codex-relay 1.0.3 → 1.0.5

package/dist/src.js

@@ -1,16 +1,16 @@
-import { A as PairResponseSchema, At as stripPromptSkillMentions, C as ListQueuedThreadInputsResponseSchema, D as ListWorkspaceFilesResponseSchema, E as ListWorkspaceDirectoriesResponseSchema, G as ResolveApprovalRequestSchema, K as ResolveApprovalResponseSchema, Q as RuntimePreferencesSchema, S as ListModelsResponseSchema, St as createOpenApiDocument, T as ListThreadsResponseSchema, Tt as promptMarkdownWithSkills, U as RateLimitsResponseSchema, X as RuntimePreferencesByWorkspacePathSchema, Z as RuntimePreferencesResponseSchema, _ as EncryptedPayloadSchema, a as ArchiveThreadResponseSchema, at as ThreadContextWindowResponseSchema, b as InterruptThreadRunResponseSchema, bt as apiPaths, ct as ThreadMessageDetailResponseSchema, d as CheckoutWorkspaceBranchRequestSchema, dt as ThreadSummarySchema, et as StatusResponseSchema, ft as UpdateRuntimePreferencesRequestSchema, h as CreateThreadRequestSchema, ht as WorkspaceChangesResponseSchema, k as PairRequestSchema, l as ChatMessageSchema, m as ContextWindowUsageSchema, nt as StreamThreadRunRequestSchema, ot as ThreadDetailResponseSchema, p as CommitPushWorkspaceRequestSchema, pt as VersionResponseSchema, q as RunThreadRequestSchema, rt as SubmitThreadInputResponseSchema, st as ThreadMessageDetailFieldSchema, tt as StreamThreadRunEventSchema, vt as WorkspaceGitActionResponseSchema, w as ListSkillsResponseSchema, wt as normalizePromptContext, xt as chatMessageDetailsFromPromptContext, y as ImageAttachmentUploadResponseSchema, z as QueuedThreadInputActionResponseSchema } from "./api-schema2.js";
-import { r as legacyCodexRelayDataPath, t as codexRelayDataPath } from "./paths.js";
+import { A as PairResponseSchema, C as ListQueuedThreadInputsResponseSchema, D as ListWorkspaceFilesResponseSchema, Dt as apiPaths, E as ListWorkspaceDirectoriesResponseSchema, G as ResolveApprovalRequestSchema, K as ResolveApprovalResponseSchema, Lt as stripPromptSkillMentions, Mt as promptMarkdownWithSkills, Ot as chatMessageDetailsFromPromptContext, Q as RuntimePreferencesSchema, S as ListModelsResponseSchema, St as WorkspaceGitActionResponseSchema, T as ListThreadsResponseSchema, U as RateLimitsResponseSchema, X as RuntimePreferencesByWorkspacePathSchema, Z as RuntimePreferencesResponseSchema, _ as EncryptedPayloadSchema, a as ArchiveThreadResponseSchema, at as ThreadContextWindowResponseSchema, b as InterruptThreadRunResponseSchema, bt as WorkspaceFileContentResponseSchema, ct as ThreadMessageDetailResponseSchema, d as CheckoutWorkspaceBranchRequestSchema, dt as ThreadSummarySchema, et as StatusResponseSchema, ft as UpdateRuntimePreferencesRequestSchema, h as CreateThreadRequestSchema, jt as normalizePromptContext, k as PairRequestSchema, kt as createOpenApiDocument, l as ChatMessageSchema, m as ContextWindowUsageSchema, mt as VersionResponseSchema, nt as StreamThreadRunRequestSchema, ot as ThreadDetailResponseSchema, p as CommitPushWorkspaceRequestSchema, pt as UpdateWorkspaceFileContentRequestSchema, q as RunThreadRequestSchema, rt as SubmitThreadInputResponseSchema, st as ThreadMessageDetailFieldSchema, tt as StreamThreadRunEventSchema, vt as WorkspaceChangesResponseSchema, w as ListSkillsResponseSchema, y as ImageAttachmentUploadResponseSchema, z as QueuedThreadInputActionResponseSchema } from "./api-schema2.js";
+import { a as getConnectUrlCandidates, i as createPairingQrPayload, o as getConnectUrlGuidance, r as legacyCodexRelayDataPath, s as createTursoPairingSessionStore, t as codexRelayDataPath } from "./paths.js";
 import { createRequire } from "node:module";
 import qrcode from "qrcode-terminal";
-import { execFile, execFileSync, spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import fs, { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { access, appendFile, copyFile, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
-import path, { basename, dirname, extname, join, relative, resolve } from "node:path";
+import { access, appendFile, copyFile, mkdir, open, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import path, { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { z } from "zod";
-import os, { homedir, hostname, networkInterfaces } from "node:os";
-import { serve } from "@hono/node-server";
 import { fromByteArray, toByteArray } from "base64-js";
+import os, { homedir, hostname } from "node:os";
+import { serve } from "@hono/node-server";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import pc from "picocolors";
 import { openRepository } from "es-git";
@@ -24,7 +24,6 @@ import { randomBytes as randomBytes$1, utf8ToBytes } from "@noble/ciphers/utils.
 import { ed25519, x25519 } from "@noble/curves/ed25519.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { sha256 } from "@noble/hashes/sha2.js";
-import { connect } from "@tursodatabase/database";
 //#region src/app-server.ts
 var CodexAppServerClient = class {
 	child;
@@ -539,14 +538,16 @@ function updatePreferencesFile(current, patch, workspacePath) {
 	});
 }
 function mergeRuntimePreferences(current, patch) {
-	const { model, reasoningEffort, threadId: _threadId, workspacePath: _workspacePath, ...rest } = UpdateRuntimePreferencesRequestSchema.parse(patch);
+	const { model, serviceTier, reasoningEffort, threadId: _threadId, workspacePath: _workspacePath, ...rest } = UpdateRuntimePreferencesRequestSchema.parse(patch);
 	const next = {
 		...current,
 		...rest,
 		...model === null ? {} : { model },
+		...serviceTier === null ? {} : { serviceTier },
 		...reasoningEffort === null ? {} : { reasoningEffort }
 	};
 	if (model === null) delete next.model;
+	if (serviceTier === null) delete next.serviceTier;
 	if (reasoningEffort === null) delete next.reasoningEffort;
 	return RuntimePreferencesSchema.parse({ ...next });
 }
@@ -798,6 +799,9 @@ const defaultWorkspacePath = process.cwd();
 const defaultCodexModel = "gpt-5.5";
 const execFileAsync = promisify(execFile);
 const IMAGE_ATTACHMENT_MAX_BYTES = 8 * 1024 * 1024;
+const WORKSPACE_FILE_PREVIEW_MAX_BYTES = 256 * 1024;
+const LOCAL_MARKDOWN_IMAGE_PATTERN = /!\[([^\]]*)\]\(([^)]*)\)/g;
+const LOCAL_IMAGE_REFERENCE_PATTERN = /\.(gif|heic|heif|jpe?g|png|webp)$/i;
 const imageAttachmentDirectory = codexRelayDataPath("attachments/images");
 const relayPackage = createRequire(import.meta.url)("../package.json");
 const collaborationModeTemplateNames = [
@@ -834,6 +838,7 @@ function createApp(options = {}) {
 	const appServerHistoryLoadsByThreadId = /* @__PURE__ */ new Map();
 	const steeringThreads = /* @__PURE__ */ new Set();
 	const secureSessionsByTokenHash = /* @__PURE__ */ new Map();
+	const activeStreamControllers = /* @__PURE__ */ new Set();
 	const threadOptions = { workingDirectory: workspacePath };
 	const scheduleAppServerHistoryLoad = (threadId, cachedMessages) => {
 		if (!appServer || appServerHistoryLoadsByThreadId.has(threadId)) return;
@@ -865,7 +870,7 @@ function createApp(options = {}) {
 	};
 	app.use("*", cors());
 	app.use("*", async (c, next) => {
-		if (!options.pairing || c.req.method === "OPTIONS" || c.req.path === apiPaths.version || c.req.path.startsWith(`${apiPaths.imageAttachments}/`) || c.req.path.startsWith(apiPaths.pair)) {
+		if (!options.pairing || c.req.method === "OPTIONS" || c.req.path === apiPaths.version || c.req.path.startsWith(`${apiPaths.imageAttachments}/`) || c.req.path === apiPaths.sessionsClear || c.req.path.startsWith(apiPaths.pair)) {
 			await next();
 			return;
 		}
@@ -973,6 +978,18 @@ function createApp(options = {}) {
 		});
 		return c.json({ ok: true });
 	});
+	app.post(apiPaths.sessionsClear, async (c) => {
+		if (!options.pairing) return c.json(apiError("pairing_disabled", "Pairing is not enabled on this server."), 404);
