frizz 0.13.0 → 0.13.2

package/dist/frizz.js

@@ -180,10 +180,21 @@ var init_local_origin = __esm({
   }
 });
 
+// packages/server/src/local-path.ts
+function normalizeLocalPath(path, platform = process.platform) {
+  return platform === "win32" ? path.replace(/^\/([a-zA-Z]:[\\/])/, "$1") : path;
+}
+var init_local_path = __esm({
+  "packages/server/src/local-path.ts"() {
+    "use strict";
+  }
+});
+
 // packages/server/src/local-image.ts
 import { readFileSync as readFileSync2, realpathSync, statSync } from "node:fs";
 import { extname, isAbsolute } from "node:path";
 function resolveLocalImage(rawPath) {
+  if (rawPath) rawPath = normalizeLocalPath(rawPath);
   if (!rawPath || !isAbsolute(rawPath)) return { status: 400 };
   const contentType = IMAGE_CONTENT_TYPE[extname(rawPath).toLowerCase()];
   if (!contentType) return { status: 400 };
@@ -204,6 +215,7 @@ var IMAGE_CONTENT_TYPE;
 var init_local_image = __esm({
   "packages/server/src/local-image.ts"() {
     "use strict";
+    init_local_path();
     IMAGE_CONTENT_TYPE = {
       ".png": "image/png",
       ".jpg": "image/jpeg",
@@ -11775,7 +11787,7 @@ var init_interactions = __esm({
     InteractionFieldId = external_exports.string().min(1).max(128).regex(/^[A-Za-z_][A-Za-z0-9_.:-]*$/).refine((value) => !["__proto__", "constructor", "prototype"].includes(value), "reserved field id");
     InteractionDecisionId = external_exports.string().min(1).max(80).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/);
     InteractionProvider = external_exports.object({
-      kind: external_exports.enum(["claude", "codex", "frizz"]),
+      kind: external_exports.enum(["claude", "codex", "acp", "frizz"]),
       name: InteractionLabel.optional(),
       version: InteractionOpaqueId.optional()
     }).strict();
@@ -12322,6 +12334,13 @@ var init_claim = __esm({
   }
 });
 
+// packages/shared/src/claude-editions.ts
+var init_claude_editions = __esm({
+  "packages/shared/src/claude-editions.ts"() {
+    "use strict";
+  }
+});
+
 // packages/shared/src/code-fences.ts
 var init_code_fences = __esm({
   "packages/shared/src/code-fences.ts"() {
@@ -12466,10 +12485,15 @@ var init_shell_writes = __esm({
 });
 
 // packages/shared/src/index.ts
+function requireEffortOutsideAcp(profile, ctx) {
+  if (profile.backend !== "acp" && profile.effort === void 0) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["effort"], message: `effort is required for a ${profile.backend} profile` });
+  }
+}
 function fallbackPort(base) {
   return base + 1e4;
 }
-var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_TEXT_EXTENSIONS, ATTACHMENT_OFFICE_EXTENSIONS, ATTACHMENT_DATA_EXTENSIONS, ATTACHMENT_ARCHIVE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, ThreadWatchView, PR_WATCH_FOR_MAX_MS, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, OwnWatchKind, AddOwnWatchInput, OwnWatchView, AddOwnWatchResult, DropOwnWatchInput, DropOwnWatchResult, AskQuestionKind, AskedOptionSchema, AskedQuestionSchema, AskInput, RegisteredQuestionView, AskResult, UnaskInput, UnaskResult, QuestionAnswerSchema, AnswerQuestionsInput, AnswerQuestionsResult, DismissQuestionsInput, DismissQuestionsResult, MarkOwnDoneInput, MarkOwnDoneResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ProviderError, ThreadLinkView, UpsertOwnLinkInput, UpsertOwnLinkResult, DropOwnLinkInput, DropOwnLinkResult, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadPinnedInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetOwnThreadTitleInput, SetOwnThreadTitleResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, HUMAN_GAP_FLOOR_MS, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_GATED, PR_WATCH_STATE, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, EditedFile, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketFilePath, SocketTranscriptClientMsg, SocketFileClientMsg, SocketClientMsg, ProjectCard, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
+var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_TEXT_EXTENSIONS, ATTACHMENT_OFFICE_EXTENSIONS, ATTACHMENT_DATA_EXTENSIONS, ATTACHMENT_ARCHIVE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ClaudeModel, AcpAgent, AcpAgentModel, AcpAgentModels, AcpAgentModelsInput, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, GithubIssueStatus, ThreadWatchView, PR_WATCH_FOR_MAX_MS, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, OwnWatchKind, AddOwnWatchInput, OwnWatchView, AddOwnWatchResult, DropOwnWatchInput, DropOwnWatchResult, AskQuestionKind, AskedOptionSchema, AskedQuestionSchema, AskInput, RegisteredQuestionView, AskResult, UnaskInput, UnaskResult, QuestionAnswerSchema, AnswerQuestionsInput, AnswerQuestionsResult, DismissQuestionsInput, DismissQuestionsResult, MarkOwnDoneInput, MarkOwnDoneResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ProviderError, ThreadLinkView, UpsertOwnLinkInput, UpsertOwnLinkResult, DropOwnLinkInput, DropOwnLinkResult, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountBackend, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshotShape, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadPinnedInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetOwnThreadTitleInput, SetOwnThreadTitleResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, UpgradeThreadModelInput, UpgradeThreadModelResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, HUMAN_GAP_FLOOR_MS, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_GATED, PR_WATCH_STATE, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, EditedFile, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketFilePath, SocketTranscriptClientMsg, SocketFileClientMsg, SocketClientMsg, ProjectCard, ProjectRailCounts, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
 var init_src = __esm({
   "packages/shared/src/index.ts"() {
     "use strict";
@@ -12478,6 +12502,7 @@ var init_src = __esm({
     init_interactions();
     init_thread_slug();
     init_claim();
+    init_claude_editions();
     init_code_fences();
     init_delta();
     init_drainable_worker();
@@ -12588,7 +12613,7 @@ var init_src = __esm({
       "exited"
       // the worker process that owned this session is gone, or is no longer driving its turn
     ]);
-    Backend = external_exports.enum(["claude", "codex"]);
+    Backend = external_exports.enum(["claude", "codex", "acp"]);
     CodexModel = external_exports.object({
       slug: external_exports.string(),
       displayName: external_exports.string(),
@@ -12602,9 +12627,36 @@ var init_src = __esm({
       contextWindow: external_exports.number().int().positive().optional(),
       maxContextWindow: external_exports.number().int().positive().optional()
     });
+    ClaudeModel = external_exports.object({
+      alias: external_exports.string(),
+      label: external_exports.string(),
+      resolvedModel: external_exports.string().optional(),
+      // The edition alone ("5.5") — the tail of `label`, which the picker sets dimmer than the family word.
