dsh-capability-panel 1.0.0

package/lib/index.js

@@ -0,0 +1,1458 @@
+import z from "@deepseek-ai/schemastery";
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+//#region src/stats.ts
+/**
+* Usage statistics: did the agent still reach for a capability AFTER the user
+* turned it off? That answer drives the panel's optimization direction, so it
+* must be measured, not guessed.
+*
+* Detection is pure (this module has no I/O): the host feeds every
+* `tools/result` observation through {@link classifyBlockedCall} and appends
+* the returned record to a JSONL log. Two blocked shapes exist:
+*
+* - skill: the `skill` loader tool is still registered (only the catalog entry
+*   is shadowed), so a blocked attempt fails INSIDE the tool with
+*   "not available for model invocation". The skill name rides the arguments.
+* - mcp: a restricted tool is invisible, so dispatch fails BEFORE the body
+*   with code UNKNOWN_TOOL. The tool name is the call name itself.
+*
+* Toggle operations are logged too (kind 'disable'/'enable') so later analysis
+* can correlate "turned off at T" with "attempted at T+n".
+*/
+/** Stable prefix of the guard's denial text, marking a hard call to a preset-layer tool the user turned off. */
+const GUARD_DENIAL_PREFIX = "capability-panel: tool disabled";
+/**
+* Classify one settled call against the session's CURRENT disabled sets.
+* Returns null for everything that is not a blocked attempt — including
+* unknown-tool failures for tools nobody disabled (genuine model typos).
+*/
+function classifyBlockedCall(call, disabledSkills, disabledToolNames) {
+	if (call.error === void 0) return null;
+	const sessionId = typeof call.agent?.id === "string" ? call.agent.id : null;
+	if (call.name === "skill") {
+		if (!(typeof call.error.message === "string" ? call.error.message : "").includes("not available for model invocation")) return null;
+		const args = call.arguments;
+		const skillName = args !== null && typeof args === "object" && typeof args.name === "string" ? args.name : null;
+		if (skillName === null || !disabledSkills.has(skillName)) return null;
+		return {
+			kind: "blocked-skill",
+			name: skillName,
+			sessionId
+		};
+	}
+	if (typeof call.name === "string" && disabledToolNames.has(call.name)) {
+		const message = typeof call.error.message === "string" ? call.error.message : "";
+		if (call.error.info?.code !== "UNKNOWN_TOOL" && !message.startsWith(GUARD_DENIAL_PREFIX)) return null;
+		return {
+			kind: "blocked-tool",
+			name: call.name,
+			sessionId
+		};
+	}
+	return null;
+}
+/** Aggregate a JSONL log into a name → blocked-attempt count map. */
+function aggregateBlocked(lines) {
+	const counts = {};
+	for (const line of lines) {
+		const trimmed = line.trim();
+		if (trimmed === "") continue;
+		let record;
+		try {
+			record = JSON.parse(trimmed);
+		} catch {
+			continue;
+		}
+		if (record.kind !== "blocked-skill" && record.kind !== "blocked-tool" && record.kind !== "blocked-mcp") continue;
+		if (typeof record.name !== "string") continue;
+		counts[record.name] = (counts[record.name] ?? 0) + 1;
+	}
+	return counts;
+}
+
+//#endregion
+//#region src/host/errors.ts
+var HttpError = class extends Error {
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+
+//#endregion
+//#region src/host/reserved.ts
+/**
+* `run_code` is the Code Mode transport the harness itself depends on. It must
+* stay reachable in every session, so it can never be switched off: the
+* settings route rejects the attempt with 409, the panels render its switch
+* disabled, and enforcement ignores a stored entry naming it. One constant
+* keeps the four of those from drifting apart.
+*/
+const RESERVED_TOOL = "run_code";
+
+//#endregion
+//#region src/host/capabilities.ts
+function renderDisabledNote(state) {
+	const lines = [];
+	if (state.skills.size > 0) lines.push(`- Skills: ${[...state.skills.keys()].join(", ")}`);
+	if (state.mcpServers.size > 0) lines.push(`- MCP servers: ${[...state.mcpServers.keys()].join(", ")}`);
+	if (state.mcpTools.size > 0) lines.push(`- MCP tools: ${[...state.mcpTools.keys()].join(", ")}`);
+	if (state.systemTools.size > 0) lines.push(`- System tools: ${[...state.systemTools.keys()].join(", ")}`);
+	if (lines.length === 0) return "";
+	return [
+		"The user has turned off the following capabilities for this session:",
+		...lines,
+		"Do not attempt to call them. If the user's request depends on one, say it is disabled and can be re-enabled from the Capability Panel."
+	].join("\n");
+}
+function createCapabilityController(ctx, appendStats, blockedCounts) {
+	const states = /* @__PURE__ */ new Map();
+	const stateFor = (sessionId) => {
+		let state = states.get(sessionId);
+		if (state === void 0) {
+			state = {
+				skills: /* @__PURE__ */ new Map(),
+				mcpServers: /* @__PURE__ */ new Map(),
+				mcpTools: /* @__PURE__ */ new Map(),
+				systemTools: /* @__PURE__ */ new Map(),
+				userToggled: /* @__PURE__ */ new Set()
+			};
+			states.set(sessionId, state);
+		}
+		return state;
+	};
+	const disabledToolNames = (state) => {
+		const names = new Set([...state.mcpTools.keys(), ...state.systemTools.keys()]);
+		for (const schema of state.mcpServers.size > 0 ? ctx.get("tools")?.schemas() ?? [] : []) {
+			if (typeof schema.name !== "string" || !schema.name.startsWith("mcp__")) continue;
+			const server = schema.name.slice(5, schema.name.indexOf("__", 5));
+			if (state.mcpServers.has(server)) names.add(schema.name);
+		}
+		return names;
+	};
+	ctx.on("system-prompt/assemble", async (_assembly, context, next) => {
+		const assembled = await next();
+		const sessionId = typeof context.agent?.id === "string" ? context.agent.id : null;
+		const state = sessionId === null ? void 0 : states.get(sessionId);
+		if (state === void 0 || state.systemTools.size === 0 || assembled.tools === void 0) return assembled;
+		return {
+			...assembled,
+			tools: assembled.tools.filter((tool) => !state.systemTools.has(String(tool.name)))
+		};
+	});
+	let guardRegistered = false;
+	const ensureGuard = () => {
+		if (guardRegistered) return;
+		const guardDispose = ctx.get("tools")?.guard?.((execution) => {
+			const sessionId = typeof execution.agent?.id === "string" ? execution.agent.id : null;
+			const state = sessionId === null ? void 0 : states.get(sessionId);
+			const name = typeof execution.name === "string" ? execution.name : null;
+			if (state === void 0 || name === null || !state.systemTools.has(name)) return void 0;
+			return `${GUARD_DENIAL_PREFIX} "${name}" (re-enable from the Capability Panel)`;
+		});
+		if (guardDispose === void 0) return;
+		guardRegistered = true;
+		ctx.effect(() => guardDispose, "capability-panel: tool guard");
+	};
+	ensureGuard();
+	ctx.on("tools/result", (exec, result) => {
+		const agent = exec.agent;
+		if (agent === void 0 || typeof agent.id !== "string") return;
+		const state = states.get(agent.id);
+		if (state === void 0) return;
+		const hit = classifyBlockedCall({
+			name: exec.name,
+			arguments: exec.arguments,
+			agent,
