codexui-android 0.1.97 → 0.1.99

package/dist-cli/index.js

@@ -2,14 +2,14 @@
 
 // src/cli/index.ts
 import { createServer as createServer2 } from "http";
-import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync5, mkdirSync } from "fs";
+import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync7, mkdirSync as mkdirSync2 } from "fs";
 import { readFile as readFile5, stat as stat7, writeFile as writeFile6 } from "fs/promises";
-import { homedir as homedir6, networkInterfaces } from "os";
-import { isAbsolute as isAbsolute4, join as join9, resolve as resolve3 } from "path";
+import { homedir as homedir7, networkInterfaces } from "os";
+import { isAbsolute as isAbsolute4, join as join10, resolve as resolve3 } from "path";
 import { spawn as spawn5 } from "child_process";
 import { createInterface as createInterface2 } from "readline/promises";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 import { get as httpsGet } from "https";
 import { Command } from "commander";
 import qrcode from "qrcode-terminal";
@@ -124,37 +124,6 @@ function resolveRipgrepCommand() {
   }
   return null;
 }
-function resolvePythonCommand() {
-  const candidates = process.platform === "win32" ? [
-    { command: "python", args: [] },
-    { command: "py", args: ["-3"] },
-    { command: "python3", args: [] }
-  ] : [
-    { command: "python3", args: [] },
-    { command: "python", args: [] }
-  ];
-  for (const candidate of candidates) {
-    if (isRunnableCommand(candidate.command, [...candidate.args, "--version"])) {
-      return candidate;
-    }
-  }
-  return null;
-}
-function resolveSkillInstallerScriptPath(codexHome) {
-  const normalizedCodexHome = codexHome?.trim();
-  const candidates = uniqueStrings([
-    normalizedCodexHome ? join(normalizedCodexHome, "skills", ".system", "skill-installer", "scripts", "install-skill-from-github.py") : null,
-    process.env.CODEX_HOME?.trim() ? join(process.env.CODEX_HOME.trim(), "skills", ".system", "skill-installer", "scripts", "install-skill-from-github.py") : null,
-    join(homedir(), ".codex", "skills", ".system", "skill-installer", "scripts", "install-skill-from-github.py"),
-    join(homedir(), ".cursor", "skills", ".system", "skill-installer", "scripts", "install-skill-from-github.py")
-  ]);
-  for (const candidate of candidates) {
-    if (existsSync(candidate)) {
-      return candidate;
-    }
-  }
-  return null;
-}
 
 // src/server/appServerRuntimeConfig.ts
 var SANDBOX_MODES = /* @__PURE__ */ new Set([
@@ -216,16 +185,16 @@ function parseApprovalPolicy(value) {
 
 // src/server/httpServer.ts
 import { fileURLToPath } from "url";
-import { dirname as dirname4, extname as extname3, isAbsolute as isAbsolute3, join as join8 } from "path";
-import { existsSync as existsSync4 } from "fs";
+import { dirname as dirname5, extname as extname3, isAbsolute as isAbsolute3, join as join9 } from "path";
+import { existsSync as existsSync6 } from "fs";
 import { writeFile as writeFile5, stat as stat6 } from "fs/promises";
 import express from "express";
 
 // src/server/codexAppServerBridge.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn4, spawnSync as spawnSync4 } from "child_process";
 import { createHash as createHash2, randomBytes } from "crypto";
-import { mkdtemp as mkdtemp3, readFile as readFile3, readdir as readdir2, rm as rm4, mkdir as mkdir4, stat as stat4 } from "fs/promises";
-import { createReadStream, readFileSync as readFileSync2 } from "fs";
+import { mkdtemp as mkdtemp3, readFile as readFile3, readdir as readdir2, rm as rm4, mkdir as mkdir4, stat as stat4, lstat as lstat2 } from "fs/promises";
+import { createReadStream, existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
 import { request as httpRequest2 } from "http";
 import { request as httpsRequest2 } from "https";
 import { homedir as homedir5 } from "os";
@@ -1778,6 +1747,50 @@ function getCodexHomeDir2() {
   const codexHome = process.env.CODEX_HOME?.trim();
   return codexHome && codexHome.length > 0 ? codexHome : join4(homedir3(), ".codex");
 }
+function splitAbsolutePath(pathValue) {
+  return pathValue.split("/").filter(Boolean);
+}
+function buildAbsolutePath(parts) {
+  return `/${parts.join("/")}`;
+}
+function normalizeSkillMarkdownPath(skillPath) {
+  if (!skillPath) return "";
+  return skillPath.endsWith("/SKILL.md") ? skillPath : `${skillPath}/SKILL.md`;
+}
+function deriveSkillPathInfo(skillPath, knownPaths = /* @__PURE__ */ new Set()) {
+  const normalizedPath = normalizeSkillMarkdownPath(skillPath);
+  const parts = splitAbsolutePath(normalizedPath);
+  if (parts.length < 2) return null;
+  const pluginSkillsIndex = parts.lastIndexOf("skills");
+  if (pluginSkillsIndex >= 2) {
+    const pluginName = parts[pluginSkillsIndex - 2] ?? "";
+    if (pluginName) {
+      const rootSkillPath = buildAbsolutePath([...parts.slice(0, pluginSkillsIndex + 1), pluginName, "SKILL.md"]);
+      if (knownPaths.has(rootSkillPath)) {
+        return {
+          normalizedPath,
+          rootSkillPath,
+          rootSkillName: pluginName,
+          installDir: buildAbsolutePath(parts.slice(0, pluginSkillsIndex + 1)),
+          isNestedSkill: normalizedPath !== rootSkillPath
+        };
+      }
+    }
+  }
+  const firstSkillsIndex = parts.indexOf("skills");
+  if (firstSkillsIndex < 0 || firstSkillsIndex + 1 >= parts.length - 1) return null;
+  const rootSkillName = parts[firstSkillsIndex + 1] ?? "";
+  if (!rootSkillName) return null;
+  const rootParts = parts.slice(0, firstSkillsIndex + 2);
+  const installDirParts = parts.slice(0, firstSkillsIndex + 1);
+  return {
+    normalizedPath,
+    rootSkillPath: buildAbsolutePath([...rootParts, "SKILL.md"]),
+    rootSkillName,
+    installDir: buildAbsolutePath(installDirParts),
+    isNestedSkill: normalizedPath !== buildAbsolutePath([...rootParts, "SKILL.md"])
+  };
+}
 function getSkillsInstallDir() {
   return join4(getCodexHomeDir2(), "skills");
 }
@@ -1889,109 +1902,94 @@ async function detectUserSkillsDir(appServer) {
     for (const entry of result.data ?? []) {
       for (const skill of entry.skills ?? []) {
         if (skill.scope !== "user" || !skill.path) continue;
-        const parts = skill.path.split("/").filter(Boolean);
-        if (parts.length < 2) continue;
-        return `/${parts.slice(0, -2).join("/")}`;
+        const skillInfo = deriveSkillPathInfo(skill.path);
+        if (!skillInfo) continue;
+        return skillInfo.installDir;
       }
     }
   } catch {
   }
   return getSkillsInstallDir();
 }
-async function ensureInstalledSkillIsValid(appServer, skillPath) {
-  const result = await appServer.rpc("skills/list", { forceReload: true });
-  const normalized = skillPath.endsWith("/SKILL.md") ? skillPath : `${skillPath}/SKILL.md`;
-  for (const entry of result.data ?? []) {
-    for (const error of entry.errors ?? []) {
-      if (error.path === normalized) {
-        throw new Error(error.message || "Installed skill is invalid");
-      }
-    }
-  }
-}
-var TREE_CACHE_TTL_MS = 5 * 60 * 1e3;
-var skillsTreeCache = null;
-var metaCache = /* @__PURE__ */ new Map();
-async function getGhToken() {
+async function runGitFetchWithRefLockRetry(repoDir, args = ["fetch", "origin"]) {
   try {
-    const proc = spawn3("gh", ["auth", "token"], { stdio: ["ignore", "pipe", "ignore"] });
-    let out = "";
-    proc.stdout.on("data", (d) => {
-      out += d.toString();
-    });
-    return new Promise((resolve4) => {
-      proc.on("close", (code) => resolve4(code === 0 ? out.trim() : null));
-      proc.on("error", () => resolve4(null));
-    });
-  } catch {
-    return null;
+    await runCommand2("git", args, { cwd: repoDir });
+  } catch (error) {
+    const message = getErrorMessage3(error, "");
+    if (!message.includes("cannot lock ref 'refs/remotes/origin/")) throw error;
+    const branchMatch = message.match(/refs\/remotes\/origin\/([^\s':]+)/);
+    if (!branchMatch?.[1]) throw error;
+    const refPath = join4(repoDir, ".git", "refs", "remotes", "origin", branchMatch[1]);
+    try {
+      await rm3(refPath, { force: true });
+    } catch {
+    }
+    await runCommand2("git", args, { cwd: repoDir });
   }
 }
-async function ghFetch(url) {
-  const token = await getGhToken();
-  const headers = {
-    Accept: "application/vnd.github+json",
-    "User-Agent": "codex-web-local"
+function buildLocalHubEntry(info) {
+  return {
+    name: info.name,
+    owner: "local",
+    description: "",
+    displayName: "",
+    publishedAt: 0,
+    avatarUrl: "",
+    url: "",
+    installed: true,
+    path: info.path,
+    enabled: info.enabled
   };
-  if (token) headers.Authorization = `Bearer ${token}`;
-  return fetch(url, { headers });
 }
-async function fetchSkillsTree() {
-  if (skillsTreeCache && Date.now() - skillsTreeCache.fetchedAt < TREE_CACHE_TTL_MS) {
-    return skillsTreeCache.entries;
-  }
-  const resp = await ghFetch(`https://api.github.com/repos/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/git/trees/main?recursive=1`);
-  if (!resp.ok) throw new Error(`GitHub tree API returned ${resp.status}`);
-  const data = await resp.json();
-  const metaPattern = /^skills\/([^/]+)\/([^/]+)\/_meta\.json$/;
-  const seen = /* @__PURE__ */ new Set();
-  const entries = [];
-  for (const node of data.tree ?? []) {
-    const match = metaPattern.exec(node.path);
-    if (!match) continue;
-    const [, owner, skillName] = match;
-    const key = `${owner}/${skillName}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    entries.push({
-      name: skillName,
-      owner,
-      url: `https://github.com/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/tree/main/skills/${owner}/${skillName}`
-    });
-  }
-  skillsTreeCache = { entries, fetchedAt: Date.now() };
-  return entries;
-}
-async function fetchMetaBatch(entries) {
-  const toFetch = entries.filter((e) => !metaCache.has(`${e.owner}/${e.name}`));
-  if (toFetch.length === 0) return;
-  const batch = toFetch.slice(0, 50);
-  await Promise.allSettled(
-    batch.map(async (e) => {
-      const rawUrl = `https://raw.githubusercontent.com/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/main/skills/${e.owner}/${e.name}/_meta.json`;
-      const resp = await fetch(rawUrl);
-      if (!resp.ok) return;
-      const meta = await resp.json();
-      metaCache.set(`${e.owner}/${e.name}`, {
-        displayName: typeof meta.displayName === "string" ? meta.displayName : "",
-        description: typeof meta.displayName === "string" ? meta.displayName : "",
-        publishedAt: meta.latest?.publishedAt ?? 0
-      });
-    })
+function groupRpcSkillRecords(skills) {
+  const normalizedPathSet = new Set(
+    skills.map((skill) => normalizeSkillMarkdownPath(typeof skill.path === "string" ? skill.path : "")).filter(Boolean)
   );
-}
-function buildHubEntry(e) {
-  const cached = metaCache.get(`${e.owner}/${e.name}`);
-  return {
-    name: e.name,
-    owner: e.owner,
-    description: cached?.description ?? "",
-    displayName: cached?.displayName ?? "",
-    publishedAt: cached?.publishedAt ?? 0,
