github-router 0.3.178 → 0.3.202

package/dist/main.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as isAdvisorRequested, $t as cacheCopilotVersion, A as liveExec, At as provisionBrowserAssets, Bt as DEFAULT_CODEX_MODEL, C as fileReviewDebounce, Ct as resolveMcpToolTimeoutMs, D as stopGateEnabledForRepo, Dt as MAX_RESPONSE_BODY_BYTES, E as repoRoot, Et as createChatCompletions, Ft as shouldUseInsecureTls, G as vscodeRipgrepPath, Gt as generateRandomPort, H as buildToolbeltAwareness, Ht as DEFAULT_PORT, It as ArtifactClient, J as searchWeb, Jt as withInstallLock, K as TOOLBELT_TOOLS, Kt as pickClaudeDefault, Lt as collapsePathKeys, Mt as provisionAndIndexColbert, Nt as extractTarGzMember, O as stopReviewStateDir, Ot as readResponseBodyCapped, Pt as extractZipMember, Q as injectAdvisorTool, Qt as tryRefreshAndRetry, Rt as toolbeltPathOverride, S as fileLastPromptStore, St as assembleResponsesPayload, T as repoFingerprint, Tt as createResponses, U as toolbeltEnabled, Ut as UPSTREAM_FETCH_TIMEOUT_MS, V as availableToolCommands, Vt as DEFAULT_CODEX_MODEL_FALLBACKS, W as toolbeltSkipSet, Wt as UPSTREAM_INACTIVITY_TIMEOUT_MS, X as ADVISOR_TOOL_INSTRUCTIONS, Xt as setupGitHubAgentToken, Y as ADVISOR_INTERNAL_TOOL_NAME, Yt as setupCopilotToken, Z as buildAdvisorStream, Zt as setupGitHubToken, _ as stopGateId, _t as workerToolsEnabled, a as buildPeerAwarenessSnippet, an as resolveModel, at as relayAnthropicStream, b as fileBaselineStore, bt as createMessages, c as buildArtifactOpenHookCommand, cn as fetchWithTransientRetry, ct as agentToolsEnabled, d as captureLaunchBaseline, dn as GITHUB_API_BASE_URL, dt as browserCompoundToolsEnabled, en as cacheModels, et as buildAnthropicErrorEvent, f as decideStopHook, fn as copilotBaseUrl, ft as browserToolsEnabled, g as stopGateDisabled, gt as standInToolEnabled, h as launchBaselineKey, hn as state, ht as nativeSubagentModel, i as buildAgentPrompt, in as resolveCodexModel, it as readIteratorWithTimeout, j as resolveSealedGate, jt as hasSupportedBrowserInstalled, k as trustRepo, kt as parseJsonOrDiagnose, l as buildSessionBindHookCommand, ln as HTTPError, lt as artifactToolsEnabled, m as injectStopHookIntoSettingsFile, mn as githubHeaders, mt as geminiAvailable, n as MCP_GROUPS, nn as filterBetaHeader, nt as isControllerClosedError, o as buildPeerAwarenessSummary, on as sleep, ot as handleMcpDelete, p as fileBlockBudget, pn as copilotHeaders, pt as fleetToolsEnabled, q as assetFor, qt as getPackageVersion, r as assertMcpToolSurfaceConsistent, rn as isNullish, rt as logStreamError, s as personasFor, sn as getModels, st as handleMcpPost, t as GROUP_META, tn as cacheVSCodeVersion, tt as buildOpenAIErrorEvent, u as buildStopHookCommand, un as forwardError, ut as browseAgentEnabled, v as stopGatePlanMode, vt as shimDefaultsToXhigh, w as isSubagentContext, wt as pickEndpoint, x as fileFindingsStore, xt as getTokenCount, y as stopReviewEnabled, yt as countTokens, zt as DEFAULT_CLAUDE_MODEL_FALLBACKS } from "./peer-mcp-personas-B1-1mVPB.js";
-import { a as isUnderClaudeConfigMirror, d as writeRuntimeFileSecure, i as ensurePaths, o as removeOwnClaudeConfigMirror, r as ensureClaudeConfigMirror, t as PATHS, u as writeArtifactCredsToMirror } from "./paths-BZPgxKUl.js";