+			...result.isError && result.error !== void 0 ? { error: result.error } : {}
+		}, new Set(state.skills.keys()), disabledToolNames(state));
+		if (hit === null) return;
+		blockedCounts[hit.name] = (blockedCounts[hit.name] ?? 0) + 1;
+		appendStats({
+			ts: (/* @__PURE__ */ new Date()).toISOString(),
+			sessionId: agent.id,
+			kind: hit.kind,
+			name: hit.name
+		});
+	});
+	const ensurePromptNote = (agent, state) => {
+		if (state.noteDispose !== void 0) return;
+		const systemPrompt = agent.ctx?.get("systemPrompt");
+		if (systemPrompt === void 0) return;
+		state.noteDispose = systemPrompt.context({
+			name: "capability-panel:disabled-capabilities",
+			order: 900,
+			text: () => renderDisabledNote(state)
+		});
+	};
+	const getAgentTools = (sessionId) => {
+		const agent = ctx.get("agents")?.get(sessionId);
+		const tools = agent?.ctx?.get("tools");
+		if (agent === void 0) throw new HttpError(404, "session agent is not available");
+		if (tools === void 0) throw new HttpError(503, "session tools service is not available");
+		return {
+			agent,
+			tools
+		};
+	};
+	const setSkill = async (sessionId, name, enabled) => {
+		const state = stateFor(sessionId);
+		const existing = state.skills.get(name);
+		if (enabled && existing !== void 0) {
+			existing();
+			state.skills.delete(name);
+			return;
+		}
+		const agent = ctx.get("agents")?.get(sessionId);
+		const scopedSkills = agent?.ctx?.get("skills");
+		if (agent === void 0 || scopedSkills === void 0) throw new HttpError(agent === void 0 ? 404 : 503, agent === void 0 ? "session agent is not available" : "session skills service is not available");
+		if (enabled || existing !== void 0) return;
+		const skills = ctx.get("skills");
+		if (skills === void 0) throw new HttpError(503, "skills service unavailable");
+		const cwd = agent.session?.header?.cwd;
+		const original = await skills.get(name, {
+			...cwd === void 0 ? {} : { cwd },
+			scope: agent
+		});
+		if (original === void 0 || typeof original.name !== "string" || typeof original.description !== "string" || typeof original.content !== "string") throw new HttpError(404, `skill "${name}" is not available in this session`);
+		state.skills.set(name, scopedSkills.register({
+			name: original.name,
+			description: original.description,
+			content: original.content,
+			source: "custom",
+			provider: "capability-panel",
+			...original.resourceBase === void 0 ? {} : { resourceBase: original.resourceBase },
+			invocation: {
+				modelInvocable: false,
+				userInvocable: true
+			}
+		}));
+		ensurePromptNote(agent, state);
+	};
+	const setServer = (sessionId, server, enabled) => {
+		const state = stateFor(sessionId);
+		const existing = state.mcpServers.get(server);
+		if (enabled && existing !== void 0) {
+			existing();
+			state.mcpServers.delete(server);
+			return;
+		}
+		const { agent, tools } = getAgentTools(sessionId);
+		if (enabled || existing !== void 0) return;
+		const toolService = ctx.get("tools");
+		if (toolService === void 0) throw new HttpError(503, "tools service unavailable");
+		const prefix = `mcp__${server}__`;
+		const names = [...toolService.schemas()].map((schema) => schema.name).filter((name) => typeof name === "string" && name.startsWith(prefix));
+		if (names.length === 0) throw new HttpError(404, `MCP server "${server}" exposes no tools`);
+		state.mcpServers.set(server, tools.restrict({ deny: names }));
+		ensurePromptNote(agent, state);
+	};
+	const setTool = (sessionId, name, enabled, system) => {
+		const state = stateFor(sessionId);
+		const map = system ? state.systemTools : state.mcpTools;
+		const existing = map.get(name);
+		if (enabled && existing !== void 0) {
+			existing();
+			map.delete(name);
+			return;
+		}
+		if (system && name === RESERVED_TOOL) throw new HttpError(409, "run_code is the reserved Code Mode transport and cannot be restricted");
+		const { agent, tools } = getAgentTools(sessionId);
+		if (enabled || existing !== void 0) return;
+		const toolService = ctx.get("tools");
+		if (toolService === void 0) throw new HttpError(503, "tools service unavailable");
+		const globalNames = new Set([...toolService.schemas()].map((schema) => schema.name).filter((entry) => typeof entry === "string"));
+		const scopedNames = system ? new Set([...toolService.schemas(agent)].map((schema) => schema.name).filter((entry) => typeof entry === "string")) : globalNames;
+		if (!(system ? scopedNames.has(name) : globalNames.has(name) && name.startsWith("mcp__"))) throw new HttpError(404, `${system ? "system tool" : "MCP tool"} "${name}" is not available in this session`);
+		if (system) ensureGuard();
+		map.set(name, globalNames.has(name) ? tools.restrict({ deny: [name] }) : () => {});
+		ensurePromptNote(agent, state);
+	};
+	ctx.effect(() => () => {
+		for (const state of states.values()) {
+			for (const map of [
+				state.skills,
+				state.mcpServers,
+				state.mcpTools,
+				state.systemTools
+			]) for (const dispose of map.values()) dispose();
+			state.noteDispose?.();
+		}
+		states.clear();
+	}, "capability-panel: capability masks");
+	const seed = async (sessionId, defaults) => {
+		const agent = ctx.get("agents")?.get(sessionId);
+		if (agent === void 0) return;
+		let state = states.get(sessionId);
+		const ensureState = () => {
+			if (state === void 0) state = stateFor(sessionId);
+			return state;
+		};
+		let maskedAny = false;
+		const scopedTools = agent.ctx?.get("tools");
+		const toolsService = ctx.get("tools");
+		if (scopedTools !== void 0 && toolsService !== void 0) {
+			const globalNames = /* @__PURE__ */ new Set();
+			const scopedNames = /* @__PURE__ */ new Set();
+			for (const schema of toolsService.schemas()) if (typeof schema.name === "string") globalNames.add(schema.name);
+			for (const schema of toolsService.schemas(agent)) if (typeof schema.name === "string") scopedNames.add(schema.name);
+			for (const name of defaults.tools) {
+				if (!globalNames.has(name)) continue;
+				if (name.startsWith("mcp__")) {
+					if (state?.mcpTools.has(name) === true) continue;
+					ensureState().mcpTools.set(name, scopedTools.restrict({ deny: [name] }));
+					maskedAny = true;
+					continue;
+				}
+				if (name === RESERVED_TOOL || state?.systemTools.has(name) === true) continue;
+				if (!scopedNames.has(name)) continue;
+				ensureState().systemTools.set(name, scopedTools.restrict({ deny: [name] }));
+				ensureGuard();
+				maskedAny = true;
+			}
+		}
+		const scopedSkills = agent.ctx?.get("skills");
+		const skillsService = ctx.get("skills");
+		if (scopedSkills !== void 0 && skillsService !== void 0) {
+			const cwd = agent.session?.header?.cwd;
+			const lookup = {
+				...cwd === void 0 ? {} : { cwd },
+				scope: agent
+			};
+			const disposers = await Promise.all(defaults.skills.map(async (name) => {
+				if (state?.skills.has(name) === true) return void 0;
+				try {
+					const original = await skillsService.get(name, lookup);
+					if (original === void 0) return void 0;
+					if (typeof original.name !== "string" || typeof original.description !== "string") return void 0;