+      // Absent exactly when `resolvedModel` is.
+      edition: external_exports.string().optional()
+    });
+    AcpAgent = external_exports.object({
+      id: external_exports.string(),
+      label: external_exports.string(),
+      command: external_exports.string(),
+      available: external_exports.boolean()
+    });
+    AcpAgentModel = external_exports.object({ id: external_exports.string(), name: external_exports.string() });
+    AcpAgentModels = external_exports.object({
+      agentId: external_exports.string(),
+      models: external_exports.array(AcpAgentModel),
+      /** The model the agent opens a session on when Frizz asks for none. */
+      current: external_exports.string().optional(),
+      /** Why the list is empty, when the probe could not open a session (not installed, not logged in…). */
+      error: external_exports.string().optional(),
+      probedAt: external_exports.string()
+    });
+    AcpAgentModelsInput = external_exports.object({ agentId: external_exports.string().min(1).max(100), refresh: external_exports.boolean().optional() }).strict();
     ThreadProfileOption = external_exports.object({
       model: external_exports.string().min(1),
       label: external_exports.string().min(1),
+      // The edition at the end of `label` ("5.5" of "Opus 5.5"), for a Claude row the pinned runtime resolved.
+      edition: external_exports.string().optional(),
       defaultEffort: external_exports.string().min(1),
       efforts: external_exports.array(external_exports.string().min(1)).min(1)
     });
@@ -12779,7 +12831,7 @@ var init_src = __esm({
       questions: external_exports.array(AskQuestion)
     });
     AwaitingHint = external_exports.object({
-      kind: external_exports.enum(["shell", "agent", "timer", "pr", "for", "title"]),
+      kind: external_exports.enum(["shell", "agent", "timer", "pr", "issue", "for", "title"]),
       value: external_exports.string()
     });
     RETIRED_AWAITING_KINDS = ["watch", "pr-watch", "human", "ci", "session", "shell", "agent", "timer", "pr", "reason"];
@@ -12929,6 +12981,20 @@ var init_src = __esm({
        *  must hear about. Empty when nothing is failing. */
       failureSig: external_exports.string().optional()
     }).strict();
+    GithubIssueStatus = external_exports.object({
+      /** OPEN | CLOSED, lowercased. A closed issue ends the wait outright. */
+      state: external_exports.enum(["open", "closed"]),
+      /** GitHub's own reason for a close — `completed`, `not_planned`, `duplicate` — lowercased, when it
+       *  gave one. Absent while open. */
+      stateReason: external_exports.string().optional(),
+      /** The issue's title, as of the last poll — the one fact a human needs to place a bare `owner/repo#N`
+       *  on the card. Capped, because a title is a headline and the card is not the place to read one. */
+      title: external_exports.string().max(200).optional(),
+      /** The conversation's size, so the card can say "14 comments" the way GitHub's list does. */
+      comments: external_exports.number().int().nonnegative(),
+      /** When frizz last heard from GitHub, for the same reason `GithubWatchStatus.polledAt` carries it. */
+      polledAt: external_exports.string()
+    }).strict();
     ThreadWatchView = external_exports.object({
       id: external_exports.string(),
       kind: ThreadWatchKind,
@@ -12937,6 +13003,15 @@ var init_src = __esm({
       createdAt: external_exports.string(),
       /** `github` rows only, and absent until the first successful poll. */
       github: GithubWatchStatus.optional(),
+      /** `github` rows only: WHAT the row watches. A pull request and an issue share the kind — they are one
+       *  registry, one ref grammar (`owner/repo#N`) and one place on every surface that lists waits — and
+       *  differ in what the poll can read off them, which is what this field lets a card branch on.
