.USERPROFILE ?? "";
+}
+function tempRootsOf(ctx) {
+	return ctx.tempRoots ?? osTempRoots(ctx.platform);
+}
+const HOME_VARS = /^(\$HOME|\$\{HOME\}|\$env:USERPROFILE|%USERPROFILE%)(?=$|[\\/])/i;
+const TEMP_VARS = /^(\$TMPDIR|\$\{TMPDIR\}|\$TEMP|\$TMP|\$env:TEMP|\$env:TMP|%TEMP%|%TMP%)(?=$|[\\/])/i;
+/**
+* Git Bash paths on Windows: `/c/Users/x` is `C:\Users\x`, and `/tmp` is the user's temp
+* directory.
+*/
+function fromGitBash(value, temp) {
+	if (temp && /^\/tmp(?=$|\/)/.test(value)) return temp + value.slice(4);
+	const drive = /^\/([a-z])(?=$|\/)/i.exec(value);
+	if (drive?.[1]) return `${drive[1].toUpperCase()}:\\${value.slice(3)}`;
+	return value;
 }
-/** Resolve `target` (absolute, relative to cwd, or `~`-prefixed) to an absolute path. */
+/**
+* Resolve `target` (absolute, relative to `dir`, `~`-prefixed, or starting with a home or
+* temp variable) to an absolute path.
+*/
 function resolveAgainst(target, ctx) {
 	const p = pathApi(ctx);
 	let value = target.trim().replace(/^["']|["']$/g, "");
-	const home = ctx.home ?? process.env.HOME ?? process.env.USERPROFILE ?? "";
+	const home = homeOf(ctx);
 	if (value === "~" || value.startsWith("~/") || value.startsWith("~\\")) value = home + value.slice(1);
-	value = value.replace(/^\$HOME(?=$|[\\/])/, home).replace(/^\$env:USERPROFILE(?=$|[\\/])/i, home);
-	return p.resolve(ctx.cwd, value);
+	value = value.replace(HOME_VARS, home);
+	const temp = tempRootsOf(ctx)[0];
+	if (temp) value = value.replace(TEMP_VARS, temp);
+	if (isWin(ctx)) value = fromGitBash(value, temp);
+	return p.resolve(ctx.dir ?? ctx.cwd, value);
 }
 /** True when `target` resolves inside `root` (or equals it). Case-insensitive on Windows. */
 function isInside$1(target, root, ctx) {
+	const rel = relative$1(root, target, ctx);
+	return rel === "" || !rel.startsWith("..") && !pathApi(ctx).isAbsolute(rel);
+}
+function relative$1(root, target, ctx) {
 	const p = pathApi(ctx);
-	const win = (ctx.platform ?? process.platform) === "win32";
-	const norm = (s) => {
-		const r = p.resolve(s);
-		return win ? r.toLowerCase() : r;
-	};
-	const rel = p.relative(norm(root), norm(target));
-	return rel === "" || !rel.startsWith("..") && !p.isAbsolute(rel);
+	const norm = (s) => isWin(ctx) ? p.resolve(s).toLowerCase() : p.resolve(s);
+	return p.relative(norm(root), norm(target));
 }
 /** True when `target` is inside the worktree or one of the extra roots. */
 function isInWorkspace(target, ctx) {
 	const abs = resolveAgainst(target, ctx);
 	return [ctx.cwd, ...ctx.extraRoots ?? []].some((root) => isInside$1(abs, root, ctx));
 }
+/** True when `target` is strictly inside one of the OS temp directories (never the root). */
+function isInTemp(target, ctx) {
+	const abs = resolveAgainst(target, ctx);
+	return tempRootsOf(ctx).some((root) => {
+		return relative$1(root, abs, ctx) !== "" && isInside$1(abs, root, ctx);
+	});
+}
+/** True when agents may write `target` without asking: the worktree, extra roots or temp. */
+function isWritable(target, ctx) {
+	return isInWorkspace(target, ctx) || isInTemp(target, ctx);
+}
+/**
+* Usable temp roots from `candidates`: absolute, deduplicated, and never a filesystem root,
+* the home directory or one of its parents (a stray `TMPDIR=/` must not open everything).
+*/
+function tempRootsFrom(candidates, platform, home) {
+	const ctx = {
+		cwd: "/",
+		platform
+	};
+	const p = pathApi(ctx);
+	const out = [];
+	for (const candidate of candidates) {
+		if (!candidate || !p.isAbsolute(candidate)) continue;
+		const root = p.resolve(candidate);
+		if (p.parse(root).root === root || p.dirname(root) === root) continue;
+		if (home && isInside$1(home, root, ctx)) continue;
+		if (!out.some((r) => relative$1(r, root, ctx) === "")) out.push(root);
+	}
+	return out;
+}
+const realpath$1 = (p) => {
+	try {
+		return realpathSync.native(p);
+	} catch {
+		return;
+	}
+};
+let cachedTempRoots;
+/**
+* The OS temp directories for the running platform: `os.tmpdir()`, `%TEMP%` and `%TMP%` on
+* Windows, `$TMPDIR` and `/tmp` elsewhere, each also by its real path (macOS symlinks
+* `/tmp`, Windows may report a short 8.3 name). Empty when asked about another platform.
+*/
+function osTempRoots(platform = process.platform) {
+	if (platform !== process.platform) return [];
+	if (cachedTempRoots) return cachedTempRoots;
+	const env = process.env;
+	cachedTempRoots = tempRootsFrom([os.tmpdir(), ...platform === "win32" ? [env.TEMP, env.TMP] : [env.TMPDIR, "/tmp"]].flatMap((c) => c ? [c, realpath$1(c)] : []), platform, os.homedir());
+	return cachedTempRoots;
+}
 const SECRET_BASENAMES = /* @__PURE__ */ new Set([
 	".env",
 	".npmrc",
@@ -15284,41 +16187,297 @@ function isSecretPath(target) {
 	if (SECRET_EXTENSIONS.some((ext) => base.endsWith(ext))) return true;
 	return /(^|\/)\.(ssh|aws|gnupg|docker)\//i.test(normalized) && !base.endsWith(".pub");
 }
-// ../../packages/providers/src/policy/risk.ts
-const SAFE = { risky: false };
-const risky = (action, reason) => ({
-	risky: true,
-	action,
-	reason
-});
-/** Split a shell command line into simple commands (on `;`, `&&`, `||`, `|`, newlines). */
-function splitCommands(command) {
-	return command.split(/\r?\n|;|&&|\|\||\|/).map((s) => s.trim()).filter(Boolean);
-}
-/** Tokenize one simple command, honouring single and double quotes. */
-function tokenize(command) {
-	const tokens = [];
-	for (const m of command.matchAll(/"((?:[^"\\]|\\.)*)"|'([^']*)'|(\S+)/g)) tokens.push(m[1] ?? m[2] ?? m[3] ?? "");
-	return tokens;
-}
-/** Strip wrappers that don't change what runs (`sudo`, `env X=1`, `command`, `exec`). */
-function unwrap(tokens) {
-	let elevated = false;
-	let rest = tokens;
-	for (;;) {
-		const head = rest[0]?.toLowerCase();
-		if (head === "sudo" || head === "doas" || head === "runas" || head === "gsudo") {
-			elevated = true;
-			rest = rest.slice(1).filter((t, i) => !(i === 0 && t.startsWith("-")));
-		} else if (head === "env" || head === "command" || head === "exec" || head === "nohup") rest = rest.slice(1);
-		else if (head && /^[A-Za-z_][A-Za-z0-9_]*=/.test(head)) rest = rest.slice(1);
-		else break;
+// ../../packages/providers/src/policy/shell.ts
+/** Parse a command line into its simple commands. */
+function parseShell(src, dialect = "auto") {
+	return new Lexer(src, dialect).list(null);
+}
+/** Placeholder for heredoc and here-string bodies, which are data, never commands. */
+const BODY = "<body>";
+/** The command being built and the word being read. */
+var Builder = class {
+	out;
+	cmd = {
+		words: [],
+		writes: [],
+		nested: []
+	};
+	word = "";
+	inWord = false;
+	/** Where the current word goes: an argument, a redirect target or a heredoc delimiter. */
+	target = "word";
+	heredocStrip = false;
+	heredocs = [];
+	constructor(out) {
+		this.out = out;
+	}
+	add(text) {
+		this.word += text;
+		this.inWord = true;
+	}
+	endWord() {
+		if (!this.inWord) return;
+		if (this.target === "write") this.cmd.writes.push(this.word);
+		else if (this.target === "heredoc") this.heredocs.push({
+			delim: this.word.replace(/\\/g, ""),
+			strip: this.heredocStrip
+		});
+		else if (this.target === "word") this.cmd.words.push(this.word);
+		this.target = "word";
+		this.word = "";
+		this.inWord = false;
+	}
+	endCommand() {
+		this.endWord();
+		this.target = "word";
+		const { cmd } = this;
+		if (cmd.words.length || cmd.writes.length || cmd.nested.length) this.out.push(cmd);
+		this.cmd = {
+			words: [],
+			writes: [],
+			nested: []
+		};
+	}
+};
+var Lexer = class {
+	src;
+	dialect;
+	i = 0;
+	constructor(src, dialect) {
+		this.src = src;
+		this.dialect = dialect;
+	}
+	/** Read simple commands until `closer` (`)` or a backtick) or the end of the input. */
+	list(closer) {
+		const out = [];
+		const b = new Builder(out);
+		const { src } = this;
+		while (this.i < src.length) {
+			const c = src[this.i];
+			const next = src[this.i + 1];
+			if (closer && c === closer) {
+				this.i += 1;
+				b.endCommand();
+				return out;
+			}
+			if (c === "\n" || c === "\r") {
+				b.endCommand();
+				this.i += c === "\r" && next === "\n" ? 2 : 1;
+				this.skipHeredocs(b.heredocs.splice(0));
+			} else if (c === " " || c === "	") {
+				b.endWord();
+				this.i += 1;
+			} else if (c === "#" && !b.inWord) while (this.i < src.length && src[this.i] !== "\n" && src[this.i] !== "\r") this.i += 1;
+			else if (c === ";") {
+				b.endCommand();
+				this.i += 1;
+			} else if (c === "|") {
+				b.endCommand();
+				this.i += next === "|" || next === "&" ? 2 : 1;
+			} else if (c === "&" && next === ">") {
+				b.endWord();
+				b.target = "write";
+				this.i += src[this.i + 2] === ">" ? 3 : 2;
+			} else if (c === "&") {
+				b.endCommand();
+				this.i += next === "&" ? 2 : 1;
+			} else if (c === ">" || c === "<") this.redirect(b, c);
+			else if (c === "'" || c === "\"") {
+				if (b.inWord && b.word.endsWith("@") && this.lineEndsAt(this.i + 1)) {
+					this.skipHereString(c);
+					b.add(BODY);
+				} else if (c === "'") b.add(this.readSingle());
+				else b.add(this.readDouble(b));
+			} else if (c === "\\" && this.dialect !== "powershell") {
+				if (next === "\n" || next === "\r") this.i += next === "\r" && src[this.i + 2] === "\n" ? 3 : 2;
+				else {
+					b.add(src.slice(this.i, this.i + 2));
+					this.i += 2;
+				}
+			} else if (c === "`") this.backtick(b);
+			else if (c === "(") {
+				const start = this.i;
+				this.i += 1;
+				b.cmd.nested.push(this.list(")"));
+				b.add(src.slice(start, this.i));
+			} else {
+				b.add(c);
+				this.i += 1;
+			}
+		}
+		b.endCommand();
+		return out;
+	}
+	/** `>`, `>>`, `>|`, `2>`, `*>`, `2>&1`, `<`, `<<EOF`, `<<-EOF`, `<<<`, `<(…)`, `>(…)`. */
+	redirect(b, c) {
+		const { src } = this;
+		if (b.inWord && /^(\d+|\*)$/.test(b.word)) {
+			b.word = "";
+			b.inWord = false;
+		} else b.endWord();
+		const next = src[this.i + 1];
+		if (next === "(") {
+			const start = this.i;
+			this.i += 2;
+			b.cmd.nested.push(this.list(")"));
+			b.add(src.slice(start, this.i));
+			return;
+		}
+		if (c === "<") {
+			if (next === "<" && src[this.i + 2] === "<") {
+				b.target = "skip";
+				this.i += 3;
+			} else if (next === "<") {
+				this.i += 2;
+				b.heredocStrip = src[this.i] === "-";
+				if (b.heredocStrip) this.i += 1;
+				b.target = "heredoc";
+			} else this.i += 1;
+			return;
+		}
+		let j = this.i + 1;
+		if (src[j] === ">") j += 1;
+		if (src[j] === "|") j += 1;
+		if (src[j] === "&") {
+			const dup = /^&(\d+|-)/.exec(src.slice(j));
+			if (dup) {
+				this.i = j + dup[0].length;
+				return;
+			}
+			j += 1;
+		}
+		b.target = "write";
+		this.i = j;
+	}
+	/**
+	* PowerShell escapes the next character; POSIX starts a command substitution. (A closing
+	* backtick never gets here: `list` checks for its closer first.)