-    avatarUrl: `https://github.com/${e.owner}.png?size=40`,
-    url: e.url,
-    installed: false
-  };
+  const grouped = /* @__PURE__ */ new Map();
+  for (const skill of skills) {
+    const rawPath = typeof skill.path === "string" ? skill.path : "";
+    const pathInfo = rawPath ? deriveSkillPathInfo(rawPath, normalizedPathSet) : null;
+    const groupingKey = pathInfo && pathInfo.isNestedSkill && normalizedPathSet.has(pathInfo.rootSkillPath) ? pathInfo.rootSkillPath : pathInfo?.normalizedPath || rawPath || `${skill.scope ?? ""}:${skill.name ?? ""}`;
+    const existing = grouped.get(groupingKey);
+    const isRootEntry = pathInfo?.normalizedPath === groupingKey;
+    const groupedName = pathInfo && groupingKey === pathInfo.rootSkillPath ? pathInfo.rootSkillName : skill.name;
+    if (!existing) {
+      grouped.set(groupingKey, {
+        preferred: isRootEntry ? {
+          ...skill,
+          name: groupedName,
+          path: groupingKey
+        } : {
+          ...skill,
+          name: groupedName,
+          path: groupingKey
+        },
+        hasRoot: isRootEntry,
+        anyEnabled: skill.enabled !== false
+      });
+      continue;
+    }
+    existing.anyEnabled = existing.anyEnabled || skill.enabled !== false;
+    if (!existing.hasRoot && isRootEntry) {
+      existing.preferred = {
+        ...skill,
+        name: groupedName,
+        path: groupingKey
+      };
+      existing.hasRoot = true;
+      continue;
+    }
+    if (!existing.preferred.description && skill.description) {
+      existing.preferred = { ...existing.preferred, description: skill.description };
+    }
+    if (!existing.preferred.shortDescription && skill.shortDescription) {
+      existing.preferred = { ...existing.preferred, shortDescription: skill.shortDescription };
+    }
+  }
+  return Array.from(grouped.values()).map(({ preferred, anyEnabled }) => ({
+    ...preferred,
+    enabled: preferred.enabled ?? anyEnabled
+  }));
 }
 var GITHUB_DEVICE_CLIENT_ID = "Iv1.b507a08c87ecfe98";
 var DEFAULT_SKILLS_SYNC_REPO_NAME = "codexskills";
@@ -2001,8 +1999,6 @@ var SYNC_UPSTREAM_SKILLS_REPO = "skills";
 var PRIVATE_SYNC_BRANCH = "main";
 var PUBLIC_UPSTREAM_BRANCH_ANDROID = "android";
 var PUBLIC_UPSTREAM_BRANCH_DEFAULT = "main";
-var HUB_SKILLS_OWNER = "openclaw";
-var HUB_SKILLS_REPO = "skills";
 var startupSkillsSyncInitialized = false;
 var startupSyncStatus = {
   inProgress: false,
@@ -2280,7 +2276,7 @@ async function ensureSkillsWorkingTreeRepo(repoUrl, branch) {
     } catch {
       await runCommand2("git", ["remote", "set-url", "origin", repoUrl], { cwd: localDir });
     }
-    await runCommand2("git", ["fetch", "origin"], { cwd: localDir });
+    await runGitFetchWithRefLockRetry(localDir);
     try {
       await runCommand2("git", ["merge", "--allow-unrelated-histories", "--no-edit", `origin/${branch}`], { cwd: localDir });
     } catch {
@@ -2288,7 +2284,7 @@ async function ensureSkillsWorkingTreeRepo(repoUrl, branch) {
     return localDir;
   }
   await runCommand2("git", ["remote", "set-url", "origin", repoUrl], { cwd: localDir });
-  await runCommand2("git", ["fetch", "origin"], { cwd: localDir });
+  await runGitFetchWithRefLockRetry(localDir);
   const hasLocalChangesBeforeSync = await hasLocalUncommittedChanges(localDir);
   const localMtimesBeforeSync = hasLocalChangesBeforeSync ? await snapshotFileMtimes(localDir) : /* @__PURE__ */ new Map();
   await resolveMergeConflictsByNewerCommit(localDir, branch, localMtimesBeforeSync);
@@ -2308,7 +2304,7 @@ async function ensureSkillsWorkingTreeRepo(repoUrl, branch) {
   } catch {
   }
   let pulledMtimes = /* @__PURE__ */ new Map();
-  await runCommand2("git", ["fetch", "origin", branch], { cwd: localDir });
+  await runGitFetchWithRefLockRetry(localDir, ["fetch", "origin", branch]);
   await runCommand2("git", ["reset", "--hard", `origin/${branch}`], { cwd: localDir });
   pulledMtimes = await snapshotFileMtimes(localDir);
   if (createdAutostash) {
@@ -2464,6 +2460,11 @@ async function syncInstalledSkillsFolderToRepo(token, repoOwner, repoName, _inst
       }
       await runCommand2("git", ["checkout", `origin/${branch2}`, "--", filePath], { cwd: repoDir2 });
     }
+    try {
+      await runCommand2("git", ["cat-file", "-e", `origin/${branch2}:shared_skills`], { cwd: repoDir2 });
+      await runCommand2("git", ["checkout", `origin/${branch2}`, "--", "shared_skills"], { cwd: repoDir2 });
+    } catch {
+    }
   }
   function isNonFastForwardPushError(error) {
     const text = getErrorMessage3(error, "").toLowerCase();
@@ -2474,7 +2475,7 @@ async function syncInstalledSkillsFolderToRepo(token, repoOwner, repoName, _inst
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
       const hasLocalChangesBeforeReconcile = await hasLocalUncommittedChanges(repoDir2);
       const localMtimesBeforeReconcile = hasLocalChangesBeforeReconcile ? await snapshotFileMtimes(repoDir2) : /* @__PURE__ */ new Map();
-      await runCommand2("git", ["fetch", "origin"], { cwd: repoDir2 });
+      await runGitFetchWithRefLockRetry(repoDir2);
       try {
         await runCommand2("git", ["rebase", `origin/${branch2}`], { cwd: repoDir2 });
       } catch {
@@ -2490,7 +2491,7 @@ async function syncInstalledSkillsFolderToRepo(token, repoOwner, repoName, _inst
         }
       }
       try {
-        await runCommand2("git", ["push", "origin", `HEAD:${branch2}`], { cwd: repoDir2 });
+        await runCommand2("git", ["push", "--no-recurse-submodules", "origin", `HEAD:${branch2}`], { cwd: repoDir2 });
         const state = await readSkillsSyncState();
         const pushedHead = await runCommandWithOutput("git", ["rev-parse", "HEAD"], { cwd: repoDir2 });
         await writeSkillsSyncState({
@@ -2542,38 +2543,16 @@ async function bootstrapSkillsFromUpstreamIntoLocal() {
 async function collectLocalSyncedSkills(appServer) {
   const state = await readSkillsSyncState();
   const owners = { ...state.installedOwners ?? {} };
-  const tree = await fetchSkillsTree();
-  const uniqueOwnerByName = /* @__PURE__ */ new Map();
-  const ambiguousNames = /* @__PURE__ */ new Set();
-  for (const entry of tree) {
-    if (ambiguousNames.has(entry.name)) continue;
-    const existingOwner = uniqueOwnerByName.get(entry.name);
-    if (!existingOwner) {
-      uniqueOwnerByName.set(entry.name, entry.owner);
-      continue;
-    }
-    if (existingOwner !== entry.owner) {
-      uniqueOwnerByName.delete(entry.name);
-      ambiguousNames.add(entry.name);
-    }
-  }
   const skills = await appServer.rpc("skills/list", {});
   const seen = /* @__PURE__ */ new Set();
   const synced = [];
   let ownersChanged = false;
   for (const entry of skills.data ?? []) {
-    for (const skill of entry.skills ?? []) {
+    for (const skill of groupRpcSkillRecords(entry.skills ?? [])) {
       const name = typeof skill.name === "string" ? skill.name : "";
-      if (!name || seen.has(name)) continue;
+      if (!name || skill.scope !== "user" || seen.has(name)) continue;
       seen.add(name);
-      let owner = owners[name];
-      if (!owner) {
-        owner = uniqueOwnerByName.get(name) ?? "";
-        if (owner) {
-          owners[name] = owner;
-          ownersChanged = true;
-        }
-      }
+      const owner = owners[name] ?? "";
       synced.push({ ...owner ? { owner } : {}, name, enabled: skill.enabled !== false });
     }
   }
@@ -2709,44 +2688,15 @@ async function finalizeGithubLoginAndSync(token, username, appServer) {
   }
   await autoPushSyncedSkills(appServer);
 }
-async function searchSkillsHub(allEntries, query, limit, sort, installedMap) {
-  const q = query.toLowerCase().trim();
-  const filtered = q ? allEntries.filter((s) => {
-    if (s.name.toLowerCase().includes(q) || s.owner.toLowerCase().includes(q)) return true;
-    const cached = metaCache.get(`${s.owner}/${s.name}`);
-    return Boolean(cached?.displayName?.toLowerCase().includes(q));
-  }) : allEntries;
-  const page = filtered.slice(0, Math.min(limit * 2, 200));
-  await fetchMetaBatch(page);
-  let results = page.map(buildHubEntry);
-  if (sort === "date") {
-    results.sort((a, b) => b.publishedAt - a.publishedAt);
-  } else if (q) {
-    results.sort((a, b) => {
-      const aExact = a.name.toLowerCase() === q ? 1 : 0;
-      const bExact = b.name.toLowerCase() === q ? 1 : 0;
-      if (aExact !== bExact) return bExact - aExact;
-      return b.publishedAt - a.publishedAt;
-    });
-  }
-  return results.slice(0, limit).map((s) => {
-    const local = installedMap.get(s.name);
-    return local ? { ...s, installed: true, path: local.path, enabled: local.enabled } : s;
-  });
-}
 async function handleSkillsRoutes(req, res, url, context) {
   const { appServer, readJsonBody: readJsonBody2 } = context;
   if (req.method === "GET" && url.pathname === "/codex-api/skills-hub") {
     try {
-      const q = url.searchParams.get("q") || "";
-      const limit = Math.min(Math.max(parseInt(url.searchParams.get("limit") || "50", 10) || 50, 1), 200);
-      const sort = url.searchParams.get("sort") || "date";
-      const allEntries = await fetchSkillsTree();
       const installedMap = await scanInstalledSkillsFromDisk();
       try {
         const result = await appServer.rpc("skills/list", {});
         for (const entry of result.data ?? []) {
-          for (const skill of entry.skills ?? []) {
+          for (const skill of groupRpcSkillRecords(entry.skills ?? [])) {
             if (skill.name) {
               installedMap.set(skill.name, { name: skill.name, path: skill.path ?? "", enabled: skill.enabled !== false });
             }
@@ -2754,25 +2704,12 @@ async function handleSkillsRoutes(req, res, url, context) {
         }
       } catch {
       }
-      const installedHubEntries = allEntries.filter((e) => installedMap.has(e.name));
-      await fetchMetaBatch(installedHubEntries);
       const installed = [];
       for (const [, info] of installedMap) {
-        const hubEntry = allEntries.find((e) => e.name === info.name);
-        const base = hubEntry ? buildHubEntry(hubEntry) : {
-          name: info.name,
-          owner: "local",
-          description: "",
-          displayName: "",
-          publishedAt: 0,
-          avatarUrl: "",
-          url: "",
-          installed: false
-        };
-        installed.push({ ...base, installed: true, path: info.path, enabled: info.enabled });
+        installed.push(buildLocalHubEntry(info));
       }
-      const results = await searchSkillsHub(allEntries, q, limit, sort, installedMap);
-      setJson3(res, 200, { data: results, installed, total: allEntries.length });
+      installed.sort((a, b) => a.name.localeCompare(b.name));
+      setJson3(res, 200, { installed });
     } catch (error) {
       setJson3(res, 502, { error: getErrorMessage3(error, "Failed to fetch skills hub") });
     }
@@ -2913,27 +2850,12 @@ async function handleSkillsRoutes(req, res, url, context) {
         return true;
       }
       const remote = await readRemoteSkillsManifest(state.githubToken, state.repoOwner, state.repoName);