+       *  Optional, and absent means a pull request — a row from a server that predates issues reads as the
+       *  PR it always was, and the non-github kinds never carry it. */
+      subject: external_exports.enum(["pull", "issue"]).optional(),
+      /** `github` rows watching an ISSUE only, and absent until the first successful poll — the twin of the
+       *  `github` half above, for the rows whose subject has no checks to report. */
+      issue: GithubIssueStatus.optional(),
       /** `timer` rows only: the armed timer's own registration, which is everything the row renders — the
        *  worker's prompt is the row's NAME (a `tmr_…` id names nothing to a human) and the fire instant is
        *  its status. Unlike `github` there is no polled half to be absent: a timer that exists is fully
@@ -12949,10 +13024,15 @@ var init_src = __esm({
       id: external_exports.string(),
       /** `owner/repo#N`, normalized — the same string the board's row and the status book are keyed by. */
       target: external_exports.string(),
+      /** A pull request or an issue. Both live in one registry (`pr_watch`) and answer to one drop verb;
+       *  `watch_pr` and `watch_issue` each list only their own. Defaulted for a row an older server sends. */
+      kind: external_exports.enum(["pull", "issue"]).default("pull"),
       state: external_exports.enum(["armed", "dropped", "settled"]),
       createdAt: external_exports.string(),
       /** The PR's checks/mergeability as the poller last saw it. Absent until the first successful poll. */
-      github: GithubWatchStatus.optional()
+      github: GithubWatchStatus.optional(),
+      /** An ISSUE's state as the poller last saw it — `kind: "issue"` rows only, absent until polled. */
+      issue: GithubIssueStatus.optional()
     }).strict();
     AddOwnPrWatchInput = external_exports.object({
       slug: ThreadSlug,
@@ -12977,7 +13057,13 @@ var init_src = __esm({
        *  already running, with no recourse from inside those threads. Absent ⇒ PR_WATCH_DEFAULT_FOR, which
        *  still BOUNDS the poll; the point of the field is that a worker chooses, and one that cannot choose
        *  is better bounded than broken. */
-      for: external_exports.string().trim().min(1).max(16).optional()
+      for: external_exports.string().trim().min(1).max(16).optional(),
+      /** What `target` names. `issue` (from `mcp__frizz__watch_issue`, 2026-09-14) registers a watcher on a
+       *  GitHub issue — same registry, same poll cadence, same drop verb, but a different probe (`gh issue
+       *  view`), a different GraphQL fragment and a report with no CI in it. ABSENT MEANS A PULL REQUEST,
+       *  for the same reason `for` is optional on the wire: every `watch_pr` binary dispatched before this
+       *  field existed sends nothing here and must go on meaning what it always did. */
+      kind: external_exports.enum(["pull", "issue"]).optional()
     }).strict();
     AddOwnPrWatchResult = external_exports.object({
       id: external_exports.string(),
@@ -13443,6 +13529,16 @@ var init_src = __esm({
       // values forward-compatible; absent when neither durable source knows → the UI renders no guess.
       model: external_exports.string().optional(),
       effort: external_exports.string().optional(),
+      // The Claude EDITION this thread's worker last ran ("Opus 5"), read off the model id on its own
+      // transcript. It can be older than the edition the picker's row names ("Opus 5.5"): a worker keeps the
+      // runtime it was started on, and a new pin only reaches the workers started after it. Emitted only when
+      // that id belongs to the family `model` names, so a pending model switch never shows the old family's.
+      runningModelLabel: external_exports.string().optional(),
+      // Present when the pinned runtime now resolves this thread's family to a NEWER edition than it runs.
+      // `staged`: no live worker holds the old edition, so the next turn starts on `label` with nothing
+      // further to do; otherwise the composer offers the upgrade, and the first message after the thread's
+      // next compaction takes it on its own.
+      modelUpgrade: external_exports.object({ label: external_exports.string(), staged: external_exports.boolean() }).optional(),
       // How full the session's context window is right now — the footer's fullness readout. BOTH halves
       // are provider-measured and the field is emitted ONLY when both are present, so a client never has
       // to decide what to do with half a fraction: absent ⇒ no reading, never a 0% dial. Codex reports
@@ -13525,14 +13621,15 @@ var init_src = __esm({
       codex: ProviderAuth,
       emails: AccountEmails
     });
-    AccountLogoutInput = external_exports.object({ backend: external_exports.enum(["claude", "codex"]) }).strict();
+    AccountBackend = external_exports.enum(["claude", "codex"]);
+    AccountLogoutInput = external_exports.object({ backend: AccountBackend }).strict();
     AccountLogoutResult = external_exports.object({
       status: external_exports.enum(["done", "blocked", "failed"]),
       auth: ProviderAuth,
       activeThreads: external_exports.number().int().positive().optional(),
       detail: external_exports.string().max(200).optional()
     });
-    AccountLoginStartInput = external_exports.object({ backend: external_exports.enum(["claude", "codex"]) }).strict();
+    AccountLoginStartInput = external_exports.object({ backend: AccountBackend }).strict();
     AccountLoginStartResult = external_exports.object({ attemptId: ThreadSlug });
     AccountLoginStatusInput = external_exports.object({ attemptId: ThreadSlug }).strict();
     AccountLoginStatusResult = external_exports.object({
@@ -13574,13 +13671,13 @@ var init_src = __esm({
        * to, not furniture you sit beside. Hidden, the way back is a breadcrumb in the status bar, which
        * costs a click exactly when you meant to switch and nothing when you did not.
        *
-       * Machine-level, like the font: which chrome you want is a property of the person, not the repo.
+       * Machine-level: which chrome you want is a property of the person, not the repo.
        */
       projectRail: external_exports.boolean(),
-      // UI type family. `mono` (default) is the mono-forward system; `sans` swaps prose/UI chrome to a
-      // sans stack while code / tool lines / the terminal stay mono. Optional so an old settings blob
-      // parses; defaultSettings pins "mono".
-      font: external_exports.enum(["mono", "sans"]).optional(),
+      // There is no `font` key any more. The interface rendered in one of two type families as a machine
+      // setting until 2026-09-19 (maintainer: "let's drop monospace as an option"); every surface is sans
+      // now, and index.html pins `data-font="sans"` on <html> directly. Settings is a non-strict object,
+      // so a stored `font` is stripped the moment an old blob parses — no migration.
