forge-cw 0.1.0

package/dist/index.js

@@ -0,0 +1,4376 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// ../core/dist/db.js
+import { randomUUID } from "node:crypto";
+import { createRequire } from "node:module";
+function quietSqliteWarning() {
+  const emitWarning = process.emitWarning;
+  process.emitWarning = function(warning, ...rest) {
+    const text = typeof warning === "string" ? warning : warning.message;
+    if (text.startsWith("SQLite is an experimental feature"))
+      return;
+    return emitWarning.call(process, warning, ...rest);
+  };
+}
+var loadSqlite, ForgeDB;
+var init_db = __esm({
+  "../core/dist/db.js"() {
+    "use strict";
+    loadSqlite = () => createRequire(import.meta.url)("node:sqlite");
+    ForgeDB = class {
+      db;
+      // node:sqlite is built into Node, so the published package has no native module to compile for it
+      constructor(dbPath) {
+        this.db = new (loadSqlite()).DatabaseSync(dbPath);
+        this.db.exec("PRAGMA journal_mode = WAL");
+        this.db.exec("PRAGMA foreign_keys = ON");
+        this.migrate();
+      }
+      migrate() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS projects (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL UNIQUE,
+        path TEXT NOT NULL,
+        created_at TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      CREATE TABLE IF NOT EXISTS modules (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL UNIQUE,
+        version TEXT NOT NULL,
+        enabled INTEGER NOT NULL DEFAULT 1,
+        installed_at TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      CREATE TABLE IF NOT EXISTS action_logs (
+        id TEXT PRIMARY KEY,
+        project_id TEXT,
+        module_id TEXT NOT NULL,
+        action_id TEXT NOT NULL,
+        command TEXT NOT NULL,
+        exit_code INTEGER,
+        started_at TEXT NOT NULL DEFAULT (datetime('now')),
+        finished_at TEXT,
+        FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+      );
+
+      CREATE TABLE IF NOT EXISTS module_settings (
+        module_id TEXT NOT NULL,
+        key TEXT NOT NULL,
+        value TEXT NOT NULL,
+        PRIMARY KEY (module_id, key)
+      );
+    `);
+      }
+      listTables() {
+        const rows = this.db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'").all();
+        return rows.map((r) => r.name);
+      }
+      addProject(input) {
+        const id = randomUUID();
+        this.db.prepare("INSERT INTO projects (id, name, path) VALUES (?, ?, ?)").run(id, input.name, input.path);
+        return id;
+      }
+      listProjects() {
+        const rows = this.db.prepare("SELECT * FROM projects ORDER BY created_at DESC").all();
+        return rows.map((r) => ({
+          id: r.id,
+          name: r.name,
+          path: r.path,
+          createdAt: r.created_at,
+          updatedAt: r.updated_at
+        }));
+      }
+      getProject(id) {
+        const row = this.db.prepare("SELECT * FROM projects WHERE id = ?").get(id);
+        if (!row)
+          return void 0;
+        return {
+          id: row.id,
+          name: row.name,
+          path: row.path,
+          createdAt: row.created_at,
+          updatedAt: row.updated_at
+        };
+      }
+      removeProject(id) {
+        this.db.prepare("DELETE FROM projects WHERE id = ?").run(id);
+      }
+      addModule(input) {
+        const id = randomUUID();
+        this.db.prepare("INSERT INTO modules (id, name, version) VALUES (?, ?, ?)").run(id, input.name, input.version);
+        return id;
+      }
+      listModules() {
+        const rows = this.db.prepare("SELECT * FROM modules ORDER BY installed_at DESC").all();
+        return rows.map((r) => ({
+          id: r.id,
+          name: r.name,
+          version: r.version,
+          enabled: r.enabled === 1,
+          installedAt: r.installed_at
+        }));
+      }
+      removeModule(name) {
+        this.db.prepare("DELETE FROM modules WHERE name = ?").run(name);
+      }
+      logAction(input) {
+        const id = randomUUID();
+        this.db.prepare("INSERT INTO action_logs (id, project_id, module_id, action_id, command) VALUES (?, ?, ?, ?, ?)").run(id, input.projectId, input.moduleId, input.actionId, input.command);
+        return id;
+      }
+      getActionLog(id) {
+        const row = this.db.prepare("SELECT * FROM action_logs WHERE id = ?").get(id);
+        if (!row)
+          return void 0;
+        return {
+          id: row.id,
+          projectId: row.project_id,
+          moduleId: row.module_id,
+          actionId: row.action_id,
+          command: row.command,
+          exitCode: row.exit_code,
+          startedAt: row.started_at,
+          finishedAt: row.finished_at
+        };
+      }
+      completeAction(id, exitCode) {
+        this.db.prepare("UPDATE action_logs SET exit_code = ?, finished_at = datetime('now') WHERE id = ?").run(exitCode, id);
+      }
+      getModuleSettings(moduleId) {
+        const rows = this.db.prepare("SELECT key, value FROM module_settings WHERE module_id = ?").all(moduleId);
+        const result2 = {};
+        for (const row of rows) {
+          result2[row.key] = row.value;
+        }
+        return result2;
+      }
+      setModuleSetting(moduleId, key, value) {
+        this.db.prepare("INSERT INTO module_settings (module_id, key, value) VALUES (?, ?, ?) ON CONFLICT(module_id, key) DO UPDATE SET value = excluded.value").run(moduleId, key, value);
+      }
+      listActionLogs(opts) {
+        const { moduleId, limit = 50 } = opts;
+        let sql = "SELECT * FROM action_logs";
+        const params = [];
+        if (moduleId) {
+          sql += " WHERE module_id = ?";
+          params.push(moduleId);
+        }
+        sql += " ORDER BY started_at DESC, rowid DESC LIMIT ?";
+        params.push(limit);
+        const rows = this.db.prepare(sql).all(...params);
+        return rows.map((r) => ({
+          id: r.id,
+          projectId: r.project_id,
+          moduleId: r.module_id,
+          actionId: r.action_id,
+          command: r.command,
+          exitCode: r.exit_code,
+          startedAt: r.started_at,
+          finishedAt: r.finished_at
+        }));
+      }
+      close() {
+        this.db.close();
+      }
+    };
+  }
+});
+
+// ../core/dist/modules.js
+import { readdirSync, readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+var ModuleLoader;
+var init_modules = __esm({
+  "../core/dist/modules.js"() {
+    "use strict";
+    ModuleLoader = class {
+      modulesDir;
+      loaded = /* @__PURE__ */ new Map();
+      constructor(modulesDir) {
+        this.modulesDir = modulesDir;
+      }
+      discover() {
+        this.loaded.clear();
+        if (!existsSync(this.modulesDir))
+          return [];
+        const entries = readdirSync(this.modulesDir, { withFileTypes: true });
+        const manifests = [];
+        for (const entry of entries) {
+          if (!entry.isDirectory())
+            continue;
+          const manifest = this.load(entry.name);
+          if (manifest)
+            manifests.push(manifest);
+        }
+        return manifests;
+      }
+      load(dirName) {
+        const manifestPath = join(this.modulesDir, dirName, "forge-module.json");
+        if (!existsSync(manifestPath))
+          return void 0;
+        try {
+          const raw = readFileSync(manifestPath, "utf-8");
+          const manifest = JSON.parse(raw);
+          this.loaded.set(dirName, manifest);
+          return manifest;
+        } catch {
+          return void 0;
+        }
+      }
+      getAction(moduleDirName, actionId) {
+        const manifest = this.loaded.get(moduleDirName);
+        if (!manifest)
+          return void 0;
+        return manifest.actions.find((a) => a.id === actionId);
+      }
+      getLoaded() {
+        return this.loaded;
+      }
+      getLoadedCount() {
+        return this.loaded.size;
+      }
+    };
+  }
+});
+
+// ../core/dist/runner.js
+import { spawn } from "node:child_process";
+var ActionRunner;
+var init_runner = __esm({
+  "../core/dist/runner.js"() {
+    "use strict";
+    ActionRunner = class {
+      async exec(command, options) {
+        return new Promise((resolve5) => {
+          let output = "";
+          let timedOut = false;
+          let timeoutId;
+          const proc = spawn("sh", ["-c", command], {
+            cwd: options.cwd,
+            env: { ...process.env, ...options.env },
+            stdio: ["ignore", "pipe", "pipe"]
+          });
+          const handleData = (data) => {
+            const str2 = data.toString();
+            output += str2;
+            options.onData?.(str2);
+          };
+          proc.stdout.on("data", handleData);
+          proc.stderr.on("data", handleData);
+          if (options.signal) {
+            options.signal.addEventListener("abort", () => {
+              proc.kill("SIGTERM");
+            }, { once: true });
+          }
+          if (options.timeout) {
+            timeoutId = setTimeout(() => {
+              timedOut = true;
+              proc.kill("SIGTERM");
+            }, options.timeout);
+          }
+          proc.on("close", (code) => {
+            if (timeoutId)
+              clearTimeout(timeoutId);
+            resolve5({
+              exitCode: code ?? 1,
+              output,
+              timedOut
+            });
+          });
+          proc.on("error", () => {
+            if (timeoutId)
+              clearTimeout(timeoutId);
+            resolve5({ exitCode: 1, output, timedOut });
+          });
+        });
+      }
+    };
+  }
+});
+
+// ../core/dist/auth.js
+function bearerAuth(token) {
+  return async (c, next) => {
+    if (c.req.path === "/api/health") {
+      return next();
+    }
+    const authHeader = c.req.header("Authorization");
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+    const provided = authHeader.slice(7);
+    if (provided !== token) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+    return next();
+  };
+}
+var init_auth = __esm({
+  "../core/dist/auth.js"() {
+    "use strict";
+  }
+});
+
+// ../core/dist/origin-guard.js
+function isLoopbackHost(host) {
+  if (!host)
+    return false;
+  if (LOOPBACK_HOSTNAMES.has(host))
+    return true;
+  try {
+    return LOOPBACK_HOSTNAMES.has(new URL(`http://${host}`).hostname);
+  } catch {
+    return false;
+  }
+}
+function isLocalRequest(host, origin) {
+  if (!isLoopbackHost(host))
+    return false;
+  if (origin === void 0)
+    return true;
+  try {
+    return LOOPBACK_HOSTNAMES.has(new URL(origin).hostname);
+  } catch {
+    return false;
+  }
+}
+function resolveListenOptions(isTeam, envHost = process.env.FORGE_HOST) {
+  const host = envHost ?? (isTeam ? void 0 : "127.0.0.1");
+  return { host, localOnly: !isTeam && isLoopbackHost(host) };
+}
+function localOriginGuard() {
+  return async (c, next) => {
+    if (!isLocalRequest(new URL(c.req.url).host, c.req.header("Origin"))) {
+      return c.json({ error: "Forbidden" }, 403);
+    }
+    return next();
+  };
+}
+var LOOPBACK_HOSTNAMES;
+var init_origin_guard = __esm({
+  "../core/dist/origin-guard.js"() {
+    "use strict";
+    LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+  }
+});
+
+// ../core/dist/cw-reader.js
+import { readdirSync as readdirSync2, readFileSync as readFileSync2, existsSync as existsSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+function* walkSessionDirs(baseDir, rel = "", depth = 0) {
+  if (depth >= MAX_SESSION_DEPTH)
+    return;
+  let entries;
+  try {
+    entries = readdirSync2(join2(baseDir, rel), { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory())
+      continue;
+    const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+    const sessionPath = join2(baseDir, childRel, "session.json");
+    if (existsSync2(sessionPath))
+      yield { relPath: childRel, absPath: sessionPath };
+    else
+      yield* walkSessionDirs(baseDir, childRel, depth + 1);
+  }
+}
+var withHarnessDefaults, CWReader, MAX_SESSION_DEPTH;
+var init_cw_reader = __esm({
+  "../core/dist/cw-reader.js"() {
+    "use strict";
+    withHarnessDefaults = (session) => ({ ...session, harness: session.harness ?? "claude", provider: session.provider ?? "native" });
+    CWReader = class {
+      cwDir;
+      constructor(cwDir) {
+        this.cwDir = cwDir ?? join2(process.env.HOME ?? "", ".cw");
+      }
+      get cwHome() {
+        return this.cwDir;
+      }
+      getProjects() {
+        const path = join2(this.cwDir, "projects.json");
+        if (!existsSync2(path))
+          return {};
+        return JSON.parse(readFileSync2(path, "utf-8"));
+      }
+      getSpaces(projectFilter) {
+        const sessionsDir = join2(this.cwDir, "sessions");
+        if (!existsSync2(sessionsDir))
+          return [];
+        const sessions = [];
+        const projects = readdirSync2(sessionsDir, { withFileTypes: true });
+        for (const proj of projects) {
+          if (!proj.isDirectory())
+            continue;
+          if (projectFilter && proj.name !== projectFilter)
+            continue;
+          const projDir = join2(sessionsDir, proj.name);
+          for (const { relPath, absPath } of walkSessionDirs(projDir)) {
+            try {
+              const data = JSON.parse(readFileSync2(absPath, "utf-8"));
+              data.sessionDir = relPath;
+              sessions.push(withHarnessDefaults(data));
+            } catch {
+            }
+          }
+        }
+        return sessions.sort((a, b) => new Date(b.last_opened).getTime() - new Date(a.last_opened).getTime());
+      }
+      getSession(project, sessionDir) {
+        const path = join2(this.cwDir, "sessions", project, sessionDir, "session.json");
+        if (!existsSync2(path))
+          return null;
+        try {
+          const data = JSON.parse(readFileSync2(path, "utf-8"));
+          data.sessionDir = sessionDir;
+          return withHarnessDefaults(data);
+        } catch {
+          return null;
+        }
+      }
+      getNotes(project, sessionDir) {
+        const baseDir = join2(this.cwDir, "sessions", project, sessionDir);
+        const sessionPath = join2(baseDir, "session.json");
+        if (existsSync2(sessionPath)) {
+          try {
+            const session = JSON.parse(readFileSync2(sessionPath, "utf-8"));
+            if (existsSync2(session.notes))
+              return readFileSync2(session.notes, "utf-8");
+          } catch {
+          }
+        }
+        for (const name of ["TASK_NOTES.md", "REVIEW_NOTES.md"]) {
+          const p = join2(baseDir, name);
+          if (existsSync2(p))
+            return readFileSync2(p, "utf-8");
+        }
+        return "";
+      }
+      getAccounts() {
+        const dir = join2(this.cwDir, "accounts");
+        if (!existsSync2(dir))
+          return [];
+        return readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+      }
+      getMCPs(project) {
+        const tools = this.getTools(project);
+        return {
+          global: Object.fromEntries(tools.mcps.filter((m) => m.source === "global").map((m) => [m.name, {}])),
+          project: tools.mcps.filter((m) => m.source === "project").map((m) => m.name),
+          cw: tools.mcps.filter((m) => m.source === "cw").map((m) => m.name),
+          plugins: tools.plugins.map((p) => p.name)
+        };
+      }
+      /** Rich tool/MCP/plugin info for the dashboard */
+      getTools(project) {
+        const home = process.env.HOME ?? "";
+        const mcps = [];
+        const plugins = [];
+        const claudeSettings = join2(home, ".claude", "settings.json");
+        let enabledPlugins = {};
+        if (existsSync2(claudeSettings)) {
+          try {
+            const data = JSON.parse(readFileSync2(claudeSettings, "utf-8"));
+            if (data.mcpServers) {
+              for (const [name, cfg] of Object.entries(data.mcpServers)) {
+                const type = cfg.url ? "url" : cfg.type === "sse" ? "sse" : "command";
+                mcps.push({ name, type, source: "global", url: cfg.url });
+              }
+            }
+            if (data.enabledPlugins)
+              enabledPlugins = data.enabledPlugins;
+          } catch {
+          }
+        }
+        if (project) {
+          const projects = this.getProjects();
+          const projPath = projects[project]?.path ?? "";
+          if (projPath) {
+            if (existsSync2(claudeSettings)) {
+              try {
+                const globalData = JSON.parse(readFileSync2(claudeSettings, "utf-8"));
+                const projSettings = globalData.projects?.[projPath];
+                if (projSettings?.mcpServers) {
+                  for (const [name, cfg] of Object.entries(projSettings.mcpServers)) {
+                    if (!mcps.some((m) => m.name === name)) {
+                      const type = cfg.url ? "url" : cfg.type === "sse" ? "sse" : "command";
+                      mcps.push({ name, type, source: "project", url: cfg.url });
+                    }
+                  }
+                }
+              } catch {
+              }
+            }
+            for (const configPath of [
+              join2(projPath, ".mcp.json"),
+              join2(projPath, ".claude", "settings.json")
+            ]) {
+              if (existsSync2(configPath)) {
+                try {
+                  const data = JSON.parse(readFileSync2(configPath, "utf-8"));
+                  const servers = data.mcpServers ?? data;
+                  if (servers && typeof servers === "object") {
+                    for (const [name, cfg] of Object.entries(servers)) {
+                      if (name === "mcpServers")
+                        continue;
+                      if (!mcps.some((m) => m.name === name)) {
+                        const type = cfg.url ? "url" : cfg.type === "sse" ? "sse" : "command";
+                        mcps.push({ name, type, source: "project", url: cfg.url });
+                      }
+                    }
+                  }
+                } catch {
+                }
+              }
+            }
+          }
+        }
+        const mcpsDir = join2(this.cwDir, "mcps");
+        if (existsSync2(mcpsDir)) {
+          const files = readdirSync2(mcpsDir).filter((f) => f.endsWith(".json"));
+          for (const f of files) {
+            const name = f.replace(".json", "");
+            if (!mcps.some((m) => m.name === name)) {
+              mcps.push({ name, type: "cw", source: "cw" });
+            }
+          }
+        }
+        const pluginsFile = join2(home, ".claude", "plugins", "installed_plugins.json");
+        if (existsSync2(pluginsFile)) {
+          try {
+            const data = JSON.parse(readFileSync2(pluginsFile, "utf-8"));
+            if (data.plugins) {
+              for (const key of Object.keys(data.plugins)) {
+                const name = key.split("@")[0];
+                const marketplace = key.includes("@") ? key.split("@").slice(1).join("@") : "unknown";
+                const enabled = enabledPlugins[key] ?? false;
+                let hasMcp = false;
+                let mcpName;
+                let mcpType;
+                const entries = data.plugins[key];
+                if (entries?.[0]?.installPath) {
+                  const pluginMcpFile = join2(entries[0].installPath, ".mcp.json");
+                  if (existsSync2(pluginMcpFile)) {
+                    try {
+                      const raw = JSON.parse(readFileSync2(pluginMcpFile, "utf-8"));
+                      const mcpData = raw.mcpServers ?? raw;
+                      const mcpKeys = Object.keys(mcpData).filter((k) => k !== "mcpServers");
+                      if (mcpKeys.length > 0) {
+                        hasMcp = true;
+                        mcpName = mcpKeys[0];
+                        const cfg = mcpData[mcpKeys[0]];