+	*/
+	backtick(b) {
+		const { src } = this;
+		const next = src[this.i + 1];
+		if (this.dialect === "powershell" || this.dialect === "auto" && (next === void 0 || /\s/.test(next))) {
+			if (next === "\n" || next === "\r") this.i += next === "\r" && src[this.i + 2] === "\n" ? 3 : 2;
+			else {
+				b.add(src.slice(this.i + 1, this.i + 2));
+				this.i += 2;
+			}
+			return;
+		}
+		const start = this.i;
+		this.i += 1;
+		b.cmd.nested.push(this.list("`"));
+		b.add(src.slice(start, this.i));
+	}
+	readSingle() {
+		const end = this.src.indexOf("'", this.i + 1);
+		const stop = end === -1 ? this.src.length : end;
+		const text = this.src.slice(this.i + 1, stop);
+		this.i = stop + 1;
+		return text;
+	}
+	/** A double-quoted string: escapes, and `$(…)` substitutions run as nested commands. */
+	readDouble(b) {
+		const { src } = this;
+		let text = "";
+		this.i += 1;
+		while (this.i < src.length) {
+			const c = src[this.i];
+			const next = src[this.i + 1];
+			if (c === "\"") {
+				this.i += 1;
+				return text;
+			}
+			if (c === "\\" && this.dialect !== "powershell" && next && "\"\\$`\n".includes(next)) {
+				text += next;
+				this.i += 2;
+			} else if (c === "`" && this.dialect !== "posix" && next !== void 0) {
+				text += next;
+				this.i += 2;
+			} else if (c === "`") {
+				const start = this.i;
+				this.i += 1;
+				b.cmd.nested.push(this.list("`"));
+				text += src.slice(start, this.i);
+			} else if (c === "$" && next === "(") {
+				const start = this.i;
+				this.i += 2;
+				b.cmd.nested.push(this.list(")"));
+				text += src.slice(start, this.i);
+			} else {
+				text += c;
+				this.i += 1;
+			}
+		}
+		return text;
+	}
+	/** True when only spaces or tabs remain before the end of the line at `j`. */
+	lineEndsAt(j) {
+		return /^[ \t]*(\r?\n|$)/.exec(this.src.slice(j)) !== null;
+	}
+	/** Skip a PowerShell here-string (`@'` … `'@`) whose opening quote is at `this.i`. */
+	skipHereString(quote) {
+		const close = new RegExp(`(^|\\n)${quote}@`, "g");
+		close.lastIndex = this.i + 1;
+		const m = close.exec(this.src);
+		this.i = m ? m.index + m[0].length : this.src.length;
+	}
+	/** Skip the bodies of heredocs opened on the line that just ended. */
+	skipHeredocs(pending) {
+		const { src } = this;
+		for (const { delim, strip } of pending) while (this.i < src.length) {
+			const nl = src.indexOf("\n", this.i);
+			const end = nl === -1 ? src.length : nl;
+			let line = src.slice(this.i, end).replace(/\r$/, "");
+			if (strip) line = line.replace(/^\t+/, "");
+			this.i = nl === -1 ? src.length : nl + 1;
+			if (line === delim) break;
+		}
+	}
+};
+// ../../packages/providers/src/policy/risk.ts
+const SAFE = { risky: false };
+const risky = (action, reason) => ({
+	risky: true,
+	action,
+	reason
+});
+/** How deep `bash -c "…"` style inline scripts are followed. */
+const MAX_DEPTH = 4;
+/**
+* Words that don't change what runs: elevation (`sudo`), wrappers (`env X=1`, `command`,
+* `exec`) and shell keywords that start a compound command (`if`, `then`, `do`, `{`, ...).
+*/
+function unwrap(words) {
+	let elevated = false;
+	let rest = words;
+	for (;;) {
+		const head = rest[0]?.toLowerCase();
+		if (head === "sudo" || head === "doas" || head === "runas" || head === "gsudo") {
+			elevated = true;
+			rest = rest.slice(1).filter((t, i) => !(i === 0 && t.startsWith("-")));
+		} else if (head === "env" || head === "command" || head === "exec" || head === "nohup") rest = rest.slice(1);
+		else if (head && KEYWORDS.has(head)) rest = rest.slice(1);
+		else if (head && /^[A-Za-z_][A-Za-z0-9_]*=/.test(head)) rest = rest.slice(1);
+		else break;
 	}
 	return {
 		tokens: rest,
 		elevated
 	};
 }
+const KEYWORDS = /* @__PURE__ */ new Set([
+	"if",
+	"then",
+	"else",
+	"elif",
+	"do",
+	"while",
+	"until",
+	"time",
+	"!",
+	"{"
+]);
 const binName = (token) => (token ?? "").replace(/\\/g, "/").split("/").pop()?.toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/, "") ?? "";
 const DOWNLOADERS = /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b|downloadstring/i;
 const SHELLS = /^\s*(sudo\s+)?(sh|bash|zsh|fish|dash|ksh|iex|invoke-expression|python3?|node|pwsh|powershell|perl|ruby)(\s|$)/i;
@@ -15328,18 +16487,109 @@ function classifyCommand(command, ctx) {
 	for (let i = 1; i < pipeline.length; i += 1) if (DOWNLOADERS.test(pipeline[i - 1] ?? "") && SHELLS.test(pipeline[i] ?? "")) return risky("network", "Pipes a downloaded script straight into a shell");
 	if (/\b(iex|invoke-expression)\b[^|]*\b(irm|iwr|invoke-restmethod|invoke-webrequest|downloadstring)\b/i.test(command)) return risky("network", "Executes a downloaded script");
 	if (/\b(bash|sh|zsh)\s+(-c\s+)?["']?\$\(\s*(curl|wget)\b/i.test(command) || /<\(\s*(curl|wget)\b/i.test(command)) return risky("network", "Executes a downloaded script");
-	for (const simple of splitCommands(command)) {
-		const result = classifySimple(simple, ctx);
+	return classifyList(parseShell(command, ctx.shell ?? "auto"), ctx, 0);
+}
+/**
+* Classify commands in order. A `cd` moves where later relative paths resolve; commands in
+* substitutions and subshells are classified too, without their `cd` leaking out.
+*/
+function classifyList(list, ctx, depth) {
+	let here = ctx;
+	for (const cmd of list) {
+		for (const nested of cmd.nested) {
+			const result = classifyList(nested, here, depth);
+			if (result.risky) return result;
+		}
+		const result = classifySimple(cmd, here, depth);
 		if (result.risky) return result;
+		here = afterCd(cmd, here);
 	}
 	return SAFE;
 }
-function classifySimple(simple, ctx) {
-	const { tokens, elevated } = unwrap(tokenize(simple));
+const CD = /* @__PURE__ */ new Set([
+	"cd",
+	"pushd",
+	"chdir",
+	"set-location",
+	"sl",
+	"push-location"
+]);
+/** The context after `cmd` when it changes directory (`cd dir`, `Set-Location -Path dir`). */
+function afterCd(cmd, ctx) {
+	const { tokens } = unwrap(cmd.words);
+	if (!CD.has(binName(tokens[0]))) return ctx;
+	const args = tokens.slice(1);
+	if (args.includes("-")) return ctx;
+	const target = namedArg(args, ["-path", "-literalpath"]) ?? args.find((a) => !a.startsWith("-")) ?? "~";
+	return {
+		...ctx,
+		dir: resolveAgainst(target, ctx)
+	};
+}
+/** The value after a PowerShell-style named parameter (`-Path x`), if present. */
+function namedArg(args, names) {
+	const i = args.findIndex((a) => names.includes(a.toLowerCase()));
+	return i >= 0 ? args[i + 1] : void 0;
+}
+/** The script of an inline shell invocation (`bash -c "…"`, `pwsh -Command …`, `cmd /c …`). */
+function inlineScript(bin, args) {
+	if ([
+		"sh",
+		"bash",
+		"zsh",
+		"dash",
+		"ksh",
+		"ash",
+		"fish"
+	].includes(bin)) {
+		const flag = args.findIndex((a) => /^-[a-z]*c[a-z]*$/i.test(a));
+		const text = flag >= 0 ? args.slice(flag + 1).find((a) => !a.startsWith("-")) : void 0;
+		return text ? {
+			text,
+			dialect: "posix"
+		} : void 0;
+	}
+	if (bin === "pwsh" || bin === "powershell") {
+		const flag = args.findIndex((a) => /^-(c|command)$/i.test(a));
+		return flag >= 0 ? {
+			text: args.slice(flag + 1).join(" "),
+			dialect: "powershell"
+		} : void 0;
+	}
+	if (bin === "cmd") {
+		const flag = args.findIndex((a) => /^\/[ck]$/i.test(a));
+		return flag >= 0 ? {
+			text: args.slice(flag + 1).join(" "),
+			dialect: "auto"
+		} : void 0;
+	}
+}
+/**
+* The argument as a path, or undefined when it can't be one: inline code, multi-line text
+* or anything with shell or code punctuation (`selected={row.key`) is not a file name.
+*/
+function asPath(arg) {
+	const value = arg.replace(/^-+[a-z-]*=/i, "");
+	if (!value || /[\n\r{}()<>|;=`]/.test(value)) return void 0;
+	return value;
+}
+const DISCARD = /^(\/dev\/(null|stdout|stderr|tty)|nul|\$null)$/i;
+function classifySimple(cmd, ctx, depth) {
+	const { tokens, elevated } = unwrap(cmd.words);
 	if (elevated) return risky("other", "Runs a command with elevated privileges");
 	const bin = binName(tokens[0]);
 	const args = tokens.slice(1);
 	const lower = args.map((a) => a.toLowerCase());
+	const script = inlineScript(bin, args);
+	if (script && depth < MAX_DEPTH) {
+		const inner = classifyList(parseShell(script.text, script.dialect), ctx, depth + 1);
+		if (inner.risky) return inner;
+	}
+	for (const target of cmd.writes) {
+		if (DISCARD.test(target)) continue;
+		const write = classifyWrite(target, ctx);
+		if (write.risky) return write;
+	}
 	if (bin === "git") return classifyGit(lower);
 	const install = classifyInstall(bin, lower);
 	if (install.risky) return install;
@@ -15357,44 +16607,51 @@ function classifySimple(simple, ctx) {
 		const targets = args.filter((a) => !a.startsWith("-") && !/^\/[a-z]$/i.test(a));
 		for (const target of targets) {
 			if (target === "*" || /^[\\/]$/.test(target) || /^[a-z]:[\\/]?$/i.test(target)) return risky("outside_worktree", `Deletes ${target}`);
-			if (!isInWorkspace(target, ctx)) return risky("outside_worktree", `Deletes ${target}, outside the worktree`);
+			if (!isWritable(target, ctx)) return risky("outside_worktree", `Deletes ${target}, outside the worktree`);
 		}
 	}
-	for (const m of simple.matchAll(/(?:^|[^0-9&])>>?\s*("[^"]+"|'[^']+'|[^\s;&|]+)/g)) {
-		const target = m[1] ?? "";
-		if (/^(\/dev\/null|nul|\$null)$/i.test(target) || /^&\d$/.test(target)) continue;
-		if (!isInWorkspace(target, ctx)) return risky("outside_worktree", `Writes ${target}, outside the worktree`);
-		if (isSecretPath(target)) return risky("secrets", `Writes the secrets file ${target}`);
+	const dest = copyDestination(bin, args);
+	if (dest) {
+		const write = classifyWrite(dest, ctx);
+		if (write.risky) return write;
 	}
-	if ([
-		"cp",
-		"mv",
-		"copy",
-		"move",
-		"copy-item",
-		"move-item",
-		"xcopy",
-		"robocopy",
-		"tee",
-		"set-content",
-		"out-file",
-		"add-content"
-	].includes(bin)) {
-		const positional = args.filter((a) => !a.startsWith("-") && !/^\/[a-z]+$/i.test(a));
-		const dest = [
-			"tee",
-			"set-content",
-			"out-file",
-			"add-content"
-		].includes(bin) ? positional[0] : positional.at(-1);
-		if (dest && !isInWorkspace(dest, ctx)) return risky("outside_worktree", `Writes ${dest}, outside the worktree`);
-	}
-	const secret = args.find((a) => isSecretPath(a.replace(/^-+[a-z-]*=/i, "")));
+	const secret = args.find((a) => {
+		const value = asPath(a);
+		return value !== void 0 && isSecretPath(value);
+	});
 	if (secret) return risky("secrets", `Accesses the secrets file ${secret}`);
 	const listsEnvDrive = /^(get-childitem|gci|ls|dir)$/.test(bin) && lower.some((a) => a.startsWith("env:"));
 	if (bin === "printenv" || listsEnvDrive) return risky("secrets", "Dumps environment variables");
 	return SAFE;
 }
+const COPIES = [
+	"cp",
+	"mv",
+	"copy",
+	"move",
+	"copy-item",
+	"move-item",
+	"xcopy",
+	"robocopy"
+];
+const WRITERS = [
+	"tee",
+	"set-content",
+	"out-file",
+	"add-content"
+];
+/** Where a copy, move or file-writing command writes. */
+function copyDestination(bin, args) {
+	if (!COPIES.includes(bin) && !WRITERS.includes(bin)) return void 0;
+	const named = WRITERS.includes(bin) ? namedArg(args, [
+		"-path",
+		"-filepath",
+		"-literalpath"
+	]) : namedArg(args, ["-destination"]);
+	if (named) return named;
+	const positional = args.filter((a) => !a.startsWith("-") && !/^\/[a-z]+$/i.test(a));
+	return WRITERS.includes(bin) ? positional[0] : positional.at(-1);
+}
 function classifyGit(args) {
 	let i = 0;
 	while (i < args.length && args[i]?.startsWith("-")) i += args[i] === "-c" || args[i] === "-C" ? 2 : 1;
@@ -15471,11 +16728,16 @@ function classifyInstall(bin, args) {
 	if (bin === "install-module" || bin === "install-package") return risky("other", `Installs a system-wide module (${bin})`);
 	return SAFE;
 }
-/** Classify a file write/edit. */
+/**
+* Classify a file write/edit. The worktree, extra roots and OS temp are fine; secrets ask. A
+* secrets file in temp counts as outside the worktree, so Full autonomy (which only asks for
+* writes outside the worktree) still asks for it.
+*/
 function classifyWrite(target, ctx) {
-	if (!isInWorkspace(target, ctx)) return risky("outside_worktree", `Writes ${target}, outside the worktree`);
-	if (isSecretPath(target)) return risky("secrets", `Writes the secrets file ${target}`);
-	return SAFE;
+	if (!isWritable(target, ctx)) return risky("outside_worktree", `Writes ${target}, outside the worktree`);
+	if (!isSecretPath(target)) return SAFE;
+	if (!isInWorkspace(target, ctx)) return risky("outside_worktree", `Writes the secrets file ${target} in the temp directory`);
+	return risky("secrets", `Writes the secrets file ${target}`);
 }
 /** Classify a file read or search. Reads anywhere are fine except credential files. */
 function classifyRead(target, _ctx) {
@@ -15496,130 +16758,6 @@ function classifyFetch(url, ctx) {
 		return rule.startsWith("*.") ? host.endsWith(rule.slice(1)) : host === rule;
 	}) ? SAFE : risky("network", `Fetches ${host}, which is not on the allowed host list`);
 }
-// ../../packages/providers/src/policy/read-only.ts
-/**
-* Read-only sessions (the orchestrator and PMs, §11.2) may inspect a repository but never
-* change it. This allowlist decides which shell commands they may run: commands that only
-* read, with no output redirection and no command substitution. Anything else is denied.