+		if (options.pairing.approvalSecret && c.req.header("x-codex-relay-approve-secret") !== options.pairing.approvalSecret) return c.json(apiError("unauthorized", "Pairing clear must come from this machine."), 401);
+		const result = await options.pairing.sessions.clearAll();
+		secureSessionsByTokenHash.clear();
+		closeActiveStreamControllers(activeStreamControllers);
+		options.pairing.onPairingsCleared?.(result);
+		return c.json({
+			ok: true,
+			...result
+		});
+	});
 	app.post(apiPaths.sessionRefresh, async (c) => {
 		if (!options.pairing) return c.json(apiError("pairing_disabled", "Pairing is not enabled on this server."), 404);
 		const oldToken = parseBearerToken(c.req.header("authorization"));
@@ -1157,8 +1174,12 @@ function createApp(options = {}) {
 			const selectedWorkspacePath = await validateThreadWorkspacePath(workspacePath, c.req.query("workspacePath"));
 			if (!selectedWorkspacePath.success) return secureJson(c, options.pairing, secureSessionsByTokenHash, apiError("invalid_workspace_path", selectedWorkspacePath.error), 400);
 			const query = c.req.query("query")?.trim() ?? "";
+			const directoryPath = normalizeWorkspaceDirectoryPath(c.req.query("directory") ?? "");
+			if (!directoryPath.success) return secureJson(c, options.pairing, secureSessionsByTokenHash, apiError("invalid_workspace_file_path", directoryPath.error), 400);
 			const response = ListWorkspaceFilesResponseSchema.parse({
-				files: await listWorkspaceFiles(selectedWorkspacePath.path, query),
+				directory: directoryPath.path,
+				files: await listWorkspaceFiles(selectedWorkspacePath.path, query, directoryPath.path),
+				parentDirectory: parentWorkspaceDirectory(directoryPath.path),
 				query,
 				workspacePath: selectedWorkspacePath.path
 			});
@@ -1167,6 +1188,40 @@ function createApp(options = {}) {
 			return secureJson(c, options.pairing, secureSessionsByTokenHash, apiError("workspace_files_unavailable", errorMessage(error)), 502);
 		}
 	});
+	app.get(apiPaths.workspaceFileContent, async (c) => {
+		try {
+			const selectedWorkspacePath = await validateThreadWorkspacePath(workspacePath, c.req.query("workspacePath"));
+			if (!selectedWorkspacePath.success) return secureJson(c, options.pairing, secureSessionsByTokenHash, apiError("invalid_workspace_path", selectedWorkspacePath.error), 400);
+			const requestedPath = c.req.query("path")?.trim();
+			if (!requestedPath) return secureJson(c, options.pairing, secureSessionsByTokenHash, apiError("missing_workspace_file_path", "Workspace file path is required."), 400);
+			const file = await readWorkspaceFileContent(selectedWorkspacePath.path, requestedPath);
+			if (!file.success) return secureJson(c, options.pairing, secureSessionsByTokenHash, apiError(file.code, file.error), file.status);
+			const response = WorkspaceFileContentResponseSchema.parse({
+				workspacePath: selectedWorkspacePath.path,
+				...file.content
+			});
+			return secureJson(c, options.pairing, secureSessionsByTokenHash, response);
+		} catch (error) {
+			return secureJson(c, options.pairing, secureSessionsByTokenHash, apiError("workspace_file_unavailable", errorMessage(error)), 502);
+		}
+	});
+	app.put(apiPaths.workspaceFileContent, async (c) => {
+		const parsed = await parseRequestJson(c, options.pairing, secureSessionsByTokenHash, UpdateWorkspaceFileContentRequestSchema);
+		if (!parsed.success) return secureJson(c, options.pairing, secureSessionsByTokenHash, validationError(parsed.error), 400);
+		try {
+			const selectedWorkspacePath = await validateThreadWorkspacePath(workspacePath, parsed.data.workspacePath);
+			if (!selectedWorkspacePath.success) return secureJson(c, options.pairing, secureSessionsByTokenHash, apiError("invalid_workspace_path", selectedWorkspacePath.error), 400);
+			const file = await updateWorkspaceFileContent(selectedWorkspacePath.path, parsed.data);
+			if (!file.success) return secureJson(c, options.pairing, secureSessionsByTokenHash, apiError(file.code, file.error), file.status);
+			const response = WorkspaceFileContentResponseSchema.parse({
+				workspacePath: selectedWorkspacePath.path,
+				...file.content
+			});
+			return secureJson(c, options.pairing, secureSessionsByTokenHash, response);
+		} catch (error) {
+			return secureJson(c, options.pairing, secureSessionsByTokenHash, apiError("workspace_file_update_unavailable", errorMessage(error)), 502);
+		}
+	});
 	app.get(apiPaths.rateLimits, async (c) => {
 		if (!appServer) return secureJson(c, options.pairing, secureSessionsByTokenHash, RateLimitsResponseSchema.parse({ buckets: [] }));
 		try {
@@ -1299,7 +1354,7 @@ function createApp(options = {}) {
 			let loadedMessages = false;
 			let messages = cachedMessages;
 			let responseThread = preserveKnownRunningThreadState(mappedThread, wasKnownRunning);
-			const rolloutHistory = readRolloutThreadMessages(threadId);
+			const rolloutHistory = readRolloutThreadMessages(threadId, workspacePath);
 			if (rolloutHistory.messages.length > 0) {
 				messages = mergeThreadMessagePages(rolloutHistory.messages, cachedMessages);
 				responseThread = rememberRolloutThreadMessages(threads, responseThread, messages, rolloutHistory.messageCountLowerBound);
@@ -1338,7 +1393,7 @@ function createApp(options = {}) {
 			});
 		}
 		const cachedMessages = messagesByThreadId.get(threadId) ?? [];
-		const rolloutHistory = readRolloutThreadMessages(threadId);
+		const rolloutHistory = readRolloutThreadMessages(threadId, workspacePath);
 		const baseThread = threads.get(threadId) ?? knownThread ?? (rolloutHistory.rolloutPath ? rolloutThreadMetadata(threadId, workspacePath, rolloutHistory.rolloutPath, [...rolloutHistory.messages, ...cachedMessages]) : void 0);
 		if (baseThread && (cachedMessages.length > 0 || rolloutHistory.messages.length > 0)) {
 			const messages = rolloutHistory.messages.length > 0 ? mergeThreadMessagePages(rolloutHistory.messages, cachedMessages) : dedupeThreadMessages(cachedMessages);
@@ -1705,9 +1760,12 @@ function createApp(options = {}) {
 		});
 		const encoder = new TextEncoder();
 		const secureSession = getSecureSessionForRequest(c, options.pairing, secureSessionsByTokenHash);
+		let streamController;
 		let streamSettled = false;
 		const stream = new ReadableStream({
 			start(controller) {
+				streamController = controller;
+				activeStreamControllers.add(controller);
 				relayDebugLog("thread.stream.started", {
 					mode: !runOptions.prompt && appServer ? "attach" : "run",
 					threadId
@@ -1738,6 +1796,7 @@ function createApp(options = {}) {
 							mode: "attach",
 							threadId
 						});
+						activeStreamControllers.delete(controller);
 						stopPreviewMonitor();
 					});
 					return;
@@ -1755,6 +1814,7 @@ function createApp(options = {}) {
 						mode: "unsupported",
 						threadId
 					});
+					activeStreamControllers.delete(controller);
 					stopPreviewMonitor();
 					return;
 				}
@@ -1787,10 +1847,12 @@ function createApp(options = {}) {
 						mode: "run",
 						threadId
 					});
+					activeStreamControllers.delete(controller);
 					stopPreviewMonitor();
 				});
 			},
 			cancel(reason) {
+				if (streamController) activeStreamControllers.delete(streamController);
 				relayDebugLog("thread.stream.cancelled_by_client", {
 					reason: debugReason(reason),
 					settled: streamSettled,
@@ -1880,7 +1942,8 @@ async function createAppServerThreadRecord(input) {
 		experimentalRawEvents: false,
 		model: input.options.model ?? null,
 		persistExtendedHistory: true,
-		sandbox: runtime.sandbox
+		sandbox: runtime.sandbox,
+		serviceTier: input.options.serviceTier ?? null
 	});
 	const metadata = ThreadSummarySchema.parse({
 		...mapAppServerThread({
@@ -2133,6 +2196,7 @@ async function startAppServerTurn(appServer, threadId, input) {
 		input: appServerTurnInput(input.prompt, input.attachments, input.skills),
 		model: input.runOptions.model ?? null,