+					if (typeof original.content !== "string") return void 0;
+					return scopedSkills.register({
+						name: original.name,
+						description: original.description,
+						content: original.content,
+						source: "custom",
+						provider: "capability-panel",
+						...original.resourceBase === void 0 ? {} : { resourceBase: original.resourceBase },
+						invocation: {
+							modelInvocable: false,
+							userInvocable: true
+						}
+					});
+				} catch {
+					return;
+				}
+			}));
+			for (let i = 0; i < disposers.length; i += 1) {
+				const dispose = disposers[i];
+				const name = defaults.skills[i];
+				if (dispose !== void 0 && name !== void 0 && state?.skills.has(name) !== true) {
+					ensureState().skills.set(name, dispose);
+					maskedAny = true;
+				}
+			}
+		}
+		if (maskedAny) ensurePromptNote(agent, ensureState());
+	};
+	return {
+		states,
+		state: (sessionId) => states.get(sessionId),
+		seed,
+		async restore(sessionId, overrides) {
+			const groups = [
+				["skill", overrides.skills],
+				["mcp-server", overrides.mcpServers],
+				["mcp-tool", overrides.mcpTools],
+				["system-tool", overrides.systemTools]
+			];
+			for (const [kind, positions] of groups) for (const [name, enabled] of Object.entries(positions)) {
+				if (states.get(sessionId)?.userToggled.has(`${kind}:${name}`) === true) continue;
+				try {
+					if (kind === "skill") await setSkill(sessionId, name, enabled);
+					else if (kind === "mcp-server") setServer(sessionId, name, enabled);
+					else setTool(sessionId, name, enabled, kind === "system-tool");
+				} catch {}
+			}
+			const st = states.get(sessionId);
+			if (st !== void 0 && st.userToggled.size === 0 && st.skills.size === 0 && st.mcpServers.size === 0 && st.mcpTools.size === 0 && st.systemTools.size === 0) {
+				st.noteDispose?.();
+				delete st.noteDispose;
+				states.delete(sessionId);
+			}
+		},
+		async set(sessionId, kind, name, enabled) {
+			stateFor(sessionId).userToggled.add(`${kind}:${name}`);
+			if (kind === "skill") await setSkill(sessionId, name, enabled);
+			else if (kind === "mcp-server") setServer(sessionId, name, enabled);
+			else setTool(sessionId, name, enabled, kind === "system-tool");
+			appendStats({
+				ts: (/* @__PURE__ */ new Date()).toISOString(),
+				sessionId,
+				kind: enabled ? "enable" : "disable",
+				name: `${kind}:${name}`
+			});
+		}
+	};
+}
+
+//#endregion
+//#region src/host/preset-enforcement.ts
+/**
+* Applies stored capability positions to freshly created agents, in two
+* layers: the preset's stored defaults first, then the session's own recorded
+* toggles. The second layer is what survives a restart — a restored session
+* creates a new agent, and its session-bound overrides land on top of the
+* preset defaults, so the user's last word wins (including an explicit
+* re-enable of a preset default).
+*
+* This is deliberately NOT part of the HTTP controller: the listener has no
+* request, and living next to one is how it grew a settings schema, a write
+* queue, and two event subscriptions in a single file. Here it owns exactly
+* one job -- at agent/created, read both stored layers and seed them into the
+* session's capability state.
+*
+* Seeding into the session state (rather than registering private masks) is
+* the point: the session panel's enable path disposes whatever the state
+* holds, whichever layer put it there, so a stored position remains a
+* starting point the user can flip in the session instead of an invisible
+* wall. Session overrides are keyed by session id, so one session's switches
+* can never leak into another.
+*/
+function registerPresetEnforcement(ctx, capabilities, presetTools, sessionOverrides) {
+	/**
+	* Subscribe to `agent/created` so that NOTHING this plugin does can veto the
+	* agent. Cordis treats a synchronous listener failure as a veto and only
+	* reports a rejected promise, so both halves are contained: the synchronous
+	* prelude (reading settings, resolving services) is wrapped here, and the
+	* asynchronous body reports through the returned promise. Applying a stored
+	* preference is never worth costing the user their session.
+	*/
+	ctx.on("agent/created", ({ agent }) => {
+		try {
+			if (typeof agent.id !== "string") return void 0;
+			const sessionId = agent.id;
+			const presetId = ctx.get("agentPresets")?.composedPreset(agent.ctx);
+			const defaults = presetId === void 0 ? void 0 : presetTools.defaultsFor(presetId);
+			const hasDefaults = defaults !== void 0 && (defaults.tools.length > 0 || defaults.skills.length > 0);
+			const overrides = sessionOverrides.overridesFor(sessionId);
+			if (!hasDefaults && overrides === void 0) return void 0;
+			return (async () => {
+				if (hasDefaults && defaults !== void 0) await capabilities.seed(sessionId, defaults);
+				if (overrides !== void 0) await capabilities.restore(sessionId, overrides);
+			})();
+		} catch {
+			return;
+		}
+	});
+}
+
+//#endregion
+//#region src/host/settings-scope.ts
+const TOOLKIT_SETTINGS_NAMESPACE = "capability-panel";
+const SessionOverrideSchema = z.object({
+	skills: z.dict(z.boolean()).default({}),
+	mcpServers: z.dict(z.boolean()).default({}),
+	mcpTools: z.dict(z.boolean()).default({}),
+	systemTools: z.dict(z.boolean()).default({})
+});
+const ToolkitSettingsSchema = z.object({
+	presets: z.dict(z.array(z.string())).default({}),
+	presetSkills: z.dict(z.array(z.string())).default({}),
+	sessions: z.dict(SessionOverrideSchema).default({})
+});
+function createToolkitSettingsAccess(ctx) {
+	let scope;
+	let writeQueue = Promise.resolve();
+	return {
+		scope() {
+			if (scope === void 0) scope = ctx.get("settings")?.register(TOOLKIT_SETTINGS_NAMESPACE, ToolkitSettingsSchema, { applies: "live" });
+			return scope;
+		},
+		serialize(work) {
+			const next = writeQueue.then(work, work);
+			writeQueue = next.then(() => void 0, () => void 0);
+			return next;
+		}
+	};
+}
+
+//#endregion
+//#region src/load-state.ts
+/** Pull the skill name out of a `skill` tool call's stringified arguments. */
+function skillNameOf(args) {
+	if (typeof args !== "string") return null;
+	try {
+		const parsed = JSON.parse(args);
+		if (parsed !== null && typeof parsed === "object" && "name" in parsed) {
+			const name = parsed.name;
+			return typeof name === "string" && name !== "" ? name : null;
+		}
+	} catch {}
+	return null;
+}
+function collectLoadRecords(events) {
+	const out = [];
+	for (const event of events) {
+		if (event.type !== "tool/call") continue;
+		if (event.data?.name !== "skill") continue;
+		const skillName = skillNameOf(event.data.arguments);
+		if (skillName === null) continue;
+		const seq = event.seq;
+		if (typeof seq !== "number") continue;
+		out.push({
+			seq,
+			skillName,
+			callId: event.data.callId ?? ""
+		});
+	}
+	return out;
+}
+/**
+* Map a tool result's pairing callId to its seq.
+*
+* Verified against real logs: `tool/result` events carry no
+* top-level callId; the pairing lives at `data.message.source.callId` and
+* matches the call's `data.callId` exactly.
