frizz 0.13.3 → 0.13.6

package/dist/frizz.js

@@ -12493,7 +12493,7 @@ function requireEffortOutsideAcp(profile, ctx) {
 function fallbackPort(base) {
   return base + 1e4;
 }
-var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_TEXT_EXTENSIONS, ATTACHMENT_OFFICE_EXTENSIONS, ATTACHMENT_DATA_EXTENSIONS, ATTACHMENT_ARCHIVE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ClaudeModel, AcpAgent, AcpAgentModel, AcpAgentModels, AcpAgentModelsInput, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, GithubIssueStatus, ThreadWatchView, PR_WATCH_FOR_MAX_MS, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, OwnWatchKind, AddOwnWatchInput, OwnWatchView, AddOwnWatchResult, DropOwnWatchInput, DropOwnWatchResult, AskQuestionKind, AskedOptionSchema, AskedQuestionSchema, AskInput, RegisteredQuestionView, AskResult, UnaskInput, UnaskResult, QuestionAnswerSchema, AnswerQuestionsInput, AnswerQuestionsResult, DismissQuestionsInput, DismissQuestionsResult, MarkOwnDoneInput, MarkOwnDoneResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ProviderError, ThreadLinkView, UpsertOwnLinkInput, UpsertOwnLinkResult, DropOwnLinkInput, DropOwnLinkResult, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountBackend, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshotShape, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadPinnedInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetOwnThreadTitleInput, SetOwnThreadTitleResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, UpgradeThreadModelInput, UpgradeThreadModelResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, HUMAN_GAP_FLOOR_MS, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_GATED, PR_WATCH_STATE, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, EditedFile, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketFilePath, SocketTranscriptClientMsg, SocketFileClientMsg, SocketClientMsg, ProjectCard, ProjectRailCounts, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
+var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_TEXT_EXTENSIONS, ATTACHMENT_OFFICE_EXTENSIONS, ATTACHMENT_DATA_EXTENSIONS, ATTACHMENT_ARCHIVE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ClaudeModel, AcpAgent, AcpAgentModel, AcpAgentModels, AcpAgentModelsInput, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, GithubIssueStatus, ThreadWatchView, PR_WATCH_FOR_MAX_MS, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, OwnWatchKind, AddOwnWatchInput, OwnWatchView, AddOwnWatchResult, DropOwnWatchInput, DropOwnWatchResult, AskQuestionKind, AskedOptionSchema, AskedQuestionSchema, AskInput, RegisteredQuestionView, AskResult, UnaskInput, UnaskResult, QuestionAnswerSchema, AnswerQuestionsInput, AnswerQuestionsResult, DismissQuestionsInput, DismissQuestionsResult, SettledQuestionView, ThreadSettledQuestionsResult, MarkOwnDoneInput, MarkOwnDoneResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ProviderError, ThreadLinkView, UpsertOwnLinkInput, UpsertOwnLinkResult, DropOwnLinkInput, DropOwnLinkResult, LiveTool, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountBackend, AccountLogoutInput, AccountLogoutResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshotShape, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, DismissFailedFollowUpInput, DismissFailedFollowUpResult, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, CompactThreadInput, SetThreadSnoozeInput, SetThreadPinnedInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetOwnThreadTitleInput, SetOwnThreadTitleResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, UpgradeThreadModelInput, UpgradeThreadModelResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, HUMAN_GAP_FLOOR_MS, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_GATED, PR_WATCH_STATE, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, EditedFile, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketFilePath, SocketTranscriptClientMsg, SocketFileClientMsg, SocketClientMsg, ProjectCard, ProjectRailCounts, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
 var init_src = __esm({
   "packages/shared/src/index.ts"() {
     "use strict";
@@ -12907,12 +12907,12 @@ var init_src = __esm({
       "  if anything is still owed, it is not done. Body: 1-3 sentences, then bullets, each opening with a",
       "  **bolded verb phrase**.",
       "- `` ```awaiting `` \u2014 you are WAITING on work that is actually running. FRONTMATTER, THEN MARKDOWN:",
-      "  one structural line per thing you are waiting on, a REQUIRED `for:` duration, then a `---` line and",
+      "  one YAML list per kind of thing you are waiting on, a REQUIRED `for:` duration, then a `---` line and",
       "  as much prose as you want. The prose is OPTIONAL; the lines above it are not.",
       "",
       "  ```awaiting",
-      "  shell: <the id your runtime gave you>",
-      "  pr: owner/repo#123",
+      "  shells: [<the id your runtime gave you>]",
+      "  prs: [owner/repo#123]",
       "  for: 2h",
       "  ---",