       // Default action for a vetted non-image local path in agent markdown. Image clicks always use the
       // OS default viewer so screenshots retain their expected behavior.
       localFileOpener: LocalFileOpener.optional(),
@@ -13607,6 +13704,15 @@ var init_src = __esm({
       // it (codex compacts at 90% of the resolved window). Unset ⇒ nothing is sent and the model's stock
       // window applies. Optional so an old blob parses; defaultSettings leaves it unset.
       codexContextWindow: external_exports.number().int().positive().optional(),
+      // The operator's OWN Agent Client Protocol agents, merged over the built-in catalogue by id
+      // (server/backend/acp-agents.ts). `command` is an executable name on PATH or an absolute path;
+      // `args` is what puts it into ACP mode (`["acp"]`, `["--acp"]`). Optional so an old blob parses.
+      acpAgents: external_exports.array(external_exports.object({
+        id: external_exports.string().trim().min(1).max(64).regex(/^[a-z0-9][a-z0-9._-]*$/i),
+        label: external_exports.string().trim().min(1).max(80),
+        command: external_exports.string().trim().min(1).max(1024),
+        args: external_exports.array(external_exports.string().max(1024)).max(32).optional()
+      })).max(32).optional(),
       // The GitHub batch-dispatch prompt template (the picker's per-item worker prompt). Optional: when
       // unset OR blank the server falls back to its exported DEFAULT_GITHUB_PROMPT. Substitution tokens
       // the server fills: {repo} {n} {title} {url} {labels} {body}. The leading `THREAD: <slug>` tag is
@@ -13633,28 +13739,38 @@ var init_src = __esm({
     DispatchPreferences = external_exports.object({
       backend: Backend,
       claude: DispatchProviderPreferences,
-      codex: DispatchProviderPreferences
+      codex: DispatchProviderPreferences,
+      // Optional because every record written before the ACP backend existed lacks it, and a required
+      // key would fail those records' parse and silently reset the operator's saved profile.
+      acp: DispatchProviderPreferences.optional()
     });
-    DispatchProfileSnapshot = external_exports.object({
+    DispatchProfileSnapshotShape = external_exports.object({
       backend: Backend,
       model: external_exports.string().trim().min(1).max(200),
-      effort: Settings.shape.effort.unwrap(),
+      // Required for Claude and Codex (the refinement below); absent for an ACP agent, which runs with
+      // whatever model and effort its own CLI is configured for — Frizz has no effort axis to offer there.
+      effort: Settings.shape.effort,
       // IGNORED: dispatch permission is decided server-side (workerDispatchPermission) from the
       // non-interactive floor plus the operator's Settings choice, never per dispatch. Optional so old
       // clients that still send it parse.
       permissionMode: PermissionMode.optional()
     }).strict();
+    DispatchProfileSnapshot = DispatchProfileSnapshotShape.superRefine(requireEffortOutsideAcp);
     SetDispatchPreferenceInput = external_exports.discriminatedUnion("field", [
       external_exports.object({ field: external_exports.literal("backend"), value: Backend }),
       external_exports.object({
         field: external_exports.literal("profile"),
         backend: Backend,
         model: external_exports.string().trim().min(1).max(200),
-        effort: Settings.shape.effort.unwrap()
+        // Optional ONLY for an ACP profile (see DispatchProfileSnapshot); a Claude/Codex profile without
+        // an effort is refused below rather than silently stored as "default".
+        effort: Settings.shape.effort
       }),
       external_exports.object({ field: external_exports.literal("model"), backend: Backend, value: external_exports.string().trim().min(1).max(200) }),
       external_exports.object({ field: external_exports.literal("effort"), backend: Backend, value: Settings.shape.effort.unwrap() })
-    ]);
+    ]).superRefine((update, ctx) => {
+      if (update.field === "profile") requireEffortOutsideAcp(update, ctx);
+    });
     DispatchInput = external_exports.object({
       // Optional: when omitted, dispatch derives a fallback title from the prompt (Claude later renames
       // the session via ai-title, which the UI prefers for display). The thread FILE always gets a
@@ -13702,8 +13818,9 @@ var init_src = __esm({
       freshProcess: external_exports.boolean().optional(),
       // PREEMPT the operation the worker is running right now, so this message is read at once instead of
       // when that operation finishes. The operator's "Interrupt and send" verb, and opt-in for the same
-      // reason `freshProcess` is: it costs the in-flight tool call's result and the worker's in-memory
-      // sub-agents.
+      // reason `freshProcess` is: it costs the in-flight tool call's result. (It no longer costs the
+      // worker's sub-agents: since 2026-09-24 the broker's SDK query declares `perTaskStopAffordance`,
+      // so the interrupt aborts only the turn and background agents run on.)
       //
       // It exists because delivery is ALREADY as fast as queueing can be. Measured over 14 days of this
       // project's own transcripts, Claude Code drains its queue at the first sampling boundary that
@@ -13806,7 +13923,7 @@ var init_src = __esm({
       timers: external_exports.array(ThreadTimerView)
     }).strict();
     ThreadActivityItem = external_exports.object({
-      kind: external_exports.enum(["shell", "agent", "timer", "pr"]),
+      kind: external_exports.enum(["shell", "agent", "timer", "pr", "issue"]),
       /** The string a `<kind>:` fence line must carry. For a shell that is the runtime task id the worker
        *  was shown; for a PR, `owner/repo#N`; for a timer, its `tmr_…` row id. */
       id: external_exports.string(),
@@ -13910,11 +14027,15 @@ var init_src = __esm({
     SetThreadProfileInput = external_exports.object({
       slug: ThreadSlug,
       model: external_exports.string().trim().min(1).max(200),
-      effort: external_exports.string().trim().min(1).max(100)
+      // Absent ONLY for an ACP thread, whose model slug (`acp:<agent>@<model>`) carries no effort axis; the
+      // router refuses a Claude/Codex profile without one rather than storing "".