-*/
-/** Programs that only read (or print). */
-const READ_ONLY_BINS = /* @__PURE__ */ new Set([
-	"ls",
-	"dir",
-	"cat",
-	"type",
-	"head",
-	"tail",
-	"less",
-	"more",
-	"wc",
-	"grep",
-	"egrep",
-	"fgrep",
-	"rg",
-	"find",
-	"fd",
-	"tree",
-	"pwd",
-	"echo",
-	"printf",
-	"which",
-	"where",
-	"whoami",
-	"date",
-	"stat",
-	"file",
-	"du",
-	"df",
-	"sort",
-	"uniq",
-	"cut",
-	"diff",
-	"jq",
-	"basename",
-	"dirname",
-	"realpath",
-	"true",
-	"get-childitem",
-	"gci",
-	"get-content",
-	"gc",
-	"get-item",
-	"gi",
-	"get-location",
-	"gl",
-	"select-string",
-	"sls",
-	"measure-object",
-	"test-path",
-	"resolve-path",
-	"write-output",
-	"write-host",
-	"select-object",
-	"where-object",
-	"format-list",
-	"format-table",
-	"out-string",
-	"sort-object",
-	"gh"
-]);
-/** Git subcommands that never change the repository. */
-const READ_ONLY_GIT = /* @__PURE__ */ new Set([
-	"status",
-	"log",
-	"show",
-	"diff",
-	"blame",
-	"grep",
-	"ls-files",
-	"ls-tree",
-	"rev-parse",
-	"rev-list",
-	"describe",
-	"shortlog",
-	"cat-file",
-	"remote",
-	"branch",
-	"tag",
-	"config",
-	"reflog",
-	"merge-base",
-	"name-rev",
-	"for-each-ref",
-	"worktree"
-]);
-/** `gh` subcommand verbs that only read. */
-const READ_ONLY_GH = /* @__PURE__ */ new Set([
-	"view",
-	"list",
-	"status",
-	"diff",
-	"checks"
-]);
-const bin = (token) => (token ?? "").replace(/\\/g, "/").split("/").pop()?.toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/, "") ?? "";
-/** Why a command is refused in a read-only session, or undefined when it may run. */
-function readOnlyCommandDenial(command) {
-	if (/\$\(|`|<\(|>\(/.test(command)) return "Command substitution is not allowed in a read-only session";
-	for (const simple of splitCommands(command)) {
-		if (/(^|[^0-9&<])>>?(?!\s*(&\d|\/dev\/null|nul\b|\$null))/i.test(simple)) return "Writing files is not allowed in a read-only session";
-		const tokens = tokenize(simple);
-		const name = bin(tokens[0]);
-		const args = tokens.slice(1).map((a) => a.toLowerCase());
-		if (name === "git") {
-			const sub = args.find((a) => !a.startsWith("-"));
-			if (!sub || !READ_ONLY_GIT.has(sub)) return `git ${sub ?? ""} may change the repository`;
-			if ((sub === "branch" || sub === "tag" || sub === "remote" || sub === "worktree") && args.some((a) => /^-(d|D|m|M|f|-delete|-move|-force)$/.test(a) || a === "add")) return `git ${sub} with these options changes the repository`;
-			if (sub === "config" && !args.some((a) => a === "--get" || a === "--list" || a === "-l")) return "Only reading git config is allowed";
-			continue;
-		}
-		if (name === "gh") {
-			if (!args.some((a) => READ_ONLY_GH.has(a)) || args.includes("api")) return "Only read-only gh commands are allowed (view, list, status, diff, checks)";
-			continue;
-		}
-		if (name === "find" && args.some((a) => a === "-delete" || a === "-exec" || a === "-execdir")) return "find with -delete or -exec is not allowed in a read-only session";
-		if (!READ_ONLY_BINS.has(name)) return `${name || "This command"} is not on the read-only allowlist`;
-	}
-}
 // ../../packages/providers/src/claude/tools.ts
 /** Claude tools that are not rendered as `tool_call` items. */
 const SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
@@ -15818,7 +16956,13 @@ function completeToolCall(item, result) {
 }
 /** Risk of a Claude tool call under the `auto` policy (§11.2). */
 function assessClaudeTool(name, input, ctx) {
-	if (COMMAND_TOOLS.has(name)) return classifyCommand(str(input, "command") ?? "", ctx);
+	if (COMMAND_TOOLS.has(name)) {
+		const shell = name === "PowerShell" ? "powershell" : "posix";
+		return classifyCommand(str(input, "command") ?? "", {
+			...ctx,
+			shell
+		});
+	}
 	if (EDIT_TOOLS.has(name)) return classifyWrite(editPath(input), ctx);
 	if (name === "Read") return classifyRead(str(input, "file_path") ?? "", ctx);
 	if (name === "Grep" || name === "Glob") {
@@ -15853,14 +16997,17 @@ function approvalTitle(name, input) {
 // ../../packages/providers/src/claude/permissions.ts
 /**
 * Native permission mode per autonomy level (§11.2):
+* - read_only  -> `default`; edits and writing commands are denied by the PreToolUse hook
+*                 (`ClaudePolicy.denial`), so they never reach a prompt
 * - supervised -> `default`, and every edit/command is forced to ask via a PreToolUse hook
 * - auto       -> `acceptEdits`, plus the risky-action classifier
-* - full       -> `bypassPermissions`, asking only for writes outside the worktree
+* - full       -> `bypassPermissions`, asking only for writes outside the worktree (the OS
+*                 temp directory counts as inside, except for secrets files there)
 * Plan mode overrides all of them with `plan`.
 */
 function permissionModeFor(autonomy, planMode) {
 	if (planMode) return "plan";
-	if (autonomy === "supervised") return "default";
+	if (autonomy === "read_only" || autonomy === "supervised") return "default";
 	if (autonomy === "auto") return "acceptEdits";
 	return "bypassPermissions";
 }
@@ -15879,16 +17026,34 @@ var ClaudePolicy = class {
 		this.ctx = ctx;
 		this.readOnly = readOnly;
 	}
+	get level() {
+		return this.autonomy;
+	}
+	/**
+	* True while edits and writing commands are refused: a read-only role (orchestrator, PMs),
+	* or the `read_only` permission level, which can change live with `setAutonomy`.
+	*/
+	get isReadOnly() {
+		return this.readOnly || this.autonomy === "read_only";
+	}
+	/** Switch the level; the next `gate()` uses it. `allow_session` decisions are kept. */
+	setAutonomy(level) {
+		this.autonomy = level;
+	}
 	/** Why a call is refused outright (read-only sessions), or undefined. */
 	denial(toolName, input) {
-		if (!this.readOnly) return void 0;
-		if (EDIT_TOOLS.has(toolName)) return "This session is read-only: it cannot edit files. Act through CodeDen tools instead.";
+		if (!this.isReadOnly) return void 0;
+		if (EDIT_TOOLS.has(toolName)) return this.readOnly ? "This session is read-only: it cannot edit files. Act through CodeDen tools instead." : "This session has read-only permissions: it cannot edit files, commit or push. Report what you found instead.";
 		if (COMMAND_TOOLS.has(toolName)) {
-			const reason = readOnlyCommandDenial(str(input, "command") ?? "");
+			const reason = readOnlyCommandDenial(str(input, "command") ?? "", { allowChecks: !this.readOnly });
 			return reason ? `This session is read-only: ${reason}.` : void 0;
 		}
 	}
-	gate(toolName, input) {
+	/**
+	* Decide one tool call. `dir` is the shell's current directory as Claude reports it (an
+	* earlier `cd` persists between Bash calls); relative paths resolve from it.
+	*/
+	gate(toolName, input, dir) {
 		if (toolName === "AskUserQuestion") return {
 			ask: true,
 			action: "other",
@@ -15900,7 +17065,10 @@ var ClaudePolicy = class {
 			reason: "The agent finished planning"
 		};
 		if (this.sessionAllow.has(this.key(toolName, input))) return { ask: false };
-		const risk = assessClaudeTool(toolName, input, this.ctx);
+		const risk = assessClaudeTool(toolName, input, dir ? {
+			...this.ctx,
+			dir
+		} : this.ctx);
 		if (this.autonomy === "supervised") {
 			if (risk.risky) return {
 				ask: true,
@@ -15926,8 +17094,8 @@ var ClaudePolicy = class {
 	* Whether a `canUseTool` call (Claude's own permission prompt) needs the user. In supervised
 	* mode everything Claude asks about goes to the user; otherwise only gated calls do.
 	*/
-	needsUser(toolName, input) {
-		const gate = this.gate(toolName, input);
+	needsUser(toolName, input, dir) {
+		const gate = this.gate(toolName, input, dir);
 		if (gate.ask || this.autonomy !== "supervised") return gate;
 		if (this.sessionAllow.has(this.key(toolName, input))) return gate;
 		return {
@@ -16063,6 +17231,83 @@ function toSdkUserMessage(input) {
 		parent_tool_use_id: null
 	};
 }
+/** The SDK's model rows as CodeDen models. The first row is Claude Code's default. */
+function toModelInfos(models) {
+	return models.map((m, i) => ({
+		id: m.value,
+		label: m.displayName || m.value,
+		...m.description ? { description: m.description } : {},
+		efforts: m.supportedEffortLevels ?? [],
+		...i === 0 ? { isDefault: true } : {}
+	}));
+}
+/**
+* List Claude Code's models without a turn. `query()` with a streaming prompt that never
+* yields starts the CLI and sends only the `initialize` control request, whose answer carries
+* the model list (`supportedModels()`); no user message is sent, so no model request is made.
+* Nothing from the user's or a project's settings is loaded (no hooks run), nothing is
+* persisted, and the CLI is closed as soon as the list arrives or `timeoutMs` passes.
+* Rejects on timeout or when the CLI fails to start.
+*/
+async function listClaudeModels(query, executable, opts = {}) {
+	const timeoutMs = opts.timeoutMs ?? 3e4;
+	const abortController = new AbortController();
+	const stopped = new Promise((resolve) => abortController.signal.addEventListener("abort", () => resolve(), { once: true }));
+	const idle = () => ({ [Symbol.asyncIterator]: () => ({ next: async () => {
+		await stopped;
+		return {
+			done: true,
+			value: void 0
+		};
+	} }) });
+	let q;
+	let timer;
+	try {
+		q = query({
+			prompt: idle(),
+			options: {
+				...executableOptions(executable),
+				cwd: tmpdir(),
+				settingSources: [],
+				persistSession: false,
+				tools: [],
+				mcpServers: {},
+				strictMcpConfig: true,
+				env: claudeEnv(void 0),
+				abortController
+			}
+		});
+		const stream = q;
+		(async () => {
+			for await (const _message of stream);
+		})().catch(() => void 0);
+		const timeout = new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`Claude Code did not list its models within ${timeoutMs}ms`)), timeoutMs);
+		});
+		return toModelInfos(await Promise.race([q.supportedModels(), timeout]));
+	} finally {
+		clearTimeout(timer);
+		abortController.abort();
+		try {
+			q?.close();
+		} catch {}
+	}
+}
+// ../../packages/providers/src/utility.ts
+/** Abort signal that fires on the caller's signal or after `timeoutMs`. */
+function oneShotSignal(request) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(/* @__PURE__ */ new Error("Utility model timed out")), request.timeoutMs ?? 6e4);
+	const onAbort = () => controller.abort(request.signal?.reason);
+	request.signal?.addEventListener("abort", onAbort, { once: true });
+	return {
+		signal: controller.signal,
+		dispose: () => {
+			clearTimeout(timer);
+			request.signal?.removeEventListener("abort", onAbort);
+		}
+	};
+}
 // ../../packages/providers/src/util/install-lock.ts
 function isAlive$1(pid) {
 	try {
@@ -16196,6 +17441,163 @@ function npmFailure(output) {
 	if (summary) return summary;
 	return output.trim().split(/\r?\n/).slice(-3).join(" ").slice(0, 500);
 }
+// ../../packages/providers/src/util/tar.ts
+const BLOCK = 512;
+/**
+* Extract a gzipped tarball (an npm package) into `dest`, dropping the first `strip` path
+* components (`package/` in npm tarballs). Only regular files and directories are written;
+* links and devices are skipped. Entries that would land outside `dest` (absolute paths,
+* `..`) fail the whole extraction. Returns the relative paths written.
+*/
+function extractTarGz(archive, dest, opts = {}) {
+	const tar = gunzipSync(archive);
+	const root = path.resolve(dest);
+	const written = [];
+	let offset = 0;
+	let longName = null;
+	let paxPath = null;
+	while (offset + BLOCK <= tar.length) {
+		const header = tar.subarray(offset, offset + BLOCK);
+		if (header.every((b) => b === 0)) break;
+		if (!checksumOk(header)) throw new Error("Corrupt tarball (bad header checksum)");
+		const size = readOctal(header, 124, 12);
+		const type = String.fromCharCode(header[156] ?? 0);
+		const dataStart = offset + BLOCK;
+		const data = tar.subarray(dataStart, dataStart + size);
+		if (data.length < size) throw new Error("Corrupt tarball (truncated entry)");
+		offset = dataStart + Math.ceil(size / BLOCK) * BLOCK;
+		if (type === "L") {
+			longName = cString(data);
+			continue;
+		}
+		if (type === "x") {
+			paxPath = paxRecord(data, "path");
+			continue;
+		}
+		if (type === "g") continue;
+		const name = paxPath ?? longName ?? headerName(header);
+		longName = null;
+		paxPath = null;
+		if (!(type === "0" || type === "\0" || type === "7") && type !== "5") continue;
+		const rel = stripComponents(name, opts.strip ?? 0);
+		if (!rel) continue;
+		const target = path.resolve(root, rel);
+		if (target !== root && !target.startsWith(root + path.sep)) throw new Error(`Unsafe path in tarball: ${name}`);
+		if (type === "5") {
+			mkdirSync(target, { recursive: true });
+			continue;
+		}
+		mkdirSync(path.dirname(target), { recursive: true });
+		writeFileSync(target, data);
+		written.push(rel);
+	}
+	return written;
+}
+function stripComponents(name, strip) {
+	const parts = name.replace(/\\/g, "/").split("/").filter(Boolean);
+	if (name.startsWith("/") || /^[A-Za-z]:/.test(name)) throw new Error(`Unsafe path in tarball: ${name}`);
+	if (parts.includes("..")) throw new Error(`Unsafe path in tarball: ${name}`);
+	const rest = parts.slice(strip).filter((p) => p !== ".");
+	return rest.length ? rest.join("/") : null;
+}
+function headerName(header) {
+	const name = cString(header.subarray(0, 100));
+	if (!header.subarray(257, 263).toString("latin1").startsWith("ustar")) return name;
+	const prefix = cString(header.subarray(345, 500));
+	return prefix ? `${prefix}/${name}` : name;
+}
+function cString(buf) {
+	const end = buf.indexOf(0);
+	return buf.subarray(0, end === -1 ? buf.length : end).toString("utf8");
+}
+function readOctal(buf, start, length) {
+	const text = cString(buf.subarray(start, start + length)).trim();
+	const value = text ? Number.parseInt(text, 8) : 0;
+	if (!Number.isFinite(value) || value < 0) throw new Error("Corrupt tarball (bad size)");
+	return value;
+}
+function checksumOk(header) {
+	const expected = readOctal(header, 148, 8);
+	let sum = 0;
+	for (let i = 0; i < BLOCK; i++) sum += i >= 148 && i < 156 ? 32 : header[i] ?? 0;
+	return sum === expected;
+}
+/** One `key=value` record from a pax extended header (`<len> <key>=<value>\n` lines). */
+function paxRecord(data, key) {
+	let i = 0;
+	while (i < data.length) {
+		const space = data.indexOf(32, i);
+		if (space === -1) break;
+		const len = Number.parseInt(data.subarray(i, space).toString("latin1"), 10);
+		if (!Number.isFinite(len) || len <= 0) break;
+		const record = data.subarray(space + 1, i + len - 1).toString("utf8");
+		const eq = record.indexOf("=");
+		if (eq !== -1 && record.slice(0, eq) === key) return record.slice(eq + 1);
+		i += len;
+	}
+	return null;
+}
+/** The registry to use: an explicit one, npm's configured one, or the public registry. */
+function registryUrl(explicit, env = process.env) {
+	return (explicit ?? env.npm_config_registry ?? "https://registry.npmjs.org").replace(/\/+$/, "");
+}
+/**
+* Install one exact package version straight from an npm registry, without npm (the desktop
+* app has no npm, §17): read the version manifest, download the tarball, check it against the
+* manifest's `dist.integrity` (sha512), extract it into a staging folder and move it into
+* `<nodeModules>/<name>`. Dependencies are not installed: use it only for packages whose
+* runtime needs none (the Claude Agent SDK, installed without optional and peer deps).