       "  What you are waiting for, in your own words \u2014 this is what the human reads on your card.",
@@ -13230,6 +13230,17 @@ var init_src = __esm({
       dismissed: external_exports.array(external_exports.string()),
       open: external_exports.array(RegisteredQuestionView)
     }).strict();
+    SettledQuestionView = external_exports.object({
+      id: external_exports.string(),
+      spec: AskedQuestionSchema,
+      askedAt: external_exports.string(),
+      /** When the human sent the answer — what decides which rest the card stood at when it was answered. */
+      settledAt: external_exports.string(),
+      answer: QuestionAnswerSchema
+    }).strict();
+    ThreadSettledQuestionsResult = external_exports.object({
+      questions: external_exports.array(SettledQuestionView)
+    }).strict();
     MarkOwnDoneInput = external_exports.object({
       slug: ThreadSlug,
       body: external_exports.string().trim().min(1).max(2e4)
@@ -13296,6 +13307,11 @@ var init_src = __esm({
     UpsertOwnLinkResult = external_exports.object({ link: ThreadLinkView }).strict();
     DropOwnLinkInput = external_exports.object({ slug: ThreadSlug, id: external_exports.string().min(1) }).strict();
     DropOwnLinkResult = external_exports.object({ dropped: external_exports.boolean() }).strict();
+    LiveTool = external_exports.object({
+      name: external_exports.string(),
+      desc: external_exports.string().optional(),
+      detail: external_exports.string().optional()
+    });
     ThreadView = external_exports.object({
       id: ThreadSlug,
       // slug; filename is <slug>.md
@@ -13334,6 +13350,15 @@ var init_src = __esm({
       // user hid the row from the nav; respawn/resume un-archives
       lastAssistant: external_exports.string().optional(),
       // trimmed preview of last assistant text
+      // The FIRST non-empty line of that same text, markdown intact and newlines honoured (capped) — the
+      // handoff's verdict line ("**Fixed** — …"), which `lastAssistant` cannot give back because its preview
+      // collapses every newline to a space. The phone board's rested row reads it. Optional so old
+      // snapshots parse.
+      lastAssistantLine: external_exports.string().optional(),
+      // The newest tool call the agent has issued and not yet had a result for (Claude session threads),
+      // in the shape `toolActivityLabel` reads, so a list row can say "Running the focused tests" with the
+      // gerund the chat's working indicator shows. Absent between calls, at rest, and for other backends.
+      liveTool: LiveTool.optional(),
       spawnedAt: external_exports.string().optional(),
       // ISO8601
       lastActivityAt: external_exports.string().optional(),
@@ -13392,6 +13417,11 @@ var init_src = __esm({
        *  same card and the swap is invisible. Absent whenever there is nothing in flight, which is almost
        *  always — it exists for the seconds between the human sending and the worker being handed it. */
       answersInFlight: external_exports.string().optional(),
+      /** The human's message — a follow-up or a registered answer — is on its way to the worker and the turn
+       *  has not started yet (board.deriveDeliveryInFlight). The queue has already let the thread go; this
+       *  tells the rail to draw it as working in every tab, not only the one that sent it (web
+       *  lib/steering.ts). Absent otherwise. */
+      deliveryInFlight: external_exports.boolean().optional(),
       // ISO8601 of the newest REAL user interaction (answer/steer/dispatch) — the chronological listing
       // sort key. Optional; the listing falls back to spawnedAt when absent (a dispatch IS an interaction).
       lastUserAt: external_exports.string().optional(),
@@ -13629,13 +13659,6 @@ var init_src = __esm({
       activeThreads: external_exports.number().int().positive().optional(),
       detail: external_exports.string().max(200).optional()
     });
-    AccountLoginStartInput = external_exports.object({ backend: AccountBackend }).strict();
-    AccountLoginStartResult = external_exports.object({ attemptId: ThreadSlug });
-    AccountLoginStatusInput = external_exports.object({ attemptId: ThreadSlug }).strict();
-    AccountLoginStatusResult = external_exports.object({
-      state: external_exports.enum(["running", "exited", "unknown"]),
-      auth: ProviderAuth
-    });
     PermissionMode = external_exports.enum(["auto", "default", "acceptEdits", "plan", "bypassPermissions"]);
     LocalFileOpener = external_exports.enum(["system", "cursor", "vscode", "finder", "copy"]);
     Settings = external_exports.object({
@@ -13831,8 +13854,18 @@ var init_src = __esm({
       // Broker-backed Claude only — that is every Claude thread dispatched since the broker cutover. On
       // any other runtime the message is delivered normally and this is ignored, never refused: a send
       // that arrives is always better than a send that errors.