+      effort: external_exports.string().trim().min(1).max(100).optional()
     }).strict();
     SetThreadProfileResult = external_exports.object({
       effect: external_exports.enum(["applied", "next-resume"])
     });
+    UpgradeThreadModelInput = external_exports.object({ slug: ThreadSlug, sessionId: external_exports.string().min(1) }).strict();
+    UpgradeThreadModelResult = external_exports.object({ effect: external_exports.literal("next-turn"), label: external_exports.string() });
     DISPATCH_TASK_BANNER = [
       "===============================================================",
       "======================    YOUR TASK    ========================",
@@ -14044,9 +14165,9 @@ ${DISPATCH_TASK_BANNER}
       page: external_exports.number().int().positive(),
       pageCount: external_exports.number().int().positive()
     });
-    GithubBatchInput = DispatchProfileSnapshot.extend({
+    GithubBatchInput = DispatchProfileSnapshotShape.extend({
       items: external_exports.array(external_exports.object({ kind: external_exports.enum(["issue", "pr"]), number: external_exports.number().int().positive() })).min(1)
-    }).strict();
+    }).strict().superRefine(requireEffortOutsideAcp);
     GithubBatchResult = external_exports.object({
       dispatched: external_exports.array(external_exports.object({ number: external_exports.number(), kind: external_exports.string(), slug: ThreadSlug })),
       failed: external_exports.array(external_exports.object({ number: external_exports.number(), kind: external_exports.string(), error: external_exports.string() }))
@@ -14490,6 +14611,10 @@ ${DISPATCH_TASK_BANNER}
       /** An operator's uploaded icon, rather than one the scan found. Drives what the menu offers. */
       iconIsCustom: external_exports.boolean().optional()
     });
+    ProjectRailCounts = external_exports.object({
+      queued: external_exports.number().int().nonnegative(),
+      running: external_exports.number().int().nonnegative()
+    });
     PROJECT_ICON_MAX_BASE64_CHARS = 4 * 1024 * 1024;
     DirectoryPickResult = external_exports.discriminatedUnion("kind", [
       external_exports.object({ kind: external_exports.literal("picked"), project: ProjectCard }),
@@ -19486,11 +19611,13 @@ function readBootProgress(stateDir) {
     return null;
   }
 }
-var BOOT_PROGRESS_NAME;
+var BOOT_PROGRESS_NAME, BOOT_STALL_TIMEOUT_MS, BOOT_HARD_TIMEOUT_MS;
 var init_boot_progress = __esm({
   "packages/server/src/boot-progress.ts"() {
     "use strict";
     BOOT_PROGRESS_NAME = "boot.progress";
+    BOOT_STALL_TIMEOUT_MS = 3e4;
+    BOOT_HARD_TIMEOUT_MS = 10 * 6e4;
   }
 });
 
@@ -22146,12 +22273,12 @@ var qrcode_default = qrcode;
 var stringToBytes = qrcode.stringToBytes;
 
 // packages/server/src/qr.ts
-var LIGHT = "\x1B[38;5;15m";
 var LIGHT_BG = "\x1B[48;5;15m";
 var DARK = "\x1B[38;5;0m";
 var DARK_BG = "\x1B[48;5;0m";
 var RESET = "\x1B[0m";
 var UPPER_HALF = "\u2580";
+var LOWER_HALF = "\u2584";
 var QUIET_ZONE = 4;
 function encode(value, errorCorrection) {
   const code = qrcode_default(0, errorCorrection);
@@ -22182,7 +22309,8 @@ function renderQrLines(value, options2 = {}) {
         line += top && bottom ? "#" : top ? "^" : bottom ? "v" : " ";
         continue;
       }
-      line += `${top ? DARK : LIGHT}${bottom ? DARK_BG : LIGHT_BG}${UPPER_HALF}`;
+      if (top === bottom) line += `${top ? DARK_BG : LIGHT_BG} `;
+      else line += `${DARK}${LIGHT_BG}${top ? UPPER_HALF : LOWER_HALF}`;
     }
     lines.push(options2.plain ? line : `${line}${RESET}`);
   }
@@ -22207,12 +22335,29 @@ var BASE_STYLE = `
 :root{
   color-scheme:dark;
   --bg:#0d0e10;--panel:#131519;--panel-2:#181b20;
-  --border:#26282d;--border-strong:#33363c;
+  --border:#26282d;--border-strong:#33363c;--control-border:#26282d;--control-strong:#33363c;
   --fg:#e6e7e9;--muted:#8b8f96;--accent:#e8b923;--danger:#fca5a5;
+  --focus-border:color-mix(in srgb,var(--accent) 55%,transparent);--focus-ring:color-mix(in srgb,var(--accent) 22%,transparent);
   --sans:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;
   --mono:ui-monospace,"JetBrains Mono","SF Mono","Cascadia Mono",Menlo,Consolas,monospace;
   --ease:cubic-bezier(0,0,.2,1);
 }
+:root[data-theme=light]{
+  color-scheme:light;
+  --bg:#f7f7f7;--panel:#fff;--panel-2:#fafafa;
+  --border:#dedede;--border-strong:#cecece;--control-border:#858585;--control-strong:#7d7d7d;
+  --fg:#292929;--muted:#606060;--accent:#416896;--danger:#cf222e;
+  --focus-border:#416896;--focus-ring:#416896;
+}
+@media(prefers-color-scheme:light){
+  :root:not([data-theme]){
+    color-scheme:light;
+    --bg:#f7f7f7;--panel:#fff;--panel-2:#fafafa;
+    --border:#dedede;--border-strong:#cecece;--control-border:#858585;--control-strong:#7d7d7d;
+    --fg:#292929;--muted:#606060;--accent:#416896;--danger:#cf222e;
+    --focus-border:#416896;--focus-ring:#416896;
+  }
+}
 html,body{background:var(--bg)}
 body{
   margin:0;min-height:100vh;min-height:100dvh;
@@ -22220,7 +22365,6 @@ body{