+*
+* Last write wins on purpose: the middle-pruner appends a stub `tool/result`
+* carrying the SAME callId and a replace surfaceOp over the original's seq
+* (verified against a real compacted session), so the callId resolves to the
+* stub — the node whose fold verdict actually tracks the surface position.
+*/
+function indexToolResultSeqs(events) {
+	const out = /* @__PURE__ */ new Map();
+	for (const event of events) {
+		if (event.type !== "tool/result") continue;
+		const callId = event.data?.message?.source?.callId;
+		const seq = event.seq;
+		if (typeof callId !== "string" || callId === "" || typeof seq !== "number") continue;
+		out.set(callId, seq);
+	}
+	return out;
+}
+/**
+* The load seqs whose skill content is gone from the model surface.
+*
+* A `tool/call` never joins the surface itself — SURFACE_EVENT_TYPES in
+* dsh-session is exactly { user/message, assistant/message, tool/result }, and
+* real skill calls carry `surfaceOp: null`. What the model actually sees of a
+* skill is its tool RESULT (a surface node), so eviction keys on the paired
+* result's surface membership, not on the call's position.
+*
+* `surfaceSeqs` is the live session's CURRENT surface (`session.surface.nodes`),
+* which the session maintains incrementally — reading it is O(1), no log fold
+* is ever run for this panel. A paired result seq absent from that set was
+* displaced by a prune stub's or a summary's `replace` op, i.e. shadowed.
+*
+* A load with no paired result is in flight or its result never landed; it is
+* NOT counted as shadowed, so it reports `loaded` — the honest reading of "the
+* model is about to see it".
+*/
+function shadowedLoadSeqs(loads, resultSeqByCallId, surfaceSeqs) {
+	const out = /* @__PURE__ */ new Set();
+	for (const load of loads) {
+		const resultSeq = resultSeqByCallId.get(load.callId);
+		if (resultSeq === void 0) continue;
+		if (!surfaceSeqs.has(resultSeq)) out.add(load.seq);
+	}
+	return out;
+}
+/**
+* Substring of dsh-compaction-tool-result-pruner's PRUNE_MARKER. Matching on
+* the bracketed phrase (without the surrounding newlines) keeps the check
+* robust to marker framing changes across pruner versions.
+*/
+const PRUNE_MARKER_TEXT = "[... tool result middle pruned ...]";
+function textBlocksOf(event) {
+	const content = event.data?.message?.content;
+	if (!Array.isArray(content)) return [];
+	const out = [];
+	const walk = (blocks) => {
+		for (const block of blocks) {
+			if (block === null || typeof block !== "object") continue;
+			const record = block;
+			if (record.type === "text" && typeof record.text === "string") out.push(record.text);
+			else if (Array.isArray(record.content)) walk(record.content);
+		}
+	};
+	walk(content);
+	return out;
+}
+/**
+* The load seqs whose paired tool result sits on the surface TRUNCATED —
+* head and tail visible, middle replaced by the pruner's marker. The model
+* partially sees these skills, so they read as their own state rather than
+* either extreme. Only surface-resident results are inspected; a shadowed
+* result is already reported by shadowedLoadSeqs and its content is
+* irrelevant to the model now.
+*/
+function prunedLoadSeqs(loads, resultSeqByCallId, surfaceSeqs, events) {
+	const prunedResults = /* @__PURE__ */ new Set();
+	for (const event of events) {
+		if (event.type !== "tool/result") continue;
+		const seq = event.seq;
+		if (typeof seq !== "number" || !surfaceSeqs.has(seq)) continue;
+		if (textBlocksOf(event).some((text) => text.includes(PRUNE_MARKER_TEXT))) prunedResults.add(seq);
+	}
+	const out = /* @__PURE__ */ new Set();
+	for (const load of loads) {
+		const resultSeq = resultSeqByCallId.get(load.callId);
+		if (resultSeq !== void 0 && prunedResults.has(resultSeq)) out.add(load.seq);
+	}
+	return out;
+}
+/**
+* Decide each skill's state.
+*
+* `shadowedSeqs` holds LOAD seqs whose paired tool result is absent from the
+* current surface (see shadowedLoadSeqs for why the result, not the call,
+* carries the verdict); `prunedSeqs` holds load seqs whose result survives on
+* the surface with its middle truncated. Do NOT re-derive either from
+* replacement ranges here: after a replacement lands, a high-seq summary node
+* sits at the shadowed range's *position*, so surface order stops tracking
+* seq order and a numeric `start <= seq <= end` test silently misjudges later
+* compactions.
+*
+* Verified against real data: the middle-pruner had replaced the lark-shared /
+* lark-im / lark-event results with stubs (those now read `pruned`), and a
+* later full-history compaction (one replace over [7..16114]) shadowed those
+* stubs plus the find-skills / git-worktree-discipline results (those read
+* `evicted`).
+*/
+function decideStates(available, loads, shadowedSeqs, disabledSkills = /* @__PURE__ */ new Set(), prunedSeqs = /* @__PURE__ */ new Set()) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const record of loads) {
+		const bucket = byName.get(record.skillName);
+		if (bucket === void 0) byName.set(record.skillName, [record]);
+		else bucket.push(record);
+	}
+	return available.map(({ name, description, masked }) => {
+		const records = byName.get(name) ?? [];
+		let state = "unloaded";
+		if (records.length > 0) {
+			const current = records.filter((r) => !shadowedSeqs.has(r.seq));
+			if (current.length === 0) state = "evicted";
+			else state = current.some((r) => !prunedSeqs.has(r.seq)) ? "loaded" : "pruned";
+		}
+		return {
+			name,
+			...description === void 0 ? {} : { description },
+			state,
+			enabled: !disabledSkills.has(name) && masked !== true,
+			loadCount: records.length
+		};
+	});
+}
+/** Group MCP tools by server: `mcp__<server>__<tool>`. */
+function groupMcpTools(toolNames) {
+	const byServer = /* @__PURE__ */ new Map();
+	for (const raw of toolNames) {
+		if (!raw.startsWith("mcp__")) continue;
+		const rest = raw.slice(5);
+		const cut = rest.indexOf("__");
+		if (cut <= 0) continue;
+		const server = rest.slice(0, cut);
+		const tool = rest.slice(cut + 2);
+		if (tool === "") continue;
+		const bucket = byServer.get(server);
+		if (bucket === void 0) byServer.set(server, [tool]);
+		else bucket.push(tool);
+	}
+	return [...byServer.entries()].map(([server, tools]) => ({
+		server,
+		tools: tools.sort()
+	})).sort((a, b) => a.server.localeCompare(b.server));
+}
+
+//#endregion
+//#region src/host/preset-tools.ts
+function requireService(service, message) {
+	if (service === void 0) throw new HttpError(503, message);
+	return service;
+}
+function toolSummaries(tools, scope) {
+	const entries = /* @__PURE__ */ new Map();
+	for (const schema of tools.schemas(scope)) {
+		if (typeof schema.name !== "string" || schema.name === "" || entries.has(schema.name)) continue;
+		entries.set(schema.name, {
+			name: schema.name,
+			...typeof schema.description === "string" ? { description: schema.description } : {}
+		});
+	}
+	return [...entries.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+* Read the skills one preset can see, marking those that came from the reading
+* process's project root.
+*
+* The panel has no agent and therefore no session cwd, so it reports what THIS
+* workspace would contribute. A project skill is marked rather than dropped:
+* hiding it would silently shorten the list, while marking it says plainly
+* that a session opened elsewhere will not see the row.