-      const tree = await fetchSkillsTree();
-      const uniqueOwnerByName = /* @__PURE__ */ new Map();
-      const ambiguousNames = /* @__PURE__ */ new Set();
-      for (const entry of tree) {
-        if (ambiguousNames.has(entry.name)) continue;
-        const existingOwner = uniqueOwnerByName.get(entry.name);
-        if (!existingOwner) {
-          uniqueOwnerByName.set(entry.name, entry.owner);
-          continue;
-        }
-        if (existingOwner !== entry.owner) {
-          uniqueOwnerByName.delete(entry.name);
-          ambiguousNames.add(entry.name);
-        }
-      }
       const localDir = await detectUserSkillsDir(appServer);
       await pullInstalledSkillsFolderFromRepo(state.githubToken, state.repoOwner, state.repoName);
       const localSkills = await scanInstalledSkillsFromDisk();
       const missingAfterPull = [];
       for (const skill of remote) {
-        const owner = skill.owner || uniqueOwnerByName.get(skill.name) || "";
+        const owner = skill.owner || "";
         if (!owner) continue;
         if (!localSkills.has(skill.name)) {
           missingAfterPull.push(`${owner}/${skill.name}`);
@@ -2953,7 +2875,7 @@ async function handleSkillsRoutes(req, res, url, context) {
       }
       const nextOwners = {};
       for (const item of remote) {
-        const owner = item.owner || uniqueOwnerByName.get(item.name) || "";
+        const owner = item.owner || "";
         if (owner) nextOwners[item.name] = owner;
       }
       const pulledHead = await runCommandWithOutput("git", ["rev-parse", "HEAD"], { cwd: getSkillsInstallDir() }).catch(() => "");
@@ -2990,74 +2912,20 @@ async function handleSkillsRoutes(req, res, url, context) {
         const installedInfo = installedMap.get(name);
         const localSkillPath = installedInfo?.path || (skillPath ? skillPath.endsWith("/SKILL.md") ? skillPath : `${skillPath}/SKILL.md` : "");
         if (localSkillPath) {
-          const content2 = await readFile2(localSkillPath, "utf8");
-          const description2 = extractSkillDescriptionFromMarkdown(content2);
-          setJson3(res, 200, { content: content2, description: description2, source: "local" });
+          const content = await readFile2(localSkillPath, "utf8");
+          const description = extractSkillDescriptionFromMarkdown(content);
+          setJson3(res, 200, { content, description, source: "local" });
           return true;
         }
       }
-      const rawUrl = `https://raw.githubusercontent.com/${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}/main/skills/${owner}/${name}/SKILL.md`;
-      const resp = await fetch(rawUrl);
-      if (!resp.ok) throw new Error(`Failed to fetch SKILL.md: ${resp.status}`);
-      const content = await resp.text();
-      const description = extractSkillDescriptionFromMarkdown(content);
-      setJson3(res, 200, { content, description, source: "remote" });
+      setJson3(res, 404, { error: "Only installed local skills are available in Skills Hub." });
     } catch (error) {
       setJson3(res, 502, { error: getErrorMessage3(error, "Failed to fetch SKILL.md") });
     }
     return true;
   }
   if (req.method === "POST" && url.pathname === "/codex-api/skills-hub/install") {
-    try {
-      const payload = asRecord3(await readJsonBody2(req));
-      const owner = typeof payload?.owner === "string" ? payload.owner : "";
-      const name = typeof payload?.name === "string" ? payload.name : "";
-      if (!owner || !name) {
-        setJson3(res, 400, { error: "Missing owner or name" });
-        return true;
-      }
-      const installerScript = resolveSkillInstallerScriptPath(getCodexHomeDir2());
-      if (!installerScript) {
-        throw new Error("Skill installer script not found");
-      }
-      const pythonCommand = resolvePythonCommand();
-      if (!pythonCommand) {
-        throw new Error("Python 3 is required to install skills");
-      }
-      const installDest = await withTimeout(
-        detectUserSkillsDir(appServer),
-        1e4,
-        "detectUserSkillsDir"
-      ).catch(() => getSkillsInstallDir());
-      const skillDir = join4(installDest, name);
-      if (existsSync2(skillDir)) {
-        await rm3(skillDir, { recursive: true, force: true });
-      }
-      await runCommand2(pythonCommand.command, [
-        ...pythonCommand.args,
-        installerScript,
-        "--repo",
-        `${HUB_SKILLS_OWNER}/${HUB_SKILLS_REPO}`,
-        "--path",
-        `skills/${owner}/${name}`,
-        "--dest",
-        installDest,
-        "--method",
-        "git"
-      ], { timeoutMs: 9e4 });
-      try {
-        await withTimeout(ensureInstalledSkillIsValid(appServer, skillDir), 1e4, "ensureInstalledSkillIsValid");
-      } catch {
-      }
-      const syncState = await readSkillsSyncState();
-      const nextOwners = { ...syncState.installedOwners ?? {}, [name]: owner };
-      await writeSkillsSyncState({ ...syncState, installedOwners: nextOwners });
-      autoPushSyncedSkills(appServer).catch(() => {
-      });
-      setJson3(res, 200, { ok: true, path: skillDir });
-    } catch (error) {
-      setJson3(res, 502, { error: getErrorMessage3(error, "Failed to install skill") });
-    }
+    setJson3(res, 410, { error: "Remote Skills Hub installation is disabled." });
     return true;
   }
   if (req.method === "POST" && url.pathname === "/codex-api/skills-hub/uninstall") {
@@ -4749,16 +4617,20 @@ function spawnSyncCommand(command, args = [], options = {}) {
 }
 
 // src/server/codexAppServerBridge.ts
+var COMPOSIO_CONNECTORS_PAGE_LIMIT_MAX = 1e3;
 var PROVIDER_MODELS_FETCH_TIMEOUT_MS = 5e3;
 var THREAD_RESPONSE_TURN_LIMIT = 10;
 var THREAD_METHODS_WITH_TURNS = /* @__PURE__ */ new Set(["thread/read", "thread/resume", "thread/fork", "thread/rollback"]);
 var THREAD_SEARCH_FULL_TEXT_THREAD_LIMIT = 100;
+var PROJECTLESS_THREAD_DIRECTORY_MAX_ATTEMPTS = 100;
+var PROJECTLESS_THREAD_SLUG_MAX_LENGTH = 80;
 var API_PERF_LOGGING_ENV_KEY = "CODEXUI_API_PERF_LOGGING";
 var API_PERF_MS_THRESHOLD_ENV_KEY = "CODEXUI_API_PERF_MS_THRESHOLD";
 var API_PERF_BODY_MB_THRESHOLD_ENV_KEY = "CODEXUI_API_PERF_BODY_MB_THRESHOLD";
 var DEFAULT_API_PERF_MS_THRESHOLD = 300;
 var DEFAULT_API_PERF_BODY_MB_THRESHOLD = 1;
 var MB_DIVISOR = 1024 * 1024;
+var COMPOSIO_USER_DATA_PATH = join6(homedir5(), ".composio", "user_data.json");
 function readEnvValueFromFile(filePath, key) {
   try {
     const content = readFileSync2(filePath, "utf8");
@@ -4830,13 +4702,42 @@ function asRecord5(value) {
 function isInlineDataUrl(value) {
   return /^data:/iu.test(value.trim());
 }
+function inferImageMimeTypeFromBytes(bytes) {
+  if (bytes.length >= 8 && bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71 && bytes[4] === 13 && bytes[5] === 10 && bytes[6] === 26 && bytes[7] === 10) {
+    return "image/png";
+  }
+  if (bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) {
+    return "image/jpeg";
+  }
+  if (bytes.length >= 12 && bytes[0] === 82 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 70 && bytes[8] === 87 && bytes[9] === 69 && bytes[10] === 66 && bytes[11] === 80) {
+    return "image/webp";
+  }
+  if (bytes.length >= 6 && bytes[0] === 71 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 56 && (bytes[4] === 55 || bytes[4] === 57) && bytes[5] === 97) {
+    return "image/gif";
+  }
+  return null;
+}
+function inferImageMimeTypeFromBase64(value) {
+  const compact = value.trim().replace(/\s+/gu, "");
+  if (compact.length < 32 || !/^[A-Za-z0-9+/]+={0,2}$/u.test(compact)) return null;
+  try {
+    return inferImageMimeTypeFromBytes(Buffer.from(compact.slice(0, 64), "base64"));
+  } catch {
+    return null;
+  }
+}
 function normalizeBase64ImageDataUrl(value, mimeType) {
   const trimmed = value.trim();
   if (!trimmed) return null;
-  if (isInlineDataUrl(trimmed)) return trimmed;
+  if (isInlineDataUrl(trimmed)) {
+    return /^data:image\//iu.test(trimmed) ? trimmed : null;
+  }
   const compact = trimmed.replace(/\s+/gu, "");
-  if (!/^[A-Za-z0-9+/]+={0,2}$/u.test(compact)) return null;
-  return `data:${mimeType};base64,${compact}`;
+  const inferredMimeType = inferImageMimeTypeFromBase64(compact);
+  if (!inferredMimeType) return null;
+  const normalizedMimeType = mimeType.trim().toLowerCase();
+  const finalMimeType = normalizedMimeType.startsWith("image/") && normalizedMimeType !== "image/*" ? normalizedMimeType : inferredMimeType;
+  return `data:${finalMimeType};base64,${compact}`;
 }
 function extensionFromMimeType(mimeType) {
   const normalized = mimeType.trim().toLowerCase();
@@ -4888,6 +4789,30 @@ async function persistInlineDataUrlToLocalFile(dataUrl, baseName) {
 function toLocalImageProxyUrl(path) {
   return `/codex-local-image?path=${encodeURIComponent(path)}`;
 }
+var INLINE_IMAGE_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "b64_json",
+  "image",
+  "image_url",
+  "images",
+  "result",
+  "url"
+]);
+function isPotentialInlineImageField(fieldName) {
+  return typeof fieldName === "string" && INLINE_IMAGE_FIELD_NAMES.has(fieldName);
+}
+async function sanitizeInlineImageString(value, context) {
+  if (!isPotentialInlineImageField(context.fieldName)) {
+    return { value, changed: false };
+  }
+  const dataUrl = normalizeBase64ImageDataUrl(value, "image/*");
+  if (!dataUrl) return { value, changed: false };
+  const localUrl = await persistInlineDataUrlToLocalFile(
+    dataUrl,
+    `inline-image-${context.turnId}-${context.itemId}-${context.fieldName}-${String(context.blockIndex)}`
+  );
+  if (!localUrl) return { value, changed: false };
+  return { value: toLocalImageProxyUrl(localUrl), changed: true };
+}
 async function sanitizeInlineUserContentBlock(block, context) {
   const record = asRecord5(block);
   if (!record) return block;
@@ -4896,10 +4821,16 @@ async function sanitizeInlineUserContentBlock(block, context) {
   if (imageUrl && isInlineDataUrl(imageUrl)) {
     const localUrl = await persistInlineDataUrlToLocalFile(imageUrl, `inline-image-${context.turnId}-${context.itemId}-${String(context.blockIndex)}`);
     if (localUrl) {
+      const nextRecord = { ...record };
+      if (typeof record.url === "string") {
+        nextRecord.url = toLocalImageProxyUrl(localUrl);
+      }
+      if (typeof record.image_url === "string") {
+        nextRecord.image_url = toLocalImageProxyUrl(localUrl);
+      }
       return {
-        ...record,
-        type: "image",
-        url: toLocalImageProxyUrl(localUrl)
+        ...nextRecord,
+        type: "image"
       };
     }
     const target = toAttachmentLinkTarget(record, `inline-image/${context.turnId}/${context.itemId}/${String(context.blockIndex)}`);
@@ -4947,6 +4878,9 @@ async function sanitizeInlinePayloadDeep(value, context) {
   if (maybeBlock !== value) {
     return { value: maybeBlock, changed: true };
   }
+  if (typeof value === "string") {
+    return sanitizeInlineImageString(value, context);
+  }
   if (Array.isArray(value)) {
     let changed2 = false;
     const nextArray = [];