 		sandboxPolicy: runtime.sandboxPolicy,
+		serviceTier: input.runOptions.serviceTier ?? null,
 		threadId
 	};
 	await resumeAppServerThreadIfNeeded(appServer, threadId, input, runtime);
@@ -2164,6 +2228,7 @@ async function resumeAppServerThread(appServer, threadId, input, runtime) {
 		model: input.runOptions.model ?? null,
 		persistExtendedHistory: true,
 		sandbox: runtime.sandbox,
+		serviceTier: input.runOptions.serviceTier ?? null,
 		threadId
 	});
 }
@@ -2918,7 +2983,8 @@ async function recoverMissingAppServerThread(input) {
 		experimentalRawEvents: false,
 		model: input.runOptions.model ?? null,
 		persistExtendedHistory: true,
-		sandbox: runtime.sandbox
+		sandbox: runtime.sandbox,
+		serviceTier: input.runOptions.serviceTier ?? null
 	});
 	const recoveredThread = mapAppServerThread({
 		...thread,
@@ -3109,6 +3175,9 @@ function appServerUserMessageText(item) {
 			case "text": return content.text;
 			case "image":
 			case "localImage":
+			case "document":
+			case "file":
+			case "localFile":
 			case "mention":
 			case "skill": return "";
 		}
@@ -3127,11 +3196,86 @@ function appServerUserMessageDetails(item) {
 					type: "image"
 				}];
 			case "localImage": return localImageAttachmentDetails(content.path);
+			case "document":
+			case "file":
+			case "localFile": return appServerDocumentAttachmentDetails(content);
 			default: return [];
 		}
 	});
 	return attachments.length > 0 ? { attachments } : void 0;
 }
+function appServerAgentMessageParts(item) {
+	return agentMessageParts(item.text);
+}
+function agentMessageParts(text) {
+	const imageReferences = localMarkdownImageReferences(text);
+	if (imageReferences.length === 0) return {
+		content: text,
+		details: void 0
+	};
+	const materializedReferences = /* @__PURE__ */ new Set();
+	const attachments = imageReferences.flatMap((reference) => {
+		const name = reference.alt || basename(localImageFilePath(reference.destination) ?? reference.destination);
+		const details = localImageAttachmentDetails(reference.destination, name);
+		if (details.length > 0) materializedReferences.add(reference.destination);
+		return details;
+	});
+	return {
+		content: attachments.length > 0 ? stripMaterializedMarkdownImages(text, materializedReferences) : text,
+		details: attachments.length > 0 ? { attachments } : void 0
+	};
+}
+function localMarkdownImageReferences(markdown) {
+	const references = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const match of markdown.matchAll(LOCAL_MARKDOWN_IMAGE_PATTERN)) {
+		const destination = markdownImageDestination(match[2] ?? "");
+		if (!destination || seen.has(destination) || !isLocalMarkdownImageReference(destination)) continue;
+		seen.add(destination);
+		references.push({
+			alt: (match[1] ?? "").trim(),
+			destination
+		});
+	}
+	return references;
+}
+function stripMaterializedMarkdownImages(markdown, destinations) {
+	return markdown.replace(LOCAL_MARKDOWN_IMAGE_PATTERN, (match, _alt, rawDestination) => {
+		const destination = markdownImageDestination(rawDestination);
+		return destination && destinations.has(destination) ? "" : match;
+	}).replace(/[ \t]+\n/g, "\n").replace(/\n{3,}/g, "\n\n").trim();
+}
+function markdownImageDestination(value) {
+	let destination = value.trim();
+	if (destination.startsWith("<")) {
+		const endIndex = destination.indexOf(">");
+		if (endIndex > 0) destination = destination.slice(1, endIndex);
+	} else {
+		const titleIndex = destination.search(/\s+["']/);
+		if (titleIndex > 0) destination = destination.slice(0, titleIndex);
+	}
+	try {
+		return decodeURI(destination);
+	} catch {
+		return destination;
+	}
+}
+function isLocalMarkdownImageReference(reference) {
+	if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(reference) && !reference.startsWith("file://")) return false;
+	const filePath = localImageFilePath(reference);
+	return Boolean(filePath && LOCAL_IMAGE_REFERENCE_PATTERN.test(filePath));
+}
+function appServerDocumentAttachmentDetails(input) {
+	const reference = input.path ?? input.url;
+	if (!reference) return [];
+	return [{
+		mimeType: input.mimeType,
+		name: input.name ?? basename(reference),
+		path: input.path,
+		type: "document",
+		url: input.url
+	}];
+}
 async function saveUploadedImageAttachment(file) {
 	if (!file.type.startsWith("image/")) throw new Error(`Unsupported attachment type: ${file.type || "unknown"}`);
 	if (file.size > IMAGE_ATTACHMENT_MAX_BYTES) throw new Error(`Image ${file.name || "attachment"} is too large.`);
@@ -3351,10 +3495,32 @@ function updateThread(threads, messagesByThreadId, threadId, update) {
 }
 function sendSse(controller, encoder, secureSession, event) {
 	const parsed = StreamThreadRunEventSchema.parse(event);
+	const threadId = threadIdFromStreamEvent(parsed);
+	relayDebugLog("thread.stream.sse", {
+		direction: "server_to_mobile",
+		eventType: parsed.type,
+		threadId,
+		payload: parsed
+	});
 	const data = secureSession ? EncryptedPayloadSchema.parse(encryptForMobile(secureSession.session, JSON.stringify(parsed))) : parsed;
 	if (secureSession) secureSession.persist().catch(() => void 0);
-	if (!enqueueSseChunk(controller, encoder.encode(`event: ${parsed.type}\n`))) return;
-	enqueueSseChunk(controller, encoder.encode(`data: ${JSON.stringify(data)}\n\n`));
+	if (!enqueueSseChunk(controller, encoder.encode(`event: ${parsed.type}\n`))) {
+		relayDebugLog("thread.stream.sse.enqueue_failed", {
+			eventType: parsed.type,
+			stage: "event",
+			threadId
+		});
+		return;
+	}
+	if (!enqueueSseChunk(controller, encoder.encode(`data: ${JSON.stringify(data)}\n\n`))) relayDebugLog("thread.stream.sse.enqueue_failed", {
+		eventType: parsed.type,
+		stage: "data",
+		threadId
+	});
+}
+function threadIdFromStreamEvent(event) {
+	if ("threadId" in event && typeof event.threadId === "string") return event.threadId;
+	if ("thread" in event && event.thread) return event.thread.id;
 }
 function enqueueSseChunk(controller, chunk) {
 	try {
@@ -3374,6 +3540,10 @@ function closeSseController(controller) {
 		throw error;
 	}
 }
+function closeActiveStreamControllers(controllers) {
+	for (const controller of controllers) closeSseController(controller);
+	controllers.clear();
+}
 function isClosedStreamControllerError(error) {
 	return error instanceof TypeError && error.code === "ERR_INVALID_STATE" && error.message.includes("Controller is already closed");
 }
@@ -3556,6 +3726,7 @@ function runtimeMetadataFromOptions(options) {
 	const sandboxMode = options.sandboxMode ?? runtime.sandboxMode;
 	return {
 		...options.model ? { model: options.model } : {},
+		...options.serviceTier ? { serviceTier: options.serviceTier } : {},
 		...options.runtimeMode ? { runtimeMode: options.runtimeMode } : {},
 		...options.collaborationMode ? { collaborationMode: options.collaborationMode } : {},
 		...approvalPolicy ? { approvalPolicy } : {},
@@ -3568,6 +3739,7 @@ function withRuntimePreferences(preferences, options) {
 		...options,
 		approvalPolicy: options.approvalPolicy,
 		model: options.model ?? preferences.model,
+		serviceTier: options.serviceTier ?? preferences.serviceTier,
 		reasoningEffort: options.reasoningEffort ?? preferences.reasoningEffort,
 		runtimeMode: options.runtimeMode ?? preferences.runtimeMode,
 		sandboxMode: options.sandboxMode
@@ -3615,7 +3787,7 @@ function sandboxPolicyForMode(sandboxMode, workspacePath) {
 	};
 }
 function hasExplicitRunOptions(options) {
-	return Boolean(options.model || options.reasoningEffort || options.approvalPolicy || options.sandboxMode || options.collaborationMode === "plan" || options.runtimeMode);
+	return Boolean(options.model || options.serviceTier || options.reasoningEffort || options.approvalPolicy || options.sandboxMode || options.collaborationMode === "plan" || options.runtimeMode);
 }
 function mapAppServerThread(thread, fallbackMessageCount) {