+                        mcpType = cfg.url ? "url" : cfg.type === "sse" ? "sse" : "command";
+                      }
+                    } catch {
+                    }
+                  }
+                }
+                plugins.push({ name, enabled, hasMcp, mcpName, mcpType, marketplace });
+              }
+            }
+          } catch {
+          }
+        }
+        return { mcps, plugins };
+      }
+      parseFrontmatter(content) {
+        const match = content.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
+        if (!match)
+          return { frontmatter: {}, body: content };
+        const rawBlock = match[1];
+        const body = match[2];
+        const frontmatter = {};
+        let inMetadata = false;
+        const metadataObj = {};
+        for (const line of rawBlock.split("\n")) {
+          if (line.match(/^metadata:\s*$/)) {
+            inMetadata = true;
+            continue;
+          }
+          if (inMetadata) {
+            const nested = line.match(/^\s+(\w[\w-]*):\s*(.*)$/);
+            if (nested) {
+              metadataObj[nested[1]] = nested[2].replace(/^['"]|['"]$/g, "");
+              continue;
+            }
+            inMetadata = false;
+          }
+          const kv = line.match(/^(\w[\w-]*):\s*(.*)$/);
+          if (kv) {
+            frontmatter[kv[1]] = kv[2].replace(/^['"]|['"]$/g, "");
+          }
+        }
+        if (Object.keys(metadataObj).length > 0)
+          frontmatter["metadata"] = metadataObj;
+        return { frontmatter, body };
+      }
+      // directory whose skills/ holds a scope's skills; an unregistered project ref is used as a path
+      getSkillConfigDir(scope, scopeRef) {
+        if (scope === "global")
+          return join2(process.env.HOME ?? "", ".claude");
+        if (scope === "account")
+          return join2(this.cwDir, "accounts", scopeRef);
+        return join2(this.getProjects()[scopeRef]?.path ?? scopeRef, ".claude");
+      }
+      getSkillDir(scope, scopeRef, name) {
+        return join2(this.getSkillConfigDir(scope, scopeRef), "skills", name);
+      }
+      getSkills(account, project) {
+        const results = [];
+        const scanDir = (dir, scope, scopeRef) => {
+          if (!existsSync2(dir))
+            return;
+          const entries = readdirSync2(dir, { withFileTypes: true });
+          for (const entry of entries) {
+            if (!entry.isDirectory())
+              continue;
+            if (entry.name.startsWith("acct--"))
+              continue;
+            const fullPath = join2(dir, entry.name);
+            const skillMd = join2(fullPath, "SKILL.md");
+            if (!existsSync2(skillMd))
+              continue;
+            try {
+              const content = readFileSync2(skillMd, "utf-8");
+              const { frontmatter } = this.parseFrontmatter(content);
+              const refsDir = join2(fullPath, "references");
+              const hasReferences = existsSync2(refsDir) && readdirSync2(refsDir).some((f) => f.endsWith(".md"));
+              results.push({
+                name: String(frontmatter["name"] ?? entry.name),
+                dirName: entry.name,
+                scope,
+                scopeRef,
+                description: String(frontmatter["description"] ?? ""),
+                domain: frontmatter["domain"] ? String(frontmatter["domain"]) : void 0,
+                triggers: frontmatter["triggers"] ? String(frontmatter["triggers"]) : void 0,
+                hasReferences
+              });
+            } catch {
+            }
+          }
+        };
+        scanDir(join2(this.getSkillConfigDir("global", "global"), "skills"), "global", "global");
+        if (account)
+          scanDir(join2(this.getSkillConfigDir("account", account), "skills"), "account", account);
+        if (project)
+          scanDir(join2(this.getSkillConfigDir("project", project), "skills"), "project", project);
+        return results;
+      }
+      getSkill(scope, scopeRef, name) {
+        const dir = this.getSkillDir(scope, scopeRef, name);
+        const skillMd = join2(dir, "SKILL.md");
+        if (!existsSync2(skillMd))
+          return null;
+        try {
+          const content = readFileSync2(skillMd, "utf-8");
+          const { frontmatter, body } = this.parseFrontmatter(content);
+          const references = [];
+          const refsDir = join2(dir, "references");
+          if (existsSync2(refsDir)) {
+            for (const f of readdirSync2(refsDir)) {
+              if (!f.endsWith(".md"))
+                continue;
+              try {
+                references.push({ name: f, content: readFileSync2(join2(refsDir, f), "utf-8") });
+              } catch {
+              }
+            }
+          }
+          return { name: String(frontmatter["name"] ?? name), scope, scopeRef, frontmatter, body, references };
+        } catch {
+          return null;
+        }
+      }
+      detectStack(project) {
+        const projects = this.getProjects();
+        const projPath = projects[project]?.path ?? "";
+        const has = (file) => existsSync2(join2(projPath, file));
+        let framework = null;
+        if (has("next.config.js") || has("next.config.ts") || has("next.config.mjs"))
+          framework = "nextjs";
+        else if (has("vite.config.ts") || has("vite.config.js"))
+          framework = "vite";
+        else if (has("astro.config.mjs"))
+          framework = "astro";
+        else if (has("nuxt.config.ts"))
+          framework = "nuxt";
+        let testRunner = null;
+        if (has("vitest.config.ts") || has("vitest.config.js"))
+          testRunner = "vitest";
+        else if (has("jest.config.js") || has("jest.config.ts"))
+          testRunner = "jest";
+        else if (has("pytest.ini") || has("pyproject.toml"))
+          testRunner = "pytest";
+        return {
+          hasPackageJson: has("package.json"),
+          hasTests: testRunner !== null || has("tests") || has("__tests__"),
+          hasTailwind: has("tailwind.config.js") || has("tailwind.config.ts"),
+          hasShadcn: has("components.json"),
+          hasTokens: has("tokens") || has("src/tokens"),
+          hasFigmaConfig: has(".figma.json") || has("figma.config.ts"),
+          hasPlaywright: has("playwright.config.ts"),
+          hasDockerfile: has("Dockerfile"),
+          framework,
+          testRunner
+        };
+      }
+    };
+    MAX_SESSION_DEPTH = 5;
+  }
+});
+
+// ../core/dist/cw-types.js
+var ACCOUNT_NAME_RE, HARNESS_NAME_RE, PROVIDER_NAME_RE, MODEL_NAME_RE;
+var init_cw_types = __esm({
+  "../core/dist/cw-types.js"() {
+    "use strict";
+    ACCOUNT_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+    HARNESS_NAME_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+    PROVIDER_NAME_RE = /^[a-z0-9][a-z0-9_.-]{0,63}$/;
+    MODEL_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,127}$/;
+  }
+});
+
+// ../core/dist/cw-doctor.js
+import { execFile } from "node:child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+function envWithoutHarness(env = process.env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== void 0 && key !== "CW_HARNESS")
+      out[key] = value;
+  }
+  return out;
+}
+function runDoctor(cwBin) {
+  return new Promise((resolve5) => {
+    execFile(cwBin, ["doctor", "--json"], { timeout: TIMEOUT_MS, env: envWithoutHarness(), maxBuffer: 10 * 1024 * 1024 }, (err, stdout) => {
+      if (err)
+        return resolve5({ available: false, reason: err.message });
+      let parsed;
+      try {
+        parsed = JSON.parse(stdout);
+      } catch {
+        return resolve5({ available: false, reason: "cw doctor --json did not print JSON" });
+      }
+      if (parsed.schema !== 1)
+        return resolve5({ available: false, reason: `unsupported doctor schema ${String(parsed.schema)}` });
+      resolve5({ available: true, doctor: parsed });
+    });
+  });
+}
+function createDoctorClient(cwBin) {
+  let inFlight = null;
+  let cached = null;
+  return {
+    get(fresh = false) {
+      if (inFlight)
+        return inFlight;
+      if (!fresh && cached && Date.now() - cached.at < CACHE_MS)
+        return Promise.resolve(cached.result);
+      inFlight = runDoctor(cwBin).then((result2) => {
+        cached = { at: Date.now(), result: result2 };
+        inFlight = null;
+        return result2;
+      });
+      return inFlight;
+    }
+  };
+}
+function readContextTokens(cwHome, env = process.env) {
+  const file = join3(cwHome, "tokens.env");
+  const text = existsSync3(file) ? readFileSync3(file, "utf-8") : "";
+  const has = (name) => Boolean(env[name]?.trim()) || new RegExp(`^\\s*(export\\s+)?${name}\\s*=\\s*\\S`, "m").test(text);
+  return { linear: has("LINEAR_API_KEY"), notion: has("NOTION_TOKEN") };
+}
+var CACHE_MS, TIMEOUT_MS;
+var init_cw_doctor = __esm({
+  "../core/dist/cw-doctor.js"() {
+    "use strict";
+    CACHE_MS = 2e3;
+    TIMEOUT_MS = 15e3;
+  }
+});
+
+// ../core/dist/task-review.js
+import { execFile as execFile2 } from "node:child_process";
+import { lstatSync } from "node:fs";
+import { join as join4 } from "node:path";
+function parseGitHubRemote(url) {
+  const match = GITHUB_REMOTE_RE.exec(url.trim());
+  return match ? { owner: match[1], repo: match[2] } : null;
+}
+function summarizeChecks(rollup) {
+  if (!Array.isArray(rollup) || rollup.length === 0)
+    return "none";
+  const entries = rollup;
+  const isStatusContext = (e) => e.__typename === "StatusContext" || e.state !== void 0 && e.status === void 0;
+  if (entries.some((e) => isStatusContext(e) ? FAILED_STATES.has(e.state ?? "") : FAILED_CONCLUSIONS.has(e.conclusion ?? "")))
+    return "failing";
+  if (entries.some((e) => isStatusContext(e) ? PENDING_STATES.has(e.state ?? "") : e.status !== "COMPLETED"))
+    return "pending";
+  return "passing";
+}
+function parseShortstat(text) {
+  const num2 = (re) => Number(re.exec(text)?.[1] ?? 0);
+  return {
+    files: num2(/(\d+) files? changed/),
+    insertions: num2(/(\d+) insertions?\(\+\)/),
+    deletions: num2(/(\d+) deletions?\(-\)/)
+  };
+}
+function githubLink(input) {
+  const { repo, kind, pr } = input;
+  if (!repo)
+    return null;
+  const repoUrl = `https://github.com/${repo.owner}/${repo.repo}`;
+  if (pr.status === "found") {
+    return { url: kind === "review" ? pr.url : `${pr.url}/files`, label: "View PR on GitHub" };
+  }
+  if (kind === "review") {
+    return input.prNumber ? { url: `${repoUrl}/pull/${encodeURIComponent(input.prNumber)}`, label: "View PR on GitHub" } : null;
+  }
+  if (input.upstream && input.branch) {
+    const branch = encodeURIComponent(input.branch);
+    if (input.base) {
+      const baseName = encodeURIComponent(input.base.replace(/^origin\//, ""));
+      return { url: `${repoUrl}/compare/${baseName}...${branch}`, label: "View on GitHub" };
+    }
+    return { url: `${repoUrl}/tree/${branch}`, label: "View on GitHub" };
+  }
+  if ((input.commits ?? 0) > 0 || input.uncommitted > 0)
+    return { url: null, reason: "Push the branch first" };
+  return null;
+}
+function closeWarningsFor(input) {
+  if (input.workspace !== "ready")
+    return [];
+  if (input.gitFailed)
+    return ["state-unknown"];
+  const warnings = [];
+  if (input.uncommitted > 0)
+    warnings.push("uncommitted");
+  const unpushed = input.unpushed !== null ? input.unpushed > 0 : (input.commits ?? 0) > 0;
+  if (unpushed)
+    warnings.push("unpushed");
+  if (input.pr.status === "found" && input.pr.state === "OPEN")
+    warnings.push("pr-open");
+  if (input.base === null && input.unpushed === null)
+    warnings.push("state-unknown");
+  return warnings;
+}
+function createRunner(env, timeoutMs = COMMAND_TIMEOUT_MS) {
+  return (bin, args, cwd) => new Promise((resolve5) => {
+    execFile2(bin, args, { cwd, env, timeout: timeoutMs, maxBuffer: 5 * 1024 * 1024 }, (err, stdout, stderr) => {
+      if (!err)
+        return resolve5({ code: 0, stdout: String(stdout), stderr: String(stderr) });
+      const { code } = err;
+      if (code === "ENOENT")
+        return resolve5({ code: 127, stdout: "", stderr: "ENOENT" });
+      resolve5({ code: typeof code === "number" ? code : 1, stdout: String(stdout), stderr: String(stderr) || err.message });
+    });
+  });
+}
+function isCwLink(worktree, porcelainLine) {
+  if (!porcelainLine.startsWith("?? "))
+    return false;
+  const path = porcelainLine.slice(3);
+  if (!CW_LINKED_FILES.has(path))
+    return false;
+  try {
+    return lstatSync(join4(worktree, path)).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+async function readGitSnapshot(run, worktree) {
+  const head = await run("git", ["rev-parse", "--abbrev-ref", "HEAD"], worktree);
+  if (head.code !== 0)
+    throw new GitReadError(head.stderr.trim() || "git rev-parse failed");
+  const status = await run("git", ["status", "--porcelain", "--untracked-files=all"], worktree);
+  if (status.code !== 0)
+    throw new GitReadError(status.stderr.trim() || "git status failed");
+  const branchName = head.stdout.trim();
+  const branch = branchName === "HEAD" ? null : branchName;
+  let upstream = null;
+  let unpushed = null;
+  if (branch) {
+    const remoteRef = `refs/remotes/origin/${branch}`;
+    const verify = await run("git", ["rev-parse", "--verify", "--quiet", remoteRef], worktree);
+    if (verify.code === 0) {
+      upstream = `origin/${branch}`;
+      const count = await run("git", ["rev-list", "--count", `${remoteRef}..HEAD`], worktree);
+      unpushed = count.code === 0 ? Number(count.stdout.trim()) : null;
+    }
+  }
+  const remote = await run("git", ["remote", "get-url", "origin"], worktree);
+  return {
+    branch,
+    uncommitted: lines(status.stdout).filter((line) => !isCwLink(worktree, line)).length,
+    upstream,
+    unpushed,
+    repo: remote.code === 0 ? parseGitHubRemote(remote.stdout) : null
+  };
+}
+async function resolveBase(run, cwd, candidates) {
+  for (const candidate of candidates) {
+    if (!candidate)
+      continue;
+    let ref = candidate;
+    if (candidate === "origin/HEAD") {
+      const head = await run("git", ["symbolic-ref", "--quiet", "refs/remotes/origin/HEAD"], cwd);
+      if (head.code !== 0)
+        continue;
+      ref = head.stdout.trim().replace(/^refs\/remotes\//, "");
+    }
+    const verify = await run("git", ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], cwd);
+    if (verify.code === 0)
+      return ref;
+  }
+  return null;
+}
+async function readBaseCounts(run, cwd, base) {
+  if (!base)
+    return { commits: null, diff: null };
+  const count = await run("git", ["rev-list", "--count", `${base}..HEAD`], cwd);
+  const stat = await run("git", ["diff", "--shortstat", base], cwd);
+  return {
+    commits: count.code === 0 ? Number(count.stdout.trim()) : null,
+    diff: stat.code === 0 ? parseShortstat(stat.stdout) : null
+  };
+}
+function toPullRequestInfo(raw) {
+  return {
+    status: "found",
+    number: raw.number,
+    url: raw.url,
+    state: PR_STATES.has(raw.state) ? raw.state : "CLOSED",
+    isDraft: Boolean(raw.isDraft),
+    baseRefName: raw.baseRefName,
+    headRefOid: typeof raw.headRefOid === "string" ? raw.headRefOid : "",
+    checks: summarizeChecks(raw.statusCheckRollup),
+    review: REVIEW_DECISIONS.has(raw.reviewDecision) ? raw.reviewDecision : null
+  };
+}
+function ghUnavailable(result2) {
+  if (result2.code === 127 && result2.stderr === "ENOENT")
+    return { status: "unavailable", reason: "gh is not installed" };
+  const firstLine = result2.stderr.split("\n").map((line) => line.trim()).find((line) => line.length > 0);
+  return { status: "unavailable", reason: firstLine ?? "gh failed" };
+}
+async function readPullRequestForBranch(run, cwd, branch) {
+  const result2 = await run("gh", ["pr", "list", "--head", branch, "--state", "all", "--limit", "1", "--json", PR_FIELDS], cwd);
+  if (result2.code !== 0)
+    return ghUnavailable(result2);
+  try {
+    const list = JSON.parse(result2.stdout);
+    if (!Array.isArray(list))
+      return UNEXPECTED;
+    return list.length === 0 ? { status: "none" } : toPullRequestInfo(list[0]);
+  } catch {
+    return UNEXPECTED;
+  }
+}
+async function readPullRequestByNumber(run, cwd, number) {
+  const result2 = await run("gh", ["pr", "view", number, "--json", PR_FIELDS], cwd);
+  if (result2.code !== 0)
+    return ghUnavailable(result2);
+  try {
+    const raw = JSON.parse(result2.stdout);
+    return typeof raw?.number === "number" ? toPullRequestInfo(raw) : UNEXPECTED;
+  } catch {
+    return UNEXPECTED;
+  }
+}
+function idleState(workspace) {
+  return {
+    workspace,
+    branch: null,
+    base: null,
+    uncommitted: 0,
+    commits: null,
+    upstream: null,
+    unpushed: null,
+    diff: null,
+    pr: { status: "none" },
+    github: null,
+    closeWarnings: []
+  };
+}
+async function buildReviewSessionState(session, projectPath, deps) {
+  if (!projectPath || !deps.exists(projectPath))
+    return idleState("none");
+  const remote = await deps.run("git", ["remote", "get-url", "origin"], projectPath);
+  const repo = remote.code === 0 ? parseGitHubRemote(remote.stdout) : null;
+  const prNumber = session.pr && /^\d+$/.test(session.pr) ? session.pr : void 0;
+  const pr = !prNumber ? { status: "none" } : !repo ? NOT_GITHUB : await deps.limitGh(() => readPullRequestByNumber(deps.run, projectPath, prNumber));
+  const github = githubLink({ repo, kind: "review", prNumber, pr, branch: null, base: null, upstream: null, commits: null, uncommitted: 0 });
+  return { ...idleState("none"), pr, github };
+}
+async function isAncestor(run, cwd, ancestor, descendant) {
+  return (await run("git", ["merge-base", "--is-ancestor", ancestor, descendant], cwd)).code === 0;
+}
+async function buildTaskReviewState(session, projectPath, deps) {
+  if (session.type === "review")
+    return buildReviewSessionState(session, projectPath, deps);
+  if (session.type !== "task")
+    return idleState("none");
+  const worktree = session.worktree;
+  if (!worktree || !deps.exists(worktree))
+    return idleState("missing");
+  let snapshot;
+  try {
+    snapshot = await readGitSnapshot(deps.run, worktree);
+  } catch {
+    return { ...idleState("ready"), pr: { status: "unavailable", reason: "Could not read git state" }, closeWarnings: ["state-unknown"] };
+  }
+  const { branch, repo, uncommitted, upstream } = snapshot;
+  let { unpushed } = snapshot;
+  let pr = !repo ? NOT_GITHUB : branch ? await deps.limitGh(() => readPullRequestForBranch(deps.run, worktree, branch)) : { status: "none" };
+  if (pr.status === "found") {
+    const valid = OBJECT_ID_RE.test(pr.headRefOid);
+    const headContained = valid && await isAncestor(deps.run, worktree, "HEAD", pr.headRefOid);
+    const headBehind = valid && !headContained && await isAncestor(deps.run, worktree, pr.headRefOid, "HEAD");
+    if (!headContained && !headBehind)
+      pr = { status: "none" };
+    else if (headContained)
+      unpushed = 0;
+  }
+  const base = await resolveBase(deps.run, worktree, [
+    pr.status === "found" ? `origin/${pr.baseRefName}` : null,
+    session.base_branch,
+    "origin/HEAD",
+    "origin/main"
+  ]);
+  const { commits, diff } = await readBaseCounts(deps.run, worktree, base);
+  return {
+    workspace: "ready",
+    branch,
+    base,
+    uncommitted,
+    commits,
+    upstream,
+    unpushed,
+    diff,
+    pr,
+    github: githubLink({ repo, kind: "task", pr, branch, base, upstream, commits, uncommitted }),
+    closeWarnings: closeWarningsFor({ workspace: "ready", uncommitted, commits, base, unpushed, pr, gitFailed: false })
+  };
+}
+function createLimiter(max) {
+  let active = 0;
+  const waiting = [];
+  return async (fn) => {
+    if (active >= max)
+      await new Promise((resolve5) => waiting.push(resolve5));
+    else
+      active++;
+    try {
+      return await fn();
+    } finally {