@@ -4954,7 +4888,8 @@ async function sanitizeInlinePayloadDeep(value, context) {
       const nested = await sanitizeInlinePayloadDeep(value[index], {
         turnId: context.turnId,
         itemId: context.itemId,
-        blockIndex: index
+        blockIndex: index,
+        fieldName: context.fieldName
       });
       if (nested.changed) changed2 = true;
       nextArray.push(nested.value);
@@ -4969,7 +4904,8 @@ async function sanitizeInlinePayloadDeep(value, context) {
     const nested = await sanitizeInlinePayloadDeep(nestedValue, {
       turnId: context.turnId,
       itemId: context.itemId,
-      blockIndex: context.blockIndex
+      blockIndex: context.blockIndex,
+      fieldName: key
     });
     if (nested.changed) changed = true;
     nextRecord[key] = nested.value;
@@ -5073,6 +5009,45 @@ function logProviderModelDiscoveryWarning(message, details) {
 function isTimeoutError(payload) {
   return payload instanceof Error && (payload.name === "AbortError" || payload.name === "TimeoutError");
 }
+function formatProjectlessDateSegment(date = /* @__PURE__ */ new Date()) {
+  const month = String(date.getMonth() + 1).padStart(2, "0");
+  const day = String(date.getDate()).padStart(2, "0");
+  return `${date.getFullYear()}-${month}-${day}`;
+}
+function buildProjectlessPromptSlug(prompt) {
+  const slug = prompt?.toLowerCase().match(/[a-z0-9]+/g)?.slice(0, 6).join("-").slice(0, PROJECTLESS_THREAD_SLUG_MAX_LENGTH);
+  return slug && slug.length > 0 ? slug : "new-chat";
+}
+async function ensureRealDirectory(path, label) {
+  const info = await lstat2(path);
+  if (info.isSymbolicLink() || !info.isDirectory()) {
+    throw new Error(`${label} must be a real directory`);
+  }
+}
+async function createProjectlessThreadDirectory(prompt) {
+  const workspaceRoot = join6(homedir5(), "Documents", "Codex");
+  await mkdir4(workspaceRoot, { recursive: true });
+  await ensureRealDirectory(workspaceRoot, "Projectless workspace root");
+  const dateDir = join6(workspaceRoot, formatProjectlessDateSegment());
+  await mkdir4(dateDir, { recursive: true });
+  await ensureRealDirectory(dateDir, "Projectless thread date directory");
+  const slug = buildProjectlessPromptSlug(prompt);
+  for (let index = 0; index < PROJECTLESS_THREAD_DIRECTORY_MAX_ATTEMPTS; index += 1) {
+    const folderName = index === 0 ? slug : `${slug}-${index + 1}`;
+    const cwd = join6(dateDir, folderName);
+    try {
+      await mkdir4(cwd, { recursive: false });
+      return { cwd, outputDirectory: cwd, workspaceRoot };
+    } catch {
+      try {
+        await stat4(cwd);
+      } catch {
+        throw new Error("Failed to create new chat folder");
+      }
+    }
+  }
+  throw new Error("Unable to create a unique new chat folder");
+}
 function normalizeHeaderValue(value) {
   if (typeof value === "string") {
     const trimmed = value.trim();
@@ -5272,6 +5247,414 @@ function extractThreadMessageText(threadReadPayload) {
 function readNonEmptyString(value) {
   return typeof value === "string" && value.trim().length > 0 ? value : "";
 }
+async function listTerminalQuickCommands(cwd) {
+  const normalizedCwd = isAbsolute2(cwd) ? cwd : resolve2(cwd);
+  const info = await stat4(normalizedCwd);
+  if (!info.isDirectory()) {
+    throw new Error("Terminal cwd is not a directory");
+  }
+  const commands = [];
+  const seen = /* @__PURE__ */ new Set();
+  const addCommand = (command) => {
+    if (!command.value || seen.has(command.value)) return;
+    seen.add(command.value);
+    commands.push(command);
+  };
+  await addPackageJsonCommands(normalizedCwd, addCommand);
+  await addMakefileCommands(normalizedCwd, addCommand);
+  await addRootScriptCommands(normalizedCwd, addCommand);
+  await addScriptsDirectoryCommands(normalizedCwd, addCommand);
+  return commands;
+}
+async function addPackageJsonCommands(cwd, addCommand) {
+  try {
+    const raw = await readFile3(join6(cwd, "package.json"), "utf8");
+    const parsed = JSON.parse(raw);
+    const record = asRecord5(parsed);
+    const scripts = asRecord5(record?.scripts);
+    if (!scripts) return;
+    const packageManager = resolvePackageManager(cwd);
+    for (const scriptName of Object.keys(scripts)) {
+      if (typeof scripts[scriptName] !== "string") continue;
+      const value = formatPackageScriptCommand(packageManager, scriptName);
+      addCommand({
+        label: value,
+        value,
+        source: "package"
+      });
+    }
+  } catch {
+  }
+}
+async function addMakefileCommands(cwd, addCommand) {
+  const makefilePath = existsSync4(join6(cwd, "Makefile")) ? join6(cwd, "Makefile") : existsSync4(join6(cwd, "makefile")) ? join6(cwd, "makefile") : "";
+  if (!makefilePath) return;
+  try {
+    const raw = await readFile3(makefilePath, "utf8");
+    for (const line of raw.split(/\r?\n/)) {
+      const match = /^([A-Za-z0-9_.@%/+~-][A-Za-z0-9_.@%/+~-]*)\s*:(?![=])/.exec(line);
+      if (!match) continue;
+      const target = match[1];
+      if (!target || target.startsWith(".")) continue;
+      const value = `make ${quoteShellTokenIfNeeded(target)}`;
+      addCommand({
+        label: value,
+        value,
+        source: "make"
+      });
+    }
+  } catch {
+  }
+}
+async function addRootScriptCommands(cwd, addCommand) {
+  await addScriptFileCommands(cwd, ".", addCommand);
+}
+async function addScriptsDirectoryCommands(cwd, addCommand) {
+  await addScriptFileCommands(join6(cwd, "scripts"), "./scripts", addCommand);
+}
+async function addScriptFileCommands(directory, commandPrefix, addCommand) {
+  try {
+    const entries = await readdir2(directory, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isFile()) continue;
+      if (!entry.name.endsWith(".sh") && !entry.name.endsWith(".cmd")) continue;
+      const value = `${commandPrefix}/${quoteShellTokenIfNeeded(entry.name)}`;
+      addCommand({
+        label: value,
+        value,
+        source: "script"
+      });
+    }
+  } catch {
+  }
+}
+function resolvePackageManager(cwd) {
+  if (existsSync4(join6(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync4(join6(cwd, "yarn.lock"))) return "yarn";
+  if (existsSync4(join6(cwd, "bun.lock")) || existsSync4(join6(cwd, "bun.lockb"))) return "bun";
+  return "npm";
+}
+function formatPackageScriptCommand(packageManager, scriptName) {
+  const quoted = quoteShellTokenIfNeeded(scriptName);
+  if (packageManager === "npm") return `npm run ${quoted}`;
+  if (packageManager === "pnpm") return `pnpm run ${quoted}`;
+  if (packageManager === "bun") return `bun run ${quoted}`;
+  return `yarn ${quoted}`;
+}
+function quoteShellTokenIfNeeded(value) {
+  return /^[A-Za-z0-9_./:@-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function readBoolean2(value) {
+  return value === true;
+}
+function readNumber2(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function resolveComposioCommand() {
+  const candidates = [
+    process.env.CODEXUI_COMPOSIO_COMMAND?.trim() ?? "",
+    join6(homedir5(), ".composio", "composio"),
+    "composio"
+  ];
+  for (const candidate of candidates) {
+    if (!candidate) continue;
+    if ((candidate.includes("/") || candidate.includes("\\")) && !existsSync4(candidate)) continue;
+    const invocation = getSpawnInvocation(candidate, ["--version"]);
+    const probe = spawnSync4(invocation.command, invocation.args, {
+      stdio: "ignore",
+      windowsHide: true
+    });
+    if (!probe.error && probe.status === 0) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function parseComposioJson(stdout, fallback) {
+  const trimmed = stdout.trim();
+  if (!trimmed) {
+    throw new Error(fallback);
+  }
+  return JSON.parse(trimmed);
+}
+async function runComposioJson(args, fallback) {
+  const command = resolveComposioCommand();
+  if (!command) {
+    throw new Error("Composio CLI is not installed");
+  }
+  const invocation = getSpawnInvocation(command, args);
+  const child = spawn4(invocation.command, invocation.args, {
+    env: process.env,
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true
+  });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.setEncoding("utf8");
+  child.stderr.setEncoding("utf8");
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk;
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk;
+  });
+  const exitCode = await new Promise((resolveExit, reject) => {
+    child.once("error", reject);
+    child.once("close", (code) => resolveExit(code ?? 0));
+  });
+  if (exitCode !== 0) {
+    throw new Error(stderr.trim() || stdout.trim() || fallback);
+  }
+  try {
+    return parseComposioJson(stdout, fallback);
+  } catch (error) {
+    const details = stderr.trim() || stdout.trim();
+    throw new Error(details || getErrorMessage5(error, fallback));
+  }
+}
+async function readComposioUserData() {
+  try {
+    const raw = await readFile3(COMPOSIO_USER_DATA_PATH, "utf8");
+    const payload = asRecord5(JSON.parse(raw));
+    if (!payload) return null;
+    return {
+      apiKey: readNonEmptyString(payload.api_key),
+      baseUrl: readNonEmptyString(payload.base_url),
+      webUrl: readNonEmptyString(payload.web_url),
+      orgId: readNonEmptyString(payload.org_id),
+      testUserId: readNonEmptyString(payload.test_user_id)
+    };
+  } catch {
+    return null;
+  }
+}
+function normalizeComposioConnection(value) {
+  const record = asRecord5(value);
+  if (!record) return null;
+  const authConfig = asRecord5(record.auth_config);
+  return {
+    id: readNonEmptyString(record.id),
+    wordId: readNonEmptyString(record.word_id),
+    alias: readNonEmptyString(record.alias),
+    status: readNonEmptyString(record.status),
+    authScheme: readNonEmptyString(record.authScheme || authConfig?.auth_scheme),
+    createdAt: readNonEmptyString(record.created_at),
+    updatedAt: readNonEmptyString(record.updated_at),
+    isComposioManaged: readBoolean2(authConfig?.is_composio_managed),
+    isDisabled: readBoolean2(record.is_disabled)
+  };
+}
+function normalizeComposioToolkit(value, connectionsBySlug) {
+  const record = asRecord5(value);
+  if (!record) return null;
+  const slug = readNonEmptyString(record.slug);
+  if (!slug) return null;
+  const connectionRows = connectionsBySlug.get(slug) ?? [];
+  return {
+    slug,
+    name: readNonEmptyString(record.name),
+    description: readNonEmptyString(record.description),
+    logoUrl: readNonEmptyString(record.logo || record.meta && asRecord5(record.meta)?.logo),
+    latestVersion: readNonEmptyString(record.latest_version || record.latestVersion),
+    toolsCount: readNumber2(record.tools_count),
+    triggersCount: readNumber2(record.triggers_count),
+    isNoAuth: readBoolean2(record.is_no_auth),
+    enabled: record.enabled !== false,
+    authModes: Array.isArray(record.auth_modes) ? record.auth_modes.map(readNonEmptyString).filter(Boolean) : [],
+    activeCount: connectionRows.filter((row) => row.status === "ACTIVE" && !row.isDisabled).length,
+    totalConnections: connectionRows.length,
+    connectionStatuses: [...new Set(connectionRows.map((row) => row.status).filter(Boolean))]