 	const createdAt = fromUnixSeconds(thread.createdAt);
@@ -3791,7 +3963,7 @@ function readSessionIndexThreadTitle(threadId) {
 		} catch {}
 	}
 }
-function readRolloutThreadMessages(threadId) {
+function readRolloutThreadMessages(threadId, workspacePath = defaultWorkspacePath) {
 	const rolloutPath = findRolloutFileForThread(threadId);
 	if (!rolloutPath) return {
 		messageCountLowerBound: 0,
@@ -3799,6 +3971,8 @@ function readRolloutThreadMessages(threadId) {
 		rolloutPath
 	};
 	const collected = [];
+	const applyPatchInputs = /* @__PURE__ */ new Map();
+	const pendingApplyPatchChanges = [];
 	const lines = readFileSync(rolloutPath, "utf8").split("\n");
 	for (let index = 0; index < lines.length; index += 1) {
 		const line = lines[index];
@@ -3806,7 +3980,15 @@ function readRolloutThreadMessages(threadId) {
 		if (!line.trim()) continue;
 		if (!isRolloutMessageLine(line)) continue;
 		try {
-			const message = rolloutRecordMessage(threadId, JSON.parse(line), `rollout:${lineNumber}`);
+			const record = JSON.parse(line);
+			rememberRolloutApplyPatchInput(record, applyPatchInputs);
+			collectRolloutApplyPatchOutput(record, workspacePath, applyPatchInputs, pendingApplyPatchChanges);
+			if (isRolloutTaskComplete(record) && pendingApplyPatchChanges.length > 0) {
+				collected.push(rolloutApplyPatchSummaryMessage(threadId, record, `rollout:${lineNumber}:apply_patch`, pendingApplyPatchChanges));
+				pendingApplyPatchChanges.length = 0;
+				continue;
+			}
+			const message = rolloutRecordMessage(threadId, record, `rollout:${lineNumber}`, workspacePath);
 			if (!message) continue;
 			collected.push(message);
 		} catch {}
@@ -3833,7 +4015,10 @@ function findRolloutFileForThread(threadId) {
 		}
 	}
 }
-function rolloutRecordMessage(threadId, record, messageKey) {
+function isRolloutTaskComplete(record) {
+	return record.type === "event_msg" && record.payload?.type === "task_complete";
+}
+function rolloutRecordMessage(threadId, record, messageKey, workspacePath = defaultWorkspacePath) {
 	const timestamp = typeof record.timestamp === "string" ? record.timestamp : (/* @__PURE__ */ new Date()).toISOString();
 	const payload = record.payload;
 	if (!payload) return;
@@ -3853,15 +4038,37 @@ function rolloutRecordMessage(threadId, record, messageKey) {
 	if (record.type === "event_msg" && payload.type === "agent_message") {
 		const content = firstString(payload, ["message"]);
 		if (!content) return;
+		const messageParts = agentMessageParts(content);
 		return ChatMessageSchema.parse({
 			id: `${messageKey}:assistant`,
 			threadId,
 			role: "assistant",
-			content,
+			content: messageParts.content,
+			details: messageParts.details,
 			createdAt: timestamp,
 			state: "completed"
 		});
 	}
+	if (record.type === "event_msg" && payload.type === "patch_apply_end") {
+		const changes = rolloutPatchApplyChanges(payload.changes, workspacePath);
+		if (changes.length === 0) return;
+		const patchPreview = largeTextPreview(changes.map((change) => change.patch).filter((patch) => Boolean(patch)).join("\n"));
+		return ChatMessageSchema.parse({
+			id: `${messageKey}:patch:${firstString(payload, ["call_id"]) ?? ""}`,
+			threadId,
+			role: "tool",
+			kind: "fileChange",
+			content: summarizeFileChanges(changes),
+			createdAt: timestamp,
+			state: "completed",
+			details: {
+				changes: changes.map(({ patch: _patch, ...change }) => change),
+				patch: patchPreview?.text,
+				patchOriginalLength: patchPreview?.originalLength,
+				patchTruncated: patchPreview?.truncated
+			}
+		});
+	}
 	if (record.type === "event_msg" && payload.type === "exec_command_end") {
 		const command = Array.isArray(payload.command) ? payload.command.map((part) => String(part)).join(" ") : firstString(payload, ["command"]) || "Command";
 		const outputPreview = largeTextPreview(firstString(payload, ["aggregated_output"]));
@@ -3916,8 +4123,114 @@ function rolloutImageAttachments(value, source) {
 		return localImageAttachmentDetails(image, name);
 	});
 }
+function rememberRolloutApplyPatchInput(record, applyPatchInputs) {
+	const payload = record.payload;
+	if (record.type !== "response_item" || payload?.type !== "custom_tool_call" || firstString(payload, ["name"]) !== "apply_patch") return;
+	const callId = firstString(payload, ["call_id"]);
+	const input = firstString(payload, ["input"]);
+	if (callId && input) applyPatchInputs.set(callId, input);
+}
+function collectRolloutApplyPatchOutput(record, workspacePath, applyPatchInputs, pendingApplyPatchChanges) {
+	const payload = record.payload;
+	if (record.type !== "response_item" || payload?.type !== "custom_tool_call_output" || !firstString(payload, ["call_id"])) return;
+	const changes = rolloutApplyPatchOutputChanges(rolloutCustomToolOutputText(payload), workspacePath);
+	if (changes.length === 0) return;
+	const callId = firstString(payload, ["call_id"]);
+	const patch = callId ? applyPatchInputs.get(callId) : void 0;
+	for (const change of changes) pendingApplyPatchChanges.push({
+		...change,
+		patch
+	});
+}
+function rolloutApplyPatchSummaryMessage(threadId, record, messageKey, pendingApplyPatchChanges) {
+	const timestamp = typeof record.timestamp === "string" ? record.timestamp : (/* @__PURE__ */ new Date()).toISOString();
+	const patchPreview = largeTextPreview([...new Set(pendingApplyPatchChanges.map((change) => change.patch))].filter((patch) => Boolean(patch)).join("\n"));
+	return ChatMessageSchema.parse({
+		id: `${messageKey}:summary`,
+		threadId,
+		role: "tool",
+		kind: "fileChange",
+		content: summarizeFileChanges(pendingApplyPatchChanges),
+		createdAt: timestamp,
+		state: "completed",
+		details: {
+			changes: pendingApplyPatchChanges.map(({ patch: _patch, ...change }) => change),
+			patch: patchPreview?.text,
+			patchOriginalLength: patchPreview?.originalLength,
+			patchTruncated: patchPreview?.truncated
+		}
+	});
+}
+function rolloutCustomToolOutputText(payload) {
+	const rawOutput = firstString(payload, ["output"]);
+	if (!rawOutput) return;
+	try {
+		const parsed = JSON.parse(rawOutput);
+		return typeof parsed.output === "string" ? parsed.output : rawOutput;
+	} catch {
+		return rawOutput;
+	}
+}
+function rolloutApplyPatchOutputChanges(value, workspacePath) {
+	if (!value || !value.includes("Updated the following files")) return [];
+	return value.split("\n").flatMap((line) => {
+		const match = line.match(/^\s*([ADM])\s+(.+?)\s*$/);
+		if (!match) return [];
+		return [{
+			kind: rolloutPatchChangeKind(match[1] === "A" ? "added" : match[1] === "D" ? "deleted" : "modified"),
+			path: rolloutPatchDisplayPath(match[2] ?? "", workspacePath)
+		}];
+	});
+}
+function rolloutPatchApplyChanges(value, workspacePath = defaultWorkspacePath) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return [];
+	return Object.entries(value).flatMap(([rawPath, rawChange]) => {
+		if (!rawChange || typeof rawChange !== "object") return [];
+		const record = rawChange;
+		return [{
+			kind: rolloutPatchChangeKind(firstString(record, ["type"]) ?? "modified"),
+			patch: firstString(record, ["unified_diff", "patch"]),
+			path: rolloutPatchDisplayPath(rawPath, workspacePath)
+		}];
+	});
+}
+function rolloutPatchChangeKind(type) {
+	const normalized = type.toLowerCase();
+	if ([
+		"add",
+		"added",
+		"create",
+		"created"
+	].includes(normalized)) return "added";
+	if ([
+		"delete",
+		"deleted",
+		"remove",
+		"removed"
+	].includes(normalized)) return "deleted";
+	if ([
+		"move",
+		"moved",
+		"rename",
+		"renamed"
+	].includes(normalized)) return "renamed";
+	return "modified";
+}
+function rolloutPatchDisplayPath(value, workspacePath = defaultWorkspacePath) {
+	const filePath = value.startsWith("file://") ? fileUrlPath(value) : value;
+	if (!isAbsolute(filePath)) return filePath;