   color:var(--fg);font-family:var(--sans);font-size:12.5px;line-height:1.55;
   -webkit-font-smoothing:antialiased;
 }
-html[data-font=mono] body{font-family:var(--mono)}
 main{width:100%;max-width:28rem;padding:18px;border:1px solid var(--border-strong);border-radius:12px;background:var(--panel-2)}
 h1{margin:0;display:flex;align-items:baseline;gap:7px;font-size:14px;font-weight:600;letter-spacing:-.01em;line-height:1.4}
 p{margin:0;text-wrap:pretty}
@@ -22234,13 +22378,13 @@ var RECOVERY_STYLE = `
 /* ErrorBoundary's ACTION_CLASS, one size up for a page that is alone in a viewport. */
 .btn{
   appearance:none;display:inline-flex;align-items:center;
-  border:1px solid var(--border);border-radius:6px;background:transparent;
+  border:1px solid var(--control-border);border-radius:6px;background:transparent;
   padding:5px 10px;font:inherit;font-size:11.5px;color:color-mix(in srgb,var(--fg) 90%,transparent);
   cursor:pointer;text-decoration:none;
   transition:background-color 120ms var(--ease),border-color 120ms var(--ease),color 120ms var(--ease);
 }
-.btn:hover{background:var(--panel);border-color:var(--border-strong);color:var(--fg)}
-.btn:focus-visible{outline:none;border-color:color-mix(in srgb,var(--accent) 55%,transparent);box-shadow:0 0 0 2px color-mix(in srgb,var(--accent) 22%,transparent)}
+.btn:hover{background:var(--panel);border-color:var(--control-strong);color:var(--fg)}
+.btn:focus-visible{outline:none;border-color:var(--focus-border);box-shadow:0 0 0 2px var(--focus-ring)}
 .btn:disabled{opacity:.5;pointer-events:none}
 /* min-height holds the slot open while it is LIVE, so a changing status line never nudges the card;
    :empty collapses it when there is nothing live to say, so a halted card has no trailing gutter. */
@@ -22260,8 +22404,7 @@ var RECOVERY_STYLE = `
    Alignment is an INK problem. A baseline-aligned flex item with no text of its own contributes its
    BORDER-BOX BOTTOM as the baseline, so the dot's ink centre lands 3px above it while the cap band's
    centre sits 0.5cap above it. \`cap\` is the resolved font's own cap height, so the correction holds
-   in BOTH board fonts and at any size, with nothing to re-measure when the type scale moves or the
-   font setting flips. The em spelling is the fallback for a browser without the unit (.35em ~= 0.5 x a
+   at any size, with nothing to re-measure when the type scale moves. The em spelling is the fallback for a browser without the unit (.35em ~= 0.5 x a
    0.7em cap) and is overwritten wherever \`cap\` parses. */
 .dot{
   width:6px;height:6px;flex:0 0 auto;border-radius:9999px;background:var(--accent);
@@ -22292,7 +22435,7 @@ var RECOVERY_STYLE = `
   .probe[data-live=yes]{animation:none;background:none;color:var(--muted)}
 }
 `.trim();
-var FONT_SCRIPT = `try{document.documentElement.dataset.font=localStorage.getItem("frizz-font")==="mono"?"mono":"sans"}catch{}`;
+var THEME_SCRIPT = `var p;try{p=localStorage.getItem("frizz-theme")}catch{}var d=false;try{d=matchMedia&&matchMedia("(prefers-color-scheme: dark)").matches}catch{}var t=p==="dark"||p==="light"?p:d?"dark":"light";document.documentElement.dataset.theme=t;document.documentElement.style.colorScheme=t;document.querySelector('meta[name="theme-color"]').content=t==="dark"?"#0d0e10":"#f7f7f7"`;
 var RECOVERY_SCRIPT = `
 (function(){
   var target=document.body.dataset.target||"/"
@@ -22391,8 +22534,8 @@ var RECOVERY_SCRIPT = `
 })()
 `.trim();
 function documentShell(options2) {
-  return `<!doctype html><html lang="en" data-font="sans"><head><meta charset="utf-8"><title>${options2.title}</title><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="dark"><meta name="theme-color" content="#0d0e10"><style>${options2.style ? `${BASE_STYLE}
-${options2.style}` : BASE_STYLE}</style>` + (options2.font ? `<script>${FONT_SCRIPT}</script>` : "") + `</head><body${options2.bodyAttributes ? ` ${options2.bodyAttributes}` : ""}><main>${options2.body}</main>` + (options2.script ? `<script>${options2.script}</script>` : "") + `</body></html>`;
+  return `<!doctype html><html lang="en" data-font="sans"><head><meta charset="utf-8"><title>${options2.title}</title><meta name="viewport" content="width=device-width,initial-scale=1">` + (options2.appearance ? `<meta name="color-scheme" content="dark light"><meta name="theme-color" content="#0d0e10">` : `<meta name="color-scheme" content="dark light"><meta name="theme-color" media="(prefers-color-scheme: dark)" content="#0d0e10"><meta name="theme-color" media="(prefers-color-scheme: light)" content="#f7f7f7">`) + `<style>${options2.style ? `${BASE_STYLE}
+${options2.style}` : BASE_STYLE}</style>` + (options2.appearance ? `<script>${THEME_SCRIPT}</script>` : "") + `</head><body${options2.bodyAttributes ? ` ${options2.bodyAttributes}` : ""}><main>${options2.body}</main>` + (options2.script ? `<script>${options2.script}</script>` : "") + `</body></html>`;
 }
 var RECOVERY_COPY = {
   starting: {
@@ -22413,7 +22556,7 @@ function recoveryPage(url, variant = "starting") {
   return documentShell({