+  };
+}
+function normalizeComposioTool(value) {
+  const record = asRecord5(value);
+  if (!record) return null;
+  const slug = readNonEmptyString(record.slug);
+  if (!slug) return null;
+  return {
+    slug,
+    name: readNonEmptyString(record.name),
+    description: readNonEmptyString(record.description)
+  };
+}
+async function readComposioConnectionsBySlug() {
+  const payload = asRecord5(await runComposioJson(["connections", "list"], "Failed to list Composio connections"));
+  const bySlug = /* @__PURE__ */ new Map();
+  for (const [slug, rawRows] of Object.entries(payload ?? {})) {
+    if (!Array.isArray(rawRows)) continue;
+    const rows = rawRows.map(normalizeComposioConnection).filter((row) => row !== null);
+    bySlug.set(slug, rows);
+  }
+  return bySlug;
+}
+async function readComposioStatus() {
+  const cliVersion = (() => {
+    const command = resolveComposioCommand();
+    if (!command) return "";
+    const invocation = getSpawnInvocation(command, ["--version"]);
+    const probe = spawnSync4(invocation.command, invocation.args, {
+      encoding: "utf8",
+      windowsHide: true
+    });
+    return probe.status === 0 ? probe.stdout.trim() : "";
+  })();
+  const userData = await readComposioUserData();
+  if (!resolveComposioCommand()) {
+    return {
+      available: false,
+      authenticated: false,
+      cliVersion,
+      email: "",
+      defaultOrgName: "",
+      defaultOrgId: userData?.orgId ?? "",
+      webUrl: userData?.webUrl ?? "",
+      baseUrl: userData?.baseUrl ?? "",
+      testUserId: userData?.testUserId ?? ""
+    };
+  }
+  try {
+    const payload = asRecord5(await runComposioJson(["whoami"], "Failed to read Composio account status"));
+    return {
+      available: true,
+      authenticated: true,
+      cliVersion,
+      email: readNonEmptyString(payload?.email),
+      defaultOrgName: readNonEmptyString(payload?.default_org_name),
+      defaultOrgId: readNonEmptyString(payload?.default_org_id) || userData?.orgId || "",
+      webUrl: userData?.webUrl || "https://dashboard.composio.dev/",
+      baseUrl: userData?.baseUrl || "https://backend.composio.dev",
+      testUserId: readNonEmptyString(payload?.test_user_id) || userData?.testUserId || ""
+    };
+  } catch {
+    return {
+      available: true,
+      authenticated: false,
+      cliVersion,
+      email: "",
+      defaultOrgName: "",
+      defaultOrgId: userData?.orgId ?? "",
+      webUrl: userData?.webUrl || "https://dashboard.composio.dev/",
+      baseUrl: userData?.baseUrl || "https://backend.composio.dev",
+      testUserId: userData?.testUserId ?? ""
+    };
+  }
+}
+async function listComposioConnectors(query, cursor = null, limit = 50) {
+  const args = ["dev", "toolkits", "list", "--limit", String(COMPOSIO_CONNECTORS_PAGE_LIMIT_MAX)];
+  const trimmedQuery = query.trim();
+  if (trimmedQuery) {
+    args.push("--query", trimmedQuery);
+  }
+  const [payload, connectionsBySlug] = await Promise.all([
+    runComposioJson(args, "Failed to list Composio toolkits"),
+    readComposioConnectionsBySlug()
+  ]);
+  const allRows = payload.map((item) => normalizeComposioToolkit(item, connectionsBySlug)).filter((row) => row !== null);
+  const safeLimit = Number.isFinite(limit) ? Math.max(1, Math.min(COMPOSIO_CONNECTORS_PAGE_LIMIT_MAX, Math.floor(limit))) : 50;
+  const safeCursor = parseComposioCursor(cursor, allRows.length);
+  return {
+    data: allRows.slice(safeCursor, safeCursor + safeLimit),
+    nextCursor: safeCursor + safeLimit < allRows.length ? String(safeCursor + safeLimit) : null,
+    total: allRows.length
+  };
+}
+function parseComposioCursor(cursor, maxLength) {
+  const trimmed = cursor?.trim() ?? "";
+  const parsed = Number.parseInt(trimmed, 10);
+  if (!Number.isFinite(parsed) || Number.isNaN(parsed) || parsed <= 0) return 0;
+  if (parsed >= maxLength) return maxLength;
+  return parsed;
+}
+function parseComposioLimit(rawLimit) {
+  const parsed = Number.parseInt((rawLimit ?? "").trim(), 10);
+  if (!Number.isFinite(parsed) || Number.isNaN(parsed) || parsed <= 0) return 50;
+  return Math.max(1, Math.min(COMPOSIO_CONNECTORS_PAGE_LIMIT_MAX, parsed));
+}
+async function readComposioConnectorDetail(slug) {
+  const normalizedSlug = slug.trim();
+  if (!normalizedSlug) {
+    throw new Error("Missing Composio connector slug");
+  }
+  const [infoPayload, toolsPayload, connectionsPayload, userData] = await Promise.all([
+    runComposioJson(["dev", "toolkits", "info", normalizedSlug], `Failed to load Composio toolkit ${normalizedSlug}`),
+    runComposioJson(["tools", "list", normalizedSlug, "--limit", "10"], `Failed to list tools for ${normalizedSlug}`),
+    runComposioJson(["link", normalizedSlug, "--list"], `Failed to list connections for ${normalizedSlug}`),
+    readComposioUserData()
+  ]);
+  const connections = Array.isArray(connectionsPayload.items) ? connectionsPayload.items.map(normalizeComposioConnection).filter((row) => row !== null) : [];
+  const connector = normalizeComposioToolkit(infoPayload, /* @__PURE__ */ new Map([[normalizedSlug, connections]]));
+  if (!connector) {
+    throw new Error(`Unknown Composio connector: ${normalizedSlug}`);
+  }
+  return {
+    connector,
+    connections,
+    tools: Array.isArray(toolsPayload) ? toolsPayload.map(normalizeComposioTool).filter((row) => row !== null) : [],
+    dashboardUrl: userData?.webUrl || "https://dashboard.composio.dev/"
+  };
+}
+async function startComposioLink(slug) {
+  const normalizedSlug = slug.trim();
+  if (!normalizedSlug) {
+    throw new Error("Missing Composio connector slug");
+  }
+  const payload = asRecord5(await runComposioJson(["link", normalizedSlug, "--no-wait"], `Failed to start Composio link for ${normalizedSlug}`));
+  return {
+    status: readNonEmptyString(payload?.status),
+    message: readNonEmptyString(payload?.message),
+    connectedAccountId: readNonEmptyString(payload?.connected_account_id),
+    redirectUrl: readNonEmptyString(payload?.redirect_url),
+    toolkit: readNonEmptyString(payload?.toolkit),
+    projectType: readNonEmptyString(payload?.project_type)
+  };
+}
+async function startComposioLogin() {
+  const command = resolveComposioCommand();
+  if (!command) {
+    throw new Error("Composio CLI is not installed");
+  }
+  const invocation = getSpawnInvocation(command, ["login", "-y"]);
+  const proc = spawn4(invocation.command, invocation.args, {
+    cwd: process.cwd(),
+    env: process.env,
+    detached: true,
+    stdio: "ignore",
+    windowsHide: true
+  });
+  proc.unref();
+  return {
+    status: "started",
+    message: "Composio CLI login started",
+    loginUrl: "",
+    cliKey: "",
+    expiresAt: ""
+  };
+}
+async function installComposioCli() {
+  const homeBin = join6(homedir5(), ".npm-global", "bin");
+  const command = "npm";
+  const args = ["install", "-g", "@composio/cli@latest"];
+  const invocation = getSpawnInvocation(command, args);
+  const env = {
+    ...process.env,
+    npm_config_prefix: process.env.npm_config_prefix?.trim() || join6(homedir5(), ".npm-global"),
+    PATH: process.env.PATH ? `${homeBin}:${process.env.PATH}` : homeBin
+  };
+  const result = spawnSync4(invocation.command, invocation.args, {
+    encoding: "utf8",
+    env,
+    windowsHide: true
+  });
+  const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
+  if (result.error || result.status !== 0) {
+    throw new Error(output || result.error?.message || "Failed to install Composio CLI");
+  }
+  return {
+    ok: true,
+    command: `${command} ${args.join(" ")}`,
+    output
+  };
+}
 function countRecoveredContentLines(value) {
   if (!value) return 0;
   const normalized = value.replace(/\r\n/g, "\n");
@@ -5863,54 +6246,6 @@ function scoreFileCandidate(path, query) {
   if (lowerPath.includes(lowerQuery)) return 4;
   return 10;
 }
-function decodeHtmlEntities(value) {
-  return value.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&#x2F;/gi, "/");
-}
-function stripHtml(value) {
-  return decodeHtmlEntities(value.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim());
-}
-function parseGithubTrendingHtml(html, limit) {
-  const rows = html.match(/<article[\s\S]*?<\/article>/g) ?? [];
-  const items = [];
-  let seq = Date.now();
-  for (const row of rows) {
-    const repoBlockMatch = row.match(/<h2[\s\S]*?<\/h2>/);
-    const hrefMatch = repoBlockMatch?.[0]?.match(/href="\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)"/);
-    if (!hrefMatch) continue;
-    const fullName = hrefMatch[1] ?? "";
-    if (!fullName || items.some((item) => item.fullName === fullName)) continue;
-    const descriptionMatch = row.match(/<p[^>]*class="[^"]*col-9[^"]*"[^>]*>([\s\S]*?)<\/p>/) ?? row.match(/<p[^>]*class="[^"]*color-fg-muted[^"]*"[^>]*>([\s\S]*?)<\/p>/) ?? row.match(/<p[^>]*>([\s\S]*?)<\/p>/);
-    const languageMatch = row.match(/programmingLanguage[^>]*>\s*([\s\S]*?)\s*<\/span>/);
-    const starsMatch = row.match(/href="\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/stargazers"[\s\S]*?>([\s\S]*?)<\/a>/);
-    const starsText = stripHtml(starsMatch?.[1] ?? "").replace(/,/g, "");
-    const stars = Number.parseInt(starsText, 10);
-    items.push({
-      id: seq,
-      fullName,
-      url: `https://github.com/${fullName}`,
-      description: stripHtml(descriptionMatch?.[1] ?? ""),
-      language: stripHtml(languageMatch?.[1] ?? ""),
-      stars: Number.isFinite(stars) ? stars : 0
-    });
-    seq += 1;
-    if (items.length >= limit) break;
-  }
-  return items;
-}
-async function fetchGithubTrending(since, limit) {
-  const endpoint = `https://github.com/trending?since=${since}`;
-  const response = await fetch(endpoint, {
-    headers: {
-      "User-Agent": "codex-web-local",
-      Accept: "text/html"
-    }
-  });
-  if (!response.ok) {
-    throw new Error(`GitHub trending fetch failed (${response.status})`);
-  }
-  const html = await response.text();
-  return parseGithubTrendingHtml(html, limit);
-}
 async function listFilesWithRipgrep(cwd) {
   return await new Promise((resolve4, reject) => {
     const ripgrepCommand = resolveRipgrepCommand();
@@ -5947,6 +6282,79 @@ function getCodexHomeDir3() {
   const codexHome = process.env.CODEX_HOME?.trim();
   return codexHome && codexHome.length > 0 ? codexHome : join6(homedir5(), ".codex");
 }
+function getPromptsDir() {
+  return join6(getCodexHomeDir3(), "prompts");
+}
+function promptNameToFileName(name) {
+  const trimmed = name.trim();
+  const withoutExtension = trimmed.replace(/\.md$/i, "");
+  const sanitized = withoutExtension.replace(/[\/\\:*?"<>|]/g, " ").replace(/\s+/g, " ").trim();
+  return `${sanitized || "prompt"}.md`;
+}
+function buildPromptDescription(content) {
+  const firstNonEmptyLine = content.split(/\r?\n/).map((line) => line.trim()).find(Boolean) ?? "";
+  return firstNonEmptyLine.slice(0, 120);
+}
+async function listComposerPrompts() {
+  const promptsDir = getPromptsDir();
+  try {
+    const entries = await readdir2(promptsDir, { withFileTypes: true });