+	const relativePath = relative(resolve(workspacePath), filePath);
+	return relativePath && !relativePath.startsWith("..") && !isAbsolute(relativePath) ? relativePath.split("\\").join("/") : filePath;
+}
+function fileUrlPath(value) {
+	try {
+		return fileURLToPath(value);
+	} catch {
+		return value;
+	}
+}
 function isRolloutMessageLine(line) {
-	return line.includes("\"type\":\"event_msg\"") && (line.includes("\"type\":\"user_message\"") || line.includes("\"type\":\"agent_message\"") || line.includes("\"type\":\"exec_command_end\"") || line.includes("\"type\":\"mcp_tool_call_end\""));
+	return line.includes("\"type\":\"event_msg\"") && (line.includes("\"type\":\"user_message\"") || line.includes("\"type\":\"agent_message\"") || line.includes("\"type\":\"patch_apply_end\"") || line.includes("\"type\":\"task_complete\"") || line.includes("\"type\":\"exec_command_end\"") || line.includes("\"type\":\"mcp_tool_call_end\"")) || line.includes("\"type\":\"response_item\"") && (line.includes("\"type\":\"custom_tool_call\"") || line.includes("\"type\":\"custom_tool_call_output\""));
 }
 function threadDetailResponse(input) {
 	return ThreadDetailResponseSchema.parse({
@@ -3996,12 +4309,13 @@ function mapAppServerItem(threadId, turn, item) {
 		case "agentMessage": {
 			const agentItem = item;
 			const planContent = proposedPlanContent(agentItem.text);
+			const messageParts = appServerAgentMessageParts(agentItem);
 			return ChatMessageSchema.parse({
 				...base,
 				role: "assistant",
 				kind: planContent ? "plan" : void 0,
-				content: planContent ?? agentItem.text,
-				details: planContent ? { raw: agentItem.text } : void 0
+				content: planContent ?? messageParts.content,
+				details: planContent ? { raw: agentItem.text } : messageParts.details
 			});
 		}
 		case "reasoning": {
@@ -4115,6 +4429,11 @@ function appServerTurnShell(turnId) {
 	};
 }
 function mapAppServerModel(model) {
+	const serviceTiers = model.serviceTiers ?? model.additionalSpeedTiers?.map((tier) => ({
+		id: tier,
+		name: tier === "fast" ? "Fast" : tier,
+		description: void 0
+	})) ?? [];
 	return {
 		id: model.id,
 		model: model.model,
@@ -4122,7 +4441,8 @@ function mapAppServerModel(model) {
 		description: model.description,
 		isDefault: Boolean(model.isDefault),
 		defaultReasoningEffort: model.defaultReasoningEffort,
-		supportedReasoningEfforts: model.supportedReasoningEfforts?.map((effort) => effort.reasoningEffort) ?? []
+		supportedReasoningEfforts: model.supportedReasoningEfforts?.map((effort) => effort.reasoningEffort) ?? [],
+		serviceTiers
 	};
 }
 function normalizeRateLimitBuckets(rateLimits) {
@@ -4183,7 +4503,13 @@ function fallbackModels() {
 			{ reasoningEffort: "medium" },
 			{ reasoningEffort: "high" },
 			{ reasoningEffort: "xhigh" }
-		]
+		],
+		additionalSpeedTiers: ["fast"],
+		serviceTiers: [{
+			id: "priority",
+			name: "Fast",
+			description: "1.5x speed, increased usage"
+		}]
 	}];
 }
 function mapAppServerThreadState(status, turns) {
@@ -4887,53 +5213,253 @@ async function git(cwd, args) {
 	});
 	return stdout.trimEnd();
 }
-async function listWorkspaceFiles(workspacePath, query) {
+async function listWorkspaceFiles(workspacePath, query, directory) {
 	const normalizedQuery = query.toLowerCase();
-	const filePaths = await workspaceFilePaths(workspacePath);
+	const isIgnored = await workspaceIgnoreMatcher(workspacePath);
+	if (directory && isWorkspacePathIgnored(directory, isIgnored)) return [];
+	const filePaths = await workspaceFilePaths(workspacePath, isIgnored);
 	const entriesByPath = /* @__PURE__ */ new Map();
+	for (const entry of await workspaceDirectoryEntries(workspacePath, directory, isIgnored)) entriesByPath.set(entry.path, entry);
 	for (const path of filePaths) {
 		if (!path || path.startsWith("../") || path.includes("/.git/")) continue;
-		entriesByPath.set(path, {
-			directory: dirname(path) === "." ? "" : dirname(path),
+		if (!directory && normalizedQuery) {
+			entriesByPath.set(path, {
+				directory: dirname(path) === "." ? "" : dirname(path),
+				kind: "file",
+				name: path.split("/").pop() ?? path,
+				path
+			});
+			const parts = path.split("/");
+			for (let index = 1; index < parts.length; index += 1) {
+				const directoryPath = parts.slice(0, index).join("/");
+				if (isWorkspacePathIgnored(directoryPath, isIgnored)) continue;
+				entriesByPath.set(directoryPath, {
+					directory: dirname(directoryPath) === "." ? "" : dirname(directoryPath),
+					kind: "directory",
+					name: parts[index - 1],
+					path: directoryPath
+				});
+			}
+			continue;
+		}
+		const prefix = directory ? `${directory}/` : "";
+		if (!path.startsWith(prefix)) continue;
+		const childParts = path.slice(prefix.length).split("/").filter(Boolean);
+		if (childParts.length === 0) continue;
+		if (childParts.length === 1) entriesByPath.set(path, {
+			directory,
 			kind: "file",
-			name: path.split("/").pop() ?? path,
+			name: childParts[0],
 			path
 		});
-		const parts = path.split("/");
-		for (let index = 1; index < parts.length; index += 1) {
-			const directoryPath = parts.slice(0, index).join("/");
+		else {
+			const directoryPath = [...directory ? directory.split("/") : [], childParts[0]].join("/");
+			if (isWorkspacePathIgnored(directoryPath, isIgnored)) continue;
 			entriesByPath.set(directoryPath, {
-				directory: dirname(directoryPath) === "." ? "" : dirname(directoryPath),
+				directory,
 				kind: "directory",
-				name: parts[index - 1],
+				name: childParts[0],
 				path: directoryPath
 			});
 		}
 	}
 	return [...entriesByPath.values()].filter((entry) => {
 		if (!normalizedQuery) return true;
-		return entry.path.toLowerCase().includes(normalizedQuery);
+		return entry.name.toLowerCase().includes(normalizedQuery) || entry.path.toLowerCase().includes(normalizedQuery);
 	}).sort((left, right) => {
 		const leftScore = workspaceFileScore(left.path, normalizedQuery);
 		const rightScore = workspaceFileScore(right.path, normalizedQuery);
 		if (leftScore !== rightScore) return leftScore - rightScore;
 		if (left.kind !== right.kind) return left.kind === "directory" ? -1 : 1;
 		return left.path.localeCompare(right.path);
-	}).slice(0, 80);
+	}).slice(0, directory || !normalizedQuery ? 160 : 80);
+}
+async function readWorkspaceFileContent(workspacePath, requestedPath) {
+	const relativePath = normalizeWorkspaceRelativePath(requestedPath);
+	if (!relativePath.success) return {
+		code: "invalid_workspace_file_path",
+		error: relativePath.error,
+		status: 400,
+		success: false
+	};
+	const rootPath = resolve(workspacePath);
+	const absolutePath = resolve(rootPath, relativePath.path);
+	if (!isPathInside(rootPath, absolutePath)) return {
+		code: "invalid_workspace_file_path",
+		error: "Workspace file path must stay inside the workspace.",
+		status: 400,
+		success: false
+	};
+	const fileStat = await stat(absolutePath).catch(() => null);
+	if (!fileStat?.isFile()) return {
+		code: "workspace_file_not_found",
+		error: "Workspace file was not found.",
+		status: 404,
+		success: false
+	};
+	const bytesToRead = Math.min(fileStat.size, WORKSPACE_FILE_PREVIEW_MAX_BYTES);
+	const buffer = Buffer.alloc(bytesToRead);
+	if (bytesToRead > 0) {
+		const handle = await open(absolutePath, "r");
+		try {
+			await handle.read(buffer, 0, bytesToRead, 0);
+		} finally {
+			await handle.close();
+		}
+	}
+	const binary = buffer.includes(0);
+	return {
+		content: {
+			binary,
+			content: binary ? "" : buffer.toString("utf8"),
+			directory: dirname(relativePath.path) === "." ? "" : dirname(relativePath.path),
+			language: languageFromWorkspaceFile(relativePath.path),
+			name: basename(relativePath.path),
+			path: relativePath.path,
+			size: fileStat.size,
+			truncated: fileStat.size > WORKSPACE_FILE_PREVIEW_MAX_BYTES
+		},
+		success: true
+	};
+}