-      interrupt: external_exports.boolean().optional()
+      interrupt: external_exports.boolean().optional(),
+      // The deliveryId of a FAILED send this one re-sends — the failed bubble's Retry. The server drops that
+      // failed entry in the same write that opens this send's own, so the retry replaces the failed bubble
+      // rather than standing beside it. A new deliveryId, never the old one: the old send's failure may be
+      // ambiguous, and only the operator decides to risk a second copy.
+      supersedes: external_exports.string().min(1).max(200).optional()
     });
+    DismissFailedFollowUpInput = external_exports.object({
+      slug: ThreadSlug,
+      deliveryId: external_exports.string().min(1).max(200)
+    }).strict();
+    DismissFailedFollowUpResult = external_exports.object({ dismissed: external_exports.boolean() }).strict();
     UnqueueFollowUpInput = external_exports.object({
       slug: ThreadSlug,
       // Same staleness guard as followUp: a stale tab must not unqueue against a re-dispatched session.
@@ -13852,6 +13885,11 @@ var init_src = __esm({
       interrupted: external_exports.boolean(),
       reason: external_exports.string().optional()
     }).strict();
+    CompactThreadInput = external_exports.object({
+      slug: ThreadSlug,
+      // Same staleness guard as followUp: a stale tab must not compact a re-dispatched session.
+      sessionId: external_exports.string().min(1)
+    }).strict();
     SetThreadSnoozeInput = external_exports.object({
       slug: ThreadSlug,
       sessionId: external_exports.string().min(1),
@@ -14460,8 +14498,13 @@ ${DISPATCH_TASK_BANNER}
       // yet — renders as an ordinary (un-grayed) user bubble. "unconfirmed": no evidence appeared within
       // the timeout — the injection likely mutated/never landed; the client renders a quiet warning.
       // Once the real transcript record lands the ledger drops the item and this field goes with it.
-      // Additive + optional.
-      deliveryState: external_exports.enum(["pending", "enqueued", "delivered", "unconfirmed"]).optional(),
+      // "sending": the server's WRITE-AHEAD entry, opened before any transport is touched, so the text is
+      // the server's from the instant it arrives. "failed": the transport threw, or never answered — the
+      // text is kept until the operator retries, edits or dismisses it, and nothing retries it on its own.
+      // Additive + optional: an older client renders both as a plain bubble (gray for "sending").
+      deliveryState: external_exports.enum(["sending", "pending", "enqueued", "delivered", "unconfirmed", "failed"]).optional(),
+      // Why a "failed" send failed, verbatim from the transport. Set only alongside deliveryState "failed".
+      deliveryError: external_exports.string().optional(),
       // FRIZZ wrote this user turn, not the human: it is a scheduler wake delivery (isWakeDelivery). The
       // client renders it as a first-party card rather than the human's off-white right-justified bubble,
       // which was claiming the operator had typed a message the watcher composed. Additive + optional: an
@@ -14613,7 +14656,8 @@ ${DISPATCH_TASK_BANNER}
     });
     ProjectRailCounts = external_exports.object({
       queued: external_exports.number().int().nonnegative(),
-      running: external_exports.number().int().nonnegative()
+      running: external_exports.number().int().nonnegative(),
+      asks: external_exports.number().int().nonnegative()
     });
     PROJECT_ICON_MAX_BASE64_CHARS = 4 * 1024 * 1024;
     DirectoryPickResult = external_exports.discriminatedUnion("kind", [
@@ -19955,13 +19999,6 @@ var init_project_registry = __esm({
   }
 });
 
-// packages/server/src/native-helper.ts
-var init_native_helper = __esm({
-  "packages/server/src/native-helper.ts"() {
-    "use strict";
-  }
-});
-
 // src/production.ts
 init_local_origin();
 import { readFileSync as readFileSync15 } from "node:fs";
@@ -20561,6 +20598,29 @@ var AccessStore = class _AccessStore {
     const id = _AccessStore.idOf(payload);
     return !(id && this.sessions.isRevoked(id));
   }
+  /**
+   * Sign out the device HOLDING this session — the "Sign out this device" row, not `--sign-out`.
+   *
+   * The id comes from the session itself, and only after its signature verifies, so the one thing this
+   * can ever revoke is the credential the caller just proved it holds. There is deliberately no
+   * parameter naming any other id: signing out SOMEONE ELSE stays loopback-only, because a stolen
+   * session must not be able to evict the owner and keep the board.
+   *
+   * - `revoked`: the id is on the denylist now, so a surviving copy of this cookie is refused too.