+*/
+async function installFromRegistry(opts) {
+	const doFetch = opts.fetch ?? fetch;
+	const progress = opts.onProgress ?? (() => {});
+	const signal = AbortSignal.timeout(opts.timeoutMs ?? 3e5);
+	const base = registryUrl(opts.registry);
+	const spec = `${opts.name}@${opts.version}`;
+	const manifestUrl = `${base}/${opts.name.replace("/", "%2f")}/${encodeURIComponent(opts.version)}`;
+	progress(`Looking up ${spec}`);
+	const res = await doFetch(manifestUrl, {
+		headers: { accept: "application/json" },
+		signal
+	});
+	if (!res.ok) throw new Error(`the registry answered ${res.status} for ${spec}`);
+	const manifest = await res.json();
+	if (manifest.name !== opts.name || manifest.version !== opts.version) throw new Error(`the registry returned the wrong package for ${spec}`);
+	const tarball = manifest.dist?.tarball;
+	const integrity = manifest.dist?.integrity;
+	if (typeof tarball !== "string" || !/^https?:\/\//.test(tarball)) throw new Error(`${spec} has no tarball URL`);
+	const expected = typeof integrity === "string" ? sha512Of(integrity) : null;
+	if (!expected) throw new Error(`${spec} has no sha512 integrity to check the download against`);
+	progress(`Downloading ${spec}`);
+	const download = await doFetch(tarball, { signal });
+	if (!download.ok) throw new Error(`downloading ${spec} failed (${download.status})`);
+	const archive = Buffer.from(await download.arrayBuffer());
+	if (createHash("sha512").update(archive).digest("base64") !== expected) throw new Error(`the download of ${spec} does not match its published integrity (sha512)`);
+	progress(`Unpacking ${spec}`);
+	const target = path.join(opts.nodeModules, ...opts.name.split("/"));
+	const staging = `${target}.staging-${randomBytes(4).toString("hex")}`;
+	try {
+		mkdirSync(staging, { recursive: true });
+		extractTarGz(archive, staging, { strip: 1 });
+		rmSync(target, {
+			recursive: true,
+			force: true,
+			maxRetries: 3
+		});
+		renameSync(staging, target);
+	} finally {
+		rmSync(staging, {
+			recursive: true,
+			force: true,
+			maxRetries: 2
+		});
+	}
+}
+/** The base64 sha512 digest in a Subresource Integrity string (`sha512-<base64> ...`). */
+function sha512Of(integrity) {
+	for (const part of integrity.trim().split(/\s+/)) if (part.startsWith("sha512-")) return part.slice(7).replace(/\?.*$/, "");
+	return null;
+}
 // ../../packages/providers/src/claude/sdk/install.ts
 /** The Claude Agent SDK package. */
 const CLAUDE_SDK_PACKAGE = "@anthropic-ai/claude-agent-sdk";
@@ -16222,6 +17624,18 @@ async function importClaudeSdkFrom(depsDir) {
 	if (typeof sdk.query !== "function") throw new Error(`${entry} does not export query()`);
 	return sdk;
 }
+/** Which installer `installClaudeSdk` uses, and the npm to run when it is npm. */
+function chooseInstaller(opts, env = process.env) {
+	const wanted = opts.installer ?? env.CODEDEN_DEPS_INSTALLER;
+	if (wanted === "registry") return { kind: "registry" };
+	const npm = opts.npm ?? resolveNpm(env);
+	if (npm) return {
+		kind: "npm",
+		npm
+	};
+	if (wanted === "npm") throw new Error("npm was not found; install Node.js with npm and try again");
+	return { kind: "registry" };
+}
 const inflight = /* @__PURE__ */ new Map();
 /**
 * Install the tested SDK version into `depsDir` with npm, skipping its optional platform
@@ -16249,25 +17663,37 @@ async function runInstall(opts) {
 			name: "codeden-deps",
 			private: true
 		}, null, 2)}\n`);
-		const npm = opts.npm ?? resolveNpm();
-		if (!npm) throw new Error("npm was not found; install Node.js with npm and try again");
+		const installer = chooseInstaller(opts);
 		const spec = `${CLAUDE_SDK_PACKAGE}@${CLAUDE_SDK_VERSION}`;
-		progress(`Downloading ${spec} from npm`);
-		await runNpm(npm, [
-			"install",
-			spec,
-			"--omit=optional",
-			"--omit=peer",
-			"--no-audit",
-			"--no-fund",
-			"--save-exact",
-			"--prefix",
-			opts.depsDir
-		], {
-			cwd: opts.depsDir,
-			timeoutMs: opts.timeoutMs ?? 3e5,
-			onLine: progress
-		});
+		if (installer.kind === "registry") {
+			await installFromRegistry({
+				name: CLAUDE_SDK_PACKAGE,
+				version: CLAUDE_SDK_VERSION,
+				nodeModules: join(opts.depsDir, "node_modules"),
+				registry: opts.registry,
+				fetch: opts.fetch,
+				timeoutMs: opts.timeoutMs,
+				onProgress: progress
+			});
+			recordDependency(manifest, CLAUDE_SDK_PACKAGE, CLAUDE_SDK_VERSION);
+		} else {
+			progress(`Downloading ${spec} from npm`);
+			await runNpm(installer.npm, [
+				"install",
+				spec,
+				"--omit=optional",
+				"--omit=peer",
+				"--no-audit",
+				"--no-fund",
+				"--save-exact",
+				"--prefix",
+				opts.depsDir
+			], {
+				cwd: opts.depsDir,
+				timeoutMs: opts.timeoutMs ?? 3e5,
+				onLine: progress
+			});
+		}
 		if (installedClaudeSdkVersion(opts.depsDir) !== "0.3.318") throw new Error(`npm finished but ${spec} is not in ${opts.depsDir}`);
 		progress("Checking the install");
 		await importClaudeSdkFrom(opts.depsDir);
@@ -16276,6 +17702,19 @@ async function runInstall(opts) {
 		release();
 	}
 }
+/** Note the installed package in `<deps>/package.json`, as `npm install --save-exact` would. */
+function recordDependency(manifest, name, version) {
+	let pkg = {};
+	try {
+		pkg = JSON.parse(readFileSync(manifest, "utf8"));
+	} catch {}
+	const deps = typeof pkg.dependencies === "object" && pkg.dependencies || {};
+	pkg.dependencies = {
+		...deps,
+		[name]: version
+	};
+	writeFileSync(manifest, `${JSON.stringify(pkg, null, 2)}\n`);
+}
 // ../../packages/providers/src/claude/sdk/load.ts
 /** Where the SDK comes from in this process. `CODEDEN_CLAUDE_SDK=deps|workspace` overrides. */
 function claudeSdkSource() {
@@ -16293,6 +17732,15 @@ function configureClaudeSdk(opts) {
 	loaded = void 0;
 }
 /**
+* True when the SDK can be loaded without installing it first: from the workspace, already
+* loaded, or already installed in the deps folder. Background work (model discovery) checks
+* this so it never triggers the on-demand install by itself.
+*/
+function claudeSdkReady() {
+	if (claudeSdkSource() === "workspace" || loaded) return true;
+	return depsDir !== void 0 && isClaudeSdkInstalled(depsDir);
+}
+/**
 * The Claude Agent SDK module, installed first when needed. Failures are not cached, so the
 * next session retries the install.
 */
@@ -17170,6 +18618,10 @@ var ClaudeSession = class {
 	abort;
 	stderrTail = "";
 	closed = false;
+	/** The shell's current directory from the latest PreToolUse hook, for relative paths. */
+	shellDir;
+	/** Current autonomy: a query restarted after the CLI exits starts with it. */
+	autonomy;
 	constructor(opts, config) {
 		this.opts = opts;
 		this.config = config;
@@ -17180,6 +18632,7 @@ var ClaudeSession = class {
 			emit
 		});
 		this.broker = new ApprovalBroker(emit);
+		this.autonomy = opts.autonomy;
 		this.policy = new ClaudePolicy(opts.autonomy, {
 			cwd: opts.cwd,
 			extraRoots: opts.additionalDirectories
@@ -17190,6 +18643,26 @@ var ClaudeSession = class {
 	resumeToken() {
 		return this.mapper.resumeToken ?? this.opts.resumeToken;
 	}
+	/**
+	* Switch autonomy. The policy changes at once, so the next tool call (even in a running
+	* turn) follows the new level; approvals already waiting stay waiting. The CLI's own
+	* permission mode follows where it can (`setPermissionMode`); when the CLI refuses a mode
+	* (`bypassPermissions` needs a launch flag), it keeps `acceptEdits` and CodeDen's policy
+	* decides through the PreToolUse hook and `canUseTool` either way. Plan mode is left alone.
+	*/
+	async setAutonomy(level) {
+		this.autonomy = level;
+		this.policy.setAutonomy(level);
+		const q = this.q;
+		if (!q || this.opts.planMode) return;
+		const mode = permissionModeFor(level, false);
+		try {
+			await q.setPermissionMode(mode);
+		} catch {
+			if (mode !== "bypassPermissions") return;
+			await q.setPermissionMode("acceptEdits").catch(() => {});
+		}
+	}
 	/** Model/effort for the following turns, applied live through the SDK's streaming query. */
 	async configure(change) {
 		const q = this.q;
@@ -17263,13 +18736,15 @@ var ClaudeSession = class {
 		const preToolUse = async (hookInput) => {
 			const name = str(hookInput, "tool_name") ?? "";
 			const toolInput = hookInput.tool_input ?? {};
+			const cwd = str(hookInput, "cwd");
+			if (cwd && (path.isAbsolute(cwd) || path.win32.isAbsolute(cwd))) this.shellDir = cwd;
 			const denied = this.policy.denial(name, toolInput);
 			if (denied) return { hookSpecificOutput: {
 				hookEventName: "PreToolUse",
 				permissionDecision: "deny",
 				permissionDecisionReason: denied
 			} };
-			const gate = this.policy.gate(name, toolInput);
+			const gate = this.policy.gate(name, toolInput, this.shellDir);
 			if (!gate.ask) return {};
 			return { hookSpecificOutput: {
 				hookEventName: "PreToolUse",
@@ -17280,7 +18755,10 @@ var ClaudeSession = class {
 		const q = this.config.query({
 			prompt: prompts,
 			options: buildQueryOptions({
-				session: this.opts,
+				session: {
+					...this.opts,
+					autonomy: this.autonomy
+				},
 				executable: this.config.executable,
 				canUseTool: this.canUseTool,
 				hooks: { PreToolUse: [{ hooks: [preToolUse] }] },
@@ -17331,7 +18809,7 @@ var ClaudeSession = class {
 			behavior: "deny",
 			message: denied
 		};
-		const gate = this.policy.needsUser(toolName, input);
+		const gate = this.policy.needsUser(toolName, input, this.shellDir);
 		if (!gate.ask) return {
 			behavior: "allow",
 			updatedInput: input
@@ -17437,7 +18915,9 @@ const capabilities$2 = {
 	planMode: true,
 	reasoningEffort: true,
 	mcp: true,
-	skills: true
+	skills: true,
+	liveAutonomy: true,
+	readOnly: true
 };
 const EFFORTS = [
 	"low",
@@ -17446,8 +18926,8 @@ const EFFORTS = [
 	"xhigh",
 	"max"
 ];
-/** Fallback model list (CLI aliases) until a session reports the real one. */
-const FALLBACK_MODELS$1 = [
+/** Fallback model list (CLI aliases) until discovery or a session reports the real one. */
+const FALLBACK_MODELS = [
 	{
 		id: "default",
 		label: "Default",
@@ -17476,7 +18956,8 @@ var ClaudeAdapter = class {
 	options;
 	id = CLAUDE_PROVIDER_ID;
 	displayName = "Claude Code";
-	modelList = FALLBACK_MODELS$1;
+	catalog = new ModelCatalog(FALLBACK_MODELS);
+	refreshing;
 	cachedExe;
 	constructor(options = {}) {
 		this.options = options;
@@ -17493,7 +18974,22 @@ var ClaudeAdapter = class {
 		return { ...capabilities$2 };
 	}
 	models() {
-		return this.modelList.map((m) => ({ ...m }));
+		return this.catalog.list();
+	}
+	onModelsChanged(listener) {
+		return this.catalog.subscribe(listener);
+	}
+	/**
+	* Load Claude Code's model list without a turn (`listClaudeModels`: the CLI starts and
+	* answers `initialize`; no message is sent). Concurrent calls share one discovery; a failed
+	* discovery keeps the last list. Skipped when Claude Code is not installed, or when the SDK
+	* would have to be installed first. Never throws.
+	*/
+	refreshModels() {
+		this.refreshing ??= this.discoverModels().finally(() => {
+			this.refreshing = void 0;
+		});
+		return this.refreshing;
 	}
 	async openSession(opts) {
 		const executable = this.executable();
@@ -17503,20 +18999,24 @@ var ClaudeAdapter = class {
 			executable,
 			query,
 			onModels: (models) => {
-				if (!models.length) return;
-				this.modelList = models.map((m, i) => ({
-					id: m.value,
-					label: m.displayName || m.value,
-					...m.description ? { description: m.description } : {},
-					efforts: m.supportedEffortLevels ?? [],
-					...i === 0 ? { isDefault: true } : {}
-				}));
+				if (models.length) this.catalog.set(toModelInfos(models));
 			}
 		});
 	}
 	utilityModel() {
 		return new ClaudeUtilityModel(() => this.executable());
 	}
+	async discoverModels() {
+		const exe = this.executable();
+		if (!exe) return;
+		const load = this.options.loadSdk ?? (claudeSdkReady() ? loadClaudeSdk : void 0);
+		if (!load) return;
+		try {
+			const { query } = await load();
+			const models = await listClaudeModels(query, exe, { timeoutMs: this.options.modelListTimeoutMs });
+			if (models.length) this.catalog.set(models);
+		} catch {}
+	}
 };
 // ../../packages/providers/src/codex/detect.ts
 /** Oldest Codex version whose app-server protocol matches the generated types. */
@@ -17766,7 +19266,10 @@ const OPT_OUT = [
 	"fuzzyFileSearch/sessionUpdated",
 	"fuzzyFileSearch/sessionCompleted"
 ];
-/** Spawn `codex app-server` (stdio) and complete the `initialize` handshake. */
+/**
+* Spawn `codex app-server` (stdio) and complete the `initialize` handshake. Aborting `signal`
+* stops the process at any point, including during the handshake.