+*/
+async function presetSkillRows(skills, scope, disabled, cwd) {
+	const seen = /* @__PURE__ */ new Map();
+	const add = (summaries, project) => {
+		for (const summary of summaries) {
+			if (typeof summary.name !== "string" || summary.name === "" || seen.has(summary.name)) continue;
+			const description = typeof summary.description === "string" ? summary.description : void 0;
+			seen.set(summary.name, {
+				name: summary.name,
+				...description === void 0 ? {} : { description },
+				enabled: !disabled.has(summary.name),
+				...project ? { project: true } : {}
+			});
+		}
+	};
+	add(await skills.list({ scope }), false);
+	add(await skills.list({
+		scope,
+		cwd
+	}), true);
+	return [...seen.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+async function presetAndTools(agentPresets, tools, presetId) {
+	const preset = (await agentPresets.list()).find((entry) => entry.id === presetId);
+	if (preset === void 0) throw new HttpError(404, `preset "${presetId}" is not available`);
+	if (preset.broken !== void 0) throw new HttpError(409, `preset "${presetId}" is broken: ${preset.broken}`);
+	try {
+		return {
+			preset,
+			tools: toolSummaries(tools, await agentPresets.standingKeyFor(presetId))
+		};
+	} catch (error) {
+		throw new HttpError(503, `preset "${presetId}" tools are unavailable: ${errorMessage(error)}`);
+	}
+}
+function createPresetToolController(ctx, access) {
+	const settingsScope = () => access.scope();
+	const services = () => ({
+		agentPresets: requireService(ctx.get("agentPresets"), "agentPresets service unavailable"),
+		tools: requireService(ctx.get("tools"), "tools service unavailable"),
+		settings: requireService(settingsScope(), "settings service unavailable")
+	});
+	const list = async () => {
+		const { agentPresets, tools, settings: settingsScope$1 } = services();
+		const stored = settingsScope$1.get();
+		const configured = stored.presets;
+		const skills = ctx.get("skills");
+		const cwd = process.cwd();
+		const presets = await agentPresets.list();
+		return {
+			presets: await Promise.all(presets.map(async (preset) => {
+				let entries = [];
+				let skillRows = [];
+				if (preset.broken === void 0) {
+					let scope;
+					try {
+						scope = await agentPresets.standingKeyFor(preset.id);
+						entries = toolSummaries(tools, scope);
+					} catch (error) {
+						throw new HttpError(503, `preset "${preset.id}" tools are unavailable: ${errorMessage(error)}`);
+					}
+					if (skills !== void 0) {
+						const disabledSkills = new Set(stored.presetSkills[preset.id] ?? []);
+						try {
+							skillRows = await presetSkillRows(skills, scope, disabledSkills, cwd);
+						} catch (error) {
+							throw new HttpError(503, `preset "${preset.id}" skills are unavailable: ${errorMessage(error)}`);
+						}
+					}
+				}
+				const disabled = new Set(configured[preset.id] ?? []);
+				const byName = new Map(entries.map((entry) => [entry.name, entry]));
+				const row = (name, label) => {
+					const description = byName.get(name)?.description;
+					return {
+						name,
+						label,
+						...description === void 0 ? {} : { description },
+						enabled: name === RESERVED_TOOL || !disabled.has(name),
+						...name === RESERVED_TOOL ? { reserved: true } : {}
+					};
+				};
+				const mcp = groupMcpTools(entries.map((entry) => entry.name)).map((group) => {
+					const tools$1 = group.tools.map((tool) => row(`mcp__${group.server}__${tool}`, tool));
+					return {
+						server: group.server,
+						tools: tools$1,
+						enabled: tools$1.some((tool) => tool.enabled)
+					};
+				});
+				const systemTools = entries.filter((entry) => !entry.name.startsWith("mcp__")).map((entry) => row(entry.name, entry.name));
+				return {
+					id: preset.id,
+					name: preset.name ?? preset.id,
+					trust: preset.trust,
+					...preset.description === void 0 ? {} : { description: preset.description },
+					...preset.broken === void 0 ? {} : { broken: preset.broken },
+					skills: skillRows,
+					mcp,
+					systemTools
+				};
+			})),
+			writable: ctx.get("settings")?.writable === true
+		};
+	};
+	/** Persist one preset's disabled set for one registry, then re-read. */
+	const persist = (presetId, settingsScope$1, disabled, registry = "presets") => access.serialize(async () => {
+		const stored = settingsScope$1.get();
+		const prune = (map) => Object.fromEntries(Object.entries(map).filter(([, value]) => value.length > 0));
+		const next = prune({
+			...stored[registry],
+			[presetId]: [...disabled].sort()
+		});
+		const presets = registry === "presets" ? next : prune(stored.presets);
+		const presetSkills = registry === "presetSkills" ? next : prune(stored.presetSkills);
+		await settingsScope$1.replace({
+			presets,
+			presetSkills,
+			sessions: stored.sessions
+		});
+		return list();
+	});
+	return {
+		defaultsFor(presetId) {
+			let stored;
+			try {
+				const settings = settingsScope();
+				if (settings === void 0) return void 0;
+				stored = settings.get();
+			} catch {
+				return;
+			}
+			return {
+				tools: (stored.presets[presetId] ?? []).filter((name) => name !== RESERVED_TOOL),
+				skills: stored.presetSkills[presetId] ?? []
+			};
+		},
+		list,
+		async set(presetId, name, enabled) {
+			if (name === RESERVED_TOOL && !enabled) throw new HttpError(409, "run_code is the reserved Code Mode transport and cannot be restricted");
+			const { agentPresets, tools, settings: settingsScope$1 } = services();
+			const { tools: available } = await presetAndTools(agentPresets, tools, presetId);
+			if (!available.some((tool) => tool.name === name)) throw new HttpError(404, `tool "${name}" is not available in preset "${presetId}"`);
+			const disabled = new Set(settingsScope$1.get().presets[presetId] ?? []);
+			if (enabled) disabled.delete(name);
+			else disabled.add(name);
+			return persist(presetId, settingsScope$1, disabled);
+		},
+		async setServer(presetId, server, enabled) {
+			const { agentPresets, tools, settings: settingsScope$1 } = services();
+			const { tools: available } = await presetAndTools(agentPresets, tools, presetId);
+			const prefix = `mcp__${server}__`;
+			const names = available.map((tool) => tool.name).filter((name) => name.startsWith(prefix));
+			if (names.length === 0) throw new HttpError(404, `MCP server "${server}" is not available in preset "${presetId}"`);
+			const disabled = new Set(settingsScope$1.get().presets[presetId] ?? []);
+			for (const name of names) if (enabled) disabled.delete(name);
+			else disabled.add(name);
+			return persist(presetId, settingsScope$1, disabled);
+		},
+		async setSkill(presetId, name, enabled) {
+			const { agentPresets, settings: settingsScope$1 } = services();
+			const skills = requireService(ctx.get("skills"), "skills service unavailable");
+			const preset = (await agentPresets.list()).find((entry) => entry.id === presetId);
+			if (preset === void 0) throw new HttpError(404, `preset "${presetId}" is not available`);
+			if (preset.broken !== void 0) throw new HttpError(409, `preset "${presetId}" is broken: ${preset.broken}`);
+			let visible;
+			try {
+				visible = await presetSkillRows(skills, await agentPresets.standingKeyFor(presetId), /* @__PURE__ */ new Set(), process.cwd());
+			} catch (error) {
+				throw new HttpError(503, `preset "${presetId}" skills are unavailable: ${errorMessage(error)}`);
+			}
+			if (!visible.some((skill) => skill.name === name)) throw new HttpError(404, `skill "${name}" is not available in preset "${presetId}"`);
+			const disabled = new Set(settingsScope$1.get().presetSkills[presetId] ?? []);
+			if (enabled) disabled.delete(name);
+			else disabled.add(name);
+			return persist(presetId, settingsScope$1, disabled, "presetSkills");
+		}
+	};
+}
+
+//#endregion
+//#region src/loopback.ts
+const LOOPBACK_ADDRS = new Set([
+	"127.0.0.1",
+	"::1",
+	"::ffff:127.0.0.1"
+]);
+/**
+* Loopback-only guard.