+      const next = waiting.shift();
+      if (next)
+        next();
+      else
+        active--;
+    }
+  };
+}
+var GITHUB_REMOTE_RE, FAILED_CONCLUSIONS, FAILED_STATES, PENDING_STATES, COMMAND_TIMEOUT_MS, runCommand, GitReadError, lines, CW_LINKED_FILES, PR_FIELDS, PR_STATES, REVIEW_DECISIONS, UNEXPECTED, NOT_GITHUB, OBJECT_ID_RE;
+var init_task_review = __esm({
+  "../core/dist/task-review.js"() {
+    "use strict";
+    GITHUB_REMOTE_RE = /^(?:git@github\.com:|ssh:\/\/git@github\.com\/|https:\/\/github\.com\/)([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/;
+    FAILED_CONCLUSIONS = /* @__PURE__ */ new Set(["FAILURE", "CANCELLED", "TIMED_OUT", "ACTION_REQUIRED", "STARTUP_FAILURE"]);
+    FAILED_STATES = /* @__PURE__ */ new Set(["FAILURE", "ERROR"]);
+    PENDING_STATES = /* @__PURE__ */ new Set(["PENDING", "EXPECTED"]);
+    COMMAND_TIMEOUT_MS = 1e4;
+    runCommand = createRunner();
+    GitReadError = class extends Error {
+    };
+    lines = (text) => text.split("\n").filter((line) => line.length > 0);
+    CW_LINKED_FILES = /* @__PURE__ */ new Set([".claude", ".env", "TASK_NOTES.md", "SHARED_CONTEXT.md"]);
+    PR_FIELDS = "number,state,url,isDraft,baseRefName,headRefOid,reviewDecision,statusCheckRollup";
+    PR_STATES = /* @__PURE__ */ new Set(["OPEN", "MERGED", "CLOSED"]);
+    REVIEW_DECISIONS = /* @__PURE__ */ new Set(["APPROVED", "CHANGES_REQUESTED", "REVIEW_REQUIRED"]);
+    UNEXPECTED = { status: "unavailable", reason: "gh returned unexpected output" };
+    NOT_GITHUB = { status: "unavailable", reason: "origin is not a GitHub repository" };
+    OBJECT_ID_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+  }
+});
+
+// ../core/dist/usage-window.js
+function severityOf(percent) {
+  if (percent >= CRITICAL_AT)
+    return "critical";
+  if (percent >= WARNING_AT)
+    return "warning";
+  return "normal";
+}
+function windowLabel(minutes) {
+  if (!minutes || minutes <= 0)
+    return "";
+  if (minutes % MINS_PER_DAY === 0)
+    return `${minutes / MINS_PER_DAY} d`;
+  if (minutes % MINS_PER_HOUR === 0)
+    return `${minutes / MINS_PER_HOUR} h`;
+  return `${minutes} min`;
+}
+var WARNING_AT, CRITICAL_AT, MINS_PER_HOUR, MINS_PER_DAY, severityFrom, obj, num, str;
+var init_usage_window = __esm({
+  "../core/dist/usage-window.js"() {
+    "use strict";
+    WARNING_AT = 70;
+    CRITICAL_AT = 90;
+    MINS_PER_HOUR = 60;
+    MINS_PER_DAY = 1440;
+    severityFrom = (value, percent) => value === "normal" || value === "warning" || value === "critical" ? value : severityOf(percent);
+    obj = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+    num = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
+    str = (value) => typeof value === "string" && value ? value : null;
+  }
+});
+
+// ../core/dist/usage-claude.js
+import { execFile as execFile3 } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFileSync as readFileSync4 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join5 } from "node:path";
+import { promisify } from "node:util";
+function mapClaudeUsage(payload) {
+  const limits = Array.isArray(payload.limits) ? payload.limits : null;
+  if (limits) {
+    return limits.flatMap((entry) => {
+      const limit = obj(entry);
+      const minutes = limit ? CLAUDE_WINDOW_MINS[String(limit.kind)] : void 0;
+      const percent = num(limit?.percent);
+      if (!minutes || percent === null)
+        return [];
+      return [{
+        label: windowLabel(minutes),
+        percent,
+        resetsAt: str(limit?.resets_at),
+        severity: severityFrom(limit?.severity, percent),
+        scope: str(obj(obj(limit?.scope)?.model)?.display_name)
+      }];
+    });
+  }
+  return [["five_hour", SESSION_MINS], ["seven_day", WEEKLY_MINS]].flatMap(([key, minutes]) => {
+    const window = obj(payload[key]);
+    const percent = num(window?.utilization);
+    if (percent === null)
+      return [];
+    return [{ label: windowLabel(minutes), percent, resetsAt: str(window?.resets_at), severity: severityFrom(null, percent), scope: null }];
+  });
+}
+function claudeKeychainService(configDir) {
+  const dir = configDir.replace(/\/+$/, "");
+  if (dir === join5(homedir(), ".claude"))
+    return KEYCHAIN_SERVICE;
+  return `${KEYCHAIN_SERVICE}-${createHash("sha256").update(dir).digest("hex").slice(0, 8)}`;
+}
+async function readFromKeychain(service) {
+  try {
+    const { stdout } = await execFileAsync("security", ["find-generic-password", "-s", service, "-w"], { encoding: "utf-8" });
+    return String(stdout);
+  } catch {
+    return null;
+  }
+}
+function parseCredentials(raw) {
+  if (!raw)
+    return null;
+  try {
+    const oauth = JSON.parse(raw).claudeAiOauth;
+    const accessToken = typeof oauth?.accessToken === "string" ? oauth.accessToken : null;
+    if (!accessToken)
+      return null;
+    return { accessToken, expiresAt: typeof oauth?.expiresAt === "number" ? oauth.expiresAt : null };
+  } catch {
+    return null;
+  }
+}
+async function readCredentials(configDir, deps) {
+  const readKeychain = deps.readKeychain ?? (process.platform === "darwin" ? readFromKeychain : () => null);
+  const fromKeychain = parseCredentials(await readKeychain(claudeKeychainService(configDir)));
+  if (fromKeychain)
+    return fromKeychain;
+  try {
+    return parseCredentials(readFileSync4(join5(configDir, ".credentials.json"), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+async function probeClaudeUsage(configDir, deps = {}) {
+  const now = deps.now ?? Date.now;
+  const credentials = await readCredentials(configDir, deps);
+  if (!credentials)
+    return { state: "not_connected", windows: [], detail: null };
+  if (credentials.expiresAt !== null && credentials.expiresAt <= now()) {
+    return { state: "expired", windows: [], detail: "The stored token has expired" };
+  }
+  const call = deps.fetchImpl ?? fetch;
+  try {
+    const response = await call(USAGE_URL, {
+      headers: { authorization: `Bearer ${credentials.accessToken}`, "anthropic-beta": OAUTH_BETA },
+      signal: AbortSignal.timeout(TIMEOUT_MS2)
+    });
+    if (response.status === 401 || response.status === 403)
+      return { state: "expired", windows: [], detail: "Claude rejected the stored token" };
+    const body = await response.text();
+    if (!response.ok)
+      return { state: "error", windows: [], detail: `Claude answered ${response.status}` };
+    return { state: "ok", windows: mapClaudeUsage(JSON.parse(body)), detail: null };
+  } catch (err) {
+    return { state: "error", windows: [], detail: err instanceof Error ? err.message : String(err) };
+  }
+}
+var execFileAsync, USAGE_URL, OAUTH_BETA, TIMEOUT_MS2, KEYCHAIN_SERVICE, SESSION_MINS, WEEKLY_MINS, CLAUDE_WINDOW_MINS;
+var init_usage_claude = __esm({
+  "../core/dist/usage-claude.js"() {
+    "use strict";
+    init_usage_window();
+    execFileAsync = promisify(execFile3);
+    USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+    OAUTH_BETA = "oauth-2025-04-20";
+    TIMEOUT_MS2 = 1e4;
+    KEYCHAIN_SERVICE = "Claude Code-credentials";
+    SESSION_MINS = 300;
+    WEEKLY_MINS = 10080;
+    CLAUDE_WINDOW_MINS = { session: SESSION_MINS, weekly_all: WEEKLY_MINS, weekly_scoped: WEEKLY_MINS };
+  }
+});
+
+// ../core/dist/usage-codex.js
+import { spawn as spawn2 } from "node:child_process";
+function mapCodexUsage(payload) {
+  const limits = obj(payload.rateLimits);
+  return ["primary", "secondary"].flatMap((key) => {
+    const window = obj(limits?.[key]);
+    const percent = num(window?.usedPercent);
+    if (percent === null)
+      return [];
+    const resetsAt = num(window?.resetsAt);
+    return [{
+      label: windowLabel(num(window?.windowDurationMins)),
+      percent,
+      resetsAt: resetsAt === null ? null : new Date(resetsAt * 1e3).toISOString(),
+      severity: severityOf(percent),
+      scope: null
+    }];
+  });
+}
+function callCodexAppServer(bin, codexHome, timeoutMs = TIMEOUT_MS3) {
+  return new Promise((resolve5, reject) => {
+    const child = spawn2(bin, ["app-server"], { env: { ...CHILD_ENV, CODEX_HOME: codexHome }, stdio: ["pipe", "pipe", "ignore"] });
+    let buffer = "";
+    let settled = false;
+    const stop = () => {
+      settled = true;
+      clearTimeout(timer);
+      child.stdin.end();
+      child.kill();
+      setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS).unref();
+    };
+    const fail = (err) => {
+      if (!settled) {
+        stop();
+        reject(err);
+      }
+    };
+    const done = (value) => {
+      if (!settled) {
+        stop();
+        resolve5(value);
+      }
+    };
+    const timer = setTimeout(() => fail(new Error(`codex app-server did not answer in ${timeoutMs / 1e3} s`)), timeoutMs);
+    child.on("error", fail);
+    child.on("exit", () => fail(new Error("codex app-server exited before answering")));
+    child.stdout.setEncoding("utf-8");
+    child.stdout.on("data", (chunk) => {
+      buffer += chunk;
+      const lines2 = buffer.split("\n");
+      buffer = lines2.pop() ?? "";
+      for (const line of lines2) {
+        if (!line.trim())
+          continue;
+        let message;
+        try {
+          message = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        if (message.id !== READ_ID)
+          continue;
+        if (message.error)
+          return fail(new Error(String(message.error.message ?? "codex app-server returned an error")));
+        return done(obj(message.result) ?? {});
+      }
+    });
+    const send = (message) => child.stdin.write(`${JSON.stringify(message)}
+`);
+    send({ jsonrpc: "2.0", id: 1, method: "initialize", params: { clientInfo: { name: "forge", title: "Forge", version: "0.1.0" } } });
+    send({ jsonrpc: "2.0", method: "initialized", params: {} });
+    send({ jsonrpc: "2.0", id: READ_ID, method: "account/rateLimits/read", params: {} });
+  });
+}
+async function probeCodexUsage(bin, codexHome, deps = {}) {
+  const call = deps.callAppServer ?? callCodexAppServer;
+  try {
+    const windows = mapCodexUsage(await call(bin, codexHome));
+    if (windows.length === 0)
+      return { state: "not_connected", windows: [], detail: null };
+    return { state: "ok", windows, detail: null };
+  } catch (err) {
+    return { state: "error", windows: [], detail: err instanceof Error ? err.message : String(err) };
+  }
+}
+var TIMEOUT_MS3, KILL_GRACE_MS, READ_ID, CHILD_ENV;
+var init_usage_codex = __esm({
+  "../core/dist/usage-codex.js"() {
+    "use strict";
+    init_cw_doctor();
+    init_usage_window();
+    TIMEOUT_MS3 = 2e4;
+    KILL_GRACE_MS = 2e3;
+    READ_ID = 2;
+    CHILD_ENV = envWithoutHarness();
+  }
+});
+
+// ../core/dist/usage.js
+function createUsageClient(deps = {}) {
+  const probes = { ...PROBES, ...deps.probes };
+  const limit = createLimiter(MAX_CONCURRENT);
+  const cache = /* @__PURE__ */ new Map();
+  const lastGood = /* @__PURE__ */ new Map();
+  const settle = async (key, account, cell, probe, doctor) => {
+    const result2 = await limit(() => probe(cell, doctor));
+    const base = { account, harness: cell.harness, detail: result2.detail };
+    if (result2.state === "ok") {
+      lastGood.set(key, result2.windows);
+      return { ...base, state: "ok", windows: result2.windows, stale: false };
+    }
+    const previous = lastGood.get(key);
+    if (result2.state === "error" && previous && previous.length > 0) {
+      return { ...base, state: "ok", windows: previous, stale: true };
+    }
+    lastGood.delete(key);
+    return { ...base, state: result2.state, windows: [], stale: false };
+  };
+  return {
+    get(doctor, fresh = false) {
+      const now = Date.now();
+      const live = /* @__PURE__ */ new Set();
+      const pending = [];
+      for (const account of doctor.accounts) {
+        for (const cell of account.harnesses) {
+          const probe = probes[cell.harness];
+          if (!probe || cell.status !== "connected")
+            continue;
+          const key = `${account.name}/${cell.harness}`;
+          live.add(key);
+          const cached = cache.get(key);
+          if (!fresh && cached && now - cached.at < TTL_MS) {
+            pending.push(cached.value);
+            continue;
+          }
+          const value = settle(key, account.name, cell, probe, doctor);
+          cache.set(key, { at: now, value });
+          pending.push(value);
+        }
+      }
+      for (const key of cache.keys()) {
+        if (live.has(key))
+          continue;
+        cache.delete(key);
+        lastGood.delete(key);
+      }
+      return Promise.all(pending);
+    }
+  };
+}
+var PROBES, TTL_MS, MAX_CONCURRENT;
+var init_usage = __esm({
+  "../core/dist/usage.js"() {
+    "use strict";
+    init_task_review();
+    init_usage_claude();
+    init_usage_codex();
+    PROBES = {
+      claude: (cell) => probeClaudeUsage(cell.config_dir),
+      codex: (cell, doctor) => {
+        const bin = doctor.harnesses.find((h) => h.name === "codex")?.path;
+        return bin ? probeCodexUsage(bin, cell.config_dir) : Promise.resolve({ state: "error", windows: [], detail: "codex is not on PATH" });
+      }
+    };
+    TTL_MS = 5e4;
+    MAX_CONCURRENT = 4;
+  }
+});
+
+// ../core/dist/harness-capabilities.js
+function supports(harness, cap) {
+  return (HARNESS_CAPABILITIES[harness ?? "claude"] ?? []).includes(cap);
+}
+var HARNESS_CAPABILITIES;
+var init_harness_capabilities = __esm({
+  "../core/dist/harness-capabilities.js"() {
+    "use strict";
+    HARNESS_CAPABILITIES = {
+      claude: ["skip_permissions", "agent_teams", "slash_commands", "mcp", "model_flag", "resume_by_name", "continue_last"],
+      codex: ["headless_login", "api_key_login", "custom_provider", "model_flag", "continue_last"],
+      pi: ["model_flag"],
+      opencode: ["custom_provider", "model_flag"]
+    };
+  }
+});
+
+// ../core/dist/login-manager.js
+import * as pty from "node-pty";
+var OUTPUT_LINES, MAX_RUNNING_MS, KEEP_EXITED_MS, ANSI_RE, URL_RE, CODE_RE, spawnInPty, LoginManager;
+var init_login_manager = __esm({
+  "../core/dist/login-manager.js"() {
+    "use strict";
+    init_cw_doctor();
+    OUTPUT_LINES = 50;
+    MAX_RUNNING_MS = 15 * 60 * 1e3;
+    KEEP_EXITED_MS = 5 * 60 * 1e3;
+    ANSI_RE = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07]*\x07/g;
+    URL_RE = /^CW_LOGIN_URL=(https?:\/\/\S+)$/;
+    CODE_RE = /^CW_LOGIN_CODE=([A-Za-z0-9-]{4,64})$/;
+    spawnInPty = (file, args, options) => pty.spawn(file, args, { name: "xterm-256color", cols: 120, rows: 40, cwd: options.cwd, env: options.env });
+    LoginManager = class {
+      cwBin;
+      spawn;
+      entries = /* @__PURE__ */ new Map();
+      constructor(cwBin, spawn7 = spawnInPty) {
+        this.cwBin = cwBin;
+        this.spawn = spawn7;
+      }
+      start(account, harness) {
+        const key = `${account}::${harness}`;
+        const existing = this.entries.get(key);
+        if (existing?.state.status === "running")
+          return existing.state;
+        if (existing)
+          this.drop(key);
+        const state = {
+          account,
+          harness,
+          status: "running",
+          url: null,
+          code: null,
+          exitCode: null,
+          output: [],
+          startedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        const proc = this.spawn(this.cwBin, ["account", "login", account, "--harness", harness, "--no-browser"], {
+          cwd: process.env.HOME ?? process.cwd(),
+          env: envWithoutHarness()
+        });
+        const entry = { state, proc, partial: "", timer: null, subscriptions: [] };
+        this.entries.set(key, entry);
+        entry.subscriptions.push(proc.onData((data) => this.ingest(entry, data)));
+        entry.subscriptions.push(proc.onExit(({ exitCode }) => this.finish(key, entry, exitCode)));
+        entry.timer = setTimeout(() => this.stop(account, harness), MAX_RUNNING_MS);
+        return state;
+      }
+      get(account, harness) {
+        return this.entries.get(`${account}::${harness}`)?.state;
+      }
+      stop(account, harness) {
+        const key = `${account}::${harness}`;
+        const entry = this.entries.get(key);
+        if (!entry || entry.state.status !== "running")
+          return;
+        try {
+          entry.proc.kill();
+        } catch {
+        }
+        this.finish(key, entry, null);
+      }
+      dispose() {
+        for (const [key, entry] of this.entries) {
+          for (const sub of entry.subscriptions)
+            sub.dispose();
+          if (entry.state.status === "running") {
+            try {
+              entry.proc.kill();
+            } catch {
+            }
+          }
+          this.drop(key);
+        }
+      }
+      ingest(entry, data) {
+        const lines2 = (entry.partial + data).split("\n");
+        entry.partial = lines2.pop() ?? "";
+        for (const raw of lines2)
+          this.addLine(entry.state, raw);
+      }
+      addLine(state, raw) {
+        const line = raw.replace(ANSI_RE, "").replace(/\r/g, "").trim();
+        if (!line)
+          return;
+        state.output.push(line);
+        if (state.output.length > OUTPUT_LINES)
+          state.output.splice(0, state.output.length - OUTPUT_LINES);
+        state.url ??= URL_RE.exec(line)?.[1] ?? null;
+        state.code ??= CODE_RE.exec(line)?.[1] ?? null;
+      }
+      finish(key, entry, exitCode) {
+        if (entry.state.status === "exited")
+          return;
+        if (entry.partial)
+          this.addLine(entry.state, entry.partial);
+        entry.partial = "";
+        entry.state.status = "exited";
+        entry.state.exitCode = exitCode;
+        if (entry.timer)
+          clearTimeout(entry.timer);
+        entry.timer = setTimeout(() => {
+          if (this.entries.get(key) === entry)
+            this.entries.delete(key);
+        }, KEEP_EXITED_MS);
+      }
+      drop(key) {
+        const entry = this.entries.get(key);
+        if (entry?.timer)
+          clearTimeout(entry.timer);
+        this.entries.delete(key);
+      }
+    };
+  }
+});
+
+// ../core/dist/api-key-login.js
+import { spawn as spawn4 } from "node:child_process";
+function importApiKey(cwBin, account, harness, apiKey) {
+  return new Promise((resolve5) => {
+    const redact = (text) => text.split(apiKey).join("***").trim();
+    const child = spawn4(cwBin, ["account", "login", account, "--harness", harness, "--with-api-key", "-"], {
+      env: envWithoutHarness(),
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let output = "";
+    const collect = (chunk) => {
+      output += chunk.toString();
+    };
+    child.stdout.on("data", collect);
+    child.stderr.on("data", collect);
+    child.stdin.on("error", () => {
+    });
+    const timer = setTimeout(() => child.kill(), TIMEOUT_MS4);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      resolve5({ ok: false, error: redact(err.message) });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve5(code === 0 ? { ok: true } : { ok: false, error: redact(output) || `cw exited with ${String(code)}` });
+    });
+    child.stdin.end(`${apiKey}
+`);
+  });
+}
+var TIMEOUT_MS4;
+var init_api_key_login = __esm({
+  "../core/dist/api-key-login.js"() {
+    "use strict";
+    init_cw_doctor();
+    TIMEOUT_MS4 = 6e4;
+  }
+});
+
+// ../core/dist/editors.js
+import { spawn as spawn5 } from "node:child_process";
+import { accessSync, constants, existsSync as existsSync4 } from "node:fs";
+import { delimiter, join as join6 } from "node:path";
+function detectEditors(probe) {
+  const found = [];
+  for (const def of EDITORS) {
+    const cliPath = probe.onPath(def.cli);
+    if (cliPath) {
+      found.push({ id: def.id, label: def.label, bin: cliPath, args: [] });
+    } else if (probe.platform === "darwin" && probe.appExists(def.app)) {
+      found.push({ id: def.id, label: def.label, bin: "open", args: ["-a", def.app.replace(/\.app$/, "")] });