     title: copy.title,
     style: RECOVERY_STYLE,
-    font: true,
+    appearance: true,
     bodyAttributes: `data-target="${target2}"`,
     body: `<h1><span class="dot" id="dot" aria-hidden="true"></span><span id="heading">${copy.heading}</span></h1><p class="detail" id="detail">${copy.detail}</p><pre class="log" id="log" hidden></pre><p class="note">${THREADS_NOTE}</p><div class="actions"><a class="btn" href="${target2}">Try again</a><button class="btn" type="button" id="restart">Restart Frizz</button></div><p class="probe" id="probe" aria-live="polite"></p>`,
     script: RECOVERY_SCRIPT
@@ -22430,7 +22573,7 @@ function unlistedHostPage(name) {
   const shown = escapeHtml(name);
   return documentShell({
     title: "Not served by this name",
-    font: true,
+    appearance: true,
     body: `<h1>Not served by this name</h1><p class="detail">Frizz does not answer to <code>${shown}</code>. A name a browser has to resolve is how DNS rebinding makes another site's page count as this board, so an exposed board accepts only its own hostname and the names its operator lists.</p><p class="note">Open the board by its IP address, or relaunch with <code>--allowed-host ${shown}</code> (or <code>FRIZZ_ALLOWED_HOSTS=${shown}</code>) to accept this one.</p>`
   });
 }
@@ -23125,6 +23268,7 @@ function createAccessPane(options2) {
 import { homedir as homedir5 } from "node:os";
 
 // src/cloud.ts
+init_frizz_paths();
 init_src();
 import { spawn as spawn2 } from "node:child_process";
 import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3, rmSync } from "node:fs";
@@ -23138,8 +23282,8 @@ init_src();
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { dirname as dirname3, join as join4 } from "node:path";
-function claimIdentityPath(home = homedir3()) {
-  return join4(frizzPaths({ home }).state, "identity.key");
+function claimIdentityPath(home = homedir3(), env) {
+  return join4(frizzPaths({ home, env }).state, "identity.key");
 }
 async function loadOrCreateClaimIdentity(home = homedir3()) {
   const path = claimIdentityPath(home);
@@ -23684,7 +23828,7 @@ async function reconcileCloudConfig(config, port, home = homedir4(), onNotice, o
   return establishCloudConfig(label, port, home, origin, github);
 }
 function cloudConfigPath(home = homedir4()) {
-  return join5(home, ".frizz", "cloud.json");
+  return join5(frizzPaths({ home }).data, "cloud.json");
 }
 function readCloudConfig(home = homedir4()) {
   try {
@@ -23707,7 +23851,7 @@ function readCloudConfig(home = homedir4()) {
   }
 }
 function tunnelTokenPath(home = homedir4()) {
-  return join5(home, ".frizz", "tunnel-token");
+  return join5(frizzPaths({ home }).state, "tunnel-token");
 }
 function readTunnelToken(home = homedir4()) {
   try {
@@ -24652,8 +24796,8 @@ init_logging();
 init_src();
 init_project_registry();
 var PORT_SCAN_COUNT = 100;
-var LAUNCH_TIMEOUT_MS = 3e4;
-var LAUNCH_HARD_TIMEOUT_MS = 10 * 6e4;
+var LAUNCH_TIMEOUT_MS = BOOT_STALL_TIMEOUT_MS;
+var LAUNCH_HARD_TIMEOUT_MS = BOOT_HARD_TIMEOUT_MS;
 var RETIRED_NETWORK_FLAGS = ["--host", "--allowed-host", "--public-origin", "--cloud"];
 function retiredFlagMessage(flag) {
   return `${flag} was retired \u2014 how a board is reached is set up from the running board now: press R in its terminal to pick a private or custom frizz.sh name, a Cloudflare Tunnel, Tailscale or a proxy of your own. The choice is remembered, so a plain launch serves it.`;
@@ -24766,11 +24910,14 @@ function parseCliArgs(argv) {
 function boardAddress(url) {
   return url.includes("?") || url.endsWith("/") ? url : `${url}/`;
 }
+var SANDBOX_DROPPED_XDG_ROOTS = ["XDG_DATA_HOME", "XDG_STATE_HOME", "XDG_CACHE_HOME"];
 function prepareSandbox(env = process.env, realHome = homedir10()) {
   const home = mkdtempSync(join13(tmpdir2(), "frizz-sandbox-"));
-  shareCredentials(realHome, home);
+  const inherited = { ...env };
   env.HOME = home;
   env.USERPROFILE = home;
+  for (const name of SANDBOX_DROPPED_XDG_ROOTS) delete env[name];
+  shareCredentials(realHome, home, inherited, env);
   const project = join13(home, "sandbox");
   mkdirSync10(project, { recursive: true });
   writeFileSync10(join13(project, "README.md"), "# frizz sandbox\n\nA throwaway project; everything here is deleted when the sandbox exits.\n");
@@ -24782,15 +24929,15 @@ function prepareSandbox(env = process.env, realHome = homedir10()) {
   process.chdir(project);
   return { home, project };
 }
-function shareCredentials(realHome, home) {
+function shareCredentials(realHome, home, realEnv, sandboxEnv) {
   const link = (from, to) => {
     try {
       symlinkSync2(from, to);
     } catch {
     }
   };
-  const realKey = claimIdentityPath(realHome);
-  const sandboxKey = claimIdentityPath(home);
+  const realKey = claimIdentityPath(realHome, realEnv);
+  const sandboxKey = claimIdentityPath(home, sandboxEnv);
   mkdirSync10(dirname10(realKey), { recursive: true });
   mkdirSync10(dirname10(sandboxKey), { recursive: true });
   link(realKey, sandboxKey);