+*/
 async function startAppServer(exe, handlers, opts = {}) {
 	const rpc = new CodexRpc(spawnResolved(exe, ["app-server"], {
 		stdio: [
@@ -17780,6 +19283,10 @@ async function startAppServer(exe, handlers, opts = {}) {
 		},
 		...opts.cwd ? { cwd: opts.cwd } : {}
 	}), handlers);
+	if (opts.signal) {
+		if (opts.signal.aborted) rpc.close();
+		else opts.signal.addEventListener("abort", () => void rpc.close(), { once: true });
+	}
 	const params = {
 		clientInfo: {
 			name: "codeden",
@@ -17793,16 +19300,79 @@ async function startAppServer(exe, handlers, opts = {}) {
 		}
 	};
 	try {
-		const info = await rpc.request("initialize", params);
-		rpc.notify("initialized");
-		return {
-			rpc,
-			info
-		};
-	} catch (error) {
-		rpc.close();
-		throw error;
+		const info = await rpc.request("initialize", params);
+		rpc.notify("initialized");
+		return {
+			rpc,
+			info
+		};
+	} catch (error) {
+		rpc.close();
+		throw error;
+	}
+}
+/** `model/list` pages are followed up to this many (a guard against a looping cursor). */
+const MAX_PAGES = 20;
+/**
+* Map an app-server `Model` to CodeDen's `ModelInfo`. The id is the model slug Codex accepts
+* in `thread/start` and `turn/start`. Efforts CodeDen does not know are dropped, and missing
+* fields (older app-servers) are tolerated.
+*/
+function modelInfoFromCodex(m) {
+	const efforts = (m.supportedReasoningEfforts ?? []).map((e) => e.reasoningEffort).filter((e) => ReasoningEffort.safeParse(e).success);
+	const defaultEffort = ReasoningEffort.safeParse(m.defaultReasoningEffort);
+	return {
+		id: m.model,
+		label: m.displayName || m.model,
+		...m.description ? { description: m.description } : {},
+		efforts,
+		...defaultEffort.success ? { defaultEffort: defaultEffort.data } : {},
+		...m.isDefault ? { isDefault: true } : {}
+	};
+}
+/** The models Codex shows in its own picker, as `ModelInfo`. */
+function visibleCodexModels(models) {
+	return models.filter((m) => !m.hidden && m.model).map(modelInfoFromCodex);
+}
+/**
+* Ask a short-lived `codex app-server` for its model list (`model/list`, every page). No
+* thread is started and no turn runs. Rejects on failure or after `timeoutMs`; the process
+* is stopped either way.
+*/
+async function listCodexModels(exe, opts = {}) {
+	const timeoutMs = opts.timeoutMs ?? 2e4;
+	const abort = new AbortController();
+	let timer;
+	const timeout = new Promise((_, reject) => {
+		timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`codex app-server did not list models within ${timeoutMs}ms`)), timeoutMs);
+	});
+	try {
+		return await Promise.race([fetchModels(exe, abort.signal), timeout]);
+	} finally {
+		clearTimeout(timer);
+		abort.abort();
+	}
+}
+async function fetchModels(exe, signal) {
+	const { rpc } = await startAppServer(exe, {
+		onNotification: () => {},
+		onRequest: async () => {
+			throw new Error("CodeDen's model discovery answers no requests");
+		},
+		onExit: () => {}
+	}, {
+		cwd: tmpdir(),
+		signal
+	});
+	const models = [];
+	let cursor = null;
+	for (let page = 0; page < MAX_PAGES; page += 1) {
+		const res = await rpc.request("model/list", cursor ? { cursor } : {});
+		models.push(...res.data ?? []);
+		cursor = res.nextCursor ?? null;
+		if (!cursor) break;
 	}
+	return visibleCodexModels(models);
 }
 /**
 * One-shot Codex call for the utility model: an ephemeral thread in a read-only sandbox with
@@ -18000,14 +19570,16 @@ async function handleServerRequest(req, ac) {
 // ../../packages/providers/src/codex/config.ts
 /**
 * Native sandbox + approval policy per autonomy level (§11.2):
+* - read_only  -> read-only sandbox + `never`: writes fail instead of asking, no network
 * - supervised -> `untrusted`: every command that isn't known-safe and every patch asks
-* - auto       -> workspace-write sandbox + `on-request`: the sandbox confines writes and
-*                 network; escaping it (outside the worktree, network, force pushes) asks
+* - auto       -> workspace-write sandbox + `on-request`: the sandbox confines writes (to the
+*                 worktree, extra roots and the OS temp directory) and network; escaping it
+*                 (outside the worktree, network, force pushes) asks
 * - full       -> workspace-write + `never`, with network on: no approvals, still confined
-*                 to the worktree
+*                 to the worktree, extra roots and temp
 */
 function codexPolicy(autonomy, readOnly = false) {
-	if (readOnly) return {
+	if (readOnly || autonomy === "read_only") return {
 		approvalPolicy: "never",
 		sandbox: "read-only",
 		networkAccess: false
@@ -18029,13 +19601,41 @@ function codexPolicy(autonomy, readOnly = false) {
 	};
 }
 /**
+* Extra writable roots for the workspace-write sandbox: the session's additional directories,
+* plus the OS temp directories in `auto` and `full`, so writing a log or scratch file there
+* never needs an approval (§11.2).
+*/
+function codexWritableRoots(opts, tempRoots = osTempRoots()) {
+	const temp = opts.readOnly || opts.autonomy === "read_only" || opts.autonomy === "supervised" ? [] : tempRoots;
+	return [.../* @__PURE__ */ new Set([...opts.additionalDirectories, ...temp])];
+}
+/**
+* The `turn/start` sandbox override for an autonomy level: the same sandbox `thread/start`
+* configures, so a mid-session change applies from the next turn.
+*/
+function codexSandboxPolicy(opts, tempRoots = osTempRoots()) {
+	const { sandbox, networkAccess } = codexPolicy(opts.autonomy, opts.readOnly);
+	if (sandbox === "read-only") return {
+		type: "readOnly",
+		networkAccess
+	};
+	return {
+		type: "workspaceWrite",
+		writableRoots: codexWritableRoots(opts, tempRoots),
+		networkAccess,
+		excludeTmpdirEnvVar: false,
+		excludeSlashTmp: false
+	};
+}
+/**
 * Config overrides for `thread/start` / `thread/resume` (same semantics as `-c key=value`).
 * Sent over stdin as JSON, so MCP bearer tokens never appear on a command line.
 */
-function codexConfigOverrides(opts) {
+function codexConfigOverrides(opts, tempRoots = osTempRoots()) {
 	const { networkAccess } = codexPolicy(opts.autonomy, opts.readOnly);
 	const config = { "sandbox_workspace_write.network_access": networkAccess };
-	if (opts.additionalDirectories.length) config["sandbox_workspace_write.writable_roots"] = [...opts.additionalDirectories];
+	const roots = codexWritableRoots(opts, tempRoots);
+	if (roots.length) config["sandbox_workspace_write.writable_roots"] = roots;
 	for (const server of opts.mcpServers) Object.assign(config, mcpOverride(server));
 	return config;
 }
@@ -18690,10 +20290,14 @@ function rateLimits(snapshot) {
 	return { rateLimits: out };
 }
 // ../../packages/providers/src/codex/session.ts
-/** CodeDen effort -> Codex reasoning effort (Codex tops out at `xhigh`). */
-function codexEffort(effort) {
+/**
+* CodeDen effort -> Codex reasoning effort. `max` is sent only to models that list it
+* (`supported`); older models top out at `xhigh`.
+*/
+function codexEffort(effort, supported) {
 	if (!effort) return void 0;
-	return effort === "max" ? "xhigh" : effort;
+	if (effort !== "max") return effort;
+	return supported?.includes("max") ? "max" : "xhigh";
 }
 /**
 * A Codex session over `codex app-server` (§7.2): one app-server process and one thread per
@@ -18710,7 +20314,12 @@ var CodexSession = class {
 	turnPending = false;
 	/** Model/effort changes from `configure`, applied on every following turn. */
 	nextTurn = {};
+	/** Current autonomy; after `setAutonomy`, every following `turn/start` carries it. */
+	autonomy;
+	autonomyChanged = false;
 	closed = false;
+	/** The model the thread started with (the user's Codex config when none was chosen). */
+	threadModel;
 	filePaths = /* @__PURE__ */ new Map();
 	constructor(opts, config) {
 		this.opts = opts;
@@ -18722,6 +20331,7 @@ var CodexSession = class {
 		this.mapper = new CodexEventMapper(opts.sessionId, emit);
 		this.mapper.codexThreadId = opts.resumeToken;
 		this.broker = new ApprovalBroker(emit);
+		this.autonomy = opts.autonomy;
 	}
 	/** Start the app-server and the thread. Called by the adapter before returning the session. */
 	async start() {
@@ -18741,19 +20351,29 @@ var CodexSession = class {
 			...change
 		};
 	}
+	/**
+	* Autonomy from the next `turn/start` on, as approval-policy and sandbox overrides. A running
+	* turn keeps the policy it started with (the app-server fixes it per turn).
+	*/
+	async setAutonomy(level) {
+		this.autonomy = level;
+		this.autonomyChanged = true;
+	}
 	async send(input) {
 		if (this.closed) throw new ProviderSessionError("closed", "Session is closed");
 		if (this.turnPending || this.mapper.currentTurnId) throw new ProviderSessionError("turn_running", "A turn is already running");
 		this.turnPending = true;
 		try {
 			const rpc = await this.ensureServer();
-			const effort = codexEffort(this.nextTurn.effort !== void 0 ? this.nextTurn.effort ?? void 0 : this.opts.effort);
 			const model = await this.turnModel(rpc);
+			const inUse = model ?? explicitModel(this.opts.model) ?? this.threadModel;
+			const effort = codexEffort(this.nextTurn.effort !== void 0 ? this.nextTurn.effort ?? void 0 : this.opts.effort, inUse ? this.config.modelEfforts?.(inUse) : void 0);
 			const res = await rpc.request("turn/start", {
 				threadId: this.threadId(),
 				input: toCodexInput(input),
 				...effort ? { effort } : {},
-				...model !== void 0 ? { model } : {}
+				...model !== void 0 ? { model } : {},
+				...this.autonomyChanged ? this.policyOverride() : {}
 			});
 			this.mapper.beginTurn(res.turn.id);
 		} catch (error) {
@@ -18795,6 +20415,21 @@ var CodexSession = class {
 		this.events.close();
 		await this.rpc?.close();
 	}
+	/** Session options with the current autonomy (a restarted app-server resumes with it). */
+	currentOptions() {
+		return {
+			...this.opts,
+			autonomy: this.autonomy
+		};
+	}
+	/** `turn/start` overrides that carry the current autonomy (§11.2). */
+	policyOverride() {
+		const opts = this.currentOptions();
+		return {
+			approvalPolicy: codexPolicy(opts.autonomy, opts.readOnly).approvalPolicy,
+			sandboxPolicy: codexSandboxPolicy(opts)
+		};
+	}
 	threadId() {
 		const id = this.mapper.codexThreadId;
 		if (!id) throw new ProviderSessionError("not_started", "Codex thread is not started");
@@ -18828,12 +20463,13 @@ var CodexSession = class {
 			cwd: this.opts.cwd
 		});
 		this.rpc = rpc;
-		const { approvalPolicy, sandbox } = codexPolicy(this.opts.autonomy, this.opts.readOnly);
+		const opts = this.currentOptions();
+		const { approvalPolicy, sandbox } = codexPolicy(opts.autonomy, opts.readOnly);
 		const common = {
 			cwd: this.opts.cwd,
 			approvalPolicy,
 			sandbox,
-			config: codexConfigOverrides(this.opts),
+			config: codexConfigOverrides(opts),
 			...explicitModel(this.opts.model) ? { model: explicitModel(this.opts.model) } : {},
 			...this.opts.systemPrompt ? { developerInstructions: this.opts.systemPrompt } : {}
 		};
@@ -18860,6 +20496,7 @@ var CodexSession = class {
 		}
 		res ??= await rpc.request("thread/start", common);
 		this.mapper.codexThreadId = res.thread.id;
+		this.threadModel = res.model || void 0;
 		this.events.push({
 			type: "session.updated",
 			resumeToken: res.thread.id,
@@ -18940,40 +20577,39 @@ const capabilities$1 = {
 	planMode: false,
 	reasoningEffort: true,
 	mcp: true,
-	skills: true
+	skills: true,
+	liveAutonomy: false,
+	readOnly: true
 };
-const FALLBACK_MODELS = [{
-	id: "default",
-	label: "Default",
-	description: "The model configured in ~/.codex/config.toml",
-	efforts: [
-		"minimal",
-		"low",
-		"medium",
-		"high",
-		"xhigh"
-	],
-	isDefault: true
-}];
-/** Map an app-server `Model` to CodeDen's `ModelInfo`. */
-function modelInfoFromCodex(m) {
-	const efforts = m.supportedReasoningEfforts.map((e) => e.reasoningEffort).filter((e) => ReasoningEffort.safeParse(e).success);
-	const defaultEffort = ReasoningEffort.safeParse(m.defaultReasoningEffort);
-	return {
-		id: m.model,
-		label: m.displayName || m.model,
-		...m.description ? { description: m.description } : {},
-		efforts,
-		...defaultEffort.success ? { defaultEffort: defaultEffort.data } : {},
-		...m.isDefault ? { isDefault: true } : {}
-	};
+const CONFIGURED_MODEL = "The model configured in ~/.codex/config.toml";
+/**
+* Until Codex has listed its models, one entry that leaves the choice to the user's Codex
+* config. `note` says why the real list is missing when discovery failed.