+    }
+  }
+  return found;
+}
+function openInEditor(editor, dir) {
+  return new Promise((resolve5, reject) => {
+    const child = spawn5(editor.bin, [...editor.args, dir], { detached: true, stdio: "ignore" });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve5();
+    });
+  });
+}
+var EDITORS, systemProbe;
+var init_editors = __esm({
+  "../core/dist/editors.js"() {
+    "use strict";
+    EDITORS = [
+      { id: "vscode", label: "VS Code", cli: "code", app: "Visual Studio Code.app" },
+      { id: "cursor", label: "Cursor", cli: "cursor", app: "Cursor.app" },
+      { id: "windsurf", label: "Windsurf", cli: "windsurf", app: "Windsurf.app" },
+      { id: "zed", label: "Zed", cli: "zed", app: "Zed.app" }
+    ];
+    systemProbe = {
+      onPath: (cli) => {
+        for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+          if (!dir)
+            continue;
+          const candidate = join6(dir, cli);
+          try {
+            accessSync(candidate, constants.X_OK);
+            return candidate;
+          } catch {
+          }
+        }
+        return null;
+      },
+      appExists: (app) => existsSync4(join6("/Applications", app)),
+      platform: process.platform
+    };
+  }
+});
+
+// ../core/dist/output.js
+function tailOutput(text, max = 20) {
+  return stripAnsi(text).split("\n").map((line) => line.trimEnd()).filter((line) => line.length > 0).slice(-max).join("\n");
+}
+var ANSI_RE2, stripAnsi;
+var init_output = __esm({
+  "../core/dist/output.js"() {
+    "use strict";
+    ANSI_RE2 = /\x1b\[[0-9;]*[A-Za-z]/g;
+    stripAnsi = (text) => text.replace(ANSI_RE2, "");
+  }
+});
+
+// ../core/dist/cw-routes.js
+import { Hono } from "hono";
+import { execFileSync, execFile as execFile4 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+import { readFileSync as readFileSync5, writeFileSync, existsSync as existsSync5, mkdirSync, rmSync, readdirSync as readdirSync3, statSync } from "node:fs";
+import { join as join7, resolve, dirname, basename, isAbsolute } from "node:path";
+import { homedir as homedir2 } from "node:os";
+function resolveCwBin(cwHome) {
+  const candidate = join7(cwHome, "bin", "cw");
+  return existsSync5(candidate) ? candidate : "cw";
+}
+function cwDoneTimeoutMessage(ms) {
+  return `cw --done timed out after ${ms % 1e3 === 0 ? `${ms / 1e3} s` : `${ms} ms`}`;
+}
+async function runCw(bin, args, timeoutMs) {
+  const pending = execFileAsync2(bin, args, { env: envWithoutHarness(), timeout: timeoutMs, maxBuffer: 5 * 1024 * 1024 });
+  pending.child.stdin?.end();
+  try {
+    const { stdout, stderr } = await pending;
+    return { code: 0, stdout: String(stdout), stderr: String(stderr), timedOut: false };
+  } catch (err) {
+    const e = err;
+    if (e.killed && e.signal === "SIGTERM" && typeof e.code !== "string") {
+      return { code: 124, stdout: e.stdout ?? "", stderr: e.stderr ?? "", timedOut: true };
+    }
+    return { code: typeof e.code === "number" ? e.code : 1, stdout: e.stdout ?? "", stderr: e.stderr || e.message, timedOut: false };
+  }
+}
+function cwRoutes(reader, options = {}) {
+  const app = new Hono();
+  const cwBin = resolveCwBin(reader.cwHome);
+  const logins = options.loginManager ?? new LoginManager(cwBin);
+  const run = options.runner ?? runCommand;
+  const localOnly = options.localOnly ?? true;
+  const editors = options.editors ?? detectEditors(systemProbe);
+  const cwDoneTimeoutMs = options.cwDoneTimeoutMs ?? CW_DONE_TIMEOUT_MS;
+  const limitGh = createLimiter(4);
+  const REVIEW_TTL_MS = 3e4;
+  const reviewCache = /* @__PURE__ */ new Map();
+  const knownAccount = (name) => ACCOUNT_NAME_RE.test(name) && reader.getAccounts().includes(name);
+  const doctor = createDoctorClient(cwBin);
+  app.get("/harnesses", async (c) => {
+    const result2 = await doctor.get(c.req.query("fresh") === "1");
+    if (!result2.available)
+      return c.json(result2);
+    const capabilities = Object.fromEntries(result2.doctor.harnesses.map((h) => [h.name, [...HARNESS_CAPABILITIES[h.name] ?? []]]));
+    return c.json({ ...result2, capabilities, contextTokens: readContextTokens(reader.cwHome) });
+  });
+  const usage = createUsageClient(options.usage);
+  app.get("/usage", async (c) => {
+    const result2 = await doctor.get();
+    if (!result2.available)
+      return c.json(result2);
+    return c.json({ available: true, usage: await usage.get(result2.doctor, c.req.query("fresh") === "1") });
+  });
+  app.get("/projects", (c) => {
+    return c.json(reader.getProjects());
+  });
+  app.get("/spaces", (c) => {
+    const project = c.req.query("project");
+    return c.json(reader.getSpaces(project));
+  });
+  app.get("/session/:project/:sessionDir", (c) => {
+    const { project, sessionDir } = c.req.param();
+    const session = reader.getSession(project, sessionDir);
+    if (!session)
+      return c.json({ error: "Session not found" }, 404);
+    return c.json(session);
+  });
+  app.get("/notes/:project/:sessionDir", (c) => {
+    const { project, sessionDir } = c.req.param();
+    const content = reader.getNotes(project, sessionDir);
+    return c.json({ content });
+  });
+  app.get("/accounts", (c) => {
+    return c.json(reader.getAccounts());
+  });
+  app.post("/accounts", async (c) => {
+    const body = await c.req.json();
+    const harness = body.harness || void 0;
+    const provider = body.provider || void 0;
+    const model = body.model || void 0;
+    if (!body.name || !body.name.trim()) {
+      return c.json({ ok: false, error: "Account name is required" }, 400);
+    }
+    const trimmed = body.name.trim();
+    if (!ACCOUNT_NAME_RE.test(trimmed)) {
+      return c.json({ ok: false, error: "Name must start with a letter or number and contain only letters, numbers, hyphens, and underscores (max 64 chars)" }, 400);
+    }
+    if (harness && !HARNESS_NAME_RE.test(harness)) {
+      return c.json({ ok: false, error: "Invalid harness" }, 400);
+    }
+    if (provider && !PROVIDER_NAME_RE.test(provider)) {
+      return c.json({ ok: false, error: "Invalid provider" }, 400);
+    }
+    if (provider && !supports(harness, "custom_provider")) {
+      return c.json({ ok: false, error: `${harness ?? "claude"} cannot use a provider` }, 400);
+    }
+    if (model && !MODEL_NAME_RE.test(model)) {
+      return c.json({ ok: false, error: "Invalid model" }, 400);
+    }
+    if (reader.getAccounts().includes(trimmed)) {
+      return c.json({ ok: false, error: `Account "${trimmed}" already exists` }, 409);
+    }
+    const args = ["account", "add", trimmed];
+    if (harness)
+      args.push("--harness", harness);
+    if (provider)
+      args.push("--provider", provider);
+    if (model)
+      args.push("--model", model);
+    try {
+      await execFileAsync2(cwBin, args, { encoding: "utf-8", timeout: 1e4, env: envWithoutHarness() });
+      return c.json({ ok: true, name: trimmed });
+    } catch (err) {
+      const stderr = err.stderr?.trim().split("\n")[0];
+      const message = stderr || (err instanceof Error ? err.message : "Unknown error");
+      return c.json({ ok: false, error: `Failed to create account: ${message}` }, 500);
+    }
+  });
+  app.delete("/accounts/:name", async (c) => {
+    const name = c.req.param("name");
+    if (!ACCOUNT_NAME_RE.test(name)) {
+      return c.json({ ok: false, error: "Invalid account name" }, 400);
+    }
+    const accountDir = join7(reader.cwHome, "accounts", name);
+    if (!existsSync5(accountDir)) {
+      return c.json({ ok: false, error: `Account "${name}" not found` }, 404);
+    }
+    try {
+      const { rmSync: rmSync3 } = await import("node:fs");
+      rmSync3(accountDir, { recursive: true, force: true });
+      return c.json({ ok: true });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Unknown error";
+      return c.json({ ok: false, error: `Failed to remove account: ${message}` }, 500);
+    }
+  });
+  app.post("/accounts/:name/login", async (c) => {
+    const name = c.req.param("name");
+    const { harness } = await c.req.json();
+    if (!knownAccount(name))
+      return c.json({ ok: false, error: "Unknown account" }, 404);
+    if (!harness || !HARNESS_NAME_RE.test(harness))
+      return c.json({ ok: false, error: "Invalid harness" }, 400);
+    if (!supports(harness, "headless_login")) {
+      return c.json({ ok: false, error: `${harness} has no headless login` }, 400);
+    }
+    return c.json({ ok: true, login: logins.start(name, harness) });
+  });
+  app.get("/accounts/:name/login/:harness", (c) => {
+    const login = logins.get(c.req.param("name"), c.req.param("harness"));
+    return login ? c.json({ ok: true, login }) : c.json({ ok: false, error: "No login in progress" }, 404);
+  });
+  app.delete("/accounts/:name/login/:harness", (c) => {
+    logins.stop(c.req.param("name"), c.req.param("harness"));
+    return c.json({ ok: true });
+  });
+  app.post("/accounts/:name/api-key", async (c) => {
+    const name = c.req.param("name");
+    const { harness, apiKey } = await c.req.json();
+    if (!knownAccount(name))
+      return c.json({ ok: false, error: "Unknown account" }, 404);
+    if (!harness || !HARNESS_NAME_RE.test(harness))
+      return c.json({ ok: false, error: "Invalid harness" }, 400);
+    if (!supports(harness, "api_key_login")) {
+      return c.json({ ok: false, error: `${harness} has no API key login` }, 400);
+    }
+    if (!apiKey || /[\r\n]/.test(apiKey) || apiKey.length < 8 || apiKey.length > 4096) {
+      return c.json({ ok: false, error: "Invalid API key" }, 400);
+    }
+    const result2 = await importApiKey(cwBin, name, harness, apiKey);
+    return result2.ok ? c.json({ ok: true }) : c.json({ ok: false, error: result2.error }, 500);
+  });
+  app.get("/detect/:project", (c) => {
+    const project = c.req.param("project");
+    return c.json(reader.detectStack(project));
+  });
+  app.get("/mcps", (c) => {
+    const project = c.req.query("project");
+    return c.json(reader.getMCPs(project));
+  });
+  app.get("/tools", (c) => {
+    const project = c.req.query("project");
+    return c.json(reader.getTools(project));
+  });
+  const loadGitSession = (project, sessionDir) => {
+    const session = reader.getSession(project, sessionDir);
+    if (!session)
+      return { error: true };
+    if (!session.worktree)
+      return { empty: true };
+    return { session };
+  };
+  app.get("/git/status/:project/:sessionDir", async (c) => {
+    const result2 = loadGitSession(c.req.param("project"), c.req.param("sessionDir"));
+    if ("error" in result2)
+      return c.json({ error: "Session not found" }, 404);
+    if ("empty" in result2)
+      return c.json({ output: "" });
+    const status = await run("git", ["status", "--short"], result2.session.worktree);
+    return c.json({ output: status.code === 0 ? status.stdout : "" });
+  });
+  app.get("/git/log/:project/:sessionDir", async (c) => {
+    const result2 = loadGitSession(c.req.param("project"), c.req.param("sessionDir"));
+    if ("error" in result2)
+      return c.json({ error: "Session not found" }, 404);
+    if ("empty" in result2)
+      return c.json({ output: "" });
+    const log = await run("git", ["log", "--oneline", "-20"], result2.session.worktree);
+    return c.json({ output: log.code === 0 ? log.stdout : "" });
+  });
+  app.get("/git/branch/:project/:sessionDir", async (c) => {
+    const result2 = loadGitSession(c.req.param("project"), c.req.param("sessionDir"));
+    if ("error" in result2)
+      return c.json({ error: "Session not found" }, 404);
+    if ("empty" in result2)
+      return c.json({ branch: "" });
+    const head = await run("git", ["rev-parse", "--abbrev-ref", "HEAD"], result2.session.worktree);
+    return c.json({ branch: head.code === 0 ? head.stdout.trim() : "" });
+  });
+  app.get("/git/diff/:project/:sessionDir", async (c) => {
+    const result2 = loadGitSession(c.req.param("project"), c.req.param("sessionDir"));
+    if ("error" in result2)
+      return c.json({ error: "Session not found" }, 404);
+    if ("empty" in result2)
+      return c.json({ output: "" });
+    const worktree = result2.session.worktree;
+    const base = await resolveBase(run, worktree, [result2.session.base_branch, "origin/HEAD", "origin/main"]);
+    if (!base)
+      return c.json({ output: "" });
+    const diff = await run("git", ["diff", "--stat", base], worktree);
+    return c.json({ output: diff.code === 0 ? diff.stdout : "" });
+  });
+  app.get("/review-state/:project/:sessionDir", async (c) => {
+    const project = c.req.param("project");
+    const sessionDir = c.req.param("sessionDir");
+    const session = reader.getSession(project, sessionDir);
+    if (!session)
+      return c.json({ error: "Session not found" }, 404);
+    const key = `${project}::${sessionDir}`;
+    const cached = reviewCache.get(key);
+    if (c.req.query("fresh") !== "1" && cached && Date.now() - cached.at < REVIEW_TTL_MS) {
+      return c.json(await cached.value);
+    }
+    const projectPath = reader.getProjects()[project]?.path ?? null;
+    const value = buildTaskReviewState(session, projectPath, { run, limitGh, exists: existsSync5 });
+    reviewCache.set(key, { at: Date.now(), value });
+    value.catch(() => reviewCache.delete(key));
+    return c.json(await value);
+  });
+  app.get("/editors", (c) => c.json({
+    enabled: localOnly,
+    editors: localOnly ? editors.map(({ id, label }) => ({ id, label })) : []
+  }));
+  app.post("/open-in-editor", async (c) => {
+    if (!localOnly) {
+      return c.json({ ok: false, error: "Opening an editor only works on the machine running Forge" }, 403);
+    }
+    const { project, sessionDir, editor } = await c.req.json();
+    const target = editors.find((e) => e.id === editor);
+    if (!target)
+      return c.json({ ok: false, error: `Editor not available: ${editor}` }, 400);
+    const session = reader.getSession(project, sessionDir);
+    if (!session?.worktree || !existsSync5(session.worktree)) {
+      return c.json({ ok: false, error: "This task has no workspace on disk yet" }, 404);
+    }
+    try {
+      await openInEditor(target, session.worktree);
+      return c.json({ ok: true });
+    } catch (err) {
+      return c.json({ ok: false, error: `Could not start ${target.label}: ${err.message}` }, 500);
+    }
+  });
+  app.post("/start", async (c) => {
+    const { type, project, task, description, workflow, account, directory, skipPermissions, model, loopPrompt, loopInterval, name, harness } = await c.req.json();
+    if (harness !== void 0 && !HARNESS_NAME_RE.test(harness)) {
+      return c.json({ ok: false, error: "Invalid harness" }, 400);
+    }
+    if (type === "login") {
+      if (!account || !ACCOUNT_NAME_RE.test(account) || !reader.getAccounts().includes(account)) {
+        return c.json({ ok: false, error: "Unknown account" }, 400);
+      }
+      if (!harness)
+        return c.json({ ok: false, error: "Harness is required" }, 400);
+      const sessionDirName2 = `login-${account}-${harness}`;
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const sessionData2 = {
+        project: ACCOUNTS_PROJECT,
+        type: "login",
+        account,
+        harness,
+        workflow: "",
+        worktree: "",
+        notes: "",
+        status: "active",
+        created: now,
+        last_opened: now,
+        opens: 0,
+        sessionDir: sessionDirName2
+      };
+      pendingSessions.set(`${ACCOUNTS_PROJECT}::${sessionDirName2}`, sessionData2);
+      return c.json({ ok: true, session: sessionData2 });
+    }
+    if (type === "general") {
+      const acct = account || "default";
+      const sessionDirName2 = `general-${acct}-${Date.now()}`;
+      const projectPath = project ? reader.getProjects()[project]?.path : void 0;
+      const projectName = project && projectPath ? project : GENERAL_PROJECT;
+      const sessionData2 = {
+        project: projectName,
+        task: task?.trim() || void 0,
+        type: "general",
+        account: acct,
+        harness: harness || void 0,
+        model: model || void 0,
+        workflow: "",
+        worktree: projectPath ?? directory ?? "",
+        notes: "",
+        status: "active",
+        created: (/* @__PURE__ */ new Date()).toISOString(),
+        last_opened: (/* @__PURE__ */ new Date()).toISOString(),
+        opens: 0,
+        sessionDir: sessionDirName2,
+        skipPermissions: skipPermissions ?? false
+      };
+      pendingSessions.set(`${projectName}::${sessionDirName2}`, sessionData2);
+      return c.json({ ok: true, session: sessionData2, command: `cw launch ${acct}` });
+    }
+    if (type === "create") {
+      const name2 = project?.trim();
+      if (!name2)
+        return c.json({ ok: false, error: "Project name is required" }, 400);
+      const sessionDirName2 = `create-${name2}-${Date.now()}`;
+      const sessionData2 = {
+        project: CREATING_PROJECT,
+        task: name2,
+        type: "create",
+        account: account ?? "",
+        harness: harness || void 0,
+        model: model || void 0,
+        workflow: "",
+        worktree: directory ?? "",
+        notes: description ?? name2,
+        status: "active",
+        created: (/* @__PURE__ */ new Date()).toISOString(),
+        last_opened: (/* @__PURE__ */ new Date()).toISOString(),
+        opens: 0,
+        sessionDir: sessionDirName2,
+        skipPermissions: skipPermissions ?? false
+      };
+      pendingSessions.set(`${CREATING_PROJECT}::${sessionDirName2}`, sessionData2);
+      return c.json({ ok: true, session: sessionData2 });
+    }
+    if (type === "loop") {
+      if (!project)
+        return c.json({ ok: false, error: "Project is required" }, 400);
+      if (harness && harness !== "claude") {
+        return c.json({ ok: false, error: "Loop runs on Claude Code only" }, 400);
+      }
+      const prompt = (loopPrompt ?? "").trim();
+      if (!prompt)
+        return c.json({ ok: false, error: "Loop prompt is required" }, 400);
+      const interval = (loopInterval ?? "").trim();
+      if (interval && !/^\d+[smh]$/.test(interval)) {
+        return c.json({ ok: false, error: "Interval must be like 30s, 5m, 2h" }, 400);
+      }
+      const explicitName = name?.trim();
+      if (explicitName && !/^[a-z0-9]([a-z0-9-]{0,28}[a-z0-9])?$/.test(explicitName)) {
+        return c.json({ ok: false, error: "Invalid name. Use lowercase letters, numbers, hyphens (max 30 chars)" }, 400);
+      }
+      const slug = (explicitName || prompt.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 30)).replace(/^-+|-+$/g, "");
+      if (!slug)
+        return c.json({ ok: false, error: "Could not derive a name from the prompt" }, 400);
+      const sessionDirName2 = `loop-${slug}`;
+      const loopSessionFile = join7(reader.cwHome, "sessions", project, sessionDirName2, "session.json");
+      if (existsSync5(loopSessionFile)) {
+        try {
+          const meta = JSON.parse(readFileSync5(loopSessionFile, "utf-8"));
+          if (meta.status === "active") {
+            return c.json({ ok: false, error: `Loop "${slug}" already exists for ${project}. Pick a different name or open the existing session.` }, 409);
+          }
+        } catch {
+        }
+      }
+      const projectPath = reader.getProjects()[project]?.path ?? "";
+      const sessionData2 = {
+        project,
+        task: slug,
+        type: "loop",
+        account: account ?? "",
+        harness: harness || void 0,
+        model: model || void 0,
+        loop_prompt: prompt,
+        loop_interval: interval,
+        workflow: "",
+        // This in-memory pending session may carry the project path (used as
+        // the PTY's cwd), but it must never be persisted to CW's session.json —
+        // `cw clean` treats a persisted worktree as a stale-space candidate to
+        // rm -rf. CW itself writes 'worktree': '' when it creates the file.