+*
+* The connection's peer address is the only trustworthy evidence, and it is the
+* only one that still holds when the host binds to a LAN interface
+* (`--host` / `--trusted-host`). The Host and Origin headers are set by the
+* caller, so they are a fallback used only when the socket is unavailable —
+* with neither present, this fails closed.
+*/
+function isLoopback(req) {
+	const addr = req.socket?.remoteAddress;
+	if (typeof addr === "string") return LOOPBACK_ADDRS.has(addr);
+	const originHeader = req.headers["origin"];
+	const origin = typeof originHeader === "string" ? originHeader : "";
+	if (origin === "") {
+		const hostHeader = req.headers["host"];
+		const host = typeof hostHeader === "string" ? hostHeader : "";
+		return /^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/.test(host);
+	}
+	return /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/.test(origin);
+}
+
+//#endregion
+//#region src/host/catalog.ts
+const EMPTY_STATE = {
+	skills: /* @__PURE__ */ new Map(),
+	mcpServers: /* @__PURE__ */ new Map(),
+	mcpTools: /* @__PURE__ */ new Map(),
+	systemTools: /* @__PURE__ */ new Map(),
+	userToggled: /* @__PURE__ */ new Set()
+};
+async function readAvailable(services, sessionId, degraded) {
+	const skills = services.get("skills");
+	if (skills === void 0) {
+		degraded.push("skills service unavailable");
+		return [];
+	}
+	try {
+		const agents = services.get("agents");
+		if (agents === void 0) {
+			degraded.push("agents service unavailable: session skill view cannot be determined");
+			return [];
+		}
+		const agent = agents.get(sessionId);
+		if (agent === void 0) {
+			degraded.push(`session agent "${sessionId}" unavailable: session skill view cannot be determined`);
+			return [];
+		}
+		const cwd = agent.session?.header?.cwd;
+		const list = await skills.list({
+			...cwd === void 0 ? {} : { cwd },
+			scope: agent
+		});
+		const out = [];
+		const seen = /* @__PURE__ */ new Map();
+		for (const item of list) {
+			if (typeof item.name !== "string" || item.name === "") continue;
+			const masked = item.invocation?.modelInvocable === false;
+			const existing = seen.get(item.name);
+			if (existing !== void 0) {
+				if (masked) existing.masked = true;
+				continue;
+			}
+			const description = typeof item.description === "string" ? item.description : void 0;
+			const row = {
+				name: item.name,
+				...description === void 0 ? {} : { description },
+				...masked ? { masked: true } : {}
+			};
+			seen.set(item.name, row);
+			out.push(row);
+		}
+		return out;
+	} catch (error) {
+		degraded.push(`skills read failed: ${error instanceof Error ? error.message : String(error)}`);
+		return [];
+	}
+}
+/**
+* Read load facts off the LIVE session's in-memory log — the same object the
+* agent loop itself reads to assemble the next request.
+*
+* This used to go through `sessionQuery.readSession` + `listEvents`, which are
+* built for cross-session/cold reads: each call structuredClones the ENTIRE
+* event log, `readSession` additionally replay-validates it via Session.create,
+* and a write landing between the two parallel reads forced a whole second
+* round. On a long session (60k events / tens of MB) that meant four full-log
+* clones plus two full replays of synchronous CPU work on every panel open —
+* blocking the Node event loop and freezing the GUI served by the same process.
+*
+* The live session needs none of that: `snapshotEvents()` hands back borrowed
+* references (zero-copy), and `surface.nodes` is maintained incrementally as
+* events land, so "what the model sees right now" is an O(1) membership test.
+* Scanning references for the few `skill` tool calls costs microseconds even
+* on the longest log. Both reads happen in one synchronous tick, so the view
+* is always self-consistent — no cross-read race, no retry loop.
+*
+* A session without a live in-memory view (e.g. restored but not yet attached)
+* degrades honestly instead of paying for a cold-log read the panel never
+* asked for.
+*/
+function readLogFacts(services, sessionId, degraded) {
+	const empty = {
+		loads: [],
+		shadowed: /* @__PURE__ */ new Set(),
+		pruned: /* @__PURE__ */ new Set()
+	};
+	try {
+		const session = services.get("agents")?.get(sessionId)?.session;
+		const nodes = session?.surface?.nodes;
+		if (session === void 0 || typeof session.snapshotEvents !== "function" || !Array.isArray(nodes)) {
+			degraded.push("live session view unavailable: load states cannot be determined");
+			return empty;
+		}
+		const events = session.snapshotEvents();
+		if (!Array.isArray(events)) {
+			degraded.push("snapshotEvents() returned an unexpected shape; cannot read skill loads");
+			return empty;
+		}
+		const surfaceSeqs = /* @__PURE__ */ new Set();
+		for (const seq of nodes) if (typeof seq === "number") surfaceSeqs.add(seq);
+		const loads = collectLoadRecords(events);
+		const resultSeqs = indexToolResultSeqs(events);
+		return {
+			loads,
+			shadowed: shadowedLoadSeqs(loads, resultSeqs, surfaceSeqs),
+			pruned: prunedLoadSeqs(loads, resultSeqs, surfaceSeqs, events)
+		};
+	} catch (error) {
+		degraded.push(`event read failed: ${error instanceof Error ? error.message : String(error)}`);
+		return empty;
+	}
+}
+function readMcp(services, degraded, disabledServers, disabledTools) {
+	const tools = services.get("tools");
+	if (tools === void 0) {
+		degraded.push("tools service unavailable");
+		return [];
+	}
+	try {
+		const names = [];
+		const descriptions = /* @__PURE__ */ new Map();
+		for (const schema of tools.schemas()) {
+			if (typeof schema.name !== "string") continue;
+			names.push(schema.name);
+			if (typeof schema.description === "string" && schema.description !== "") descriptions.set(schema.name, schema.description);
+		}
+		return groupMcpTools(names).map((group) => {
+			const enabled = !disabledServers.has(group.server);
+			const entries = group.tools.map((tool) => {
+				const name = `mcp__${group.server}__${tool}`;
+				const description = descriptions.get(name);
+				return {
+					name,
+					label: tool,
+					...description === void 0 ? {} : { description },
+					enabled: enabled && !disabledTools.has(name)
+				};
+			});
+			return {
+				server: group.server,
+				tools: entries,
+				enabled
+			};
+		});
+	} catch (error) {
+		degraded.push(`tool read failed: ${error instanceof Error ? error.message : String(error)}`);
+		return [];
+	}
+}
+function readSystemTools(services, degraded, disabledTools, agent) {
+	const tools = services.get("tools");
+	if (tools === void 0) {
+		if (!degraded.includes("tools service unavailable")) degraded.push("tools service unavailable");
+		return [];
+	}
+	try {
+		let reachable;
+		if (agent !== void 0) {
+			reachable = /* @__PURE__ */ new Set();
+			for (const schema of tools.schemas(agent)) if (typeof schema.name === "string") reachable.add(schema.name);
+		}
+		const byName = /* @__PURE__ */ new Map();
+		const collect = (scope) => {
+			for (const schema of tools.schemas(scope)) {