+*/
+function fallbackModels(note) {
+	return [{
+		id: DEFAULT_MODEL_ID,
+		label: "Default",
+		description: note ? `${CONFIGURED_MODEL}. ${note}` : CONFIGURED_MODEL,
+		efforts: [
+			"minimal",
+			"low",
+			"medium",
+			"high",
+			"xhigh"
+		],
+		isDefault: true
+	}];
 }
 /** Codex through `codex app-server` JSON-RPC (§7.2). */
 var CodexAdapter = class {
 	options;
 	id = CODEX_PROVIDER_ID;
 	displayName = "Codex";
-	modelList = FALLBACK_MODELS;
+	catalog = new ModelCatalog(fallbackModels());
+	/** True once Codex reported a real model list (discovery or a session). */
+	listed = false;
+	refreshing;
 	cachedExe;
 	constructor(options = {}) {
 		this.options = options;
@@ -18990,7 +20626,20 @@ var CodexAdapter = class {
 		return { ...capabilities$1 };
 	}
 	models() {
-		return this.modelList.map((m) => ({ ...m }));
+		return this.catalog.list();
+	}
+	onModelsChanged(listener) {
+		return this.catalog.subscribe(listener);
+	}
+	/**
+	* Load Codex's model list through a short-lived `codex app-server` (`model/list`; no thread,
+	* no turn). Concurrent calls share one discovery. Never throws.
+	*/
+	refreshModels() {
+		this.refreshing ??= this.discoverModels().finally(() => {
+			this.refreshing = void 0;
+		});
+		return this.refreshing;
 	}
 	async openSession(opts) {
 		const executable = this.executable();
@@ -18998,9 +20647,10 @@ var CodexAdapter = class {
 		const session = new CodexSession(opts, {
 			executable,
 			onModels: (models) => {
-				const visible = models.filter((m) => !m.hidden).map(modelInfoFromCodex);
-				if (visible.length) this.modelList = visible;
-			}
+				const visible = visibleCodexModels(models);
+				if (visible.length) this.setModels(visible);
+			},
+			modelEfforts: (model) => this.catalog.list().find((m) => m.id === model)?.efforts
 		});
 		try {
 			await session.start();
@@ -19013,7 +20663,65 @@ var CodexAdapter = class {
 	utilityModel() {
 		return new CodexUtilityModel(() => this.executable());
 	}
+	async discoverModels() {
+		const exe = this.executable();
+		if (!exe) return;
+		try {
+			const models = await listCodexModels(exe, { timeoutMs: this.options.modelListTimeoutMs });
+			if (models.length) this.setModels(models);
+			else this.discoveryFailed("Codex listed no models.");
+		} catch (error) {
+			const reason = (error instanceof Error ? error.message : String(error)).slice(0, 200);
+			this.discoveryFailed(`Codex's model list could not be loaded: ${reason}`);
+		}
+	}
+	setModels(models) {
+		this.listed = true;
+		this.catalog.set(models);
+	}
+	/** Keep the last real list; without one, say why only the configured default is offered. */
+	discoveryFailed(note) {
+		if (!this.listed) this.catalog.set(fallbackModels(note));
+	}
+};
+// ../../packages/providers/src/fake/mcp-result.ts
+/** A long, unbroken token, like the ids, hashes and base64 blobs real tool results carry. */
+const blob = "c0de".repeat(12) + "d3n".repeat(60);
+/** Input of the scripted `[mcp]` tool call: an issue reference with a long unbroken URL. */
+const fakeMcpInput = {
+	issue: {
+		number: 3,
+		url: `https://github.com/codeden-e2e/demo-repo/issues/3?trace=${blob}`
+	},
+	priority: "low"
 };
+/**
+* Result text of the scripted `[mcp]` tool call: one compact line of JSON, several kilobytes
+* long, shaped like a triage result. Lets tests check that long tool output stays inside the
+* transcript column.
+*/
+function fakeMcpResult() {
+	const body = Array.from({ length: 12 }, (_, i) => `Step ${i + 1}: list the models the provider reports before a session starts.`).join(" ");
+	return JSON.stringify({ issue: {
+		projectId: "a72f9074-7b37-4693-bbae-8b108576aefc",
+		number: 3,
+		title: "Discover the real model list without running a session first",
+		state: "open",
+		url: `https://github.com/codeden-e2e/demo-repo/issues/3?trace=${blob}`,
+		labels: [
+			"enhancement",
+			"providers",
+			"low-priority"
+		],
+		body,
+		trace: blob,
+		blockedBy: [{
+			number: 2,
+			title: "Model picker redesign",
+			state: "open"
+		}]
+	} });
+}
 // ../../packages/providers/src/fake/session.ts
 var Interrupted$1 = class extends Error {};
 /** A scripted, deterministic session. Ids are counters scoped to the session. */
@@ -19029,6 +20737,7 @@ var FakeSession = class {
 	constructor(opts, fake) {
 		this.opts = opts;
 		this.fake = fake;
+		this.autonomy = opts.autonomy;
 		this.token = opts.resumeToken ?? `fake-${opts.sessionId}`;
 		this.rootThreadId = `${opts.sessionId}:thread-root`;
 		this.events.push({
@@ -19056,6 +20765,11 @@ var FakeSession = class {
 			model: change.model ?? "fake-1"
 		});
 	}
+	/** Current autonomy. Full skips the scripted command approval, as it would for real. */
+	autonomy;
+	async setAutonomy(level) {
+		this.autonomy = level;
+	}
 	async send(input) {
 		if (this.events.isClosed) throw new ProviderSessionError("closed", "Session is closed");
 		if (this.turn) throw new ProviderSessionError("turn_running", "A turn is already running");
@@ -19137,7 +20851,9 @@ var FakeSession = class {
 			}
 			await this.streamAssistant(turn, threadId, this.replyFor(prompt));
 			await this.todoList(turn);
-			if (this.fake.approval || prompt.includes("[approval]") ? await this.approval(turn) : true) await this.commandToolCall(turn);
+			if (prompt.includes("[mcp]")) await this.mcpToolCall(turn);
+			const readOnly = this.autonomy === "read_only";
+			if ((!readOnly && (this.fake.approval || prompt.includes("[approval]")) && this.autonomy !== "full" ? await this.approval(turn) : true) && !readOnly) await this.commandToolCall(turn);
 			if (this.fake.subagent || prompt.includes("[subagent]")) await this.subagent(turn);
 			if (this.fake.followups ?? true) {
 				await this.step(turn);
@@ -19322,6 +21038,45 @@ var FakeSession = class {
 		});
 		return allowed;
 	}
+	/** An MCP tool call with a long, one-line JSON result (`[mcp]` in the prompt). */
+	async mcpToolCall(turn) {
+		const { threadId, turnId } = turn;
+		const base = {
+			id: this.nextId("item"),
+			kind: "tool_call",
+			toolKind: "mcp",
+			toolName: "mcp__codeden__triage_issue",
+			server: "codeden",
+			tool: "triage_issue",
+			title: "codeden: triage_issue",
+			input: fakeMcpInput
+		};
+		await this.step(turn);
+		this.emit({
+			type: "item.started",
+			threadId,
+			turnId,
+			item: {
+				...base,
+				status: "in_progress"
+			}
+		});
+		await this.step(turn);
+		this.emit({
+			type: "item.completed",
+			threadId,
+			turnId,
+			item: {
+				...base,
+				status: "completed",
+				output: {
+					text: fakeMcpResult(),
+					truncated: false
+				},
+				durationMs: 12
+			}
+		});
+	}
 	async commandToolCall(turn) {
 		const { threadId, turnId } = turn;
 		const id = this.nextId("item");
@@ -19490,13 +21245,16 @@ const capabilities = {
 	planMode: false,
 	reasoningEffort: false,
 	mcp: false,
-	skills: false
+	skills: false,
+	liveAutonomy: true,
+	readOnly: true
 };
 /**
 * Deterministic scripted provider for demos and tests (§7.2). Every turn streams:
 * user message, assistant message (word deltas), a todo list, a command tool call,
 * optionally an approval request (waits for `respond`) and a subagent child thread,
-* followups, usage, then `turn.completed`. Prompts containing `[fail]` fail the turn.
+* followups, usage, then `turn.completed`. Prompts containing `[fail]` fail the turn;
+* `[mcp]` adds an MCP tool call with a long JSON result before the command.
 */
 var FakeProvider = class {
 	options;
@@ -20449,12 +22207,14 @@ function createImageEngineRegistry(opts = {}) {
 /** The set of adapters a runner has loaded, keyed by id. */
 var ProviderRegistry = class {
 	adapters = /* @__PURE__ */ new Map();
+	listeners = /* @__PURE__ */ new Set();
 	constructor(adapters = []) {
 		for (const adapter of adapters) this.register(adapter);
 	}
 	register(adapter) {
 		if (this.adapters.has(adapter.id)) throw new Error(`Provider "${adapter.id}" is already registered`);
 		this.adapters.set(adapter.id, adapter);
+		adapter.onModelsChanged?.(() => this.notify());
 	}
 	get(id) {
 		return this.adapters.get(id);
@@ -20465,6 +22225,24 @@ var ProviderRegistry = class {
 	info() {
 		return this.list().map(providerInfo);
 	}
+	/**
+	* Refresh the model lists of all adapters (or those in `ids`) that support it. Never throws;
+	* changes reach `onChange` listeners.
+	*/
+	async refreshModels(ids) {
+		const adapters = ids ? this.list().filter((a) => ids.includes(a.id)) : this.list();
+		await Promise.all(adapters.map((a) => a.refreshModels?.().catch(() => void 0)));
+	}
+	/** Call `listener` whenever `info()` changes (a provider's models). Returns unsubscribe. */
+	onChange(listener) {
+		this.listeners.add(listener);
+		return () => this.listeners.delete(listener);
+	}
+	notify() {
+		for (const listener of this.listeners) try {
+			listener();
+		} catch {}
+	}
 };
 /** Fresh instances of the built-in real providers (Claude Code, Codex). */
 function builtinProviders() {
@@ -23983,7 +25761,8 @@ function installChromium(log) {
 			"chromium"
 		], {
 			windowsHide: true,
-			timeout: 6e5
+			timeout: 6e5,
+			env: ownNodeEnv()
 		}, (error) => error ? reject(error) : resolve());
 	});
 }
@@ -24022,13 +25801,18 @@ function firstLine(error) {
 /** Names of CodeDen-internal variables that must never reach agents, shells or setup scripts. */
 const SECRET = /^CODEDEN_.*(TOKEN|SECRET|KEY|PASSWORD)/i;
 /**
+* Set when the desktop app runs CodeDen's own processes on its Electron binary (§17). It must
+* not reach the user's shells and agents: an Electron app started there would run as Node.js.
+*/
+const RUNTIME_ONLY = /* @__PURE__ */ new Set(["ELECTRON_RUN_AS_NODE"]);
+/**
 * Environment for child processes (§15): the user's environment minus CodeDen's own
 * secrets. `CODEDEN_HOME` and similar non-secret variables are kept.
 */
 function childEnv(extra = {}) {
 	const out = {};
 	for (const [key, value] of Object.entries(process.env)) {
-		if (value === void 0 || SECRET.test(key)) continue;
+		if (value === void 0 || SECRET.test(key) || RUNTIME_ONLY.has(key)) continue;
 		out[key] = value;
 	}
 	return {
@@ -24345,6 +26129,22 @@ async function topLevel(cwd) {
 	return resolve(await gitText(cwd, ["rev-parse", "--show-toplevel"]));
 }
 /**
+* Copy the index for use as a temporary index, keeping its modification time. Git trusts an
+* entry's cached stat data only when the entry is older than the index file; an entry written
+* in the same timestamp tick as the index is "racily clean" and its content is re-read. A
+* copy stamped with the current time (Linux `copyFile` does that) would make such entries
+* look safe, and a same-size rewrite in that tick would be missed by diffs and checkpoints.
+*/
+async function copyIndex(realIndex, tmp) {
+	try {
+		await copyFile(realIndex, tmp);
+	} catch {
+		return;
+	}
+	const { atime, mtime } = await stat(realIndex);
+	await utimes(tmp, atime, mtime);
+}
+/**
 * Write the full working tree (tracked + untracked, minus ignored files) as a tree object
 * using a temporary index seeded from a copy of the real one (for its stat cache). The
 * user's index, HEAD and branch are never modified.
@@ -24359,7 +26159,7 @@ async function snapshotTree(cwd) {
 	]);
 	const tmp = join(tmpdir(), `codeden-index-${randomBytes(8).toString("hex")}`);
 	try {
-		await copyFile(realIndex, tmp).catch(() => void 0);
+		await copyIndex(realIndex, tmp);
 		const env = { GIT_INDEX_FILE: tmp };
 		await git(top, [
 			"add",
@@ -24768,6 +26568,303 @@ async function listPorts(probe = []) {
 		url: `http://localhost:${port}`
 	}));
 }
+// ../runner/src/util/paths.ts
+/** True when `child` is `dir` itself or somewhere inside it. */
+function isInside(dir, child) {
+	const rel = relative(resolve(dir), resolve(child));
+	return rel === "" || !rel.startsWith("..") && !/^[a-zA-Z]:/.test(rel);
+}
+// ../runner/src/workspace/delete-tree.ts
+/** Error codes Windows returns while another process still holds a file or folder open. */
+const IN_USE = /* @__PURE__ */ new Set([
+	"EBUSY",
+	"EPERM",
+	"EACCES",
+	"ENOTEMPTY"
+]);
+const errorCode = (error) => error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
+/** Run `op`, retrying briefly (about 1.5s for 5 attempts) while the path is in use. */
+async function retry(op, attempts = 5) {
+	for (let attempt = 1;; attempt++) try {
+		await op();
+		return;
+	} catch (error) {
+		const code = errorCode(error);
+		if (code === "ENOENT") return;
+		if (!code || !IN_USE.has(code) || attempt >= attempts) throw error;
+		await new Promise((r) => setTimeout(r, 100 * attempt));
+	}
+}
+/** Delete a file or link (never what a link points at); clears the read-only flag if needed. */
+function removeFile(path) {
+	return retry(async () => {
+		try {
+			await unlink(path);
+		} catch (error) {
+			if (errorCode(error) !== "EPERM" && errorCode(error) !== "EACCES") throw error;
+			await chmod(path, 438).catch(() => void 0);
+			await unlink(path);
+		}
+	});
+}
+async function kind(path, entry) {
+	if (entry.isSymbolicLink()) return "other";
+	if (entry.isDirectory()) return "dir";
+	if (entry.isFile()) return "other";
+	const stat = await lstat(path).catch(() => void 0);
+	return stat?.isDirectory() && !stat.isSymbolicLink() ? "dir" : "other";
+}
+/**
+* Empty `dir`: files and links are unlinked, real folders are emptied and removed. A symlink
+* or junction is never descended into (Windows reports junctions as links), so nothing
+* outside the tree is touched. Every branch is finished before the first failure is thrown.