+        worktree: projectPath,
+        notes: "",
+        status: "active",
+        created: (/* @__PURE__ */ new Date()).toISOString(),
+        last_opened: (/* @__PURE__ */ new Date()).toISOString(),
+        opens: 0,
+        sessionDir: sessionDirName2,
+        skipPermissions: skipPermissions ?? false
+      };
+      pendingSessions.set(`${project}::${sessionDirName2}`, sessionData2);
+      return c.json({ ok: true, session: sessionData2 });
+    }
+    if (!project || !task) {
+      return c.json({ ok: false, error: "Project and task are required" }, 400);
+    }
+    const cwHome = reader.cwHome;
+    let taskSlug = task.trim();
+    let taskUrl;
+    let taskSource;
+    if (taskSlug.startsWith("http")) {
+      taskUrl = taskSlug;
+      if (taskSlug.includes("github.com")) {
+        taskSource = "github";
+        const m = taskSlug.match(/(\d+)\s*$/);
+        if (m)
+          taskSlug = m[1];
+      } else if (taskSlug.includes("linear.app")) {
+        taskSource = "linear";
+        const m = taskSlug.match(/([A-Z]+-\d+)/);
+        if (m)
+          taskSlug = m[1];
+      } else if (taskSlug.includes("notion.so") || taskSlug.includes("notion.site")) {
+        taskSource = "notion";
+        const parts = taskSlug.split("/");
+        const last = parts[parts.length - 1] ?? "";
+        taskSlug = last.replace(/-[a-f0-9]+$/, "").slice(0, 30);
+      } else {
+        taskSource = "url";
+        taskSlug = taskSlug.replace(/^https?:\/\//, "").replace(/\//g, "-").slice(0, 30);
+      }
+    }
+    const dirPrefix = type === "review" ? "review-pr-" : "task-";
+    const sessionDir = join7(cwHome, "sessions", project, `${dirPrefix}${taskSlug}`);
+    const sessionFile = join7(sessionDir, "session.json");
+    if (existsSync5(sessionFile)) {
+      try {
+        const meta = JSON.parse(readFileSync5(sessionFile, "utf-8"));
+        if (meta.status === "active") {
+          return c.json({ ok: false, error: `Session "${taskSlug}" already exists for ${project}. Pick a different name or open the existing task.` }, 409);
+        }
+      } catch {
+      }
+    }
+    const args = [];
+    if (skipPermissions)
+      args.push("--skip-permissions");
+    if (type === "review") {
+      args.push("review", project, task);
+      if (account)
+        args.push("--account", account);
+      if (model)
+        args.push("--model", model);
+    } else {
+      args.push("work", project, task);
+      if (account)
+        args.push("--account", account);
+      if (workflow)
+        args.push("--workflow", workflow);
+      if (model)
+        args.push("--model", model);
+    }
+    if (harness)
+      args.push("--harness", harness);
+    if (description) {
+      const notesDir = join7(cwHome, "sessions", project, `${dirPrefix}${taskSlug}`);
+      mkdirSync(notesDir, { recursive: true });
+      const notesFile = join7(notesDir, type === "review" ? "REVIEW_NOTES.md" : "TASK_NOTES.md");
+      if (!existsSync5(notesFile)) {
+        const header = type === "review" ? "Review" : "Task";
+        const now = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+        writeFileSync(notesFile, [
+          `# ${header}: ${taskSlug}`,
+          `**Project:** ${project}`,
+          `**Created:** ${now}`,
+          "",
+          "## Description",
+          description,
+          "",
+          "## Context",
+          "<!-- Additional context discovered during work -->",
+          "",
+          "## Decisions",
+          "<!-- Important decisions made during this task -->",
+          "",
+          "## Status",
+          "- [ ] Pending",
+          "",
+          "## Notes",
+          "<!-- Findings, context, references -->",
+          ""
+        ].join("\n"));
+      }
+    }
+    const sessionDirName = `${dirPrefix}${taskSlug}`;
+    const sessionData = {
+      project,
+      task: type === "review" ? void 0 : taskSlug,
+      pr: type === "review" ? taskSlug : void 0,
+      type: type === "review" ? "review" : "task",
+      account: account ?? "",
+      harness: harness || void 0,
+      workflow: workflow ?? "",
+      model: model || void 0,
+      source: taskSource,
+      source_url: taskUrl,
+      worktree: "",
+      notes: "",
+      status: "active",
+      created: (/* @__PURE__ */ new Date()).toISOString(),
+      last_opened: (/* @__PURE__ */ new Date()).toISOString(),
+      opens: 0,
+      sessionDir: sessionDirName,
+      skipPermissions: skipPermissions ?? false
+    };
+    pendingSessions.set(`${project}::${sessionDirName}`, sessionData);
+    return c.json({ ok: true, session: sessionData, command: `cw ${args.join(" ")}` });
+  });
+  app.post("/done", async (c) => {
+    const { project, task, type, sessionDir } = await c.req.json();
+    const sessionDirName = sessionDir ?? (type === "review" ? `review-pr-${task}` : type === "loop" ? `loop-${task}` : `task-${task}`);
+    const args = type === "review" ? ["review", project, task, "--done"] : type === "loop" ? ["loop", project, task, "--done"] : ["work", project, task, "--done"];
+    reviewCache.delete(`${project}::${sessionDirName}`);
+    const result2 = await runCw(cwBin, args, cwDoneTimeoutMs);
+    if (result2.code === 0)
+      return c.json({ ok: true });
+    const output = tailOutput(`${result2.stdout}
+${result2.stderr}`);
+    const error = result2.timedOut ? [cwDoneTimeoutMessage(cwDoneTimeoutMs), output].filter(Boolean).join("\n") : output || "cw --done failed";
+    return c.json({ ok: false, error }, 500);
+  });
+  app.post("/move-project", async (c) => {
+    const { project, toAccount } = await c.req.json();
+    if (!project || !toAccount) {
+      return c.json({ ok: false, error: "Project and target account are required" }, 400);
+    }
+    if (!ACCOUNT_NAME_RE.test(toAccount)) {
+      return c.json({ ok: false, error: "Invalid account name" }, 400);
+    }
+    const projects = reader.getProjects();
+    if (!projects[project]) {
+      return c.json({ ok: false, error: `Project "${project}" not found` }, 404);
+    }
+    if (projects[project].account === toAccount) {
+      return c.json({ ok: false, error: `Project "${project}" is already in account "${toAccount}"` }, 409);
+    }
+    if (!reader.getAccounts().includes(toAccount)) {
+      return c.json({ ok: false, error: `Account "${toAccount}" does not exist` }, 404);
+    }
+    projects[project] = { ...projects[project], account: toAccount };
+    try {
+      writeFileSync(join7(reader.cwHome, "projects.json"), JSON.stringify(projects, null, 2));
+      return c.json({ ok: true });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Unknown error";
+      return c.json({ ok: false, error: `Failed to update projects: ${message}` }, 500);
+    }
+  });
+  app.post("/delete-project", async (c) => {
+    const { project, deleteFiles } = await c.req.json();
+    const projects = reader.getProjects();
+    const projPath = projects[project]?.path;
+    try {
+      execFileSync(cwBin, ["project", "remove", project, "--yes"], { encoding: "utf-8", timeout: 1e4, stdio: "pipe", env: envWithoutHarness() });
+    } catch {
+    }
+    const sessionsDir = join7(reader.cwHome, "sessions", project);
+    if (existsSync5(sessionsDir)) {
+      try {
+        rmSync(sessionsDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    if (deleteFiles && projPath) {
+      try {
+        rmSync(projPath, { recursive: true, force: true });
+      } catch {
+        return c.json({ ok: true, filesDeleted: false, reason: "Failed to delete directory" });
+      }
+    }
+    return c.json({ ok: true, filesDeleted: deleteFiles && !!projPath });
+  });
+  const resolveBrowsePath = (input) => {
+    const home = homedir2();
+    let p = input.trim();
+    if (!p)
+      p = home;
+    if (p === "~" || p.startsWith("~/"))
+      p = join7(home, p.slice(1).replace(/^\//, ""));
+    if (!isAbsolute(p))
+      return null;
+    return resolve(p);
+  };
+  app.get("/browse-dirs", (c) => {
+    const requested = c.req.query("path") ?? "~";
+    const target = resolveBrowsePath(requested);
+    if (!target) {
+      return c.json({ ok: false, error: "Path must be absolute or start with ~" }, 400);
+    }
+    if (!existsSync5(target)) {
+      return c.json({ ok: false, error: `Path does not exist: ${target}` }, 404);
+    }
+    let stat;
+    try {
+      stat = statSync(target);
+    } catch {
+      return c.json({ ok: false, error: "Cannot stat path" }, 500);
+    }
+    if (!stat.isDirectory()) {
+      return c.json({ ok: false, error: "Not a directory" }, 400);
+    }
+    let entries = [];
+    try {
+      entries = readdirSync3(target, { withFileTypes: true });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Unknown error";
+      return c.json({ ok: false, error: `Cannot read directory: ${message}` }, 500);
+    }
+    const dirs = entries.filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map(({ name }) => {
+      const full = join7(target, name);
+      return { name, path: full, isGitRepo: existsSync5(join7(full, ".git")) };
+    }).sort((a, b) => a.name.localeCompare(b.name));
+    const parent = dirname(target);
+    return c.json({
+      ok: true,
+      path: target,
+      parent: parent === target ? null : parent,
+      home: homedir2(),
+      isGitRepo: existsSync5(join7(target, ".git")),
+      entries: dirs
+    });
+  });
+  app.post("/register-project", async (c) => {
+    const { path: rawPath, account, alias, type } = await c.req.json();
+    if (!rawPath || !account) {
+      return c.json({ ok: false, error: "Path and account are required" }, 400);
+    }
+    if (!ACCOUNT_NAME_RE.test(account)) {
+      return c.json({ ok: false, error: "Invalid account name" }, 400);
+    }
+    const projectPath = resolveBrowsePath(rawPath);
+    if (!projectPath) {
+      return c.json({ ok: false, error: "Path must be absolute or start with ~" }, 400);
+    }
+    if (!existsSync5(projectPath)) {
+      return c.json({ ok: false, error: `Path does not exist: ${projectPath}` }, 404);
+    }
+    if (!existsSync5(join7(projectPath, ".git"))) {
+      return c.json({ ok: false, error: "Selected directory is not a git repository" }, 400);
+    }
+    if (!reader.getAccounts().includes(account)) {
+      return c.json({ ok: false, error: `Account "${account}" does not exist` }, 404);
+    }
+    const projectName = (alias?.trim() || basename(projectPath)).trim();
+    if (reader.getProjects()[projectName]) {
+      return c.json({ ok: false, error: `Project "${projectName}" is already registered` }, 409);
+    }
+    const args = ["project", "register", projectPath, "--account", account];
+    if (alias?.trim())
+      args.push("--alias", alias.trim());
+    if (type?.trim())
+      args.push("--type", type.trim());
+    try {
+      await execFileAsync2(cwBin, args, { encoding: "utf-8", timeout: 3e4, env: envWithoutHarness() });
+      return c.json({ ok: true, project: projectName });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Unknown error";
+      return c.json({ ok: false, error: `Failed to register project: ${message}` }, 500);
+    }
+  });
+  return app;
+}
+var execFileAsync2, GENERAL_PROJECT, CREATING_PROJECT, ACCOUNTS_PROJECT, pendingSessions, CW_DONE_TIMEOUT_MS;
+var init_cw_routes = __esm({
+  "../core/dist/cw-routes.js"() {
+    "use strict";
+    init_cw_types();
+    init_cw_doctor();
+    init_usage();
+    init_harness_capabilities();
+    init_login_manager();
+    init_api_key_login();
+    init_task_review();
+    init_editors();
+    init_output();
+    execFileAsync2 = promisify2(execFile4);
+    GENERAL_PROJECT = "__general";
+    CREATING_PROJECT = "__creating";
+    ACCOUNTS_PROJECT = "__accounts";
+    pendingSessions = /* @__PURE__ */ new Map();
+    CW_DONE_TIMEOUT_MS = 6e4;
+  }
+});
+
+// ../core/dist/plugins.js
+import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync4 } from "node:fs";
+import { basename as basename2, join as join8, resolve as resolve2, sep } from "node:path";
+function readJson(path) {
+  try {
+    const value = JSON.parse(readFileSync6(path, "utf-8"));
+    return isRecord(value) ? value : {};
+  } catch {
+    return {};
+  }
+}
+function normalizeRepo(value) {
+  if (!value)
+    return void 0;
+  const m = value.trim().match(/^(?:git@github\.com:|(?:https?|ssh|git):\/\/(?:[^@/]+@)?github\.com\/)?([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/i);
+  return m ? `${m[1]}/${m[2]}`.toLowerCase() : void 0;
+}
+function createRemoteLookup(run) {
+  const cache = /* @__PURE__ */ new Map();
+  return (projectPath) => {
+    let hit = cache.get(projectPath);
+    if (!hit) {
+      hit = run("git", ["remote", "get-url", "origin"], projectPath).then((r) => r.code === 0 && r.stdout.trim() || null).catch(() => null);
+      cache.set(projectPath, hit);
+    }
+    return hit;
+  };
+}
+function scanDirs(root) {
+  if (!existsSync6(root))
+    return [];
+  return readdirSync4(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => join8(root, e.name));
+}
+function skillDirs(installPath, manifest) {
+  const listed = manifest["skills"];
+  if (Array.isArray(listed)) {
+    return listed.filter((p) => typeof p === "string").map((p) => resolve2(installPath, p)).filter((p) => inside(installPath, p));
+  }
+  if (typeof listed === "string") {
+    const root = resolve2(installPath, listed);
+    return inside(installPath, root) ? scanDirs(root) : [];
+  }
+  return scanDirs(join8(installPath, "skills"));
+}
+function readSkill(reader, dir) {
+  try {
+    const { frontmatter } = reader.parseFrontmatter(readFileSync6(join8(dir, "SKILL.md"), "utf-8"));
+    return { name: String(frontmatter["name"] ?? basename2(dir)), description: String(frontmatter["description"] ?? ""), path: dir };
+  } catch {
+    return null;
+  }
+}
+function manifestRepo(manifest) {
+  const repo = manifest["repository"];
+  if (typeof repo === "string")
+    return repo;
+  if (isRecord(repo) && typeof repo["url"] === "string")
+    return repo["url"];
+  return void 0;
+}
+function marketplaceRepo(marketplaces, marketplace) {
+  const entry = marketplaces[marketplace];
+  const source = isRecord(entry) ? entry["source"] : void 0;
+  if (!isRecord(source))
+    return void 0;
+  const value = source["repo"] ?? source["url"];
+  return typeof value === "string" ? value : void 0;
+}
+function projectSkillNames(projectPath) {
+  const dir = join8(projectPath, ".claude", "skills");
+  if (!existsSync6(dir))
+    return [];
+  return readdirSync4(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync6(join8(dir, e.name, "SKILL.md"))).map((e) => e.name).sort();
+}
+async function listPlugins(reader, remoteOf) {
+  const scopes = [
+    { scope: "global", scopeRef: "global" },
+    ...reader.getAccounts().map((a) => ({ scope: "account", scopeRef: a }))
+  ];
+  const found = /* @__PURE__ */ new Map();
+  for (const { scope, scopeRef } of scopes) {
+    const configDir = reader.getSkillConfigDir(scope, scopeRef);
+    const installed = readJson(join8(configDir, "plugins", "installed_plugins.json"))["plugins"];
+    if (!isRecord(installed))
+      continue;
+    const marketplaces = readJson(join8(configDir, "plugins", "known_marketplaces.json"));
+    const enabledPlugins = readJson(join8(configDir, "settings.json"))["enabledPlugins"];
+    for (const [id, entries] of Object.entries(installed)) {
+      if (!Array.isArray(entries))
+        continue;
+      const user = entries.find((e) => isRecord(e) && e["scope"] === "user" && typeof e["installPath"] === "string");
+      if (!user)
+        continue;
+      const marketplace = id.slice(id.lastIndexOf("@") + 1);
+      const install = {
+        scope,
+        scopeRef,
+        version: String(user["version"] ?? ""),
+        enabled: !isRecord(enabledPlugins) || enabledPlugins[id] !== false,
+        installPath: String(user["installPath"]),
+        lastUpdated: typeof user["lastUpdated"] === "string" ? user["lastUpdated"] : void 0
+      };
+      const list = found.get(id) ?? [];
+      list.push({ install, repo: marketplaceRepo(marketplaces, marketplace) });
+      found.set(id, list);
+    }
+  }
+  const projects = Object.entries(reader.getProjects());
+  const remotes = await Promise.all(projects.map(async ([name, p]) => ({ name, path: p.path, repo: normalizeRepo(await remoteOf(p.path) ?? void 0) })));
+  const plugins = [];
+  for (const [id, list] of found) {
+    const newest = [...list].sort((a, b) => (b.install.lastUpdated ?? "").localeCompare(a.install.lastUpdated ?? ""))[0];
+    const manifest = readJson(join8(newest.install.installPath, ".claude-plugin", "plugin.json"));
+    const repo = [manifestRepo(manifest), ...list.map((f) => f.repo)].map(normalizeRepo).find(Boolean);
+    const match = repo ? remotes.find((r) => r.repo === repo) : void 0;
+    plugins.push({
+      id,
+      name: id.slice(0, id.lastIndexOf("@")),
+      marketplace: id.slice(id.lastIndexOf("@") + 1),
+      description: String(manifest["description"] ?? ""),
+      repo,
+      installs: list.map((f) => f.install),
+      skills: skillDirs(newest.install.installPath, manifest).flatMap((dir) => readSkill(reader, dir) ?? []),
+      project: match?.name,
+      contributing: match ? existsSync6(join8(match.path, "CONTRIBUTING.md")) : false,
+      projectSkills: match ? projectSkillNames(match.path) : []
+    });
+  }
+  return plugins.sort((a, b) => a.name.localeCompare(b.name));
+}
+function readPluginSkill(plugin, name) {
+  const skill = plugin.skills.find((s) => s.name === name);
+  if (!skill)
+    return null;
+  try {
+    return { name: skill.name, description: skill.description, content: readFileSync6(join8(skill.path, "SKILL.md"), "utf-8") };
+  } catch {
+    return null;
+  }
+}
+var isRecord, inside;
+var init_plugins = __esm({
+  "../core/dist/plugins.js"() {
+    "use strict";
+    isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    inside = (root, path) => {
+      const r = resolve2(root);
+      const p = resolve2(path);
+      return p === r || p.startsWith(r + sep);
+    };
+  }
+});
+
+// ../core/dist/skill-routes.js
+import { Hono as Hono2 } from "hono";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, rmSync as rmSync2, existsSync as existsSync7, unlinkSync } from "node:fs";
+import { dirname as dirname2, join as join9 } from "node:path";
+function installFailure(result2) {
+  try {
+    const entries = JSON.parse(result2.stdout);
+    const reason = entries.find((e) => e.status !== "installed")?.reason;
+    if (reason)
+      return reason;
+  } catch {
+  }
+  return result2.stderr.trim().split("\n").pop() || `skills CLI exited with code ${result2.code}`;
+}
+function commandFailure(result2) {
+  if (result2.code === 127)
+    return "the claude CLI is not installed";
+  const lines2 = `${result2.stderr}
+${result2.stdout}`.trim().split("\n").filter(Boolean);
+  return lines2.find((l) => /error|fatal/i.test(l)) ?? lines2.pop() ?? `claude exited with code ${result2.code}`;
+}
+function skillRoutes(reader, options = {}) {
+  const runnerFor = options.runnerFor ?? ((env) => createRunner(env, INSTALL_TIMEOUT_MS));
+  const remoteOf = options.remoteOf ?? createRemoteLookup(runCommand);
+  const app = new Hono2();
+  const updating = /* @__PURE__ */ new Set();
+  app.get("/", (c) => {
+    const account = c.req.query("account");
+    const project = c.req.query("project");
+    return c.json(reader.getSkills(account, project));
+  });
+  app.get("/global/:name", (c) => {
+    const name = c.req.param("name");
+    const skill = reader.getSkill("global", "global", name);
+    if (!skill)
+      return c.json({ error: "Skill not found" }, 404);
+    return c.json(skill);
+  });
+  app.get("/account/:account/:name", (c) => {
+    const { account, name } = c.req.param();
+    const skill = reader.getSkill("account", account, name);
+    if (!skill)
+      return c.json({ error: "Skill not found" }, 404);
+    return c.json(skill);
+  });
+  app.get("/project/:project/:name", (c) => {
+    const { project, name } = c.req.param();
+    const skill = reader.getSkill("project", project, name);
+    if (!skill)
+      return c.json({ error: "Skill not found" }, 404);
+    return c.json(skill);
+  });
+  app.post("/", async (c) => {
+    const { scope, scopeRef, name, content } = await c.req.json();
+    const ref = scopeRef ?? (scope === "global" ? "global" : "");
+    const dir = reader.getSkillDir(scope, ref, name);
+    if (existsSync7(join9(dir, "SKILL.md"))) {
+      return c.json({ error: "Skill already exists" }, 409);
+    }
+    try {
+      mkdirSync2(dir, { recursive: true });
+      writeFileSync2(join9(dir, "SKILL.md"), content, "utf-8");
+      return c.json({ ok: true, dir });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Unknown error";
+      return c.json({ error: `Failed to create skill: ${message}` }, 500);
+    }
+  });
+  const scopePatterns = [
+    { pattern: "/global/:name", scope: "global" },
+    { pattern: "/account/:account/:name", scope: "account", paramKey: "account" },
+    { pattern: "/project/:project/:name", scope: "project", paramKey: "project" }
+  ];
+  for (const { pattern, scope, paramKey } of scopePatterns) {