+    const prompts = await Promise.all(entries.filter((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".md")).map(async (entry) => {
+      const promptPath = join6(promptsDir, entry.name);
+      const content = await readFile3(promptPath, "utf8");
+      return {
+        name: entry.name.replace(/\.md$/i, ""),
+        path: promptPath,
+        content,
+        description: buildPromptDescription(content)
+      };
+    }));
+    return prompts.sort((a, b) => a.name.localeCompare(b.name));
+  } catch (error) {
+    if (error?.code === "ENOENT") return [];
+    throw error;
+  }
+}
+async function createComposerPromptFile(name, content) {
+  const trimmedName = name.trim();
+  if (!trimmedName) throw new Error("Prompt name is required");
+  const trimmedContent = content.trim();
+  if (!trimmedContent) throw new Error("Prompt content is required");
+  const promptsDir = getPromptsDir();
+  await mkdir4(promptsDir, { recursive: true });
+  const baseFileName = promptNameToFileName(trimmedName);
+  let targetPath = join6(promptsDir, baseFileName);
+  let suffix = 2;
+  while (existsSync4(targetPath)) {
+    const nextFileName = `${baseFileName.replace(/\.md$/i, "")}-${suffix}.md`;
+    targetPath = join6(promptsDir, nextFileName);
+    suffix += 1;
+  }
+  await writeFile4(targetPath, `${trimmedContent}
+`, "utf8");
+  return {
+    name: basename4(targetPath).replace(/\.md$/i, ""),
+    path: targetPath,
+    content: `${trimmedContent}
+`,
+    description: buildPromptDescription(trimmedContent)
+  };
+}
+async function removeComposerPromptFile(promptPath) {
+  const resolvedPath = resolve2(promptPath);
+  const promptsDir = resolve2(getPromptsDir());
+  const relative = resolvedPath.startsWith(`${promptsDir}/`) ? resolvedPath.slice(promptsDir.length + 1) : "";
+  if (!relative || relative.includes("..") || !resolvedPath.toLowerCase().endsWith(".md")) {
+    throw new Error("Invalid prompt path");
+  }
+  try {
+    await rm4(resolvedPath, { force: false });
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+}
 async function runCommand3(command, args, options = {}) {
   await new Promise((resolve4, reject) => {
     const proc = spawn4(command, args, {
@@ -6346,6 +6754,109 @@ async function writePinnedThreadIds(threadIds) {
   payload[PINNED_THREAD_IDS_KEY] = normalizePinnedThreadIds(threadIds);
   await writeFile4(statePath, JSON.stringify(payload), "utf8");
 }
+var FIRST_LAUNCH_PLUGINS_CARD_DISMISSED_KEY = "first-launch-plugins-card-dismissed";
+var THREAD_QUEUE_STATE_KEY = "thread-queue-state";
+function normalizeStoredQueuedMessage(value) {
+  const record = asRecord5(value);
+  if (!record) return null;
+  const id = typeof record.id === "string" ? record.id.trim() : "";
+  if (!id) return null;
+  const normalizeNamedPathItems = (items) => {
+    if (!Array.isArray(items)) return [];
+    return items.flatMap((item) => {
+      const itemRecord = asRecord5(item);
+      if (!itemRecord) return [];
+      const name = typeof itemRecord.name === "string" ? itemRecord.name.trim() : "";
+      const path = typeof itemRecord.path === "string" ? itemRecord.path.trim() : "";
+      return name && path ? [{ name, path }] : [];
+    });
+  };
+  const normalizeFileAttachments = (items) => {
+    if (!Array.isArray(items)) return [];
+    return items.flatMap((item) => {
+      const itemRecord = asRecord5(item);
+      if (!itemRecord) return [];
+      const label = typeof itemRecord.label === "string" ? itemRecord.label.trim() : "";
+      const path = typeof itemRecord.path === "string" ? itemRecord.path.trim() : "";
+      const fsPath = typeof itemRecord.fsPath === "string" ? itemRecord.fsPath.trim() : "";
+      return label && path && fsPath ? [{ label, path, fsPath }] : [];
+    });
+  };
+  return {
+    id,
+    text: typeof record.text === "string" ? record.text : "",
+    imageUrls: normalizeStringArray(record.imageUrls),
+    skills: normalizeNamedPathItems(record.skills),
+    fileAttachments: normalizeFileAttachments(record.fileAttachments),
+    collaborationMode: record.collaborationMode === "plan" ? "plan" : "default"
+  };
+}
+function normalizeThreadQueueState(value) {
+  const record = asRecord5(value);
+  if (!record) return {};
+  const state = {};
+  for (const [threadId, rawMessages] of Object.entries(record)) {
+    const normalizedThreadId = threadId.trim();
+    if (!normalizedThreadId || !Array.isArray(rawMessages)) continue;
+    const messages = rawMessages.flatMap((item) => {
+      const message = normalizeStoredQueuedMessage(item);
+      return message ? [message] : [];
+    });
+    if (messages.length > 0) {
+      state[normalizedThreadId] = messages;
+    }
+  }
+  return state;
+}
+async function readThreadQueueState() {
+  const statePath = getCodexGlobalStatePath();
+  try {
+    const raw = await readFile3(statePath, "utf8");
+    const payload = asRecord5(JSON.parse(raw)) ?? {};
+    return normalizeThreadQueueState(payload[THREAD_QUEUE_STATE_KEY]);
+  } catch {
+    return {};
+  }
+}
+async function writeThreadQueueState(nextState) {
+  const statePath = getCodexGlobalStatePath();
+  let payload = {};
+  try {
+    const raw = await readFile3(statePath, "utf8");
+    payload = asRecord5(JSON.parse(raw)) ?? {};
+  } catch {
+    payload = {};
+  }
+  const normalized = normalizeThreadQueueState(nextState);
+  if (Object.keys(normalized).length > 0) {
+    payload[THREAD_QUEUE_STATE_KEY] = normalized;
+  } else {
+    delete payload[THREAD_QUEUE_STATE_KEY];
+  }
+  await writeFile4(statePath, JSON.stringify(payload), "utf8");
+}
+async function readFirstLaunchPluginsCardDismissed() {
+  const statePath = getCodexGlobalStatePath();
+  try {
+    const raw = await readFile3(statePath, "utf8");
+    const payload = asRecord5(JSON.parse(raw)) ?? {};
+    return payload[FIRST_LAUNCH_PLUGINS_CARD_DISMISSED_KEY] === true;
+  } catch {
+    return false;
+  }
+}
+async function writeFirstLaunchPluginsCardDismissed(dismissed) {
+  const statePath = getCodexGlobalStatePath();
+  let payload = {};
+  try {
+    const raw = await readFile3(statePath, "utf8");
+    payload = asRecord5(JSON.parse(raw)) ?? {};
+  } catch {
+    payload = {};
+  }
+  payload[FIRST_LAUNCH_PLUGINS_CARD_DISMISSED_KEY] = dismissed === true;
+  await writeFile4(statePath, JSON.stringify(payload), "utf8");
+}
 function getSessionIndexFileSignature(stats) {
   return `${String(stats.mtimeMs)}:${String(stats.size)}`;
 }
@@ -6651,6 +7162,46 @@ async function proxyTranscribe(body, contentType, authToken, accountId) {
   }
   return result;
 }
+function parseConnectorLogoUrl(rawUrl) {
+  const trimmed = rawUrl.trim();
+  if (!trimmed.startsWith("connectors://")) return null;
+  const rest = trimmed.slice("connectors://".length);
+  const connectorId = (rest.split(/[/?#]/u)[0] ?? "").trim();
+  if (!connectorId) return null;
+  const query = rest.includes("?") ? rest.slice(rest.indexOf("?") + 1).split("#")[0] ?? "" : "";
+  const theme = new URLSearchParams(query).get("theme")?.toLowerCase() === "dark" ? "dark" : "light";
+  return { connectorId, theme };
+}
+async function fetchConnectorLogo(rawUrl) {
+  const parsed = parseConnectorLogoUrl(rawUrl);
+  if (!parsed) throw new Error("Unsupported connector logo URL");
+  const auth = await readCodexAuth();
+  if (!auth) throw new Error("No auth token available for connector logo");
+  const endpoint = `https://chatgpt.com/backend-api/aip/connectors/${encodeURIComponent(parsed.connectorId)}/logo?theme=${parsed.theme}`;
+  const response = await fetch(endpoint, {
+    headers: {
+      Authorization: `Bearer ${auth.accessToken}`,
+      originator: "Codex Desktop",
+      "User-Agent": `Codex Desktop/0.1.0 (${process.platform}; ${process.arch})`,
+      ...auth.accountId ? { "ChatGPT-Account-Id": auth.accountId } : {}
+    },
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!response.ok) throw new Error(`Connector logo fetch failed (${response.status})`);
+  const contentType = response.headers.get("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    const payload = asRecord5(await response.json());
+    const body = asRecord5(payload?.body);
+    const base64 = readNonEmptyString(body?.base64);
+    const nestedContentType = readNonEmptyString(body?.contentType) ?? readNonEmptyString(body?.content_type);
+    if (!base64 || !nestedContentType) throw new Error("Connector logo response was missing image data");
+    return { contentType: nestedContentType, body: Buffer.from(base64, "base64") };
+  }
+  return {
+    contentType: contentType || "image/png",
+    body: Buffer.from(await response.arrayBuffer())
+  };
+}
 var STREAM_EVENT_BUFFER_LIMIT = 400;
 var MERGEABLE_ITEM_TYPES = /* @__PURE__ */ new Set([
   "commandExecution",
@@ -7543,6 +8094,19 @@ function createCodexBridgeMiddleware() {
         setJson4(res, 200, terminalManager.getAvailability());
         return;
       }
+      if (req.method === "GET" && url.pathname === "/codex-api/thread-terminal/quick-commands") {
+        const cwd = url.searchParams.get("cwd")?.trim() ?? "";
+        if (!cwd) {
+          setJson4(res, 400, { error: "Missing cwd" });
+          return;
+        }
+        try {
+          setJson4(res, 200, { commands: await listTerminalQuickCommands(cwd) });
+        } catch (error) {
+          setJson4(res, 500, { error: getErrorMessage5(error, "Failed to load terminal quick commands") });
+        }
+        return;
+      }
       if (req.method === "POST" && url.pathname === "/codex-api/thread-terminal/attach") {
         const availability = terminalManager.getAvailability();
         if (!availability.available) {
@@ -7844,6 +8408,77 @@ function createCodexBridgeMiddleware() {
         res.end(upstream.body);
         return;
       }
+      if (req.method === "GET" && url.pathname === "/codex-api/composio/status") {
+        try {
+          setJson4(res, 200, await readComposioStatus());
+        } catch (error) {
+          setJson4(res, 500, { error: getErrorMessage5(error, "Failed to read Composio status") });
+        }
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/codex-api/composio/connectors") {
+        try {
+          const query = url.searchParams.get("query") ?? "";
+          const cursor = url.searchParams.get("cursor")?.trim() ?? null;
+          const limit = parseComposioLimit(url.searchParams.get("limit"));
+          setJson4(res, 200, await listComposioConnectors(query, cursor, limit));
+        } catch (error) {
+          setJson4(res, 500, { error: getErrorMessage5(error, "Failed to list Composio connectors") });
+        }
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/codex-api/composio/connector") {
+        try {
+          const slug = url.searchParams.get("slug") ?? "";
+          setJson4(res, 200, await readComposioConnectorDetail(slug));
+        } catch (error) {
+          setJson4(res, 500, { error: getErrorMessage5(error, "Failed to load Composio connector") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/composio/link") {
+        try {