@@ -25187,12 +25334,13 @@ import { basename as basename6, dirname as dirname11, extname as extname2, isAbs
 import { fileURLToPath } from "node:url";
 import watcher from "@parcel/watcher";
 init_logging();
+init_boot_progress();
 var DEV_RESTART_DEBOUNCE_MS = 180;
 var DEV_CRASH_STABLE_MS = 5e3;
 var DEV_CRASH_RETRY_BASE_MS = 500;
 var DEV_CRASH_RETRY_MAX_MS = 1e4;
 var CHILD_STOP_TIMEOUT_MS = 15e3;
-var STABLE_UPDATE_READY_TIMEOUT_MS = 3e4;
+var STABLE_UPDATE_READY_TIMEOUT_MS = BOOT_STALL_TIMEOUT_MS;
 var STABLE_UPDATE_STABILIZE_MS = 1e3;
 var CHILD_KILL_GRACE_MS = 5e3;
 var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"]);
@@ -25444,6 +25592,7 @@ var Supervisor = class {
   updateMode;
   commitUpdate;
   updateReadyTimeoutMs;
+  updateHardTimeoutMs;
   updateStabilizeMs;
   rollbackUpdate;
   durableReexec;
@@ -25488,6 +25637,7 @@ var Supervisor = class {
     this.updateMode = opts.updateMode ?? "durableReexec";
     this.commitUpdate = opts.commitUpdate;
     this.updateReadyTimeoutMs = Math.max(1, opts.updateReadyTimeoutMs ?? STABLE_UPDATE_READY_TIMEOUT_MS);
+    this.updateHardTimeoutMs = Math.max(1, opts.updateHardTimeoutMs ?? BOOT_HARD_TIMEOUT_MS);
     this.updateStabilizeMs = Math.max(0, opts.updateStabilizeMs ?? STABLE_UPDATE_STABILIZE_MS);
     this.rollbackUpdate = opts.rollbackUpdate;
     this.durableReexec = opts.durableReexec;
@@ -25732,7 +25882,8 @@ var Supervisor = class {
       if (this.closed) return this.failChildUpdate("Frizz supervisor stopped while starting the update", true);
       const ready = await this.spawnChild({
         updateCandidate: true,
-        readinessTimeoutMs: this.updateReadyTimeoutMs
+        readinessTimeoutMs: this.updateReadyTimeoutMs,
+        hardTimeoutMs: this.updateHardTimeoutMs
       });
       const candidate = this.child;
       if (!ready || !candidate) {
@@ -25912,9 +26063,28 @@ var Supervisor = class {
         settled(ready);
       };
       if (options2.readinessTimeoutMs !== void 0) {
-        readinessTimer = setTimeout(() => {
+        const stallMs = options2.readinessTimeoutMs;
+        const hardMs = options2.hardTimeoutMs ?? BOOT_HARD_TIMEOUT_MS;
+        const hardDeadline = Date.now() + hardMs;
+        let stallDeadline = Date.now() + stallMs;
+        let lastStep = -1;
+        let lastPhase;
+        const checkProgress = () => {
           if (spawnSettled) return;
-          const message = `update candidate did not become ready within ${options2.readinessTimeoutMs}ms`;
+          const now = Date.now();
+          const progress = readBootProgress(this.launchTarget.stateDir);
+          if (progress && progress.pid === child.pid && progress.step > lastStep) {
+            lastStep = progress.step;
+            lastPhase = progress.phase;
+            stallDeadline = now + stallMs;
+          }
+          if (now < stallDeadline && now < hardDeadline) {
+            readinessTimer = setTimeout(checkProgress, Math.min(250, stallDeadline - now, hardDeadline - now));
+            readinessTimer.unref();
+            return;
+          }
+          const reason = now >= hardDeadline ? `update candidate did not become ready within ${hardMs}ms` : `update candidate made no boot progress for ${stallMs}ms`;
+          const message = lastPhase ? `${reason}; last boot step: ${lastPhase}` : reason;
           this.lastRestartFailure = message;
           this.errorLine(`[frizz] ${message}`);
           this.writeStatus("failed", message, null);
@@ -25923,8 +26093,8 @@ var Supervisor = class {
           } catch {
           }
           settleSpawn(false);
-        }, options2.readinessTimeoutMs);
-        readinessTimer.unref();
+        };
+        checkProgress();
       }
       child.on("message", (message) => {
         if (stopOwnerMessage(message) && message.token === this.ownerToken) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frizz",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "private": false,
   "description": "A local web UI for running many coding agents at once",
   "keywords": [
@@ -35,7 +35,7 @@
     "frizz-dev:check": "nub scripts/install-global-cli.mjs --check",
     "frizz-dev:uninstall": "nub scripts/install-global-cli.mjs --uninstall",
     "install:global": "nub scripts/install-global-cli.mjs",
-    "typecheck": "tsc -b packages/shared packages/rpc packages/server packages/registrar packages/relay . packages/web",
+    "typecheck": "tsc -b packages/shared packages/rpc packages/claude-agent-sdk-runtime packages/server packages/registrar packages/relay . packages/web",
     "test": "nub scripts/run-tests.mjs",
     "test:e2e": "nub scripts/e2e-web.mjs",
     "prepack": "node ./scripts/prepare-package.mjs --server && node ./scripts/build-package.mjs --server && node ./scripts/build-package.mjs --shell && node ./scripts/publish-manifest.mjs --strip",
@@ -65,7 +65,7 @@
   },
   "frizzServer": {
     "package": "frizz-server",
-    "version": "0.13.0",
+    "version": "0.15.0",
     "protocol": 1,
     "dataEpoch": 1
   }