+    app.put(pattern, async (c) => {
+      const params = c.req.param();
+      const scopeRef = paramKey ? params[paramKey] ?? "" : "global";
+      const name = params["name"] ?? "";
+      const dir = reader.getSkillDir(scope, scopeRef, name);
+      const skillMd = join9(dir, "SKILL.md");
+      if (!existsSync7(skillMd)) {
+        return c.json({ error: "Skill not found" }, 404);
+      }
+      const { content } = await c.req.json();
+      try {
+        writeFileSync2(skillMd, content, "utf-8");
+        return c.json({ ok: true });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Unknown error";
+        return c.json({ error: `Failed to update skill: ${message}` }, 500);
+      }
+    });
+    app.put(`${pattern}/references/:filename`, async (c) => {
+      const params = c.req.param();
+      const scopeRef = paramKey ? params[paramKey] ?? "" : "global";
+      const name = params["name"] ?? "";
+      const filename = params["filename"] ?? "";
+      const dir = reader.getSkillDir(scope, scopeRef, name);
+      const skillMd = join9(dir, "SKILL.md");
+      if (!existsSync7(skillMd)) {
+        return c.json({ error: "Skill not found" }, 404);
+      }
+      const { content } = await c.req.json();
+      try {
+        const refsDir = join9(dir, "references");
+        mkdirSync2(refsDir, { recursive: true });
+        writeFileSync2(join9(refsDir, filename), content, "utf-8");
+        return c.json({ ok: true });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Unknown error";
+        return c.json({ error: `Failed to write reference: ${message}` }, 500);
+      }
+    });
+    app.delete(`${pattern}/references/:filename`, (c) => {
+      const params = c.req.param();
+      const scopeRef = paramKey ? params[paramKey] ?? "" : "global";
+      const name = params["name"] ?? "";
+      const filename = params["filename"] ?? "";
+      const dir = reader.getSkillDir(scope, scopeRef, name);
+      const refFile = join9(dir, "references", filename);
+      if (!existsSync7(refFile)) {
+        return c.json({ error: "Reference not found" }, 404);
+      }
+      try {
+        unlinkSync(refFile);
+        return c.json({ ok: true });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Unknown error";
+        return c.json({ error: `Failed to delete reference: ${message}` }, 500);
+      }
+    });
+    app.delete(pattern, (c) => {
+      const params = c.req.param();
+      const scopeRef = paramKey ? params[paramKey] ?? "" : "global";
+      const name = params["name"] ?? "";
+      const dir = reader.getSkillDir(scope, scopeRef, name);
+      if (!existsSync7(join9(dir, "SKILL.md"))) {
+        return c.json({ error: "Skill not found" }, 404);
+      }
+      try {
+        rmSync2(dir, { recursive: true, force: true });
+        return c.json({ ok: true });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Unknown error";
+        return c.json({ error: `Failed to delete skill: ${message}` }, 500);
+      }
+    });
+  }
+  app.get("/explore", async (c) => {
+    const q = c.req.query("q") ?? "";
+    try {
+      const res = await globalThis.fetch(`https://skills.sh/api/search?q=${encodeURIComponent(q)}`);
+      if (!res.ok) {
+        return c.json({ results: [] });
+      }
+      const data = await res.json();
+      const results = (data.skills ?? []).flatMap((s) => s.id ? [{
+        name: s.name ?? s.id,
+        slug: s.id,
+        skillId: s.skillId ?? "",
+        installs: s.installs ?? 0,
+        source: "skills.sh",
+        url: `https://skills.sh/${s.id}`,
+        repo: s.source ?? ""
+      }] : []);
+      return c.json({ results });
+    } catch {
+      return c.json({ results: [] });
+    }
+  });
+  app.post("/install", async (c) => {
+    const { repo, skill, scope, scopeRef } = await c.req.json();
+    if (!repo || !skill) {
+      return c.json({ error: "repo and skill are required" }, 400);
+    }
+    const ref = scope === "global" ? "global" : scopeRef ?? "";
+    const known = scope === "global" || (scope === "account" ? reader.getAccounts().includes(ref) : ref in reader.getProjects());
+    if (!known) {
+      return c.json({ error: `Unknown ${scope}: ${ref}` }, 404);
+    }
+    const configDir = reader.getSkillConfigDir(scope, ref);
+    const args = ["--yes", "skills", "add", repo, "--skill", skill, "--agent", "claude-code", "--yes", "--json"];
+    if (scope !== "project")
+      args.push("--global");
+    const run = runnerFor({ ...envWithoutHarness(), CLAUDE_CONFIG_DIR: configDir });
+    const result2 = await run("npx", args, dirname2(configDir));
+    if (result2.code !== 0) {
+      return c.json({ error: `Failed to install skill: ${installFailure(result2)}` }, 500);
+    }
+    return c.json({ ok: true });
+  });
+  app.get("/plugins", async (c) => c.json(await listPlugins(reader, remoteOf)));
+  app.get("/plugins/:id/skills/:name", async (c) => {
+    const plugin = (await listPlugins(reader, remoteOf)).find((p) => p.id === c.req.param("id"));
+    const skill = plugin && readPluginSkill(plugin, c.req.param("name"));
+    if (!skill)
+      return c.json({ error: "Skill not found" }, 404);
+    return c.json(skill);
+  });
+  app.post("/plugins/:id/update", async (c) => {
+    const id = c.req.param("id");
+    const { scope, scopeRef } = await c.req.json().catch(() => ({}));
+    const ref = scope === "global" ? "global" : scopeRef ?? "";
+    const find = async () => (await listPlugins(reader, remoteOf)).find((p) => p.id === id);
+    const plugin = await find();
+    const install = plugin?.installs.find((i) => i.scope === scope && i.scopeRef === ref);
+    if (!plugin || !install)
+      return c.json({ error: `${id} is not installed in ${ref || "that scope"}` }, 404);
+    const configDir = reader.getSkillConfigDir(install.scope, install.scopeRef);
+    if (updating.has(configDir))
+      return c.json({ error: `An update is already running for ${ref}` }, 409);
+    updating.add(configDir);
+    try {
+      const { CLAUDE_CONFIG_DIR: _ignored, ...base } = envWithoutHarness();
+      const run = runnerFor(install.scope === "global" ? base : { ...base, CLAUDE_CONFIG_DIR: configDir });
+      for (const args of [["plugin", "marketplace", "update", plugin.marketplace], ["plugin", "update", plugin.id]]) {
+        const result2 = await run("claude", args, configDir);
+        if (result2.code !== 0)
+          return c.json({ error: `Failed to update ${plugin.name}: ${commandFailure(result2)}` }, 500);
+      }
+    } finally {
+      updating.delete(configDir);
+    }
+    const version = (await find())?.installs.find((i) => i.scope === install.scope && i.scopeRef === ref)?.version ?? install.version;
+    return c.json({ ok: true, version });
+  });
+  return app;
+}
+var INSTALL_TIMEOUT_MS;
+var init_skill_routes = __esm({
+  "../core/dist/skill-routes.js"() {
+    "use strict";
+    init_cw_doctor();
+    init_task_review();
+    init_plugins();
+    INSTALL_TIMEOUT_MS = 12e4;
+  }
+});
+
+// ../core/dist/pty-manager.js
+import * as pty2 from "node-pty";
+import { existsSync as existsSync8, chmodSync, statSync as statSync2 } from "node:fs";
+import { join as join10, dirname as dirname3 } from "node:path";
+import { createRequire as createRequire2 } from "node:module";
+function ensureSpawnHelperPermissions() {
+  try {
+    const require2 = createRequire2(import.meta.url);
+    const ptyPath = dirname3(require2.resolve("node-pty/package.json"));
+    const helper = join10(ptyPath, "prebuilds", `${process.platform}-${process.arch}`, "spawn-helper");
+    if (existsSync8(helper)) {
+      const mode = statSync2(helper).mode;
+      if (!(mode & 73)) {
+        chmodSync(helper, mode | 493);
+      }
+    }
+  } catch {
+  }
+}
+function buildLaunch(session, isNew) {
+  const env = envWithoutHarness();
+  const harness = session.harness ?? "claude";
+  const harnessFlag = isNew && session.harness ? ` --harness ${shellQuote(harness)}` : "";
+  const prefix = session.skipPermissions ? "cw --skip-permissions" : "cw";
+  if (session.type === "general") {
+    let cmd2 = "cw launch";
+    if (session.account)
+      cmd2 += ` ${shellQuote(session.account)}`;
+    if (harness === "claude") {
+      if (session.model)
+        cmd2 += ` --model ${shellQuote(session.model)}`;
+      if (session.skipPermissions)
+        cmd2 += " --dangerously-skip-permissions";
+    }
+    if (isNew && session.harness)
+      env.CW_HARNESS = harness;
+    return { command: cmd2, env };
+  }
+  if (session.type === "login") {
+    return { command: `cw account login ${shellQuote(session.account)} --harness ${shellQuote(harness)}`, env };
+  }
+  if (session.type === "create") {
+    const desc = session.notes || session.task || "New project";
+    let cmd2 = `cw create ${shellQuote(desc)}`;
+    if (supports(harness, "agent_teams"))
+      cmd2 += " --team";
+    if (session.task)
+      cmd2 += ` --name ${shellQuote(session.task)}`;
+    if (session.account)
+      cmd2 += ` --account ${shellQuote(session.account)}`;
+    if (session.model)
+      cmd2 += ` --model ${shellQuote(session.model)}`;
+    if (session.worktree)
+      cmd2 += ` --dir ${shellQuote(session.worktree)}`;
+    return { command: cmd2 + harnessFlag, env };
+  }
+  if (session.type === "review") {
+    const prArg = session.source_url || session.pr;
+    let cmd2 = `${prefix} review ${shellQuote(session.project)} ${shellQuote(String(prArg ?? ""))}`;
+    if (session.account)
+      cmd2 += ` --account ${shellQuote(session.account)}`;
+    if (session.model)
+      cmd2 += ` --model ${shellQuote(session.model)}`;
+    return { command: cmd2 + harnessFlag, env };
+  }
+  if (session.type === "loop") {
+    const prompt = session.loop_prompt ?? "";
+    const slug = session.sessionDir?.replace(/^loop-/, "") ?? session.task ?? "";
+    let cmd2 = `${prefix} loop ${shellQuote(session.project)} ${shellQuote(prompt)} --name ${shellQuote(slug)}`;
+    if (session.loop_interval)
+      cmd2 += ` --every ${shellQuote(session.loop_interval)}`;
+    if (session.account)
+      cmd2 += ` --account ${shellQuote(session.account)}`;
+    if (session.model)
+      cmd2 += ` --model ${shellQuote(session.model)}`;
+    return { command: cmd2 + harnessFlag, env };
+  }
+  const taskArg = session.source_url || session.task;
+  let cmd = `${prefix} work ${shellQuote(session.project)} ${shellQuote(taskArg ?? "")}`;
+  if (session.account)
+    cmd += ` --account ${shellQuote(session.account)}`;
+  if (session.workflow)
+    cmd += ` --workflow ${shellQuote(session.workflow)}`;
+  if (session.model)
+    cmd += ` --model ${shellQuote(session.model)}`;
+  return { command: cmd + harnessFlag, env };
+}
+var SCROLLBACK_LIMIT, IDLE_TIMEOUT_MS, CLEANUP_INTERVAL_MS, shellQuote, PTYManager;
+var init_pty_manager = __esm({
+  "../core/dist/pty-manager.js"() {
+    "use strict";
+    init_cw_doctor();
+    init_harness_capabilities();
+    SCROLLBACK_LIMIT = 5e3;
+    IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
+    CLEANUP_INTERVAL_MS = 5 * 60 * 1e3;
+    shellQuote = (value) => `'${value.replace(/'/g, "'\\''")}'`;
+    ensureSpawnHelperPermissions();
+    PTYManager = class {
+      states;
+      sessions = /* @__PURE__ */ new Map();
+      cleanupTimer = null;
+      constructor(states = null) {
+        this.states = states;
+        this.cleanupTimer = setInterval(() => this.cleanup(), CLEANUP_INTERVAL_MS);
+      }
+      makeKey(project, sessionDir) {
+        return `${project}::${sessionDir}`;
+      }
+      getOrCreate(project, sessionDir, session, options = {}) {
+        const key = this.makeKey(project, sessionDir);
+        const existing = this.sessions.get(key);
+        if (existing)
+          return existing;
+        const shell = process.env.SHELL || "/bin/zsh";
+        const { command, env } = buildLaunch(session, options.isNew ?? false);
+        const cwd = session.worktree && existsSync8(session.worktree) ? session.worktree : session.type === "general" || session.type === "create" || session.type === "login" ? process.env.HOME ?? process.cwd() : process.cwd();
+        let ptyProcess;
+        try {
+          ptyProcess = pty2.spawn(shell, ["-c", command], {
+            name: "xterm-256color",
+            cols: 120,
+            rows: 40,
+            cwd,
+            env
+          });
+        } catch (err) {
+          console.error(`[pty] Failed to spawn for ${key}: ${err}`);
+          return null;
+        }
+        const ptySession = {
+          pty: ptyProcess,
+          scrollback: [],
+          clients: /* @__PURE__ */ new Set(),
+          cwd,
+          command,
+          createdAt: /* @__PURE__ */ new Date(),
+          lastClientDisconnect: null,
+          onDataDisposable: null,
+          onExitDisposable: null
+        };
+        this.states?.track(key, session.harness ?? "claude");
+        ptySession.onDataDisposable = ptyProcess.onData((data) => {
+          this.states?.output(key, data);
+          ptySession.scrollback.push(data);
+          if (ptySession.scrollback.length > SCROLLBACK_LIMIT) {
+            ptySession.scrollback.splice(0, ptySession.scrollback.length - SCROLLBACK_LIMIT);
+          }
+          const message = JSON.stringify({ type: "output", data });
+          for (const client of ptySession.clients) {
+            try {
+              client.send(message);
+            } catch {
+              ptySession.clients.delete(client);
+            }
+          }
+        });
+        ptySession.onExitDisposable = ptyProcess.onExit(({ exitCode }) => {
+          this.states?.exit(key, exitCode);
+          const message = JSON.stringify({ type: "exit", code: exitCode });
+          for (const client of ptySession.clients) {
+            try {
+              client.send(message);
+            } catch {
+            }
+          }
+          this.sessions.delete(key);
+        });
+        this.sessions.set(key, ptySession);
+        return ptySession;
+      }
+      attach(sessionId, client) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+          return;
+        session.clients.add(client);
+        session.lastClientDisconnect = null;
+        if (session.scrollback.length > 0) {
+          const scrollbackData = session.scrollback.join("");
+          try {
+            client.send(JSON.stringify({ type: "scrollback", data: scrollbackData }));
+          } catch {
+          }
+        }
+      }
+      detach(sessionId, client) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+          return;
+        session.clients.delete(client);
+        if (session.clients.size === 0) {
+          session.lastClientDisconnect = /* @__PURE__ */ new Date();
+        }
+      }
+      kill(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+          return;
+        try {
+          session.onDataDisposable.dispose();
+          session.onExitDisposable.dispose();
+          session.pty.kill();
+        } catch {
+        }
+        this.states?.forget(sessionId);
+        this.sessions.delete(sessionId);
+      }
+      has(sessionId) {
+        return this.sessions.has(sessionId);
+      }
+      get(sessionId) {
+        return this.sessions.get(sessionId);
+      }
+      // the state tracker reads the screen at the size the user sees it
+      resize(sessionId, cols, rows) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+          return;
+        session.pty.resize(cols, rows);
+        this.states?.resize(sessionId, cols, rows);
+      }
+      cleanup() {
+        const now = Date.now();
+        for (const [key, session] of this.sessions) {
+          if (session.clients.size === 0 && session.lastClientDisconnect && now - session.lastClientDisconnect.getTime() > IDLE_TIMEOUT_MS) {
+            this.kill(key);
+          }
+          if (session.clients.size === 0 && !session.lastClientDisconnect && now - session.createdAt.getTime() > IDLE_TIMEOUT_MS) {
+            this.kill(key);
+          }
+        }
+      }
+      dispose() {
+        if (this.cleanupTimer) {
+          clearInterval(this.cleanupTimer);
+          this.cleanupTimer = null;
+        }
+        for (const key of this.sessions.keys()) {
+          this.kill(key);
+        }
+      }
+    };
+  }
+});
+
+// ../core/dist/state-classifier-local.js
+function latestMarker(text, markers) {
+  let best = null;
+  let bestAt = -1;
+  for (const marker of markers) {
+    const at = lastIndex(text, marker.re);
+    if (at > bestAt) {
+      best = marker;
+      bestAt = at;
+    }
+  }
+  return best;
+}
+function classifyLocal(input) {
+  if (input.exitCode !== null)
+    return result("exited", 1);
+  if (input.quietMs < ACTIVE_MS)
+    return result("working", input.harness === "claude" ? 0.95 : 0.6);
+  if (input.harness !== "claude")
+    return result("idle", 0.5);
+  const marker = latestMarker(input.text, CLAUDE_MARKERS);
+  return marker ? result(marker.state, marker.confidence) : result("idle", 0.3);
+}
+var ACTIVE_MS, CLAUDE_MARKERS, lastIndex, result;
+var init_state_classifier_local = __esm({
+  "../core/dist/state-classifier-local.js"() {
+    "use strict";
+    ACTIVE_MS = 1500;
+    CLAUDE_MARKERS = [
+      { state: "permission", confidence: 0.95, re: /Do you want to [^?\n]{1,80}\?[\s\S]{0,40}❯ ?1\. Yes/g },
+      { state: "permission", confidence: 0.95, re: /Esc to cancel · Tab to amend|Enter to confirm · Esc to cancel/g },
+      { state: "waiting", confidence: 0.9, re: new RegExp("(?:^|[^(\\p{L}\\d_])\\p{Lu}\\p{Ll}+ed for (?:\\d+[hm] )*\\d+s\\b", "gmu") },
+      // a redraw can reuse the digits of the spinner above, leaving "Baked for  done 10:12 am"
+      { state: "waiting", confidence: 0.9, re: new RegExp("\\p{Lu}\\p{Ll}+ed for [^\\n\u2026]{0,20}?\\bdone \\d{1,2}:\\d{2}", "gu") },
+      { state: "waiting", confidence: 0.9, re: /Interrupted · What should Claude do instead\?/g },
+      { state: "waiting", confidence: 0.8, re: /Claude Code v\d+\.\d+/g },
+      { state: "error", confidence: 0.85, re: /API Error|usage limit reached|You've hit your (?:usage )?limit|Credit balance is too low|Please run \/login|OAuth token (?:has )?expired/gi },
+      // a spinner that stopped moving: a stall or a slow redraw, so it is only a guess
+      { state: "working", confidence: 0.5, re: new RegExp("\\p{Lu}\\p{Ll}+ing\u2026|\\(\\d+s \xB7 |esc to interrupt", "gu") }
+    ];
+    lastIndex = (text, re) => {
+      let at = -1;
+      for (const m of text.matchAll(re))
+        at = (m.index ?? 0) + m[0].length;
+      return at;
+    };
+    result = (state, confidence) => ({ state, confidence, source: "local" });
+  }
+});
+
+// ../core/dist/state-classifier-jev.js
+function jevScreen(text, lines2 = SCREEN_LINES) {
+  const kept = text.split("\n").map((l) => l.replace(FOOTER_NOISE, "").trim()).filter(Boolean).filter((l, i, all) => l !== all[i - 1]).slice(-lines2).join("\n");
+  return kept.slice(-SCREEN_CHARS);
+}
+function createJevClassifier({ apiKey, model = "jev-latest", timeoutMs = 3e3, fetch: fetch2 = globalThis.fetch }) {
+  return {
+    name: "jev",
+    async classify(input) {
+      if (input.exitCode !== null)
+        return { state: "exited", confidence: 1, source: "jev" };
+      const body = {
+        model,
+        state: { harness: input.harness, seconds_since_last_output: Math.round(input.quietMs / 1e3), screen: jevScreen(input.screen ?? input.text) },
+        questions: {
+          state: {
+            type: "choice",
+            instructions: "What is the coding agent in `screen` doing right now? `screen` is the bottom of its terminal with the newest line last; older lines can be leftovers of a redraw.",
+            criteria: CRITERIA
+          }
+        }
+      };
+      const res = await fetch2(JEV_URL, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok)
+        throw new Error(`Jev answered ${res.status}`);
+      const data = await res.json();
+      const answer = data.answers?.state;
+      if (!answer || !(answer.choice in CRITERIA) || typeof answer.confidence !== "number") {
+        throw new Error(`Unexpected Jev answer: ${JSON.stringify(answer)}`);
+      }
+      return { state: answer.choice, confidence: answer.confidence, source: "jev" };
+    }
+  };
+}
+var JEV_URL, SCREEN_LINES, SCREEN_CHARS, CRITERIA, FOOTER_NOISE;
+var init_state_classifier_jev = __esm({
+  "../core/dist/state-classifier-jev.js"() {
+    "use strict";
+    JEV_URL = "https://api.typesafe.ai/v1/systemone";
+    SCREEN_LINES = 30;
+    SCREEN_CHARS = 4e3;
+    CRITERIA = {
+      working: "The agent is still busy: a spinner, a progress line or a running tool is the newest thing above the prompt. Status bars and notices below the prompt are not progress.",
+      waiting: "The agent finished its turn or was interrupted and is waiting at an empty prompt for the next message.",
+      permission: "The agent shows a question with options the user must pick, such as approving a command or edit, trusting a folder, or answering yes or no.",
+      error: "The agent stopped on an error: an API error, a usage or rate limit, a failed login or a crash.",
+      idle: "Nothing on screen shows which of the other options applies."