+*/
+async function emptyDir(dir) {
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch (error) {
+		if (errorCode(error) === "ENOENT") return;
+		throw error;
+	}
+	const failed = (await Promise.allSettled(entries.map(async (entry) => {
+		const path = join(dir, entry.name);
+		if (await kind(path, entry) !== "dir") return removeFile(path);
+		await emptyDir(path);
+		await retry(() => rmdir(path));
+	}))).find((r) => r.status === "rejected");
+	if (failed) throw failed.reason;
+}
+/** A short, user-facing error for a failed delete or move of the worktree folder `root`. */
+function deleteFailed(root, error) {
+	const file = error && typeof error === "object" && "path" in error ? String(error.path) : root;
+	const where = relative(root, file);
+	const code = errorCode(error);
+	if (code && IN_USE.has(code)) return new CommandError("worktree_in_use", `${where ? `A file in the worktree is in use (${where})` : "The worktree is in use"}. Close whatever is using it (a terminal, dev server or editor), then try again.`);
+	const reason = error instanceof Error ? error.message : String(error);
+	return new CommandError("remove_failed", `Could not delete ${where || root}: ${reason}`);
+}
+/**
+* Delete a worktree folder without ever following a symlink or junction out of it.
+*
+* `git worktree remove` can't be trusted with this on Windows: Git treats junctions as
+* folders, so it deletes the contents of whatever a live junction points at, and it stops at
+* a dangling one with "Directory not empty". In a pnpm install the packages are deleted before
+* the junctions that point at them, so it fails halfway, after removing `.git`. Node's
+* recursive `rm` is no better here: on Windows it waits for as long as a file stays locked.
+*
+* `.git` goes first, so a delete that a locked file interrupts leaves an orphan folder the
+* next attempt cleans up (never a damaged worktree that looks dirty). Each locked entry is
+* retried for about 1.5s, then this throws `worktree_in_use`.
+*/
+async function deleteTree(root) {
+	try {
+		const stat = await lstat(root).catch(() => void 0);
+		if (!stat) return;
+		if (stat.isSymbolicLink() || !stat.isDirectory()) return await removeFile(root);
+		await removeFile(join(root, ".git"));
+		await emptyDir(root);
+		await retry(() => rmdir(root));
+	} catch (error) {
+		throw deleteFailed(root, error);
+	}
+}
+// ../runner/src/workspace/trash.ts
+/**
+* True for a session folder CodeDen created and owns: exactly `<home>/wt/<project>/<session>`.
+* Only these may be deleted once they are no longer git worktrees.
+*/
+function isManagedWorktreePath(home, path) {
+	const rel = relative(resolve(home, "wt"), resolve(path));
+	if (!rel || isAbsolute(rel)) return false;
+	const parts = rel.split(/[\\/]+/);
+	return parts.length === 2 && !parts.includes("..") && !parts.includes(".") && parts[0] !== ".trash";
+}
+/** Where removed worktrees wait to be deleted. `.trash` can never be a project slug. */
+function trashDir(home) {
+	return join(resolve(home), "wt", ".trash");
+}
+/**
+* Move a session folder into the trash. A rename is all or nothing: while anything in the
+* folder is held open (a process's working directory, an open file), Windows refuses it and
+* the folder stays exactly as it was (`worktree_in_use`). Returns null when the trash is on
+* another volume.
+*/
+async function moveToTrash(home, path) {
+	const trash = trashDir(home);
+	await mkdir(trash, { recursive: true });
+	const stamp = `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
+	const dest = join(trash, `${basename(dirname(path))}-${basename(path)}-${stamp}`);
+	try {
+		await retry(() => rename(path, dest), 8);
+		return dest;
+	} catch (error) {
+		if (errorCode(error) === "EXDEV") return null;
+		throw deleteFailed(path, error);
+	}
+}
+const runs = /* @__PURE__ */ new Map();
+/**
+* Delete everything in the trash, one folder at a time, never following a link (the links in
+* a trashed pnpm install still point at the old path, where a new worktree may live by now).
+* Runs in the background after each removal and when the runner starts; a folder something
+* still holds open stays for the next run. Calls during a run share it and add one more pass.
+*/
+function emptyTrash(home, log) {
+	const trash = trashDir(home);
+	const current = runs.get(trash);
+	if (current) {
+		current.again = true;
+		return current.done;
+	}
+	const run = {
+		again: true,
+		done: Promise.resolve()
+	};
+	run.done = (async () => {
+		try {
+			while (run.again) {
+				run.again = false;
+				const entries = await readdir(trash).catch(() => []);
+				for (const name of entries) await deleteTree(join(trash, name)).catch((error) => log?.(`worktree trash: ${error instanceof Error ? error.message : String(error)}`));
+			}
+		} finally {
+			runs.delete(trash);
+		}
+	})();
+	runs.set(trash, run);
+	return run.done;
+}
+/**
+* Delete a worktree folder that has been cleared for removal. A session folder under
+* `<home>/wt` goes to the trash, so the removal is instant and the path is free right away,
+* and is deleted in the background. Anything else is deleted in place.
+*/
+async function discardFolder(home, path, log) {
+	if (isManagedWorktreePath(home, path) ? await moveToTrash(home, path) : null) emptyTrash(home, log);
+	else await deleteTree(path);
+}
+// ../runner/src/workspace/removal.ts
+async function canonical(path) {
+	const real = await realpath(path).catch(() => resolve(path));
+	return process.platform === "win32" ? real.toLowerCase() : real;
+}
+async function listWorktrees(repo) {
+	const out = await gitText(repo, [
+		"worktree",
+		"list",
+		"--porcelain"
+	]).catch(() => "");
+	const list = [];
+	for (const block of out.split(/\r?\n\r?\n/)) {
+		const lines = block.split(/\r?\n/);
+		if (!lines[0]?.startsWith("worktree ")) continue;
+		const locked = lines.some((l) => l === "locked" || l.startsWith("locked "));
+		list.push({
+			path: lines[0].slice(9),
+			locked
+		});
+	}
+	return list;
+}
+/** Classify `path` against the worktrees of `repo` (see `WorktreeState`). */
+async function worktreeState(repo, path) {
+	const target = await canonical(path);
+	let registered = false;
+	let locked = false;
+	let containsOther = false;
+	for (const wt of await listWorktrees(repo)) {
+		const other = await canonical(wt.path);
+		if (other === target) {
+			registered = true;
+			locked = wt.locked;
+		} else if (isInside(target, other)) containsOther = true;
+	}
+	if (isInside(target, await canonical(repo))) containsOther = true;
+	const info = {
+		registered,
+		locked,
+		containsOther
+	};
+	const stat = await lstat(path).catch(() => void 0);
+	if (!stat) return {
+		state: "missing",
+		...info
+	};
+	if (stat.isSymbolicLink() || !stat.isDirectory()) return {
+		state: "orphan",
+		...info
+	};
+	const dotGit = await lstat(resolve(path, ".git")).catch(() => void 0);
+	if (!dotGit) return {
+		state: "orphan",
+		...info
+	};
+	return {
+		state: dotGit.isFile() && registered ? "registered" : "foreign",
+		...info
+	};
+}
+/** Whether a registered worktree has uncommitted changes (ignored files don't count). */
+async function isDirty(path) {
+	return (await git(path, ["status", "--porcelain"])).stdout.toString("utf8").trim() !== "";
+}
+/**
+* Decide whether `workspace.remove` may delete the path, before anything is touched (terminals
+* and processes in it are stopped only after this passes). Refuses (`not_a_worktree`) anything
+* that isn't a linked worktree of the repository, unless it is an orphan inside CodeDen's
+* worktree folder, and anything containing the repository or another worktree. Unless forced,
+* keeps a locked worktree (`worktree_locked`) or one with uncommitted changes
+* (`worktree_dirty`); ignored files (build output, `node_modules`) don't count.
+*/
+async function assertRemovable(cmd, home) {
+	const path = resolve(cmd.path);
+	const info = await worktreeState(cmd.repoPath, path);
+	const leftAlone = (why) => new CommandError("not_a_worktree", `${path} ${why}, so it was left alone`);
+	if (info.state === "missing") return info;
+	if (info.containsOther) throw leftAlone("contains the repository or another worktree");
+	if (info.state === "foreign") throw leftAlone("is not a worktree of this repository");
+	if (info.state === "orphan" && !isManagedWorktreePath(home, path)) throw leftAlone("is no longer a git worktree and is outside CodeDen's worktree folder");
+	if (info.state !== "registered" || cmd.force) return info;
+	if (info.locked) throw new CommandError("worktree_locked", `${path} is locked; unlock it or remove it with force`);
+	if (await isDirty(path)) throw new CommandError("worktree_dirty", `${path} has uncommitted changes; commit them or remove it with force`);
+	return info;
+}
+/** Drop git's records of worktrees whose folders are gone. */
+async function pruneWorktrees(repo) {
+	await git(repo, ["worktree", "prune"]).catch(() => void 0);
+}
+/**
+* `workspace.remove`: delete a session worktree and git's record of it. Idempotent: a missing
+* path, or a half-deleted orphan inside `<home>/wt`, ends removed too. The folder goes to the
+* trash or is deleted in place, never through a link (`discardFolder`), then
+* `git worktree prune` drops the record. The branch stays unless `deleteBranch` names it.
+*/
+async function removeWorkspace(cmd, home, log) {
+	const path = resolve(cmd.path);
+	const info = await assertRemovable(cmd, home);
+	const registered = info.state === "registered";
+	const discardedChanges = registered && cmd.force === true && await isDirty(path);
+	try {
+		if (registered && info.locked) await git(cmd.repoPath, [
+			"worktree",
+			"unlock",
+			path
+		]).catch(() => void 0);
+		if (info.state !== "missing") await discardFolder(home, path, log);
+	} finally {
+		await pruneWorktrees(cmd.repoPath);
+	}
+	if (cmd.deleteBranch) await git(cmd.repoPath, [
+		"branch",
+		"-D",
+		cmd.deleteBranch
+	]).catch(() => void 0);
+	return {
+		removed: true,
+		...discardedChanges ? { discardedChanges } : {}
+	};
+}
 // ../runner/src/workspace/project-config.ts
 const PROJECT_CONFIG_PATH = ".codeden/project.json";
 /**
@@ -24910,20 +27007,41 @@ async function resolveBase(repo, cmd) {
 	])) return `origin/${def}`;
 	return def ?? "HEAD";
 }
-async function createWorktree(cmd, home) {
+function isEmptyDir(path) {
+	try {
+		return readdirSync(path).length === 0;
+	} catch {
+		return false;
+	}
+}
+/**
+* Make `path` ready for `git worktree add`: reuse a worktree of this repository, delete the
+* orphan folder an interrupted removal left inside `<home>/wt` (stopping processes in it
+* first), and drop git's stale record of it. Returns the worktree to reuse, if any.
+*/
+async function clearTarget(repo, path, ctx) {
+	const info = await worktreeState(repo, path);
+	if (info.state === "registered") return {
+		cwd: path,
+		branch: await currentBranch(path),
+		created: false
+	};
+	if (info.state === "orphan" && isManagedWorktreePath(ctx.home, path) && !info.containsOther) {
+		await ctx.supervisor.killUnder(path);
+		await discardFolder(ctx.home, path);
+	} else if (info.state !== "missing" && !isEmptyDir(path)) throw new CommandError("path_exists", `${path} exists and is not a worktree`);
+	if (info.registered) await pruneWorktrees(repo);
+	return null;
+}
+async function createWorktree(cmd, ctx) {
 	const repo = await topLevel(cmd.repoPath).catch(() => {
 		throw new CommandError("not_a_repo", `${cmd.repoPath} is not a git repository`);
 	});
 	const short = sessionShort(cmd.sessionId);
-	const path = resolve(cmd.path ?? join(home, "wt", cmd.projectSlug ?? slugFromPath(repo), short));
-	if (existsSync(path)) {
-		if (await isWorkTree(path)) return {
-			cwd: path,
-			branch: await currentBranch(path),
-			created: false
-		};
-		if (readdirSync(path).length > 0) throw new CommandError("path_exists", `${path} exists and is not a worktree`);
-	}
+	const slug = cmd.projectSlug ?? slugFromPath(repo);
+	const path = resolve(cmd.path ?? join(ctx.home, "wt", slug, short));
+	const reuse = await clearTarget(repo, path, ctx);
+	if (reuse) return reuse;
 	await mkdir(dirname(path), { recursive: true });
 	const base = await resolveBase(repo, cmd);
 	if (cmd.branch && await branchExists(repo, cmd.branch)) {
@@ -24983,7 +27101,7 @@ async function prepareWorkspace(cmd, ctx) {
 				created: false
 			};
 			break;
-		case "worktree": target = await createWorktree(cmd, ctx.home);
+		case "worktree": target = await createWorktree(cmd, ctx);
 	}
 	const { config, error } = await readProjectConfig(target.cwd);
 	if (error) ctx.emit({
@@ -25008,44 +27126,6 @@ async function prepareWorkspace(cmd, ctx) {
 		setup
 	};
 }
-/** `workspace.remove`: remove a worktree (retrying briefly for Windows file locks). */
-async function removeWorkspace(cmd) {
-	const path = resolve(cmd.path);
-	let removed = false;
-	let lastError;
-	for (let attempt = 0; attempt < 5 && !removed; attempt++) try {
-		const args = [
-			"worktree",
-			"remove",
-			...cmd.force ? ["--force"] : [],
-			path
-		];
-		await git(cmd.repoPath, args);
-		removed = true;
-	} catch (error) {
-		lastError = error;
-		if (!existsSync(path)) break;
-		if (!cmd.force && /modified or untracked|contains/.test(String(error))) break;
-		await new Promise((r) => setTimeout(r, 250 * (attempt + 1)));
-	}
-	if (!removed && existsSync(path) && cmd.force) {
-		await rm(path, {
-			recursive: true,
-			force: true,
-			maxRetries: 5,
-			retryDelay: 200
-		});
-		removed = true;
-	}
-	await git(cmd.repoPath, ["worktree", "prune"]).catch(() => void 0);
-	if (!removed && existsSync(path)) throw lastError instanceof Error ? lastError : new CommandError("remove_failed", `Could not remove ${path}`);
-	if (cmd.deleteBranch) await git(cmd.repoPath, [
-		"branch",
-		"-D",
-		cmd.deleteBranch
-	]).catch(() => void 0);
-	return { removed: removed || !existsSync(path) };
-}
 // ../runner/src/commands.ts
 /** Execute one server command (§4.3). Throws `CommandError` for expected failures. */
 async function executeCommand(core, command) {
@@ -25069,7 +27149,9 @@ async function executeCommand(core, command) {
 			return {};
 		case "provider.detect": {
 			const adapters = command.providerId ? registry.list().filter((a) => a.id === command.providerId) : registry.list();
-			return { statuses: await Promise.all(adapters.map((a) => a.detect())) };
+			const statuses = await Promise.all(adapters.map((a) => a.detect()));
+			registry.refreshModels(adapters.map((a) => a.id));
+			return { statuses };
 		}
 		case "provider.oneShot": {
 			const utility = registry.get(command.providerId)?.utilityModel?.();
@@ -25093,9 +27175,10 @@ async function executeCommand(core, command) {
 				emit: core.emit
 			});
 		case "workspace.remove":
+			await assertRemovable(command, core.home);
 			await terminals.closeUnder(command.path);
 			await core.supervisor.killUnder(command.path);
-			return removeWorkspace(command);
+			return removeWorkspace(command, core.home, core.log);
 		case "session.start":
 			if (core.isDraining()) throw new CommandError("draining", "Runner is draining");
 			return host.start(command);
@@ -25373,12 +27456,6 @@ async function handleMcpRequest(request, upstream) {
 		return jsonRpcError(502, `CodeDen server unreachable: ${error.message}`);
 	}
 }
-// ../runner/src/util/paths.ts
-/** True when `child` is `dir` itself or somewhere inside it. */
-function isInside(dir, child) {
-	const rel = relative(resolve(dir), resolve(child));
-	return rel === "" || !rel.startsWith("..") && !/^[a-zA-Z]:/.test(rel);
-}
 // ../runner/src/process/supervisor.ts
 /**
 * Tracks every child process the runner starts so they can be killed as whole process
@@ -26808,6 +28885,10 @@ var ServerConnection = class {
 				for (const event of this.core.journal.after(msg.lastAckedSeq)) this.send(event);
 				this.attached = true;
 				this.onAttach(this);
+				this.send({
+					type: "providers",
+					providers: this.core.registry.info()
+				});
 				return;
 			case "ack":
 				this.core.journal.ack(msg.seq);
@@ -26967,14 +29048,20 @@ var SessionHost = class {
 	async interrupt(sessionId) {
 		await this.get(sessionId).session.interrupt();
 	}
-	/** Model/effort for the next turn, when the provider can change them live. */
+	/**
+	* Model/effort for the next turn and the autonomy level, when the provider can change them
+	* live. Checks every requested setting before applying any.