+          const payload = asRecord5(await readJsonBody(req));
+          const slug = readNonEmptyString(payload?.slug);
+          setJson4(res, 200, await startComposioLink(slug));
+        } catch (error) {
+          setJson4(res, 500, { error: getErrorMessage5(error, "Failed to start Composio login") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/composio/login") {
+        try {
+          setJson4(res, 200, await startComposioLogin());
+        } catch (error) {
+          setJson4(res, 500, { error: getErrorMessage5(error, "Failed to start Composio CLI login") });
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/composio/install") {
+        try {
+          setJson4(res, 200, await installComposioCli());
+        } catch (error) {
+          setJson4(res, 500, { error: getErrorMessage5(error, "Failed to install Composio CLI") });
+        }
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/codex-api/connector-logo") {
+        const src = url.searchParams.get("src")?.trim() ?? "";
+        if (!src) {
+          setJson4(res, 400, { error: "Missing src" });
+          return;
+        }
+        try {
+          const logo = await fetchConnectorLogo(src);
+          res.statusCode = 200;
+          res.setHeader("Content-Type", logo.contentType);
+          res.setHeader("Cache-Control", "private, max-age=3600");
+          res.end(logo.body);
+        } catch (error) {
+          setJson4(res, 502, { error: getErrorMessage5(error, "Failed to fetch connector logo") });
+        }
+        return;
+      }
       if (req.method === "POST" && url.pathname === "/codex-api/server-requests/respond") {
         const payload = await readJsonBody(req);
         await appServer.respondToServerRequest(payload);
@@ -7925,21 +8560,13 @@ function createCodexBridgeMiddleware() {
         setJson4(res, 200, { data: state });
         return;
       }
-      if (req.method === "GET" && url.pathname === "/codex-api/home-directory") {
-        setJson4(res, 200, { data: { path: homedir5() } });
+      if (req.method === "GET" && url.pathname === "/codex-api/thread-queue-state") {
+        const state = await readThreadQueueState();
+        setJson4(res, 200, { data: state });
         return;
       }
-      if (req.method === "GET" && url.pathname === "/codex-api/github-trending") {
-        const sinceRaw = (url.searchParams.get("since") ?? "").trim().toLowerCase();
-        const since = sinceRaw === "weekly" ? "weekly" : sinceRaw === "monthly" ? "monthly" : "daily";
-        const limitRaw = Number.parseInt((url.searchParams.get("limit") ?? "6").trim(), 10);
-        const limit = Number.isFinite(limitRaw) ? Math.max(1, Math.min(10, limitRaw)) : 6;
-        try {
-          const data = await fetchGithubTrending(since, limit);
-          setJson4(res, 200, { data });
-        } catch (error) {
-          setJson4(res, 502, { error: getErrorMessage5(error, "Failed to fetch GitHub trending") });
-        }
+      if (req.method === "GET" && url.pathname === "/codex-api/home-directory") {
+        setJson4(res, 200, { data: { path: homedir5() } });
         return;
       }
       if (req.method === "POST" && url.pathname === "/codex-api/worktree/create") {
@@ -8201,6 +8828,17 @@ function createCodexBridgeMiddleware() {
         setJson4(res, 200, { ok: true });
         return;
       }
+      if (req.method === "PUT" && url.pathname === "/codex-api/thread-queue-state") {
+        const payload = await readJsonBody(req);
+        const record = asRecord5(payload);
+        if (!record) {
+          setJson4(res, 400, { error: "Invalid body: expected object" });
+          return;
+        }
+        await writeThreadQueueState(normalizeThreadQueueState(record));
+        setJson4(res, 200, { ok: true });
+        return;
+      }
       if (req.method === "POST" && url.pathname === "/codex-api/project-root") {
         const payload = asRecord5(await readJsonBody(req));
         const rawPath = typeof payload?.path === "string" ? payload.path.trim() : "";
@@ -8262,6 +8900,17 @@ function createCodexBridgeMiddleware() {
         setJson4(res, 200, { data: { path: normalizedPath } });
         return;
       }
+      if (req.method === "POST" && url.pathname === "/codex-api/projectless-thread-cwd") {
+        const payload = asRecord5(await readJsonBody(req));
+        const prompt = typeof payload?.prompt === "string" ? payload.prompt : null;
+        try {
+          const directory = await createProjectlessThreadDirectory(prompt);
+          setJson4(res, 200, { data: directory });
+        } catch (error) {
+          setJson4(res, 500, { error: error instanceof Error ? error.message : "Failed to create new chat folder" });
+        }
+        return;
+      }
       if (req.method === "GET" && url.pathname === "/codex-api/project-root-suggestion") {
         const basePath = url.searchParams.get("basePath")?.trim() ?? "";
         if (!basePath) {
@@ -8325,6 +8974,40 @@ function createCodexBridgeMiddleware() {
         }
         return;
       }
+      if (req.method === "GET" && url.pathname === "/codex-api/prompts") {
+        setJson4(res, 200, { data: await listComposerPrompts() });
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/codex-api/prompts") {
+        const payload = asRecord5(await readJsonBody(req));
+        const name = typeof payload?.name === "string" ? payload.name.trim() : "";
+        const content = typeof payload?.content === "string" ? payload.content : "";
+        if (!name || !content.trim()) {
+          setJson4(res, 400, { error: "Prompt name and content are required" });
+          return;
+        }
+        try {
+          const prompt = await createComposerPromptFile(name, content);
+          setJson4(res, 200, { data: prompt });
+        } catch (error) {
+          setJson4(res, 500, { error: getErrorMessage5(error, "Failed to create prompt") });
+        }
+        return;
+      }
+      if (req.method === "DELETE" && url.pathname === "/codex-api/prompts") {
+        const promptPath = url.searchParams.get("path")?.trim() ?? "";
+        if (!promptPath) {
+          setJson4(res, 400, { error: "Missing path" });
+          return;
+        }
+        try {
+          const removed = await removeComposerPromptFile(promptPath);
+          setJson4(res, 200, { data: { removed } });
+        } catch (error) {
+          setJson4(res, 400, { error: getErrorMessage5(error, "Failed to remove prompt") });
+        }
+        return;
+      }
       if (req.method === "GET" && url.pathname === "/codex-api/thread-titles") {
         const cache = await readMergedThreadTitleCache();
         setJson4(res, 200, { data: cache });
@@ -8335,6 +9018,11 @@ function createCodexBridgeMiddleware() {
         setJson4(res, 200, { data: { threadIds } });
         return;
       }
+      if (req.method === "GET" && url.pathname === "/codex-api/preferences/first-launch-plugins-card") {
+        const dismissed = await readFirstLaunchPluginsCardDismissed();
+        setJson4(res, 200, { data: { dismissed } });
+        return;
+      }
       if (req.method === "GET" && url.pathname === "/codex-api/thread-automations") {
         const automationsByThreadId = await listThreadHeartbeatAutomations();
         setJson4(res, 200, { data: automationsByThreadId });
@@ -8385,6 +9073,13 @@ function createCodexBridgeMiddleware() {
         setJson4(res, 200, { ok: true });
         return;
       }
+      if (req.method === "PUT" && url.pathname === "/codex-api/preferences/first-launch-plugins-card") {
+        const payload = asRecord5(await readJsonBody(req));
+        const dismissed = payload?.dismissed === true;
+        await writeFirstLaunchPluginsCardDismissed(dismissed);
+        setJson4(res, 200, { ok: true });
+        return;
+      }
       if (req.method === "PUT" && url.pathname === "/codex-api/thread-automation") {
         const payload = asRecord5(await readJsonBody(req));
         const threadId = typeof payload?.threadId === "string" ? payload.threadId.trim() : "";
@@ -8517,7 +9212,13 @@ data: ${JSON.stringify({ ok: true })}
 
 // src/server/authMiddleware.ts
 import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { existsSync as existsSync5, mkdirSync, readFileSync as readFileSync3, renameSync, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname3, join as join7 } from "path";
 var TOKEN_COOKIE = "portal_session";
+var SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var SESSION_STORE_FILE = "webui-auth-sessions.json";
+var MAX_PERSISTED_TOKENS = 128;
 function constantTimeCompare(a, b) {
   const bufA = Buffer.from(a);
   const bufB = Buffer.from(b);
@@ -8565,6 +9266,69 @@ function isTrustedTailscaleIPv6(remote) {
 function isTrustedTailscaleRemote(remote) {
   return isTrustedTailscaleIPv4(remote) || isTrustedTailscaleIPv6(remote);
 }
+function getCodexHomeDir4() {
+  const codexHome = process.env.CODEX_HOME?.trim();
+  return codexHome && codexHome.length > 0 ? codexHome : join7(homedir6(), ".codex");
+}
+function getSessionStorePath() {
+  return join7(getCodexHomeDir4(), SESSION_STORE_FILE);
+}
+function readPersistedSessions() {
+  const sessionStorePath = getSessionStorePath();
+  if (!existsSync5(sessionStorePath)) return /* @__PURE__ */ new Map();
+  try {
+    const raw = readFileSync3(sessionStorePath, "utf8");
+    const parsed = JSON.parse(raw);
+    const now = Date.now();
+    const sessions = /* @__PURE__ */ new Map();
+    for (const entry of parsed.tokens ?? []) {
+      const token = typeof entry?.value === "string" ? entry.value : "";
+      const expiresAt = typeof entry?.expiresAt === "number" ? entry.expiresAt : 0;
+      if (!token || !Number.isFinite(expiresAt) || expiresAt <= now) continue;
+      sessions.set(token, expiresAt);
+    }
+    return sessions;
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+function persistSessions(validTokens) {
+  const sessionStorePath = getSessionStorePath();
+  mkdirSync(dirname3(sessionStorePath), { recursive: true });
+  const tokens = Array.from(validTokens.entries()).sort((left, right) => right[1] - left[1]).slice(0, MAX_PERSISTED_TOKENS).map(([value, expiresAt]) => ({ value, expiresAt }));
+  const tmpPath = `${sessionStorePath}.tmp`;
+  writeFileSync2(tmpPath, `${JSON.stringify({ tokens }, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  renameSync(tmpPath, sessionStorePath);
+}
+function tryPersistSessions(validTokens) {
+  try {
+    persistSessions(validTokens);
+  } catch (error) {
+    console.warn("[auth] failed to persist login sessions:", error);
+  }
+}
+function pruneExpiredSessions(validTokens) {
+  const now = Date.now();
+  let changed = false;
+  for (const [token, expiresAt] of validTokens.entries()) {
+    if (expiresAt > now) continue;
+    validTokens.delete(token);
+    changed = true;
+  }
+  return changed;
+}
+function buildSessionCookie(token, expiresAt) {
+  const maxAgeSeconds = Math.max(0, Math.floor((expiresAt - Date.now()) / 1e3));
+  return [