+async function updateWorkspaceFileContent(workspacePath, input) {
+	const relativePath = normalizeWorkspaceRelativePath(input.path);
+	if (!relativePath.success) return {
+		code: "invalid_workspace_file_path",
+		error: relativePath.error,
+		status: 400,
+		success: false
+	};
+	const rootPath = resolve(workspacePath);
+	const absolutePath = resolve(rootPath, relativePath.path);
+	if (!isPathInside(rootPath, absolutePath)) return {
+		code: "invalid_workspace_file_path",
+		error: "Workspace file path must stay inside the workspace.",
+		status: 400,
+		success: false
+	};
+	if (!(await stat(absolutePath).catch(() => null))?.isFile()) return {
+		code: "workspace_file_not_found",
+		error: "Workspace file was not found.",
+		status: 404,
+		success: false
+	};
+	await writeFile(absolutePath, input.content, "utf8");
+	return readWorkspaceFileContent(workspacePath, relativePath.path);
+}
+function normalizeWorkspaceRelativePath(requestedPath) {
+	const normalized = requestedPath.trim().replaceAll("\\", "/").replace(/^\.\/+/, "");
+	if (!normalized) return {
+		error: "Workspace file path is required.",
+		success: false
+	};
+	if (isAbsolute(normalized)) return {
+		error: "Workspace file path must be relative.",
+		success: false
+	};
+	const segments = normalized.split("/").filter(Boolean);
+	if (segments.some((segment) => segment === "." || segment === ".." || segment === ".git")) return {
+		error: "Workspace file path contains an unsupported segment.",
+		success: false
+	};
+	return {
+		path: segments.join("/"),
+		success: true
+	};
+}
+function normalizeWorkspaceDirectoryPath(requestedPath) {
+	const normalized = requestedPath.trim().replaceAll("\\", "/").replace(/^\.\/+/, "").replace(/\/+$/, "");
+	if (!normalized) return {
+		path: "",
+		success: true
+	};
+	if (isAbsolute(normalized)) return {
+		error: "Workspace directory path must be relative.",
+		success: false
+	};
+	const segments = normalized.split("/").filter(Boolean);
+	if (segments.some((segment) => segment === "." || segment === ".." || segment === ".git")) return {
+		error: "Workspace directory path contains an unsupported segment.",
+		success: false
+	};
+	return {
+		path: segments.join("/"),
+		success: true
+	};
 }
-async function workspaceFilePaths(workspacePath) {
+function parentWorkspaceDirectory(directory) {
+	if (!directory) return null;
+	const parent = dirname(directory);
+	return parent === "." ? "" : parent;
+}
+function isPathInside(rootPath, targetPath) {
+	const pathFromRoot = relative(rootPath, targetPath);
+	return Boolean(pathFromRoot) && !pathFromRoot.startsWith("..") && !isAbsolute(pathFromRoot);
+}
+function languageFromWorkspaceFile(path) {
+	const name = basename(path).toLowerCase();
+	const extension = extname(name).replace(/^\./, "");
+	if (name === "dockerfile") return "dockerfile";
+	if (name === "makefile") return "make";
+	if (name === "package.json") return "json";
+	return {
+		cjs: "javascript",
+		css: "css",
+		diff: "diff",
+		go: "go",
+		htm: "html",
+		html: "html",
+		java: "java",
+		js: "javascript",
+		json: "json",
+		jsx: "jsx",
+		kt: "kotlin",
+		lock: "yaml",
+		log: "text",
+		md: "markdown",
+		mdx: "markdown",
+		mjs: "javascript",
+		plist: "xml",
+		py: "python",
+		rb: "ruby",
+		rs: "rust",
+		sh: "bash",
+		swift: "swift",
+		ts: "typescript",
+		tsx: "tsx",
+		txt: "text",
+		xml: "xml",
+		yaml: "yaml",
+		yml: "yaml"
+	}[extension] ?? extension;
+}
+async function workspaceFilePaths(workspacePath, isIgnored) {
 	try {
 		return (await git(workspacePath, [
 			"ls-files",
 			"--cached",
 			"--others",
 			"--exclude-standard"
-		])).split("\n").filter(Boolean);
+		])).split("\n").filter(Boolean).filter((path) => !isWorkspacePathIgnored(path, isIgnored));
 	} catch {
-		return recursiveWorkspaceFilePaths(workspacePath);
+		return recursiveWorkspaceFilePaths(workspacePath, isIgnored);
 	}
 }
-async function recursiveWorkspaceFilePaths(rootPath) {
+async function workspaceDirectoryEntries(workspacePath, directory, isIgnored) {
+	const rootPath = resolve(workspacePath);
+	const absoluteDirectory = resolve(rootPath, directory);
+	if (absoluteDirectory !== rootPath && !isPathInside(rootPath, absoluteDirectory)) return [];
+	return (await readdir(absoluteDirectory, { withFileTypes: true })).filter((entry) => entry.isDirectory() && entry.name !== ".git").map((entry) => {
+		const path = [...directory ? directory.split("/") : [], entry.name].join("/");
+		return {
+			directory,
+			kind: "directory",
+			name: entry.name,
+			path
+		};
+	}).filter((entry) => !isWorkspacePathIgnored(entry.path, isIgnored));
+}
+async function recursiveWorkspaceFilePaths(rootPath, isIgnored) {
 	const ignoredDirectories = new Set([
 		".git",
 		".expo",
@@ -4947,17 +5473,56 @@ async function recursiveWorkspaceFilePaths(rootPath) {
 		for (const entry of entries) {
 			if (entry.name.startsWith(".") && entry.name !== ".github") continue;
 			const absolutePath = resolve(directory, entry.name);
+			const relativePath = relative(rootPath, absolutePath).split("\\").join("/");
+			if (isWorkspacePathIgnored(relativePath, isIgnored)) continue;
 			if (entry.isDirectory()) {
 				if (ignoredDirectories.has(entry.name)) continue;
 				await visit(absolutePath);
 				continue;
 			}
-			if (entry.isFile()) results.push(relative(rootPath, absolutePath).split("\\").join("/"));
+			if (entry.isFile()) results.push(relativePath);
 		}
 	}
 	await visit(rootPath);
 	return results;
 }
+async function workspaceIgnoreMatcher(workspacePath) {
+	const matchers = (await readFile(join(workspacePath, ".gitignore"), "utf8").catch(() => "")).split(/\r?\n/).map((line) => gitignorePatternMatcher(line)).filter((matcher) => Boolean(matcher));
+	return (path) => matchers.some((matcher) => matcher(path.split("\\").join("/")));
+}
+function isWorkspacePathIgnored(path, isIgnored) {
+	const normalizedPath = path.replace(/^\/+/, "").replaceAll("\\", "/").replace(/\/+$/, "");
+	if (!normalizedPath) return false;
+	if (isIgnored(normalizedPath) || isIgnored(`${normalizedPath}/`)) return true;
+	const parts = normalizedPath.split("/");
+	for (let index = 1; index < parts.length; index += 1) {
+		const ancestorPath = parts.slice(0, index).join("/");
+		if (isIgnored(ancestorPath) || isIgnored(`${ancestorPath}/`)) return true;
+	}
+	return false;
+}
+function gitignorePatternMatcher(line) {
+	const trimmed = line.trim();
+	if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("!")) return;
+	const directoryOnly = trimmed.endsWith("/");
+	const anchored = trimmed.startsWith("/");
+	const pattern = trimmed.replace(/^\/+/, "").replace(/\/+$/, "");
+	if (!pattern) return;
+	const matcher = gitignoreGlobMatcher(pattern);
+	const hasSlash = pattern.includes("/");
+	return (path) => {
+		const normalizedPath = path.replace(/^\/+/, "");
+		return (anchored || hasSlash ? [normalizedPath] : normalizedPath.split("/")).some((candidate) => {
+			if (directoryOnly) return matcher(candidate);
+			return matcher(candidate);
+		});
+	};
+}
+function gitignoreGlobMatcher(pattern) {
+	const expression = pattern.split("**").map((part) => part.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*")).join(".*").replace(/\?/g, "[^/]");
+	const regex = new RegExp(`^${expression}(?:/.*)?$`);
+	return (path) => regex.test(path);
+}
 function workspaceFileScore(path, query) {
 	if (!query) return path.split("/").length;
 	const lowerPath = path.toLowerCase();
@@ -4982,238 +5547,6 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : "Codex run failed.";
 }
 //#endregion
-//#region src/pairing-store.ts
-async function createTursoPairingSessionStore(path) {
-	if (path !== ":memory:") await mkdir(dirname(path), { recursive: true });
-	const db = await connect(path);
-	await db.exec(`
-    CREATE TABLE IF NOT EXISTS pairing_sessions (