+   * - `legacy`: a session minted before ids existed verifies but has no id to revoke on its own. The
+   *   caller can still clear the cookie; rotating the key remains the way to kill a copy of it.
+   * - `no-session`: nothing valid was presented — absent, forged, expired, or already signed out.
+   */
+  signOutSession(session) {
+    if (!session || !this.verifySession(session)) return { result: "no-session" };
+    const id = _AccessStore.idOf(session.slice(0, session.lastIndexOf(".")));
+    if (!id) return { result: "legacy" };
+    if (!this.sessions.revoke(id)) {
+      this.sessions.record({ id, label: "unknown device", createdAt: this.options.now() });
+      this.sessions.revoke(id);
+    }
+    return this.sessions.isRevoked(id) ? { result: "revoked", id } : { result: "no-session" };
+  }
   /**
    * Drop codes past their expiry so a long-lived board does not accumulate them forever.
    *
@@ -22586,6 +22646,7 @@ var SUPERVISOR_UPDATE_RESTART_PATH = `${SUPERVISOR_CONTROL_PREFIX}/update-restar
 var SUPERVISOR_STATUS_PATH = `${SUPERVISOR_CONTROL_PREFIX}/status`;
 var SUPERVISOR_ACCESS_CODE_PATH = `${SUPERVISOR_CONTROL_PREFIX}/access-code`;
 var SUPERVISOR_SESSIONS_PATH = `${SUPERVISOR_CONTROL_PREFIX}/sessions`;
+var SUPERVISOR_SIGN_OUT_PATH = `${SUPERVISOR_CONTROL_PREFIX}/sign-out`;
 var SUPERVISOR_CONTROL_PROTOCOL = 1;
 function responseJson(res, status, value) {
   res.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
@@ -22614,7 +22675,7 @@ function readCookie(header, name) {
 }
 function isControlRequest(req) {
   const url = new URL(req.url ?? "/", "http://frizz.invalid");
-  return url.pathname === SUPERVISOR_RESTART_PATH || url.pathname === SUPERVISOR_UPDATE_RESTART_PATH || url.pathname === SUPERVISOR_STATUS_PATH || url.pathname === SUPERVISOR_ACCESS_CODE_PATH || url.pathname === SUPERVISOR_SESSIONS_PATH;
+  return url.pathname === SUPERVISOR_RESTART_PATH || url.pathname === SUPERVISOR_UPDATE_RESTART_PATH || url.pathname === SUPERVISOR_STATUS_PATH || url.pathname === SUPERVISOR_ACCESS_CODE_PATH || url.pathname === SUPERVISOR_SESSIONS_PATH || url.pathname === SUPERVISOR_SIGN_OUT_PATH;
 }
 function isLocalImageRequest(req) {
   if (req.method !== "GET" && req.method !== "HEAD") return false;
@@ -22820,6 +22881,11 @@ var RestartSupervisorProxy = class {
   }
   async handleControl(req, res) {
     const pathname = new URL(req.url ?? "/", "http://frizz.invalid").pathname;
+    if (pathname !== SUPERVISOR_SIGN_OUT_PATH && this.arrivedPublicly(req) && !this.sessionAccepted(req)) {
+      res.writeHead(401, { "cache-control": "no-store" });
+      res.end();
+      return;
+    }
     const sameOrigin = req.headers["sec-fetch-site"] === "same-origin" || this.vouchesSameOrigin(req);
     const allowMissingOrigin = pathname === SUPERVISOR_STATUS_PATH && req.method === "GET" && sameOrigin;
     if (!this.authorityAccepted(req, allowMissingOrigin)) {
@@ -22883,8 +22949,24 @@ var RestartSupervisorProxy = class {
       responseJson(res, 200, { signedOut: 1 });
       return;
     }
+    if (pathname === SUPERVISOR_SIGN_OUT_PATH) {
+      if (req.method !== "POST") {
+        res.writeHead(405, { allow: "POST" });
+        res.end();
+        return;
+      }
+      this.signOutThisDevice(req, res);
+      return;
+    }
     if (pathname === SUPERVISOR_STATUS_PATH && req.method === "GET") {
-      responseJson(res, 200, { protocol: SUPERVISOR_CONTROL_PROTOCOL, ...this.status() });
+      responseJson(res, 200, {
+        protocol: SUPERVISOR_CONTROL_PROTOCOL,
+        ...this.status(),
+        // Sent ONLY when true, so a loopback tab's payload is byte-identical to what it was. The web
+        // app cannot tell on its own: the session cookie is HttpOnly, and the page is the same bundle
+        // whichever way it was reached. It is a fact about THIS request, never about the board.