+				if (typeof schema.name !== "string" || schema.name.startsWith("mcp__") || byName.has(schema.name)) continue;
+				const description = typeof schema.description === "string" && schema.description !== "" ? schema.description : void 0;
+				byName.set(schema.name, {
+					name: schema.name,
+					label: schema.name,
+					...description === void 0 ? {} : { description },
+					enabled: !disabledTools.has(schema.name) && (reachable === void 0 || reachable.has(schema.name)),
+					...schema.name === RESERVED_TOOL ? { reserved: true } : {}
+				});
+			}
+		};
+		collect(void 0);
+		if (agent !== void 0) collect(agent);
+		return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+	} catch (error) {
+		degraded.push(`tool read failed: ${error instanceof Error ? error.message : String(error)}`);
+		return [];
+	}
+}
+async function buildPayload(services, sessionId, capabilityState = EMPTY_STATE, blocked = {}) {
+	const degraded = [];
+	const disabledSkills = new Set(capabilityState.skills.keys());
+	const disabledServers = new Set(capabilityState.mcpServers.keys());
+	const disabledTools = new Set(capabilityState.mcpTools.keys());
+	const disabledSystem = new Set(capabilityState.systemTools.keys());
+	if (sessionId === null) return {
+		sessionId: null,
+		skills: [],
+		mcp: readMcp(services, degraded, disabledServers, disabledTools),
+		systemTools: readSystemTools(services, degraded, disabledSystem),
+		blocked,
+		...degraded.length > 0 ? { degraded } : {}
+	};
+	const agent = services.get("agents")?.get(sessionId);
+	const available = await readAvailable(services, sessionId, degraded);
+	const logFacts = readLogFacts(services, sessionId, degraded);
+	return {
+		sessionId,
+		skills: decideStates(available, logFacts.loads, logFacts.shadowed, disabledSkills, logFacts.pruned),
+		mcp: readMcp(services, degraded, disabledServers, disabledTools),
+		systemTools: readSystemTools(services, degraded, disabledSystem, agent),
+		blocked,
+		...degraded.length > 0 ? { degraded } : {}
+	};
+}
+
+//#endregion
+//#region src/host/route.ts
+const ROUTE = "/api/capability-panel";
+const KINDS = [
+	"skill",
+	"mcp-server",
+	"mcp-tool",
+	"system-tool"
+];
+var ClientRequestError = class extends HttpError {
+	constructor(message, status = 400) {
+		super(status, message);
+	}
+};
+function readRequestBody(req) {
+	return new Promise((resolve, reject) => {
+		if (req.on === void 0) {
+			reject(new ClientRequestError("request body stream unavailable"));
+			return;
+		}
+		let body = "";
+		let settled = false;
+		const fail = (error) => {
+			if (settled) return;
+			settled = true;
+			reject(error instanceof ClientRequestError ? error : new Error(String(error)));
+		};
+		req.on("data", (chunk) => {
+			if (settled) return;
+			body += String(chunk);
+			if (body.length > 16384) fail(new ClientRequestError("request body too large", 413));
+		});
+		req.on("end", () => {
+			if (settled) return;
+			settled = true;
+			try {
+				resolve(body === "" ? {} : JSON.parse(body));
+			} catch {
+				reject(new ClientRequestError("invalid JSON body"));
+			}
+		});
+		req.on("error", fail);
+	});
+}
+/**
+* Every response here reflects live process state, so `no-store` is the
+* default and opting out is explicit. The flag reads as what it does: the
+* previous spelling was `cache = true` on the ERROR branch, which left a
+* transient 503 as the only cacheable response the route produced.
+*/
+function json(res, status, body, allowCaching = false) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		...allowCaching ? {} : { "cache-control": "no-store" }
+	});
+	res.end(JSON.stringify(body));
+}
+/**
+* `kind` mirrors the session route's toggle shape: one tool, or a whole MCP
+* server in a single write.
+*/
+function validatePresetToggle(body) {
+	if (body === null || typeof body !== "object") throw new ClientRequestError("invalid request body");
+	const record = body;
+	if (typeof record.presetId !== "string" || record.presetId === "") throw new ClientRequestError("presetId is required");
+	const kind = record.kind ?? "tool";
+	if (kind !== "tool" && kind !== "mcp-server" && kind !== "skill") throw new ClientRequestError("kind must be \"tool\", \"mcp-server\" or \"skill\"");
+	if (typeof record.name !== "string" || record.name === "") throw new ClientRequestError("name is required");
+	if (typeof record.enabled !== "boolean") throw new ClientRequestError("enabled must be boolean");
+	return {
+		presetId: record.presetId,
+		kind,
+		name: record.name,
+		enabled: record.enabled
+	};
+}
+function validatePresetContentType(req, res) {
+	const contentType = req.headers["content-type"];
+	if (typeof contentType === "string" && contentType.startsWith("application/json")) return true;
+	res.writeHead(415, { "content-type": "text/plain; charset=utf-8" });
+	res.end("expected application/json");
+	return false;
+}
+function validateToggle(sessionId, body) {
+	if (sessionId === null) throw new ClientRequestError("session is required");
+	if (body === null || typeof body !== "object") throw new ClientRequestError("invalid request body");
+	const record = body;
+	if (typeof record.kind !== "string" || !KINDS.includes(record.kind) || typeof record.enabled !== "boolean") throw new ClientRequestError("kind must be skill, mcp-server, mcp-tool or system-tool and enabled must be boolean");
+	if (typeof record.name !== "string" || record.name === "") throw new ClientRequestError("name is required");
+	return {
+		sessionId,
+		kind: record.kind,
+		name: record.name,
+		enabled: record.enabled
+	};
+}
+function createRouteHandler(services, capabilities, stats, blockedCounts, presetTools, sessionOverrides) {
+	return async (req, res) => {
+		if (!isLoopback(req)) {
+			res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+			res.end("forbidden");
+			return;
+		}
+		try {
+			const url = new URL(req.url ?? "/", "http://dsh.local");
+			if (url.pathname === `${ROUTE}/presets`) {
+				if (req.method !== "GET" && req.method !== "POST") {
+					res.writeHead(405, {
+						allow: "GET, POST",
+						"content-type": "text/plain; charset=utf-8"
+					});
+					res.end("method not allowed");
+					return;
+				}
+				if (req.method === "POST") {
+					if (!validatePresetContentType(req, res)) return;
+					const toggle = validatePresetToggle(await readRequestBody(req));
+					json(res, 200, toggle.kind === "skill" ? await presetTools.setSkill(toggle.presetId, toggle.name, toggle.enabled) : toggle.kind === "mcp-server" ? await presetTools.setServer(toggle.presetId, toggle.name, toggle.enabled) : await presetTools.set(toggle.presetId, toggle.name, toggle.enabled));
+					return;
+				}
+				json(res, 200, await presetTools.list());
+				return;
+			}
+			if (url.pathname === `${ROUTE}/stats`) {
+				if (req.method !== "GET") {
+					res.writeHead(405, {
+						allow: "GET",
+						"content-type": "text/plain; charset=utf-8"
+					});
+					res.end("method not allowed");
+					return;
+				}
+				const snapshot = stats.read();
+				json(res, 200, {
+					logFile: stats.file,