+    };
+    FOOTER_NOISE = /Checking for updates|new task\? \/clear to save [\d.]+k? tokens/g;
+  }
+});
+
+// ../core/dist/state-classifier.js
+function terminalText(raw) {
+  return raw.replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, "").replace(/\x1b\[\d*[GC]/g, " ").replace(/\x1b\[[\d;]*[ABEFHfd]/g, "\n").replace(/\x1b\[[0-9;?<>=]*[ -/]*[@-~]/g, "").replace(/\x1b[()][0-9A-Za-z]/g, "").replace(/\x1b[@-_]/g, "").replace(/[\x00-\x08\x0b-\x1f\x7f]/g, "");
+}
+var init_state_classifier = __esm({
+  "../core/dist/state-classifier.js"() {
+    "use strict";
+  }
+});
+
+// ../core/dist/terminal-screen.js
+import xterm from "@xterm/headless";
+var Terminal, SCROLLBACK, TerminalScreen;
+var init_terminal_screen = __esm({
+  "../core/dist/terminal-screen.js"() {
+    "use strict";
+    ({ Terminal } = xterm);
+    SCROLLBACK = 200;
+    TerminalScreen = class {
+      term;
+      constructor(cols = 120, rows = 40) {
+        this.term = new Terminal({ cols, rows, scrollback: SCROLLBACK, allowProposedApi: true });
+      }
+      write(data) {
+        this.term.write(data);
+      }
+      // a resize applies at once while writes wait to be parsed, so it waits its turn behind them
+      resize(cols, rows) {
+        this.term.write("", () => this.term.resize(cols, rows));
+      }
+      // rows oldest first, scrollback included, without the blank rows under the last one written
+      read() {
+        return new Promise((resolve5) => this.term.write("", () => {
+          const buffer = this.term.buffer.active;
+          const rows = [];
+          for (let y = 0; y < buffer.length; y++) {
+            const line = buffer.getLine(y);
+            if (!line)
+              continue;
+            const text = line.translateToString(false);
+            if (line.isWrapped && rows.length)
+              rows[rows.length - 1] += text;
+            else
+              rows.push(text);
+          }
+          const trimmed = rows.map((r) => r.trimEnd());
+          while (trimmed.length && !trimmed[trimmed.length - 1])
+            trimmed.pop();
+          resolve5(trimmed.join("\n"));
+        }));
+      }
+      dispose() {
+        this.term.dispose();
+      }
+    };
+  }
+});
+
+// ../core/dist/session-state.js
+function remoteClassifierFromEnv(env = process.env) {
+  const shadow = env.FORGE_JEV_SHADOW === "1";
+  if (env.FORGE_STATE_CLASSIFIER !== "jev")
+    return { remote: null, shadow: false, warning: null };
+  if (!env.TYPESAFE_API_KEY)
+    return { remote: null, shadow: false, warning: "FORGE_STATE_CLASSIFIER=jev needs TYPESAFE_API_KEY; reading session states with local rules only" };
+  return { remote: createJevClassifier({ apiKey: env.TYPESAFE_API_KEY, model: env.FORGE_JEV_MODEL || void 0 }), shadow, warning: null };
+}
+var TAIL_CHARS, StateTracker;
+var init_session_state = __esm({
+  "../core/dist/session-state.js"() {
+    "use strict";
+    init_state_classifier_local();
+    init_state_classifier_jev();
+    init_state_classifier();
+    init_terminal_screen();
+    TAIL_CHARS = 32e3;
+    StateTracker = class {
+      sessions = /* @__PURE__ */ new Map();
+      remote;
+      settleMs;
+      burstMs;
+      localTrust;
+      remoteMin;
+      shadow;
+      keepExitedMs;
+      onError;
+      onRemote;
+      constructor(options = {}) {
+        this.remote = options.remote ?? null;
+        this.settleMs = options.settleMs ?? 1500;
+        this.burstMs = options.burstMs ?? 2e3;
+        this.localTrust = options.localTrust ?? 0.9;
+        this.remoteMin = options.remoteMin ?? 0.6;
+        this.shadow = options.shadow ?? false;
+        this.keepExitedMs = options.keepExitedMs ?? 10 * 60 * 1e3;
+        this.onError = options.onError ?? (() => {
+        });
+        this.onRemote = options.onRemote ?? (() => {
+        });
+      }
+      get remoteName() {
+        return this.remote?.name ?? null;
+      }
+      get isShadow() {
+        return this.remote !== null && this.shadow;
+      }
+      track(key, harness) {
+        const now = Date.now();
+        this.forget(key);
+        const tracked = {
+          harness,
+          raw: "",
+          lastOutputAt: now,
+          burstStart: now,
+          version: 0,
+          timer: null,
+          screen: new TerminalScreen(),
+          askedScreen: null,
+          exitedAt: null,
+          entry: { state: "working", confidence: 0.6, since: now, source: "local" }
+        };
+        this.sessions.set(key, tracked);
+        this.schedule(key, tracked);
+      }
+      output(key, chunk) {
+        const tracked = this.sessions.get(key);
+        if (!tracked || tracked.exitedAt !== null)
+          return;
+        tracked.screen.write(chunk);
+        if (!terminalText(chunk).trim())
+          return;
+        const now = Date.now();
+        tracked.raw = (tracked.raw + chunk).slice(-TAIL_CHARS);
+        tracked.lastOutputAt = now;
+        tracked.version++;
+        tracked.burstStart ??= now;
+        if (now - tracked.burstStart >= this.burstMs && tracked.entry.state !== "working") {
+          this.apply(tracked, { state: "working", confidence: 0.95, source: "local" });
+        }
+        this.schedule(key, tracked);
+      }
+      exit(key, exitCode) {
+        const tracked = this.sessions.get(key);
+        if (!tracked)
+          return;
+        if (tracked.timer)
+          clearTimeout(tracked.timer);
+        tracked.timer = null;
+        tracked.exitedAt = Date.now();
+        tracked.version++;
+        this.apply(tracked, { state: "exited", confidence: 1, source: "local" });
+        tracked.entry.exitCode = exitCode;
+      }
+      resize(key, cols, rows) {
+        this.sessions.get(key)?.screen.resize(cols, rows);
+      }
+      forget(key) {
+        const tracked = this.sessions.get(key);
+        if (tracked?.timer)
+          clearTimeout(tracked.timer);
+        tracked?.screen.dispose();
+        this.sessions.delete(key);
+      }
+      snapshot() {
+        const now = Date.now();
+        const out = {};
+        for (const [key, tracked] of this.sessions) {
+          if (tracked.exitedAt !== null && now - tracked.exitedAt > this.keepExitedMs) {
+            this.sessions.delete(key);
+            continue;
+          }
+          out[key] = { ...tracked.entry };
+        }
+        return out;
+      }
+      dispose() {
+        for (const key of [...this.sessions.keys()])
+          this.forget(key);
+      }
+      schedule(key, tracked) {
+        if (tracked.timer)
+          clearTimeout(tracked.timer);
+        tracked.timer = setTimeout(() => this.settle(key, tracked), this.settleMs);
+      }
+      apply(tracked, c) {
+        if (c.state !== tracked.entry.state)
+          tracked.entry.since = Date.now();
+        tracked.entry.state = c.state;
+        tracked.entry.confidence = c.confidence;
+        tracked.entry.source = c.source;
+      }
+      settle(key, tracked) {
+        tracked.timer = null;
+        tracked.burstStart = null;
+        if (this.sessions.get(key) !== tracked || tracked.exitedAt !== null)
+          return;
+        const quietMs = Math.max(Date.now() - tracked.lastOutputAt, this.settleMs);
+        const input = { text: terminalText(tracked.raw), quietMs, harness: tracked.harness, exitCode: null };
+        const local = classifyLocal(input);
+        this.apply(tracked, local);
+        if (!this.remote)
+          return;
+        if (!this.shadow && (local.confidence >= this.localTrust || local.state === "error"))
+          return;
+        const remote = this.remote;
+        const version = tracked.version;
+        void tracked.screen.read().then((screen) => {
+          if (this.sessions.get(key) !== tracked || tracked.version !== version)
+            return;
+          if (!screen.trim() || screen === tracked.askedScreen)
+            return;
+          tracked.askedScreen = screen;
+          const startedAt = Date.now();
+          const record = (answer, error, outcome) => this.onRemote({
+            at: startedAt,
+            key,
+            harness: input.harness,
+            screen,
+            local,
+            remote: answer,
+            error,
+            latencyMs: Date.now() - startedAt,
+            outcome
+          });
+          remote.classify({ ...input, screen }).then((answer) => {
+            if (this.shadow)
+              return record(answer, null, "shadow");
+            if (this.sessions.get(key) !== tracked || tracked.version !== version)
+              return record(answer, null, "stale");
+            if (answer.confidence < this.remoteMin)
+              return record(answer, null, "low-confidence");
+            this.apply(tracked, answer);
+            record(answer, null, "applied");
+          }, (err) => {
+            const error = err instanceof Error ? err : new Error(String(err));
+            record(null, error.message, "failed");
+            this.onError(error);
+          });
+        });
+      }
+    };
+  }
+});
+
+// ../core/dist/state-log.js
+import { mkdirSync as mkdirSync3 } from "node:fs";
+import { appendFile } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname4, resolve as resolve3 } from "node:path";
+function expandHome(path) {
+  return path === "~" || path.startsWith("~/") ? homedir3() + path.slice(1) : path;
+}
+function stateLogLine(call) {
+  return JSON.stringify({
+    at: new Date(call.at).toISOString(),
+    key: call.key,
+    harness: call.harness,
+    outcome: call.outcome,
+    local: { state: call.local.state, confidence: call.local.confidence },
+    remote: call.remote && { state: call.remote.state, confidence: call.remote.confidence },
+    error: call.error,
+    latencyMs: call.latencyMs,
+    screen: jevScreen(call.screen)
+  }) + "\n";
+}
+function createStateLog(path, onError = () => {
+}) {
+  const file = resolve3(expandHome(path));
+  mkdirSync3(dirname4(file), { recursive: true });
+  let queue = Promise.resolve();
+  return (call) => {
+    const line = stateLogLine(call);
+    queue = queue.then(() => appendFile(file, line)).catch((err) => onError(err instanceof Error ? err : new Error(String(err))));
+  };
+}
+var init_state_log = __esm({
+  "../core/dist/state-log.js"() {
+    "use strict";
+    init_state_classifier_jev();
+  }
+});
+
+// ../core/dist/pty-routes.js
+import { WebSocketServer, WebSocket } from "ws";
+function takeSession(reader, project, sessionDir) {
+  const sessionId = `${project}::${sessionDir}`;
+  const pending = pendingSessions.get(sessionId);
+  if (pending) {
+    pendingSessions.delete(sessionId);
+    return { session: pending, isNew: true };
+  }
+  const session = reader.getSession(project, sessionDir);
+  return session ? { session, isNew: false } : null;
+}
+function createTerminalWss(manager, reader, { localOnly = true } = {}) {
+  const wss = new WebSocketServer({ noServer: true });
+  function wireWs(ws, sessionId, project, sessionDir) {
+    const client = {
+      send: (data) => {
+        if (ws.readyState === WebSocket.OPEN)
+          ws.send(data);
+      },
+      close: () => ws.close()
+    };
+    manager.attach(sessionId, client);
+    ws.on("message", (raw) => {
+      try {
+        const msg = JSON.parse(raw.toString());
+        if (msg.type === "input") {
+          const ptySession = manager.get(sessionId);
+          if (ptySession)
+            ptySession.pty.write(msg.data);
+        } else if (msg.type === "resize") {
+          if (msg.cols && msg.rows)
+            manager.resize(sessionId, msg.cols, msg.rows);
+        }
+      } catch {
+      }
+    });
+    ws.on("close", () => {
+      console.log(`[pty-ws] Disconnected: ${project}/${sessionDir}`);
+      manager.detach(sessionId, client);
+    });
+  }
+  wss.on("connection", (ws, project, sessionDir) => {
+    console.log(`[pty-ws] Connected: ${project}/${sessionDir}`);
+    const sessionId = `${project}::${sessionDir}`;
+    if (manager.has(sessionId)) {
+      wireWs(ws, sessionId, project, sessionDir);
+      return;
+    }
+    const taken = takeSession(reader, project, sessionDir);
+    if (!taken) {
+      console.log(`[pty-ws] Session not found: ${project}/${sessionDir}`);
+      ws.send(JSON.stringify({ type: "error", message: `Session not found: ${project}/${sessionDir}` }));
+      ws.close();
+      return;
+    }
+    const ptySession = manager.getOrCreate(project, sessionDir, taken.session, { isNew: taken.isNew });
+    if (!ptySession) {
+      console.error(`[pty-ws] Failed to spawn terminal for: ${project}/${sessionDir}`);
+      ws.send(JSON.stringify({ type: "error", message: `Failed to start terminal for ${project}/${sessionDir}` }));
+      ws.close();
+      return;
+    }
+    wireWs(ws, sessionId, project, sessionDir);
+  });
+  function attachToServer(server) {
+    server.on("upgrade", (request, socket, head) => {
+      if (localOnly && !isLocalRequest(request.headers.host, request.headers.origin)) {
+        socket.destroy();
+        return;
+      }
+      const url = new URL(request.url ?? "/", "http://localhost");
+      const parsed = parseTerminalUpgradeUrl(url.pathname);
+      if (parsed) {
+        const { project, sessionDir } = parsed;
+        console.log(`[pty-ws] Upgrade request: ${project}/${sessionDir}`);
+        wss.handleUpgrade(request, socket, head, (ws) => {
+          wss.emit("connection", ws, project, sessionDir);
+        });
+      } else {
+        socket.destroy();
+      }
+    });
+  }
+  return { wss, attachToServer };
+}
+function parseTerminalUpgradeUrl(pathname) {
+  const match = pathname.match(/^\/ws\/terminal\/([^/]+)\/([^/]+)$/);
+  if (!match)
+    return null;
+  try {
+    return { project: decodeURIComponent(match[1]), sessionDir: decodeURIComponent(match[2]) };
+  } catch {
+    return null;
+  }
+}
+var init_pty_routes = __esm({
+  "../core/dist/pty-routes.js"() {
+    "use strict";
+    init_cw_routes();
+    init_origin_guard();
+  }
+});
+
+// ../core/dist/liveframe.js
+import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync5 } from "node:fs";
+import { mkdir, rm } from "node:fs/promises";
+import { homedir as homedir4 } from "node:os";
+import { join as join11 } from "node:path";
+function slugify(name) {
+  const slug = name.toLowerCase().normalize("NFKD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
+  return slug || "untitled";
+}
+function failureMessage(result2) {
+  if (result2.code === 127)
+    return INSTALL_HINT;
+  const lastLine = tailOutput(result2.stderr, 1) || tailOutput(result2.stdout, 1);
+  return lastLine.replace(/^✗\s*/, "").trim() || `lf exited with code ${result2.code}`;
+}
+function parseFrameUrl(stdout) {
+  return FRAME_URL_RE.exec(stripAnsi(stdout))?.[0] ?? null;
+}
+function readJson2(path) {
+  try {
+    return JSON.parse(readFileSync7(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+var LiveframeError, DEFAULT_API, DEFAULT_ACCOUNT, INSTALL_HINT, LF_TIMEOUT_MS, FRAME_URL_RE, SEGMENT_RE, isFrameSegment, Liveframe;
+var init_liveframe = __esm({
+  "../core/dist/liveframe.js"() {
+    "use strict";
+    init_task_review();
+    init_output();
+    LiveframeError = class extends Error {
+      status;
+      constructor(message, status = 502) {
+        super(message);
+        this.status = status;
+      }
+    };
+    DEFAULT_API = "https://liveframe.monokulabs.com";
+    DEFAULT_ACCOUNT = "monoku";
+    INSTALL_HINT = `The Liveframe CLI is not installed. Install it with: npm i -g ${DEFAULT_API}/cli.tgz`;
+    LF_TIMEOUT_MS = 5 * 60 * 1e3;
+    FRAME_URL_RE = /https?:\/\/\S+\/f\/\S+/;
+    SEGMENT_RE = /^[a-z0-9][a-z0-9-]*$/;
+    isFrameSegment = (value) => SEGMENT_RE.test(value);
+    Liveframe = class {
+      account;
+      root;
+      home;
+      run;
+      busy = /* @__PURE__ */ new Set();
+      constructor(options = {}) {
+        this.account = options.account ?? process.env.FORGE_LIVEFRAME_ACCOUNT ?? DEFAULT_ACCOUNT;
+        this.root = options.root ?? join11(homedir4(), "liveframe");
+        this.home = options.home ?? process.env.LIVEFRAME_HOME ?? join11(homedir4(), ".liveframe");
+        this.run = options.run ?? createRunner(void 0, LF_TIMEOUT_MS);
+      }
+      // reads only the API base and whether a credential exists, never the credential itself
+      config() {
+        const file = readJson2(join11(this.home, "config.json")) ?? {};
+        const api = process.env.LIVEFRAME_API ?? (typeof file.api === "string" ? file.api : DEFAULT_API);
+        return { api: api.replace(/\/+$/, ""), signedIn: Boolean(process.env.LIVEFRAME_TOKEN || file.oauth || file.token) };
+      }
+      async status() {
+        const { api, signedIn } = this.config();
+        const version = await this.run("lf", ["--version"], homedir4());
+        return { account: this.account, installed: version.code === 0, signedIn, api, root: this.root };
+      }
+      frameDir(project, frame) {
+        return join11(this.root, project, frame);
+      }
+      readFrame(project, frame, api) {
+        const dir = this.frameDir(project, frame);
+        const json = readJson2(join11(dir, "liveframe.json"));
+        if (!json || typeof json.key !== "string")
+          return null;
+        const branch = typeof json.branch === "string" ? json.branch : "main";
+        return {
+          project,
+          frame,
+          dir,
+          key: json.key,
+          kind: typeof json.kind === "string" ? json.kind : "view",
+          branch,
+          url: `${api}/f/${json.key}/${branch === "main" ? "" : `${branch}/`}`
+        };
+      }
+      getFrame(project, frame) {
+        if (!isFrameSegment(project) || !isFrameSegment(frame))
+          return null;
+        return this.readFrame(project, frame, this.config().api);
+      }
+      listFrames() {
+        if (!existsSync9(this.root))
+          return [];
+        const { api } = this.config();
+        const frames = [];
+        for (const project of readdirSync5(this.root, { withFileTypes: true })) {
+          if (!project.isDirectory() || !isFrameSegment(project.name))
+            continue;
+          for (const frame of readdirSync5(join11(this.root, project.name), { withFileTypes: true })) {
+            if (!frame.isDirectory() || !isFrameSegment(frame.name))
+              continue;
+            const found = this.readFrame(project.name, frame.name, api);
+            if (found)
+              frames.push(found);
+          }
+        }
+        return frames;
+      }
+      async lf(args, cwd) {
+        const result2 = await this.run("lf", args, cwd);
+        if (result2.code !== 0)
+          throw new LiveframeError(failureMessage(result2));
+        return result2;
+      }
+      // one lf command per frame folder at a time
+      async exclusive(project, frame, work) {
+        const key = `${project}/${frame}`;
+        if (this.busy.has(key))
+          throw new LiveframeError(`${key} is busy with another lf command`, 409);
+        this.busy.add(key);
+        try {
+          return await work();
+        } finally {
+          this.busy.delete(key);
+        }
+      }
+      // runs lf into a fresh frame folder, removing whatever it left if it fails
+      intoNewDir(project, frame, args) {
+        return this.exclusive(project, frame, async () => {
+          const projectDir = join11(this.root, project);
+          const dir = this.frameDir(project, frame);
+          if (existsSync9(dir))
+            throw new LiveframeError(`${project}/${frame} already exists in ${this.root}`, 409);
+          await mkdir(projectDir, { recursive: true });
+          try {
+            await this.lf(args(dir), this.root);
+          } catch (err) {
+            await rm(dir, { recursive: true, force: true });
+            if (readdirSync5(projectDir).length === 0)
+              await rm(projectDir, { recursive: true, force: true });
+            throw err;
+          }
+          const found = this.getFrame(project, frame);
+          if (!found)
+            throw new LiveframeError(`lf finished but ${dir} has no liveframe.json`);
+          return found;
+        });
+      }
+      async createFrame(projectName, frameName) {
+        return this.intoNewDir(slugify(projectName), slugify(frameName), (dir) => ["new", frameName, "--project", projectName, "--kind", "view", "--dir", dir, "--yes"]);
+      }
+      async pullFrame(project, frame) {
+        if (!isFrameSegment(project) || !isFrameSegment(frame))
+          throw new LiveframeError("Use project/frame slugs, for example reservas/checkout-flow", 400);
+        return this.intoNewDir(project, frame, (dir) => ["pull", `${project}/${frame}`, dir]);
+      }
+      async pushFrame(project, frame, note) {
+        const found = this.getFrame(project, frame);
+        if (!found)
+          throw new LiveframeError(`No frame ${project}/${frame} in ${this.root}`, 404);
+        const result2 = await this.exclusive(project, frame, () => this.lf(["push", ...note ? ["-m", note] : []], found.dir));
+        const url = parseFrameUrl(result2.stdout);
+        if (!url)
+          throw new LiveframeError("lf push finished without a frame URL");
+        return url;
+      }
+    };
+  }
+});
+
+// ../core/dist/liveframe-routes.js
+import { Hono as Hono3 } from "hono";
+function liveframeRoutes(liveframe = new Liveframe()) {
+  const app = new Hono3();
+  app.onError((err, c) => {
+    if (err instanceof LiveframeError)
+      return c.json({ error: err.message }, err.status);
+    throw err;
+  });
+  app.get("/status", async (c) => c.json(await liveframe.status()));
+  app.get("/frames", (c) => c.json(liveframe.listFrames()));
+  app.post("/frames", async (c) => {
+    const { project, name } = await c.req.json();
+    if (!project?.trim() || !name?.trim())
+      return c.json({ error: "project and name are required" }, 400);
+    return c.json(await liveframe.createFrame(project.trim(), name.trim()), 201);
+  });
+  app.post("/pull", async (c) => {
+    const { target } = await c.req.json();
+    const [project = "", frame = ""] = (target ?? "").trim().split("/");
+    return c.json(await liveframe.pullFrame(project, frame), 201);
+  });
+  app.post("/frames/:project/:frame/push", async (c) => {
+    const { project, frame } = c.req.param();
+    const { note } = await c.req.json().catch(() => ({ note: void 0 }));
+    return c.json({ url: await liveframe.pushFrame(project, frame, note?.trim() || void 0) });
+  });
+  return app;
+}
+var init_liveframe_routes = __esm({
+  "../core/dist/liveframe-routes.js"() {
+    "use strict";
+    init_liveframe();
+  }
+});
+
+// ../core/dist/server.js
+import { Hono as Hono4 } from "hono";
+import { cors } from "hono/cors";
+import { join as join12, basename as basename3, resolve as resolve4 } from "node:path";
+import { readdirSync as readdirSync6, existsSync as existsSync10 } from "node:fs";
+function createForgeServer(options) {
+  const { dataDir, db: externalDb, authToken, localOnly = true } = options;
+  const dbPath = join12(dataDir, "forge.db");
+  const modulesDir = join12(dataDir, "modules");
+  const db = externalDb ?? new ForgeDB(dbPath);
+  const loader = new ModuleLoader(modulesDir);
+  const runner = new ActionRunner();
+  loader.discover();
+  const app = new Hono4();
+  app.use("*", localOnly ? localOriginGuard() : cors());
+  if (authToken) {
+    app.use("/api/*", bearerAuth(authToken));
+  }
+  const cwReader = new CWReader();
+  const loginManager = new LoginManager(resolveCwBin(cwReader.cwHome));