+        ...this.carriesRemoteSession(req) ? { remoteSession: true } : {}
+      });
       return;
     }
     if (pathname !== SUPERVISOR_RESTART_PATH && pathname !== SUPERVISOR_UPDATE_RESTART_PATH || req.method !== "POST") {
@@ -22962,6 +23044,42 @@ var RestartSupervisorProxy = class {
     if (!this.publicOrigin) return true;
     return this.access.verifySession(readCookie(req.headers.cookie, SESSION_COOKIE));
   }
+  /** Did this request arrive through the public origin carrying a live session? Loopback never does. */
+  carriesRemoteSession(req) {
+    return this.arrivedPublicly(req) && this.access.verifySession(readCookie(req.headers.cookie, SESSION_COOKIE));
+  }
+  /**
+   * End the session this request carries, and nothing else — see SUPERVISOR_SIGN_OUT_PATH in
+   * handleControl for why that makes it safe to reach from the tunnel.
+   *
+   * A loopback request is a no-op even if it somehow carries a cookie: the operator's own tab has no
+   * remote session to end, and loopback is the place `--sign-out` already covers.
+   */
+  signOutThisDevice(req, res) {
+    const reply = (status, body, clearCookie) => {
+      res.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store",
+        // Same attributes the exchange set, so the browser matches and drops that exact cookie.
+        ...clearCookie ? { "set-cookie": `${SESSION_COOKIE}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0` } : {}
+      });
+      res.end(JSON.stringify(body));
+    };
+    if (!this.arrivedPublicly(req)) {
+      reply(200, { protocol: SUPERVISOR_CONTROL_PROTOCOL, result: "no-remote-session" }, false);
+      return;
+    }
+    const outcome = this.access.signOutSession(readCookie(req.headers.cookie, SESSION_COOKIE));
+    if (outcome.result === "revoked") {
+      reply(200, { protocol: SUPERVISOR_CONTROL_PROTOCOL, result: "signed-out", id: outcome.id }, true);
+      return;
+    }
+    if (outcome.result === "legacy") {
+      reply(200, { protocol: SUPERVISOR_CONTROL_PROTOCOL, result: "cookie-cleared" }, true);
+      return;
+    }
+    reply(401, { protocol: SUPERVISOR_CONTROL_PROTOCOL, result: "no-remote-session" }, true);
+  }
   /**
    * Trade `?frizz_code=…` for a cookie, then bounce to the same URL
    * without the secret, so it never lands in history, a Referer header, or a screenshot.
@@ -26464,7 +26582,8 @@ function createNpmRegistryReleaseAdapter(options2 = {}) {
               return reject(new Error(`could not check npm for ${packageName}: ${why}`));
             }
             try {
-              const parsed = JSON.parse(stdout);
+              const answer = JSON.parse(stdout);
+              const parsed = Array.isArray(answer) && answer.length === 1 ? answer[0] : answer;
               resolveVersion(typeof parsed === "string" ? parsed : String(parsed));
             } catch {
               resolveVersion(stdout.trim().replaceAll('"', ""));
@@ -26669,7 +26788,8 @@ function npmServerPackageInstaller(env = process.env) {
     },
     async latestVersion(packageName) {
       if (!PACKAGE.test(packageName)) throw new Error("invalid Frizz server package name");
-      const version = JSON.parse(await run3(["view", `${packageName}@latest`, "version", "--json"]));
+      const parsed = JSON.parse(await run3(["view", `${packageName}@latest`, "version", "--json"]));
+      const version = Array.isArray(parsed) && parsed.length === 1 ? parsed[0] : parsed;
       if (typeof version !== "string" || !VERSION.test(version)) throw new Error("npm returned an invalid Frizz server version");
       return version;
     }
@@ -26897,7 +27017,6 @@ function releaseHeldLease(lease) {
 }
 
 // src/preflight.ts
-init_native_helper();
 import { spawnSync } from "node:child_process";
 var SUPPORTED_NODE_LINES = [
   { major: 22, minor: 13 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frizz",
-  "version": "0.13.3",
+  "version": "0.13.6",
   "private": false,
   "description": "A local web UI for running many coding agents at once",
   "keywords": [
@@ -49,6 +49,7 @@
     "@types/ws": "^8.5",
     "esbuild": "^0.25.0",
     "jsqr": "^1.4.0",
+    "node-pty": "1.2.0-beta.15",
     "puppeteer": "^25.3.0",
     "typescript": "^5.7",
     "ws": "^8.18"
@@ -65,7 +66,7 @@
   },
   "frizzServer": {
     "package": "frizz-server",
-    "version": "0.15.1",
+    "version": "0.15.7",
     "protocol": 1,
     "dataEpoch": 1
   }