-      token_hash TEXT PRIMARY KEY,
-      client_session_id TEXT,
-      client_name TEXT,
-      expires_at INTEGER NOT NULL,
-      key_epoch INTEGER,
-      mobile_to_server_key TEXT,
-      server_to_mobile_key TEXT,
-      last_mobile_counter INTEGER,
-      next_server_counter INTEGER,
-      created_at INTEGER NOT NULL,
-      updated_at INTEGER NOT NULL
-    );
-
-    CREATE TABLE IF NOT EXISTS pending_pairings (
-      approval_code TEXT PRIMARY KEY,
-      client_session_id TEXT,
-      client_name TEXT,
-      client_ephemeral_public_key TEXT NOT NULL,
-      client_nonce TEXT NOT NULL,
-      server_url TEXT NOT NULL,
-      approved INTEGER NOT NULL DEFAULT 0,
-      expires_at INTEGER NOT NULL,
-      created_at INTEGER NOT NULL,
-      updated_at INTEGER NOT NULL
-    );
-  `);
-	await ensurePairingSessionColumns();
-	async function countActive(now) {
-		const row = await db.prepare("SELECT COUNT(DISTINCT COALESCE(client_session_id, token_hash)) AS count FROM pairing_sessions WHERE expires_at > ?").get(now);
-		return Number(row?.count ?? 0);
-	}
-	async function deleteSession(tokenHash) {
-		await db.prepare("DELETE FROM pairing_sessions WHERE token_hash = ?").run(tokenHash);
-	}
-	async function deletePendingPairing(approvalCode) {
-		await db.prepare("DELETE FROM pending_pairings WHERE approval_code = ?").run(approvalCode);
-	}
-	async function getPendingPairing(approvalCode, now) {
-		const row = await db.prepare(`SELECT approval_code AS approvalCode,
-                client_session_id AS clientSessionId,
-                client_name AS clientName,
-                client_ephemeral_public_key AS clientEphemeralPublicKey,
-                client_nonce AS clientNonce,
-                server_url AS serverUrl,
-                approved,
-                expires_at AS expiresAt
-         FROM pending_pairings
-         WHERE approval_code = ?`).get(approvalCode);
-		if (!row) return;
-		const expiresAt = Number(row.expiresAt);
-		if (now > expiresAt) {
-			await deletePendingPairing(approvalCode);
-			return;
-		}
-		return {
-			approvalCode: String(row.approvalCode),
-			approved: Number(row.approved) === 1,
-			clientEphemeralPublicKey: String(row.clientEphemeralPublicKey),
-			clientSessionId: typeof row.clientSessionId === "string" ? row.clientSessionId : void 0,
-			clientName: typeof row.clientName === "string" ? row.clientName : void 0,
-			clientNonce: String(row.clientNonce),
-			expiresAt,
-			serverUrl: String(row.serverUrl)
-		};
-	}
-	return {
-		async approvePendingPairing(approvalCode, now) {
-			const pending = await getPendingPairing(approvalCode, now);
-			if (!pending) return;
-			await db.prepare("UPDATE pending_pairings SET approved = 1, updated_at = ? WHERE approval_code = ?").run(now, approvalCode);
-			return {
-				...pending,
-				approved: true
-			};
-		},
-		countActive,
-		async createPendingPairing(pairing) {
-			const now = Date.now();
-			await db.prepare(`INSERT INTO pending_pairings (
-             approval_code,
-             client_session_id,
-             client_name,
-             client_ephemeral_public_key,
-             client_nonce,
-             server_url,
-             approved,
-             expires_at,
-             created_at,
-             updated_at
-           )
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(pairing.approvalCode, pairing.clientSessionId ?? null, pairing.clientName ?? null, pairing.clientEphemeralPublicKey, pairing.clientNonce, pairing.serverUrl, pairing.approved ? 1 : 0, pairing.expiresAt, now, now);
-		},
-		async createSession(tokenHash, session) {
-			const now = Date.now();
-			const secure = encodeSecureSession(session.secureSession);
-			if (session.clientSessionId) {
-				await db.prepare("DELETE FROM pairing_sessions WHERE client_session_id = ?").run(session.clientSessionId);
-				if (session.clientName) await db.prepare("DELETE FROM pairing_sessions WHERE client_session_id IS NULL AND client_name = ?").run(session.clientName);
-			}
-			await db.prepare(`INSERT INTO pairing_sessions (
-             token_hash,
-             client_session_id,
-             client_name,
-             expires_at,
-             key_epoch,
-             mobile_to_server_key,
-             server_to_mobile_key,
-             last_mobile_counter,
-             next_server_counter,
-             created_at,
-             updated_at
-           )
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(tokenHash, session.clientSessionId ?? null, session.clientName ?? null, session.expiresAt, secure?.keyEpoch ?? null, secure?.mobileToServerKey ?? null, secure?.serverToMobileKey ?? null, secure?.lastMobileCounter ?? null, secure?.nextServerCounter ?? null, now, now);
-			return countActive(now);
-		},
-		deleteSession,
-		deletePendingPairing,
-		getPendingPairing,
-		async getValidSession(tokenHash, now) {
-			const row = await db.prepare(`SELECT client_name AS clientName,
-                  client_session_id AS clientSessionId,
-                  expires_at AS expiresAt,
-                  key_epoch AS keyEpoch,
-                  mobile_to_server_key AS mobileToServerKey,
-                  server_to_mobile_key AS serverToMobileKey,
-                  last_mobile_counter AS lastMobileCounter,
-                  next_server_counter AS nextServerCounter
-           FROM pairing_sessions
-           WHERE token_hash = ?`).get(tokenHash);
-			if (!row) return;
-			const expiresAt = Number(row.expiresAt);
-			if (now > expiresAt) {
-				await deleteSession(tokenHash);
-				return;
-			}
-			return {
-				clientSessionId: typeof row.clientSessionId === "string" ? row.clientSessionId : void 0,
-				clientName: typeof row.clientName === "string" ? row.clientName : void 0,
-				expiresAt,
-				secureSession: decodeSecureSession(row)
-			};
-		},
-		async pruneExpired(now) {
-			await db.prepare("DELETE FROM pairing_sessions WHERE expires_at <= ?").run(now);
-			await db.prepare("DELETE FROM pending_pairings WHERE expires_at <= ?").run(now);
-		},
-		async rotateSession(oldTokenHash, newTokenHash, session) {
-			const now = Date.now();
-			const secure = encodeSecureSession(session.secureSession);
-			await db.transaction(async () => {
-				await db.prepare("DELETE FROM pairing_sessions WHERE token_hash = ?").run(oldTokenHash);
-				if (session.clientSessionId) {
-					await db.prepare("DELETE FROM pairing_sessions WHERE client_session_id = ?").run(session.clientSessionId);
-					if (session.clientName) await db.prepare("DELETE FROM pairing_sessions WHERE client_session_id IS NULL AND client_name = ?").run(session.clientName);
-				}
-				await db.prepare(`INSERT INTO pairing_sessions (
-               token_hash,
-               client_session_id,
-               client_name,
-               expires_at,
-               key_epoch,
-               mobile_to_server_key,
-               server_to_mobile_key,
-               last_mobile_counter,
-               next_server_counter,
-               created_at,
-               updated_at
-             )
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(newTokenHash, session.clientSessionId ?? null, session.clientName ?? null, session.expiresAt, secure?.keyEpoch ?? null, secure?.mobileToServerKey ?? null, secure?.serverToMobileKey ?? null, secure?.lastMobileCounter ?? null, secure?.nextServerCounter ?? null, now, now);
-			})();
-			return countActive(now);
-		},
-		async updateSecureSession(tokenHash, secureSession) {
-			const secure = encodeSecureSession(secureSession);
-			const now = Date.now();
-			await db.prepare(`UPDATE pairing_sessions
-           SET key_epoch = ?,
-               mobile_to_server_key = ?,
-               server_to_mobile_key = ?,
-               last_mobile_counter = ?,
-               next_server_counter = ?,
-               updated_at = ?