+  app.route("/api/cw", cwRoutes(cwReader, { loginManager, localOnly }));
+  app.route("/api/skills", skillRoutes(cwReader));
+  const { remote, shadow, warning } = remoteClassifierFromEnv();
+  if (warning)
+    console.warn(`[state] ${warning}`);
+  const logPath = process.env.FORGE_STATE_LOG;
+  if (logPath && !remote)
+    console.warn("[state] FORGE_STATE_LOG only records remote classifier calls; set FORGE_STATE_CLASSIFIER=jev");
+  const onRemote = logPath && remote ? createStateLog(logPath, (err) => console.warn(`[state] could not write ${logPath}: ${err.message}`)) : void 0;
+  let lastStateError = "";
+  const states = new StateTracker({
+    remote,
+    shadow,
+    onRemote,
+    onError: (err) => {
+      if (err.message !== lastStateError)
+        console.warn(`[state] ${remote?.name ?? "remote"} classifier failed, using local rules: ${err.message}`);
+      lastStateError = err.message;
+    }
+  });
+  const ptyManager = new PTYManager(states);
+  const terminalWss = createTerminalWss(ptyManager, cwReader, { localOnly });
+  app.route("/api/liveframe", liveframeRoutes());
+  app.get("/api/cw/session-states", (c) => c.json({ classifier: states.remoteName ?? "local", shadow: states.isShadow, states: states.snapshot() }));
+  app.post("/api/cw/terminal/kill", async (c) => {
+    const { project, sessionDir } = await c.req.json();
+    const sessionId = `${project}::${sessionDir}`;
+    ptyManager.kill(sessionId);
+    return c.json({ ok: true });
+  });
+  async function resolveAction(c) {
+    const moduleName = c.req.param("module");
+    const actionId = c.req.param("action");
+    const { projectId } = await c.req.json();
+    const action = loader.getAction(moduleName, actionId);
+    if (!action) {
+      return c.json({ error: "Action not found" }, 404);
+    }
+    const project = projectId ? db.getProject(projectId) : void 0;
+    const cwd = project?.path ?? process.cwd();
+    const logId = db.logAction({
+      projectId: projectId ?? null,
+      moduleId: moduleName,
+      actionId,
+      command: action.command
+    });
+    return { action, cwd, logId };
+  }
+  app.get("/api/health", (c) => {
+    return c.json({
+      status: "ok",
+      version: "0.1.0",
+      modules: loader.getLoadedCount()
+    });
+  });
+  app.get("/api/projects", (c) => {
+    return c.json(db.listProjects());
+  });
+  app.post("/api/projects", async (c) => {
+    const { name, path } = await c.req.json();
+    const id = db.addProject({ name, path });
+    const project = db.getProject(id);
+    return c.json(project, 201);
+  });
+  app.delete("/api/projects/:id", (c) => {
+    db.removeProject(c.req.param("id"));
+    return c.json({ ok: true });
+  });
+  app.get("/api/modules", (c) => {
+    const installed = db.listModules();
+    const loaded = loader.getLoaded();
+    return c.json(installed.map((m) => ({
+      ...m,
+      manifest: loaded.get(m.name) ?? null
+    })));
+  });
+  app.get("/api/modules/available", (c) => {
+    const manifests = loader.discover();
+    return c.json(manifests);
+  });
+  app.post("/api/actions/:module/:action", async (c) => {
+    const resolved = await resolveAction(c);
+    if (resolved instanceof Response)
+      return resolved;
+    const { action, cwd, logId } = resolved;
+    const result2 = await runner.exec(action.command, { cwd });
+    db.completeAction(logId, result2.exitCode);
+    return c.json({
+      logId,
+      exitCode: result2.exitCode,
+      output: result2.output,
+      timedOut: result2.timedOut
+    });
+  });
+  app.post("/api/actions/:module/:action/stream", async (c) => {
+    const resolved = await resolveAction(c);
+    if (resolved instanceof Response)
+      return resolved;
+    const { action, cwd, logId } = resolved;
+    return new Response(new ReadableStream({
+      async start(controller) {
+        const encoder = new TextEncoder();
+        const send = (event, data) => {
+          controller.enqueue(encoder.encode(`event: ${event}
+data: ${JSON.stringify(data)}
+
+`));
+        };
+        send("start", { logId, command: action.command });
+        const result2 = await runner.exec(action.command, {
+          cwd,
+          onData: (chunk) => send("output", { chunk })
+        });
+        db.completeAction(logId, result2.exitCode);
+        send("done", { exitCode: result2.exitCode, timedOut: result2.timedOut });
+        controller.close();
+      }
+    }), {
+      headers: {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        Connection: "keep-alive"
+      }
+    });
+  });
+  app.get("/api/action-logs", (c) => {
+    const moduleId = c.req.query("moduleId");
+    const limitStr = c.req.query("limit");
+    const limit = limitStr ? parseInt(limitStr, 10) : void 0;
+    return c.json(db.listActionLogs({ moduleId, limit }));
+  });
+  app.get("/api/modules/:module/settings", (c) => {
+    const moduleId = c.req.param("module");
+    return c.json(db.getModuleSettings(moduleId));
+  });
+  app.put("/api/modules/:module/settings", async (c) => {
+    const moduleId = c.req.param("module");
+    const body = await c.req.json();
+    for (const [key, value] of Object.entries(body)) {
+      db.setModuleSetting(moduleId, key, String(value));
+    }
+    return c.json({ ok: true });
+  });
+  app.get("/api/registry/search", async (c) => {
+    const q = c.req.query("q") ?? "forge-dev";
+    try {
+      const npmRes = await globalThis.fetch(`https://registry.npmjs.org/-/v1/search?text=${encodeURIComponent(q)}+keywords:forge-module&size=20`);
+      const data = await npmRes.json();
+      const results = (data.objects ?? []).map((o) => ({
+        name: o.package.name,
+        version: o.package.version,
+        description: o.package.description
+      }));
+      return c.json({ results });
+    } catch {
+      return c.json({ results: [] });
+    }
+  });
+  app.get("/api/filesystem/browse", (c) => {
+    const home = process.env.HOME ?? "/tmp";
+    const dir = resolve4(c.req.query("path") ?? process.cwd());
+    if (!dir.startsWith(home)) {
+      return c.json({ error: "Access denied: path must be within home directory" }, 403);
+    }
+    if (!existsSync10(dir)) {
+      return c.json({ error: "Directory not found" }, 404);
+    }
+    try {
+      const entries = readdirSync6(dir, { withFileTypes: true });
+      const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({
+        name: e.name,
+        path: join12(dir, e.name),
+        hasPackageJson: existsSync10(join12(dir, e.name, "package.json")),
+        hasGit: existsSync10(join12(dir, e.name, ".git"))
+      })).sort((a, b) => a.name.localeCompare(b.name));
+      return c.json({
+        current: dir,
+        name: basename3(dir),
+        parent: join12(dir, ".."),
+        directories: dirs
+      });
+    } catch {
+      return c.json({ error: "Cannot read directory" }, 500);
+    }
+  });
+  const fetch2 = (path, init) => {
+    return app.request(path, init);
+  };
+  return {
+    app,
+    fetch: fetch2,
+    attachTerminalWs: (server) => terminalWss.attachToServer(server),
+    close: () => {
+      ptyManager.dispose();
+      states.dispose();
+      loginManager.dispose();
+      db.close();
+    }
+  };
+}
+var init_server = __esm({
+  "../core/dist/server.js"() {
+    "use strict";
+    init_db();
+    init_modules();
+    init_runner();
+    init_auth();
+    init_origin_guard();
+    init_cw_reader();
+    init_cw_routes();
+    init_skill_routes();
+    init_pty_manager();
+    init_session_state();
+    init_state_log();
+    init_pty_routes();
+    init_login_manager();
+    init_liveframe_routes();
+  }
+});
+
+// ../core/dist/db-postgres.js
+var db_postgres_exports = {};
+__export(db_postgres_exports, {
+  PostgresDB: () => PostgresDB
+});
+import postgres from "postgres";
+import { randomUUID as randomUUID2 } from "node:crypto";
+var PostgresDB;
+var init_db_postgres = __esm({
+  "../core/dist/db-postgres.js"() {
+    "use strict";
+    PostgresDB = class {
+      sql;
+      constructor(connectionUrl) {
+        this.sql = postgres(connectionUrl);
+      }
+      async migrate() {
+        await this.sql`
+      CREATE TABLE IF NOT EXISTS projects (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL UNIQUE,
+        path TEXT NOT NULL,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      )
+    `;
+        await this.sql`
+      CREATE TABLE IF NOT EXISTS modules (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL UNIQUE,
+        version TEXT NOT NULL,
+        enabled BOOLEAN NOT NULL DEFAULT true,
+        installed_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      )
+    `;
+        await this.sql`
+      CREATE TABLE IF NOT EXISTS action_logs (
+        id TEXT PRIMARY KEY,
+        project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+        module_id TEXT NOT NULL,
+        action_id TEXT NOT NULL,
+        command TEXT NOT NULL,
+        exit_code INTEGER,
+        started_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+        finished_at TIMESTAMPTZ
+      )
+    `;
+        await this.sql`
+      CREATE TABLE IF NOT EXISTS module_settings (
+        module_id TEXT NOT NULL,
+        key TEXT NOT NULL,
+        value TEXT NOT NULL,
+        PRIMARY KEY (module_id, key)
+      )
+    `;
+      }
+      listTables() {
+        return ["projects", "modules", "action_logs", "module_settings"];
+      }
+      addProject(input) {
+        const id = randomUUID2();
+        this.sql`INSERT INTO projects (id, name, path) VALUES (${id}, ${input.name}, ${input.path})`.execute();
+        return id;
+      }
+      listProjects() {
+        throw new Error("PostgresDB.listProjects() not implemented \u2014 team mode is not yet supported");
+      }
+      getProject(_id) {
+        throw new Error("PostgresDB.getProject() not implemented \u2014 team mode is not yet supported");
+      }
+      removeProject(id) {
+        this.sql`DELETE FROM projects WHERE id = ${id}`.execute();
+      }
+      addModule(input) {
+        const id = randomUUID2();
+        this.sql`INSERT INTO modules (id, name, version) VALUES (${id}, ${input.name}, ${input.version})`.execute();
+        return id;
+      }
+      listModules() {
+        throw new Error("PostgresDB.listModules() not implemented \u2014 team mode is not yet supported");
+      }
+      removeModule(name) {
+        this.sql`DELETE FROM modules WHERE name = ${name}`.execute();
+      }
+      logAction(input) {
+        const id = randomUUID2();
+        this.sql`INSERT INTO action_logs (id, project_id, module_id, action_id, command) VALUES (${id}, ${input.projectId}, ${input.moduleId}, ${input.actionId}, ${input.command})`.execute();
+        return id;
+      }
+      getActionLog(_id) {
+        throw new Error("PostgresDB.getActionLog() not implemented \u2014 team mode is not yet supported");
+      }
+      completeAction(id, exitCode) {
+        this.sql`UPDATE action_logs SET exit_code = ${exitCode}, finished_at = now() WHERE id = ${id}`.execute();
+      }
+      getModuleSettings(_moduleId) {
+        throw new Error("PostgresDB.getModuleSettings() not implemented \u2014 team mode is not yet supported");
+      }
+      setModuleSetting(moduleId, key, value) {
+        this.sql`INSERT INTO module_settings (module_id, key, value) VALUES (${moduleId}, ${key}, ${value}) ON CONFLICT (module_id, key) DO UPDATE SET value = EXCLUDED.value`.execute();
+      }
+      listActionLogs(_opts) {
+        throw new Error("PostgresDB.listActionLogs() not implemented \u2014 team mode is not yet supported");
+      }
+      close() {
+        this.sql.end();
+      }
+    };
+  }
+});
+
+// ../core/dist/db-factory.js
+async function createDatabase(opts) {
+  if (opts.mode === "team" && opts.databaseUrl) {
+    const { PostgresDB: PostgresDB2 } = await Promise.resolve().then(() => (init_db_postgres(), db_postgres_exports));
+    const db = new PostgresDB2(opts.databaseUrl);
+    await db.migrate();
+    return db;
+  }
+  const { join: join16 } = await import("node:path");
+  return new ForgeDB(join16(opts.dataDir, "forge.db"));
+}
+var init_db_factory = __esm({
+  "../core/dist/db-factory.js"() {
+    "use strict";
+    init_db();
+  }
+});
+
+// ../core/dist/init.js
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join13 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+function getForgeDir() {
+  return join13(homedir5(), ".forge");
+}
+function ensureForgeDir() {
+  const forgeDir = getForgeDir();
+  if (existsSync11(forgeDir)) {
+    return { forgeDir, created: false };
+  }
+  mkdirSync4(forgeDir, { recursive: true });
+  for (const d of FORGE_SUBDIRS) {
+    mkdirSync4(join13(forgeDir, d), { recursive: true });
+  }
+  writeFileSync3(join13(forgeDir, "config.json"), JSON.stringify({
+    port: 3e3,
+    theme: "dark",
+    openBrowser: true,
+    dataDir: forgeDir
+  }, null, 2));
+  return { forgeDir, created: true };
+}
+var FORGE_SUBDIRS;
+var init_init = __esm({
+  "../core/dist/init.js"() {
+    "use strict";
+    FORGE_SUBDIRS = ["modules", "templates", "cache", "logs"];
+  }
+});
+
+// ../core/dist/cw-install.js
+import { execFile as execFile5 } from "node:child_process";
+import { createHash as createHash2 } from "node:crypto";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync12, readFileSync as readFileSync8, statSync as statSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { delimiter as delimiter2, join as join14 } from "node:path";
+function readCwVersion(file) {
+  try {
+    const match = /^CW_VERSION="([^"]+)"/m.exec(readFileSync8(file, "utf-8"));
+    return match ? match[1] : null;
+  } catch {
+    return null;
+  }
+}
+function compareVersions(a, b) {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (diff !== 0)
+      return diff;
+  }
+  return 0;
+}
+function readCwBundle(dir) {
+  try {
+    const { ref } = JSON.parse(readFileSync8(join14(dir, ".bundle.json"), "utf-8"));
+    const version = readCwVersion(join14(dir, "cw"));
+    if (!ref || !version || !existsSync12(join14(dir, "install.sh")))
+      return null;
+    return { dir, version, ref };
+  } catch {
+    return null;
+  }
+}
+function decideCwInstall({ bundle, installed, marker, cwOnPath, skip }) {
+  if (skip)
+    return { action: "skip", reason: "FORGE_SKIP_CW_INSTALL is set" };
+  if (!bundle)
+    return { action: "skip", reason: "this Forge carries no CW" };
+  if (!installed) {
+    return cwOnPath ? { action: "skip", reason: "using the cw found on PATH" } : { action: "install", reason: "CW is not installed" };
+  }
+  if (!installed.version)
+    return { action: "skip", reason: "cannot read the installed CW version" };
+  const newer = compareVersions(bundle.version, installed.version);
+  const ownedByForge = marker !== null && marker.sha256 === installed.sha256;
+  if (ownedByForge) {
+    if (marker.ref === bundle.ref)
+      return { action: "skip", reason: `CW ${installed.version} is current` };
+    return newer >= 0 ? { action: "update", reason: `CW ${installed.version} \u2192 ${bundle.version}` } : { action: "skip", reason: `installed CW ${installed.version} is newer than ${bundle.version}` };
+  }
+  return newer > 0 ? { action: "update", reason: `CW ${installed.version} \u2192 ${bundle.version}` } : { action: "skip", reason: `CW ${installed.version} is current` };
+}
+function findOnPath(name, pathVar, excludeDir) {
+  for (const dir of (pathVar ?? "").split(delimiter2)) {
+    if (!dir || dir === excludeDir)
+      continue;
+    const candidate = join14(dir, name);
+    try {
+      if (!statSync3(candidate).isFile())
+        continue;
+      accessSync2(candidate, constants2.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function pathWithCw(cwHome, pathVar) {
+  const bin = join14(cwHome, "bin");
+  const rest = (pathVar ?? "").split(delimiter2).filter((dir) => dir && dir !== bin);
+  return [bin, ...rest].join(delimiter2);
+}
+function readMarker(cwHome) {
+  try {
+    return JSON.parse(readFileSync8(join14(cwHome, MARKER_FILE), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function failureMessage2(output) {
+  const lines2 = output.replace(ANSI_RE3, "").split("\n").map((l) => l.trim()).filter(Boolean);
+  const errors = lines2.filter((l) => l.startsWith("[\u2717]")).map((l) => l.slice(3).trim());
+  return (errors.length > 0 ? errors : lines2.slice(-3)).join(" ") || "the CW installer failed";
+}
+async function ensureCw(options) {
+  const { cwHome, bundleDir } = options;
+  const env = options.env ?? process.env;
+  const run = options.run ?? runInstall;
+  const bin = join14(cwHome, "bin", "cw");
+  const bundle = readCwBundle(bundleDir);
+  const installed = existsSync12(bin) ? { version: readCwVersion(bin), sha256: sha256Of(bin) } : null;
+  const decision = decideCwInstall({
+    bundle,
+    installed,
+    marker: readMarker(cwHome),
+    cwOnPath: findOnPath("cw", env.PATH, join14(cwHome, "bin")) !== null,
+    skip: env.FORGE_SKIP_CW_INSTALL === "1"
+  });
+  if (decision.action === "skip" || !bundle)
+    return { action: "skipped", message: decision.reason };
+  const { code, output } = await run(join14(bundle.dir, "install.sh"), ["--no-shell"], { ...env, CW_HOME: cwHome });
+  if (code !== 0 || !existsSync12(bin))
+    return { action: "failed", message: failureMessage2(output) };
+  const marker = { version: bundle.version, ref: bundle.ref, sha256: sha256Of(bin) };
+  writeFileSync4(join14(cwHome, MARKER_FILE), JSON.stringify(marker, null, 2) + "\n");
+  return {
+    action: decision.action === "install" ? "installed" : "updated",
+    version: bundle.version,
+    message: decision.reason
+  };
+}
+var MARKER_FILE, INSTALL_TIMEOUT_MS2, ANSI_RE3, sha256Of, runInstall;
+var init_cw_install = __esm({
+  "../core/dist/cw-install.js"() {
+    "use strict";
+    MARKER_FILE = ".forge-cw.json";
+    INSTALL_TIMEOUT_MS2 = 12e4;
+    ANSI_RE3 = /\u001b\[[0-9;?]*[A-Za-z]/g;
+    sha256Of = (file) => createHash2("sha256").update(readFileSync8(file)).digest("hex");
+    runInstall = (script, args, env) => new Promise((resolve5) => {
+      execFile5("bash", [script, ...args], { env, timeout: INSTALL_TIMEOUT_MS2, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => {
+        const output = `${String(stdout)}${String(stderr)}`;
+        if (!err)
+          return resolve5({ code: 0, output });
+        const code = err.code;
+        resolve5({ code: typeof code === "number" ? code : 1, output: output || err.message });
+      });
+    });
+  }
+});
+
+// ../core/dist/index.js
+var dist_exports = {};
+__export(dist_exports, {
+  ACCOUNT_NAME_RE: () => ACCOUNT_NAME_RE,
+  ActionRunner: () => ActionRunner,
+  CWReader: () => CWReader,
+  ForgeDB: () => ForgeDB,
+  HARNESS_CAPABILITIES: () => HARNESS_CAPABILITIES,
+  HARNESS_NAME_RE: () => HARNESS_NAME_RE,
+  Liveframe: () => Liveframe,
+  LiveframeError: () => LiveframeError,
+  MODEL_NAME_RE: () => MODEL_NAME_RE,
+  ModuleLoader: () => ModuleLoader,
+  PROVIDER_NAME_RE: () => PROVIDER_NAME_RE,
+  PTYManager: () => PTYManager,
+  bearerAuth: () => bearerAuth,
+  createDatabase: () => createDatabase,
+  createForgeServer: () => createForgeServer,
+  createTerminalWss: () => createTerminalWss,
+  cwRoutes: () => cwRoutes,
+  ensureCw: () => ensureCw,
+  ensureForgeDir: () => ensureForgeDir,
+  getForgeDir: () => getForgeDir,
+  liveframeRoutes: () => liveframeRoutes,
+  pathWithCw: () => pathWithCw,
+  quietSqliteWarning: () => quietSqliteWarning,
+  resolveListenOptions: () => resolveListenOptions,
+  skillRoutes: () => skillRoutes,
+  supports: () => supports
+});
+var init_dist = __esm({
+  "../core/dist/index.js"() {
+    "use strict";
+    init_server();
+    init_db();
+    init_modules();
+    init_runner();
+    init_auth();
+    init_origin_guard();
+    init_db_factory();
+    init_init();
+    init_cw_reader();
+    init_cw_install();
+    init_cw_routes();
+    init_skill_routes();
+    init_harness_capabilities();
+    init_cw_types();
+    init_pty_manager();
+    init_pty_routes();
+    init_liveframe_routes();
+    init_liveframe();
+  }
+});
+
+// src/index.ts
+import { existsSync as existsSync13 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { join as join15 } from "node:path";
+function parseArgs(argv) {
+  const out = { open: true };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--port" || arg === "-p") out.port = argv[++i];
+    else if (arg.startsWith("--port=")) out.port = arg.slice("--port=".length);
+    else if (arg === "--no-open") out.open = false;
+  }
+  return out;
+}
+var packageRoot = join15(import.meta.dirname, "..");
+var isCheckout = existsSync13(join15(packageRoot, "src"));
+var consoleDist = isCheckout ? join15(packageRoot, "../console/dist") : join15(packageRoot, "console");
+async function main() {
+  const { ensureForgeDir: ensureForgeDir2, createForgeServer: createForgeServer2, createDatabase: createDatabase2, resolveListenOptions: resolveListenOptions2, ensureCw: ensureCw2, pathWithCw: pathWithCw2, quietSqliteWarning: quietSqliteWarning2 } = await Promise.resolve().then(() => (init_dist(), dist_exports));
+  quietSqliteWarning2();
+  const args = parseArgs(process.argv.slice(2));
+  const { forgeDir, created } = ensureForgeDir2();
+  if (created) {
+    console.log("First run \u2014 initialized Forge.");
+  }
+  const cwHome = join15(process.env.HOME ?? homedir6(), ".cw");
+  const cw = isCheckout ? { action: "skipped", message: "a checkout does not install CW" } : await ensureCw2({ cwHome, bundleDir: join15(packageRoot, "cw") });
+  if (cw.action === "installed") console.log(`  Installed CW ${cw.version} in ${cwHome}`);
+  else if (cw.action === "updated") console.log(`  Updated ${cw.message}`);
+  else if (cw.action === "failed") console.log(`  Could not install CW: ${cw.message}`);
+  process.env.PATH = pathWithCw2(cwHome, process.env.PATH);
+  const port = parseInt(args.port ?? process.env.FORGE_PORT ?? "3000", 10);
+  const dbUrl = process.env.FORGE_DB_URL;
+  const authToken = process.env.FORGE_AUTH_TOKEN;
+  const isTeam = !!dbUrl;
+  const { host, localOnly } = resolveListenOptions2(isTeam);
+  const db = await createDatabase2({
+    mode: isTeam ? "team" : "local",
+    dataDir: forgeDir,
+    databaseUrl: dbUrl
+  });
+  const server = createForgeServer2({
+    dataDir: forgeDir,
+    port,
+    db,
+    authToken: isTeam ? authToken : void 0,
+    localOnly
+  });
+  const { serveStatic } = await import("@hono/node-server/serve-static");
+  const { readFileSync: readFileSync9 } = await import("node:fs");
+  if (existsSync13(join15(consoleDist, "index.html"))) {
+    server.app.use("/*", serveStatic({ root: consoleDist }));
+    const indexHtml = readFileSync9(join15(consoleDist, "index.html"), "utf-8");
+    server.app.get("*", (c) => c.html(indexHtml));
+  }
+  const { serve } = await import("@hono/node-server");
+  const httpServer = serve({ fetch: server.app.fetch, port, hostname: host });
+  server.attachTerminalWs(httpServer);
+  console.log(`
+  Forge Console running at http://localhost:${port}
+  Mode: ${isTeam ? "team (PostgreSQL)" : "local (SQLite)"}
+${authToken ? "  Auth: bearer token required\n" : ""}
+     Dashboard:  http://localhost:${port}
+     API:        http://localhost:${port}/api/health
+
+     Press Ctrl+C to stop
+  `);
+  if (args.open && process.env.FORGE_NO_OPEN !== "1") {
+    try {
+      const open = (await import("open")).default;
+      await open(`http://localhost:${port}`);
+    } catch {
+    }
+  }
+}
+main().catch(console.error);