+					blocked: blockedCounts,
+					records: snapshot.records,
+					...snapshot.warnings.length > 0 ? { warnings: snapshot.warnings } : {}
+				}, true);
+				return;
+			}
+			if (url.pathname !== ROUTE && url.pathname !== "/") {
+				res.writeHead(404, {
+					"content-type": "text/plain; charset=utf-8",
+					"cache-control": "no-store"
+				});
+				res.end("not found");
+				return;
+			}
+			if (req.method !== "GET" && req.method !== "POST") {
+				res.writeHead(405, {
+					allow: "GET, POST",
+					"content-type": "text/plain; charset=utf-8"
+				});
+				res.end("method not allowed");
+				return;
+			}
+			const sessionId = url.searchParams.get("session");
+			let persistNote;
+			if (req.method === "POST") {
+				const contentType = req.headers["content-type"];
+				if (typeof contentType !== "string" || !contentType.startsWith("application/json")) {
+					res.writeHead(415, { "content-type": "text/plain; charset=utf-8" });
+					res.end("expected application/json");
+					return;
+				}
+				const toggle = validateToggle(sessionId, await readRequestBody(req));
+				await capabilities.set(toggle.sessionId, toggle.kind, toggle.name, toggle.enabled);
+				try {
+					await sessionOverrides.record(toggle.sessionId, toggle.kind, toggle.name, toggle.enabled);
+				} catch (error) {
+					persistNote = `switch applied for this session but could not be persisted across a restart: ${errorMessage(error)}`;
+				}
+			}
+			const payload = await buildPayload(services, sessionId, sessionId === null ? EMPTY_STATE : capabilities.state(sessionId) ?? EMPTY_STATE, blockedCounts);
+			json(res, 200, persistNote === void 0 ? payload : {
+				...payload,
+				degraded: [...payload.degraded ?? [], persistNote]
+			});
+		} catch (error) {
+			json(res, error instanceof HttpError ? error.status : 500, { error: errorMessage(error) });
+		}
+	};
+}
+
+//#endregion
+//#region src/host/session-overrides.ts
+/**
+* Session-bound switch positions, persisted in the capability-panel settings namespace
+* so a restored session gets its own toggles back after a restart.
+*
+* The binding is the session id: a record is read only by the session that
+* made it, so one session's switch can never leak into another. What changes
+* at a restart is only WHEN it is read — the masks themselves are re-applied
+* by the same capability controller the panel uses, over the fresh agent.
+*
+* The store is a record of user intent, not a snapshot of derived state: an
+* explicit `true` matters only when a preset default masks the name, and
+* recording every toggle's final value keeps the write path dumb (no preset
+* lookup needed) while restore order (defaults first, overrides second) makes
+* the user's last word win.
+*/
+/** Kind keys map 1:1 onto SessionOverrideState's fields. */
+const KIND_KEYS = {
+	skill: "skills",
+	"mcp-server": "mcpServers",
+	"mcp-tool": "mcpTools",
+	"system-tool": "systemTools"
+};
+/**
+* Retained session records cap. A record costs a handful of names, and a
+* session the user never revisits is pruned oldest-first — the alternative
+* (unbounded growth in a settings file) trades a real read cost for a
+* scenario nobody has.
+*/
+const MAX_SESSION_RECORDS = 200;
+function createSessionOverrideStore(access) {
+	return {
+		overridesFor(sessionId) {
+			try {
+				return access.scope()?.get().sessions[sessionId];
+			} catch {
+				return;
+			}
+		},
+		async record(sessionId, kind, name, enabled) {
+			const scope = access.scope();
+			if (scope === void 0) throw new HttpError(503, "settings service unavailable");
+			await access.serialize(async () => {
+				const stored = scope.get();
+				const kindKey = KIND_KEYS[kind];
+				const current = stored.sessions[sessionId];
+				const next = {
+					skills: { ...current?.skills },
+					mcpServers: { ...current?.mcpServers },
+					mcpTools: { ...current?.mcpTools },
+					systemTools: { ...current?.systemTools },
+					[kindKey]: {
+						...current?.[kindKey],
+						[name]: enabled
+					}
+				};
+				const entries = Object.entries(stored.sessions).filter(([id]) => id !== sessionId);
+				entries.push([sessionId, next]);
+				const sessions = Object.fromEntries(entries.slice(-MAX_SESSION_RECORDS));
+				await scope.replace({
+					presets: stored.presets,
+					presetSkills: stored.presetSkills,
+					sessions
+				});
+			});
+		}
+	};
+}
+
+//#endregion
+//#region src/host/stats-store.ts
+function statsFilePath(environment = process.env, home = homedir()) {
+	return join(environment["DSH_HOME"] ?? join(home, ".dsh"), "capability-panel", "stats.jsonl");
+}
+function isEnoent(error) {
+	return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function createStatsStore(file = statsFilePath()) {
+	const appendWarnings = [];
+	return {
+		file,
+		read() {
+			let text;
+			try {
+				text = readFileSync(file, "utf8");
+			} catch (error) {
+				if (isEnoent(error)) return {
+					records: [],
+					blocked: {},
+					warnings: [...appendWarnings]
+				};
+				return {
+					records: [],
+					blocked: {},
+					warnings: [`stats read failed: ${String(error)}`, ...appendWarnings]
+				};
+			}
+			const records = [];
+			const warnings = [...appendWarnings];
+			const validLines = [];
+			for (const [index, line] of text.split("\n").entries()) {
+				if (line.trim() === "") continue;
+				try {
+					const parsed = JSON.parse(line);
+					records.push(parsed);
+					validLines.push(line);
+				} catch (error) {
+					warnings.push(`stats line ${index + 1} skipped: ${String(error)}`);
+				}
+			}
+			return {
+				records,
+				blocked: aggregateBlocked(validLines),
+				warnings
+			};
+		},
+		append(record) {
+			try {
+				mkdirSync(dirname(file), { recursive: true });
+				appendFileSync(file, `${JSON.stringify(record)}\n`);
+				return null;
+			} catch (error) {
+				const warning = `stats append failed: ${String(error)}`;
+				appendWarnings.push(warning);
+				return warning;
+			}
+		}
+	};
+}
+
+//#endregion
+//#region src/index.ts
+/** Host composition root: construct stores/controllers and register the route. */
+function apply(ctx) {
+	const webServer = ctx.webServer;
+	if (webServer === void 0) return;
+	const stats = createStatsStore();
+	const blockedCounts = stats.read().blocked;
+	const appendStats = (record) => {
+		stats.append(record);
+	};
+	const capabilities = createCapabilityController(ctx, appendStats, blockedCounts);
+	const settingsAccess = createToolkitSettingsAccess(ctx);
+	const presetTools = createPresetToolController(ctx, settingsAccess);
+	const sessionOverrides = createSessionOverrideStore(settingsAccess);
+	registerPresetEnforcement(ctx, capabilities, presetTools, sessionOverrides);
+	const handler = createRouteHandler(ctx, capabilities, stats, blockedCounts, presetTools, sessionOverrides);
+	ctx.effect(() => webServer.register({
+		kind: "prefix",
+		path: ROUTE,
+		handler
+	}), "capability-panel: data route");
+}
+const inject = ["webServer"];
+
+//#endregion
+export { apply, inject };
+//# sourceMappingURL=index.js.map