+	*/
 	async configure(cmd) {
 		const { session } = this.get(cmd.sessionId);
-		if (!session.configure) throw new CommandError("unsupported", "This provider cannot change model or effort live");
 		const change = {};
 		if (cmd.model !== void 0) change.model = cmd.model;
 		if (cmd.effort !== void 0) change.effort = cmd.effort;
-		await session.configure(change);
+		const modelOrEffort = Object.keys(change).length > 0;
+		if (modelOrEffort && !session.configure) throw new CommandError("unsupported", "This provider cannot change model or effort live");
+		if (cmd.autonomy !== void 0 && !session.setAutonomy) throw new CommandError("unsupported", "This provider cannot change autonomy live");
+		if (modelOrEffort) await session.configure?.(change);
+		if (cmd.autonomy !== void 0) await session.setAutonomy?.(cmd.autonomy);
 	}
 	async respond(cmd) {
 		await this.get(cmd.sessionId).session.respond(cmd.requestId, cmd.response);
@@ -27141,6 +29228,12 @@ async function startRunner(opts) {
 			stream: data
 		});
 	};
+	const stopProviderUpdates = registry.onChange(() => {
+		if (!stopped) attached?.deliver({
+			type: "providers",
+			providers: registry.info()
+		});
+	});
 	const supervisor = new ProcessSupervisor();
 	const host = new SessionHost(registry, emit, { log });
 	const terminals = new TerminalHost({
@@ -27165,6 +29258,7 @@ async function startRunner(opts) {
 		browser,
 		startedAt: (/* @__PURE__ */ new Date()).toISOString(),
 		emit,
+		log,
 		isDraining: () => draining,
 		drain: ({ reason, timeoutMs, exitWhenDrained }) => {
 			if (!draining) {
@@ -27237,11 +29331,14 @@ async function startRunner(opts) {
 	writeFileSync(tmp, `${JSON.stringify(lock, null, 2)}\n`, { mode: 384 });
 	renameSync(tmp, lockFile);
 	log(`runner ${journal.runnerId} listening on 127.0.0.1:${port}`);
+	registry.refreshModels();
+	emptyTrash(opts.home, log);
 	const removeLock = () => removeOwnLock(lockFile);
 	process.once("exit", removeLock);
 	async function close() {
 		closing ??= (async () => {
 			removeLock();
+			stopProviderUpdates();
 			await host.closeAll();
 			await terminals.closeAll();
 			await browserManager.shutdown().catch((error) => log(`browser: ${String(error)}`));
@@ -27266,6 +29363,6 @@ async function startRunner(opts) {
 		close
 	};
 }
-export { RunAutomationRequest as $, unknown as $n, Automation as $t, SessionFileQuery as A, McpServerTarget as An, isNewerVersion as At, BrowserClientMessage as B, custom as Bn, TriageIssueRequest as Bt, import_websocket_server as C, InboxItemKind as Cn, HealthResponse as Ct, CODEDEN_VERSION as D, AgentConfigLocator as Dn, UpdateInstallRequest as Dt, TtsRequest as E, AgentConfigListQuery as En, AppPointer as Et, ListNoticesQuery as F, datetime as Fn, GithubIssue as Ft, BrowserOpenRequest as G, looseObject as Gn, FactoryTriageRequest as Gt, BrowserHistoryRequest as H, int as Hn, parseGithubPrId as Ht, ResolveConflictRequest as I, _enum as In, GithubLabelRequest as It, AutomationFileFrontmatter as J, optional as Jn, PutVisionRequest as Jt, BrowserViewportRequest as K, number$1 as Kn, FactoryTuning as Kt, RoleMessageRequest as L, _null as Ln, GithubListQuery as Lt, RunnerToServerMessage as M, AutonomyLevel as Mn, NOTICE_BATCH_CODE as Mt, ServerLock as N, ProviderId as Nn, CreateGithubIssueRequest as Nt, UsageQuery as O, AgentConfigWriteRequest as On, UpdateStatus as Ot, ListConflictsQuery as P, ReasoningEffort as Pn, GithubCommentRequest as Pt, ListAutomationsQuery as Q, union as Qn, Artifact as Qt, UpdateSessionRequest as R, array as Rn, GithubPr as Rt, acquireInstallLock as S, InboxItem as Sn, UpdateProjectRequest as St, SttQuery as T, AgentConfigDiffRequest as Tn, Settings as Tt, BrowserNavigateRequest as U, intersection as Un, DiscoveryArea as Ut, BrowserDevServerRequest as V, discriminatedUnion as Vn, githubPrId as Vt, BrowserNewTabRequest as W, literal as Wn, FactoryCandidate as Wt, CreateAutomationRequest as X, record as Xn, SetAutonomyModeRequest as Xt, AutomationProjectRequest as Y, preprocess as Yn, ReviewVerdict as Yt, ListAutomationRunsQuery as Z, string as Zn, isFactoryMode as Zt, importClaudeSdkFrom as _, StartedBy as _n, SetSecretRequest as _t, Hono as a, DiffScope as an, UpdateAutomationProjectSettingsRequest as at, runNpm as b, DEFAULT_VISION_PATH as bn, ThreadItemsQuery as bt, serve as c, RestoreFilesRequest as cn, FileReadQuery as ct, createImageEngineRegistry as d, TerminalClientMessage as dn, ListSessionsQuery as dt, AutomationGuards as en, ZodError as er, SetAutomationEnabledRequest as et, IMAGE_ASPECT_RATIOS as f, TerminalQuery as fn, ResolveInboxRequest as ft, CLAUDE_SDK_VERSION as g, ConflictDecision as gn, SessionStartMeta as gt, claudeSdkSource as h, ProjectConfigFile as hn, SendMessageRequest as ht, killTree as i, SessionStatus as in, UpcomingRunsQuery as it, RunnerLock as j, McpServerUpsertRequest as jn, ConflictRecord as jt, UsageSettings as k, McpServerDiffRequest as kn, compareVersions$1 as kt, upgradeWebSocket as l, SessionResult as ln, FileWriteRequest as lt, ImageGenerationError as m, SessionOptions as mn, SecretKey as mt, readLock as n, TriagePolicy as nn, safeParse$1 as nr, TriageDecisionRequest as nt, tryDecodeURIComponent as o, GitCommitRequest as on, UpdateAutomationRequest as ot, resolveImageOutput as p, RunnerCommandResults as pn, RespondRequest as pt, BrowserWsQuery as q, object as qn, KillSwitchRequest as qt, isAlive as r, Session as rn, prettifyError as rr, TriageReport as rt, bufferToFormData as s, GitPushRequest as sn, CreateProjectRequest as st, startRunner as t, AutomationRun as tn, toJSONSchema as tr, StarterSetRequest as tt, ImageEngineRegistry as u, SpeechSummaryRequest as un, ListInboxQuery as ut, installClaudeSdk as v, WorkKey as vn, StartSessionRequest as vt, wrapper_default as w, AgentConfigDeleteQuery as wn, agentEventToNewEvent as wt, resolveNpm as x, FactoryLimits as xn, UiClientMessage as xt, isClaudeSdkInstalled as y, Project as yn, SteerRequest as yt, ImageTestRequest as z, boolean as zn, MergePrRequest as zt };
+export { ExportAutomationsQuery as $, datetime as $n, TriageIssueRequest as $t, SessionFileQuery as A, SessionOptions as An, UiClientMessage as At, ImageTestRequest as B, InboxItemKind as Bn, UpdateInstallRequest as Bt, isElectronRuntime as C, GitPushRequest as Cn, SecretKey as Ct, CODEDEN_VERSION as D, TerminalClientMessage as Dn, StartSessionRequest as Dt, wrapper_default as E, SpeechSummaryRequest as En, SetSecretRequest as Et, ListConflictsQuery as F, Project as Fn, LOCAL_STT_SAMPLE_RATE as Ft, BrowserNavigateRequest as G, AgentConfigLocator as Gn, NOTICE_BATCH_CODE as Gt, BrowserClientMessage as H, AgentConfigDeleteQuery as Hn, compareVersions$1 as Ht, ListNoticesQuery as I, sortProjects as In, LocalSttModelParams as It, BrowserViewportRequest as J, McpServerTarget as Jn, GithubIssue as Jt, BrowserNewTabRequest as K, AgentConfigWriteRequest as Kn, CreateGithubIssueRequest as Kt, ResolveConflictRequest as L, DEFAULT_VISION_PATH as Ln, SttQuery as Lt, RunnerToServerMessage as M, ConflictDecision as Mn, HealthResponse as Mt, ServerLock as N, StartedBy as Nn, agentEventToNewEvent as Nt, UsageQuery as O, TerminalQuery as On, SteerRequest as Ot, ArchiveSessionRequest as P, WorkKey as Pn, Settings as Pt, DuplicateAutomationRequest as Q, ReasoningEffort as Qn, MergePrRequest as Qt, RoleMessageRequest as R, FactoryLimits as Rn, TtsRequest as Rt, acquireInstallLock as S, GitCommitRequest as Sn, RespondRequest as St, import_websocket_server as T, SessionResult as Tn, SessionStartMeta as Tt, BrowserDevServerRequest as U, AgentConfigDiffRequest as Un, isNewerVersion as Ut, summarizeActivity as V, messageFrom as Vn, UpdateStatus as Vt, BrowserHistoryRequest as W, AgentConfigListQuery as Wn, ConflictRecord as Wt, AUTOMATION_IMPORT_LIMITS as X, AutonomyLevel as Xn, GithubListQuery as Xt, BrowserWsQuery as Y, McpServerUpsertRequest as Yn, GithubLabelRequest as Yt, AutomationImportSource as Z, ProviderId as Zn, GithubPr as Zt, importClaudeSdkFrom as _, TriagePolicy as _n, unknown as _r, FileWriteRequest as _t, Hono as a, FactoryTuning as an, discriminatedUnion as ar, ListAutomationRunsQuery as at, runNpm as b, DiffScope as bn, safeParse$1 as br, ReorderProjectsRequest as bt, serve as c, ReviewVerdict as cn, literal as cr, SetAutomationEnabledRequest as ct, createImageEngineRegistry as d, Artifact as dn, object as dr, TriageReport as dt, githubPrId as en, _enum as er, ImportAutomationsRequest as et, IMAGE_ASPECT_RATIOS as f, Automation as fn, optional as fr, UpcomingRunsQuery as ft, CLAUDE_SDK_VERSION as g, AutomationTrigger as gn, union as gr, FileReadQuery as gt, claudeSdkSource as h, AutomationRun as hn, string as hr, CreateProjectRequest as ht, killTree as i, FactoryTriageRequest as in, custom as ir, CreateAutomationRequest as it, RunnerLock as j, ProjectConfigFile as jn, UpdateProjectRequest as jt, UsageSettings as k, RunnerCommandResults as kn, ThreadItemsQuery as kt, upgradeWebSocket as l, SetAutonomyModeRequest as ln, looseObject as lr, StarterSetRequest as lt, ImageGenerationError as m, AutomationGuards as mn, record as mr, UpdateAutomationRequest as mt, readLock as n, DiscoveryArea as nn, array as nr, AutomationGuardsPatch as nt, tryDecodeURIComponent as o, KillSwitchRequest as on, int as or, ListAutomationsQuery as ot, resolveImageOutput as p, AutomationAction as pn, preprocess as pr, UpdateAutomationProjectSettingsRequest as pt, BrowserOpenRequest as q, McpServerDiffRequest as qn, GithubCommentRequest as qt, isAlive as r, FactoryCandidate as rn, boolean as rr, AutomationProjectRequest as rt, bufferToFormData as s, PutVisionRequest as sn, intersection as sr, RunAutomationRequest as st, startRunner as t, parseGithubPrId as tn, _null as tr, AutomationFileFrontmatter as tt, ImageEngineRegistry as u, isFactoryMode as un, number$1 as ur, TriageDecisionRequest as ut, installClaudeSdk as v, Session as vn, ZodError as vr, ListInboxQuery as vt, ownNodeEnv as w, RestoreFilesRequest as wn, SendMessageRequest as wt, resolveNpm as x, EditQueuedMessageRequest as xn, prettifyError as xr, ResolveInboxRequest as xt, isClaudeSdkInstalled as y, SessionStatus as yn, toJSONSchema as yr, ListSessionsQuery as yt, UpdateSessionRequest as z, InboxItem as zn, AppPointer as zt };
 
-//# sourceMappingURL=runner-D8m3WdtS.js.map
+//# sourceMappingURL=runner-DGomZl80.js.map