+    `${TOKEN_COOKIE}=${token}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    `Max-Age=${String(maxAgeSeconds)}`,
+    `Expires=${new Date(expiresAt).toUTCString()}`
+  ].join("; ");
+}
 function isAuthorizedByRequestLike(remoteAddress, hostHeader, cookieHeader, validTokens) {
   const remote = remoteAddress ?? "";
   if (isLocalhostRemote(remote) && isLocalhostHost(hostHeader ?? "")) {
@@ -8575,7 +9339,9 @@ function isAuthorizedByRequestLike(remoteAddress, hostHeader, cookieHeader, vali
   }
   const cookies = parseCookies(cookieHeader);
   const token = cookies[TOKEN_COOKIE];
-  return Boolean(token && validTokens.has(token));
+  if (!token) return false;
+  const expiresAt = validTokens.get(token);
+  return typeof expiresAt === "number" && expiresAt > Date.now();
 }
 var LOGIN_PAGE_HTML = `<!DOCTYPE html>
 <html lang="en">
@@ -8619,8 +9385,14 @@ form.addEventListener('submit',async e=>{
 </body>
 </html>`;
 function createAuthSession(password) {
-  const validTokens = /* @__PURE__ */ new Set();
+  const validTokens = readPersistedSessions();
+  if (pruneExpiredSessions(validTokens)) {
+    tryPersistSessions(validTokens);
+  }
   const middleware = (req, res, next) => {
+    if (pruneExpiredSessions(validTokens)) {
+      tryPersistSessions(validTokens);
+    }
     if (isAuthorizedByRequestLike(req.socket.remoteAddress, req.headers.host, req.headers.cookie, validTokens)) {
       next();
       return;
@@ -8632,19 +9404,27 @@ function createAuthSession(password) {
         body += chunk;
       });
       req.on("end", () => {
+        let parsed;
+        try {
+          parsed = JSON.parse(body);
+        } catch {
+          res.status(400).json({ error: "Invalid request body" });
+          return;
+        }
+        const provided = typeof parsed.password === "string" ? parsed.password : "";
+        if (!constantTimeCompare(provided, password)) {
+          res.status(401).json({ error: "Invalid password" });
+          return;
+        }
         try {
-          const parsed = JSON.parse(body);
-          const provided = typeof parsed.password === "string" ? parsed.password : "";
-          if (!constantTimeCompare(provided, password)) {
-            res.status(401).json({ error: "Invalid password" });
-            return;
-          }
           const token = randomBytes2(32).toString("hex");
-          validTokens.add(token);
-          res.setHeader("Set-Cookie", `${TOKEN_COOKIE}=${token}; Path=/; HttpOnly; SameSite=Strict`);
+          const expiresAt = Date.now() + SESSION_TTL_MS;
+          validTokens.set(token, expiresAt);
+          tryPersistSessions(validTokens);
+          res.setHeader("Set-Cookie", buildSessionCookie(token, expiresAt));
           res.json({ ok: true });
         } catch {
-          res.status(400).json({ error: "Invalid request body" });
+          res.status(500).json({ error: "Failed to create login session" });
         }
       });
       return;
@@ -8653,8 +9433,10 @@ function createAuthSession(password) {
       const provided = req.path.slice("/password=".length);
       if (constantTimeCompare(provided, password)) {
         const token = randomBytes2(32).toString("hex");
-        validTokens.add(token);
-        res.setHeader("Set-Cookie", `${TOKEN_COOKIE}=${token}; Path=/; HttpOnly; SameSite=Strict`);
+        const expiresAt = Date.now() + SESSION_TTL_MS;
+        validTokens.set(token, expiresAt);
+        tryPersistSessions(validTokens);
+        res.setHeader("Set-Cookie", buildSessionCookie(token, expiresAt));
         res.redirect(302, "/");
         return;
       }
@@ -8669,7 +9451,7 @@ function createAuthSession(password) {
 }
 
 // src/server/localBrowseUi.ts
-import { dirname as dirname3, extname as extname2, join as join7 } from "path";
+import { dirname as dirname4, extname as extname2, join as join8 } from "path";
 import { open, readFile as readFile4, readdir as readdir3, stat as stat5 } from "fs/promises";
 var TEXT_EDITABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".txt",
@@ -8817,7 +9599,7 @@ function escapeForInlineScriptString(value) {
 async function getDirectoryItems(localPath) {
   const entries = await readdir3(localPath, { withFileTypes: true });
   const withMeta = await Promise.all(entries.map(async (entry) => {
-    const entryPath = join7(localPath, entry.name);
+    const entryPath = join8(localPath, entry.name);
     const entryStat = await stat5(entryPath);
     const editable = !entry.isDirectory() && await isTextEditableFile(entryPath);
     return {
@@ -8838,7 +9620,7 @@ async function getDirectoryItems(localPath) {
 function projectCreationTargetPath(parentPath, newProjectName) {
   const normalizedName = normalizeNewProjectName(newProjectName);
   if (!normalizedName) return "";
-  return join7(parentPath, normalizedName);
+  return join8(parentPath, normalizedName);
 }
 function projectCreationButtonLabel(newProjectName) {
   const normalizedName = normalizeNewProjectName(newProjectName);
@@ -8867,7 +9649,7 @@ async function getLocalDirectoryListing(localPath, options = {}) {
   const entries = await readdir3(localPath, { withFileTypes: true });
   const directories = entries.filter((entry) => entry.isDirectory()).map((entry) => ({
     name: entry.name,
-    path: join7(localPath, entry.name)
+    path: join8(localPath, entry.name)
   })).filter((entry) => options.showHidden === true || !isHiddenName(entry.name)).sort((a, b) => {
     const aHidden = isHiddenName(a.name);
     const bHidden = isHiddenName(b.name);
@@ -8876,14 +9658,14 @@ async function getLocalDirectoryListing(localPath, options = {}) {
   });
   return {
     path: localPath,
-    parentPath: dirname3(localPath),
+    parentPath: dirname4(localPath),
     entries: directories
   };
 }
 async function createDirectoryListingHtml(localPath, options) {
   const newProjectName = normalizeNewProjectName(options?.newProjectName ?? "");
   const items = await getDirectoryItems(localPath);
-  const parentPath = dirname3(localPath);
+  const parentPath = dirname4(localPath);
   const rows = items.map((item) => {
     const suffix = item.isDirectory ? "/" : "";
     const editAction = item.editable ? ` <a class="icon-btn" aria-label="Edit ${escapeHtml2(item.name)}" href="${escapeHtml2(toEditHref(item.path, newProjectName))}" title="Edit">\u270F\uFE0F</a>` : "";
@@ -8989,7 +9771,7 @@ async function createDirectoryListingHtml(localPath, options) {
 }
 async function createTextEditorHtml(localPath) {
   const content = await readFile4(localPath, "utf8");
-  const parentPath = dirname3(localPath);
+  const parentPath = dirname4(localPath);
   const language = languageForPath(localPath);
   const safeContentLiteral = escapeForInlineScriptString(content);
   return `<!doctype html>
@@ -9058,9 +9840,9 @@ async function createTextEditorHtml(localPath) {
 
 // src/server/httpServer.ts
 import { WebSocketServer } from "ws";
-var __dirname = dirname4(fileURLToPath(import.meta.url));
-var distDir = join8(__dirname, "..", "dist");
-var spaEntryFile = join8(distDir, "index.html");
+var __dirname = dirname5(fileURLToPath(import.meta.url));
+var distDir = join9(__dirname, "..", "dist");
+var spaEntryFile = join9(distDir, "index.html");
 var IMAGE_CONTENT_TYPES = {
   ".avif": "image/avif",
   ".bmp": "image/bmp",
@@ -9229,7 +10011,7 @@ function createServer(options = {}) {
       res.status(404).json({ error: "File not found." });
     }
   });
-  const hasFrontendAssets = existsSync4(spaEntryFile);
+  const hasFrontendAssets = existsSync6(spaEntryFile);
   if (hasFrontendAssets) {
     app.use(express.static(distDir));
   }
@@ -9299,26 +10081,26 @@ function generatePassword() {
 
 // src/cli/index.ts
 var program = new Command().name("codexui").description("Web interface for Codex app-server");
-var __dirname2 = dirname5(fileURLToPath2(import.meta.url));
+var __dirname2 = dirname6(fileURLToPath2(import.meta.url));
 var hasPromptedCloudflaredInstall = false;
 function getCodexHomePath() {
-  return process.env.CODEX_HOME?.trim() || join9(homedir6(), ".codex");
+  return process.env.CODEX_HOME?.trim() || join10(homedir7(), ".codex");
 }
 function getCloudflaredPromptMarkerPath() {
-  return join9(getCodexHomePath(), ".cloudflared-install-prompted");
+  return join10(getCodexHomePath(), ".cloudflared-install-prompted");
 }
 function hasPromptedCloudflaredInstallPersisted() {
-  return existsSync5(getCloudflaredPromptMarkerPath());
+  return existsSync7(getCloudflaredPromptMarkerPath());
 }
 async function persistCloudflaredInstallPrompted() {
   const codexHome = getCodexHomePath();
-  mkdirSync(codexHome, { recursive: true });
+  mkdirSync2(codexHome, { recursive: true });
   await writeFile6(getCloudflaredPromptMarkerPath(), `${Date.now()}
 `, "utf8");
 }
 async function readCliVersion() {
   try {
-    const packageJsonPath = join9(__dirname2, "..", "package.json");
+    const packageJsonPath = join10(__dirname2, "..", "package.json");
     const raw = await readFile5(packageJsonPath, "utf8");
     const parsed = JSON.parse(raw);
     return typeof parsed.version === "string" ? parsed.version : "unknown";
@@ -9343,8 +10125,8 @@ function resolveCloudflaredCommand() {
   if (canRunCommand("cloudflared", ["--version"])) {
     return "cloudflared";
   }
-  const localCandidate = join9(homedir6(), ".local", "bin", "cloudflared");
-  if (existsSync5(localCandidate) && canRunCommand(localCandidate, ["--version"])) {
+  const localCandidate = join10(homedir7(), ".local", "bin", "cloudflared");
+  if (existsSync7(localCandidate) && canRunCommand(localCandidate, ["--version"])) {
     return localCandidate;
   }
   return null;
@@ -9397,9 +10179,9 @@ async function ensureCloudflaredInstalledLinux() {
   if (!mappedArch) {
     throw new Error(`cloudflared auto-install is not supported for Linux architecture: ${process.arch}`);
   }
-  const userBinDir = join9(homedir6(), ".local", "bin");
-  mkdirSync(userBinDir, { recursive: true });
-  const destination = join9(userBinDir, "cloudflared");
+  const userBinDir = join10(homedir7(), ".local", "bin");
+  mkdirSync2(userBinDir, { recursive: true });
+  const destination = join10(userBinDir, "cloudflared");
   const downloadUrl = `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${mappedArch}`;
   console.log("\ncloudflared not found. Installing to ~/.local/bin...\n");
   await downloadFile(downloadUrl, destination);
@@ -9450,7 +10232,7 @@ async function resolveCloudflaredForTunnel() {
 }
 function hasCodexAuth() {
   const codexHome = getCodexHomePath();
-  return existsSync5(join9(codexHome, "auth.json"));
+  return existsSync7(join10(codexHome, "auth.json"));
 }
 function ensureCodexInstalled() {
   let codexCommand = resolveCodexCommand();
@@ -9640,7 +10422,7 @@ function listenWithFallback(server, startPort) {
 }
 function getCodexGlobalStatePath2() {
   const codexHome = getCodexHomePath();
-  return join9(codexHome, ".codex-global-state.json");
+  return join10(codexHome, ".codex-global-state.json");
 }
 function normalizeUniqueStrings(value) {
   if (!Array.isArray(value)) return [];