-           WHERE token_hash = ?`).run(secure.keyEpoch, secure.mobileToServerKey, secure.serverToMobileKey, secure.lastMobileCounter, secure.nextServerCounter, now, tokenHash);
-		}
-	};
-	async function ensurePairingSessionColumns() {
-		const rows = await db.prepare("PRAGMA table_info(pairing_sessions)").all();
-		const columns = new Set(resultRows(rows).map((row) => String(row.name)));
-		for (const [column, sql] of [
-			["client_session_id", "ALTER TABLE pairing_sessions ADD COLUMN client_session_id TEXT"],
-			["key_epoch", "ALTER TABLE pairing_sessions ADD COLUMN key_epoch INTEGER"],
-			["mobile_to_server_key", "ALTER TABLE pairing_sessions ADD COLUMN mobile_to_server_key TEXT"],
-			["server_to_mobile_key", "ALTER TABLE pairing_sessions ADD COLUMN server_to_mobile_key TEXT"],
-			["last_mobile_counter", "ALTER TABLE pairing_sessions ADD COLUMN last_mobile_counter INTEGER"],
-			["next_server_counter", "ALTER TABLE pairing_sessions ADD COLUMN next_server_counter INTEGER"]
-		]) if (!columns.has(column)) await db.exec(sql);
-		const pendingRows = await db.prepare("PRAGMA table_info(pending_pairings)").all();
-		if (!new Set(resultRows(pendingRows).map((row) => String(row.name))).has("client_session_id")) await db.exec("ALTER TABLE pending_pairings ADD COLUMN client_session_id TEXT");
-	}
-}
-function encodeSecureSession(session) {
-	if (!session) return;
-	return {
-		keyEpoch: session.keyEpoch,
-		lastMobileCounter: session.lastMobileCounter,
-		mobileToServerKey: fromByteArray(session.mobileToServerKey),
-		nextServerCounter: session.nextServerCounter,
-		serverToMobileKey: fromByteArray(session.serverToMobileKey)
-	};
-}
-function decodeSecureSession(row) {
-	if (typeof row.mobileToServerKey !== "string" || typeof row.serverToMobileKey !== "string" || row.keyEpoch === null || row.lastMobileCounter === null || row.nextServerCounter === null) return;
-	return {
-		keyEpoch: Number(row.keyEpoch),
-		lastMobileCounter: Number(row.lastMobileCounter),
-		mobileToServerKey: toByteArray(row.mobileToServerKey),
-		nextServerCounter: Number(row.nextServerCounter),
-		serverToMobileKey: toByteArray(row.serverToMobileKey)
-	};
-}
-function resultRows(result) {
-	if (Array.isArray(result)) return result;
-	if (result && typeof result === "object" && Array.isArray(result.rows)) return result.rows;
-	return [];
-}
-//#endregion
 //#region src/index.ts
 const port = Number(process.env.PORT ?? 8787);
 const hostname$1 = process.env.HOST ?? "0.0.0.0";
@@ -5264,6 +5597,9 @@ serve({
 			onPairApproved: ({ clientName }) => {
 				logRuntimeEvent("Approved", `Pairing request approved${clientName ? ` for ${clientName}` : ""}. Waiting for secure session pickup.`);
 			},
+			onPairingsCleared: ({ pendingPairingsCleared, sessionsCleared }) => {
+				logRuntimeEvent("Cleared", `Signed out ${sessionsCleared} mobile session${sessionsCleared === 1 ? "" : "s"} and removed ${pendingPairingsCleared} pending pairing request${pendingPairingsCleared === 1 ? "" : "s"}.`);
+			},
 			onTokenRefreshed: ({ clientName, tokenCount }) => {
 				logRuntimeEvent("Refreshed", `Mobile session rotated${clientName ? ` for ${clientName}` : ""}; ${formatClientCount(tokenCount)} active.`);
 			}
@@ -5274,10 +5610,19 @@ serve({
 	port
 }, (info) => {
 	const listenUrl = `http://${info.address}:${info.port}`;
-	const connectUrl = getConfiguredConnectUrl() ?? getTailscaleConnectUrl(info.port) ?? getLocalNetworkConnectUrl(info.port) ?? listenUrl;
-	const pairingPayload = createPairingQrPayload(connectUrl);
+	const connectUrlCandidates = getConnectUrlCandidates({
+		listenUrl,
+		port: info.port
+	});
+	const connectUrl = connectUrlCandidates[0]?.url ?? listenUrl;
+	const connectUrls = connectUrlCandidates.map((candidate) => candidate.url);
+	const pairingPayload = createPairingQrPayload({
+		serverPublicKey: serverIdentity.publicKey,
+		serverUrls: connectUrls.length > 0 ? connectUrls : [connectUrl]
+	});
 	writeServerState({
 		connectUrl,
+		connectUrlCandidates,
 		host: hostname$1,
 		listenUrl,
 		pairingPayload,
@@ -5288,6 +5633,7 @@ serve({
 		logRuntimeEvent("Debug", `Writing diagnostics to ${debugLogPath}`);
 		relayDebugLog("relay.started", {
 			connectUrl,
+			connectUrlCandidates,
 			listenUrl,
 			port: info.port,
 			workspacePath: process.env.CODEX_RELAY_WORKSPACE_PATH ?? process.cwd()
@@ -5297,6 +5643,7 @@ serve({
 	qrcode.generate(pairingPayload, { small: true });
 	console.log(formatStartupInstructions({
 		connectUrl,
+		connectUrlCandidates,
 		dangerouslyAutoApprove,
 		listenUrl,
 		pairingPayload,
@@ -5310,6 +5657,8 @@ function formatStartupInstructions(details) {
 			`${color.prompt("›")} Scan the QR code above to pair ${color.brand("Codex Relay mobile")}.`,
 			"",
 			`${color.prompt("›")} Mobile: ${color.url(details.connectUrl)}`,
+			...formatConnectUrlGuidance(details.connectUrl),
+			...formatConnectUrlCandidates(details.connectUrlCandidates),
 			`${color.prompt("›")} Server: ${color.muted(details.listenUrl)}`,
 			"",
 			`${color.prompt("›")} Pairing: ${color.url(details.pairingPayload)}`,
@@ -5326,34 +5675,23 @@ function formatStartupInstructions(details) {
 		""
 	].join("\n");
 }
+function formatConnectUrlGuidance(connectUrl) {
+	const guidance = getConnectUrlGuidance(connectUrl);
+	return guidance ? [`${color.prompt("›")} Network: ${guidance}`] : [];
+}
+function formatConnectUrlCandidates(candidates) {
+	if (candidates.length <= 1) return [];
+	return [`${color.prompt("›")} QR includes ${candidates.length} candidate addresses; the app will use the first reachable one.`, ...candidates.slice(1).map((candidate) => `  ${color.muted(candidate.label)} ${color.url(candidate.url)}`)];
+}
 function logRuntimeEvent(label, message) {
 	console.log(`${color.prompt("›")} ${color.event(label.padEnd(8))} ${message}`);
 }
 function formatClientCount(tokenCount) {
 	return `${tokenCount} client${tokenCount === 1 ? "" : "s"}`;
 }
-function createPairingQrPayload(serverUrl) {
-	const url = new URL("codex-relay://pair");
-	url.searchParams.set("serverUrl", serverUrl);
-	url.searchParams.set("serverPublicKey", serverIdentity.publicKey);
-	return url.toString();
-}
 function hashClientToken(token) {
 	return createHash("sha256").update(token).digest("base64url");
 }
-function getConfiguredConnectUrl() {
-	const configuredUrl = normalizeUrl(process.env.CODEX_RELAY_PUBLIC_URL);
-	if (configuredUrl) return configuredUrl;
-}
-function getTailscaleConnectUrl(port) {
-	const status = getTailscaleStatus();
-	const tailscaleIp = status?.Self?.TailscaleIPs?.find((ip) => ip.startsWith("100.") && ip.includes("."));
-	if (tailscaleIp) return `http://${tailscaleIp}:${port}`;
-	const dnsName = status?.Self?.DNSName?.replace(/\.$/, "");
-	if (dnsName) return getTailscaleServeHttpsUrl(dnsName, port) ?? `http://${dnsName}:${port}`;
-	const tailscaleHost = status?.Self?.TailscaleIPs?.find((ip) => ip.includes("."));
-	return tailscaleHost ? `http://${tailscaleHost}:${port}` : void 0;
-}
 async function getApprovalSecret() {
 	if (process.env.CODEX_RELAY_APPROVAL_SECRET) return process.env.CODEX_RELAY_APPROVAL_SECRET;
 	const path = await prepareCodexRelayDataPath("approval-secret");
@@ -5406,58 +5744,5 @@ async function writeBackgroundPid() {
 function formatApprovalCommand(approvalCode, activePort) {
 	return activePort === 8787 ? `${npxCommand} approve ${approvalCode}` : `PORT=${activePort} ${npxCommand} approve ${approvalCode}`;
 }
-function getLocalNetworkConnectUrl(port) {
-	for (const addresses of Object.values(networkInterfaces())) for (const address of addresses ?? []) if (address.family === "IPv4" && !address.internal) return `http://${address.address}:${port}`;
-}
-function normalizeUrl(value) {
-	if (!value) return;
-	const trimmed = value.trim().replace(/\/$/, "");
-	if (!trimmed) return;
-	try {
-		const url = new URL(trimmed);
-		return url.protocol === "http:" || url.protocol === "https:" ? url.toString().replace(/\/$/, "") : void 0;
-	} catch {
-		return;
-	}
-}
-function getTailscaleStatus() {
-	try {
-		const output = execFileSync("tailscale", ["status", "--json"], {
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			],
-			timeout: 1500
-		});
-		return JSON.parse(output);
-	} catch {
-		return;
-	}
-}
-function getTailscaleServeHttpsUrl(dnsName, port) {
-	try {
-		const output = execFileSync("tailscale", [
-			"serve",
-			"status",
-			"--json"
-		], {
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			],
-			timeout: 1500
-		});
-		const serveStatus = JSON.parse(output);
-		const portKey = String(port);
-		const hostPort = `${dnsName}:${portKey}`;
-		return serveStatus.TCP?.[portKey]?.HTTPS && serveStatus.Web?.[hostPort] ? `https://${hostPort}` : void 0;
-	} catch {
-		return;
-	}
-}
 //#endregion
 export {};