-import { c as killManagedTree, d as runCommandCapture, f as runCommandVoid, l as parseBoolEnv, s as killChildProcessTree, u as resolveExecutable } from "./lifecycle-DrDEjx_c.js";
-import { a as sweepRegistry } from "./lifecycle-Dvr3pGGG.js";
+import { $ as buildAdvisorStream, $t as setupCopilotToken, A as trustRepo, At as readResponseBodyCapped, Bt as buildWorkspaceHeaderJson, C as fileLastPromptStore, Ct as getTokenCount, D as repoRoot, Dt as createResponses, E as repoFingerprint, Et as pickEndpoint, Ft as extractTarGzMember, G as toolbeltEnabled, Gt as DEFAULT_CODEX_MODEL_FALLBACKS, H as buildEnv, Ht as toolbeltPathOverride, It as extractZipMember, J as TOOLBELT_TOOLS, Jt as UPSTREAM_INACTIVITY_TIMEOUT_MS, K as toolbeltSkipSet, Kt as DEFAULT_PORT, Lt as shouldUseInsecureTls, M as resolveSealedGate, Mt as provisionBrowserAssets, Nt as hasSupportedBrowserInstalled, O as stopGateEnabledForRepo, Ot as createChatCompletions, Pt as provisionAndIndexColbert, Q as ADVISOR_TOOL_INSTRUCTIONS, Qt as withInstallLock, Rt as ArtifactClient, S as fileFindingsStore, St as createMessages, T as isSubagentContext, Tt as resolveMcpToolTimeoutMs, U as availableToolCommands, Ut as DEFAULT_CLAUDE_MODEL_FALLBACKS, Vt as collapsePathKeys, W as buildToolbeltAwareness, Wt as DEFAULT_CODEX_MODEL, X as searchWeb, Xt as pickClaudeDefault, Y as assetFor, Yt as generateRandomPort, Z as ADVISOR_INTERNAL_TOOL_NAME, Zt as getPackageVersion, _ as stopGateDisabled, _n as copilotBaseUrl, _t as nativeSubagentModel, a as buildPeerAwarenessSnippet, an as cacheVSCodeVersion, at as logStreamError, b as stopReviewEnabled, bn as state, bt as shimDefaultsToXhigh, c as personasFor, cn as resolveCodexModel, ct as handleMcpDelete, d as buildStopHookCommand, dn as getModels, dt as artifactToolsEnabled, en as setupGitHubAgentToken, et as injectAdvisorTool, f as captureLaunchBaseline, fn as getGitHubUser, ft as browseAgentEnabled, g as launchBaselineKey, gn as GITHUB_API_BASE_URL, gt as geminiAvailable, h as injectStopHookIntoSettingsFile, hn as forwardError, ht as fleetToolsEnabled, i as buildAgentPrompt, in as cacheModels, it as isControllerClosedError, j as liveExec, jt as parseJsonOrDiagnose, k as stopReviewStateDir, kt as MAX_RESPONSE_BODY_BYTES, l as buildArtifactOpenHookCommand, ln as resolveModel, lt as handleMcpPost, m as fileBlockBudget, mn as HTTPError, mt as browserToolsEnabled, n as MCP_GROUPS, nn as tryRefreshAndRetry, nt as buildAnthropicErrorEvent, o as buildPeerAwarenessSummary, on as filterBetaHeader, ot as readIteratorWithTimeout, p as decideStopHook, pn as fetchWithTransientRetry, pt as browserCompoundToolsEnabled, q as vscodeRipgrepPath, qt as UPSTREAM_FETCH_TIMEOUT_MS, r as assertMcpToolSurfaceConsistent, rn as cacheCopilotVersion, rt as buildOpenAIErrorEvent, s as enumerateInjectedMcpToolNames, sn as isNullish, st as relayAnthropicStream, t as GROUP_META, tn as setupGitHubToken, tt as isAdvisorRequested, u as buildSessionBindHookCommand, un as sleep$1, ut as agentToolsEnabled, v as stopGateId, vn as copilotHeaders, vt as standInToolEnabled, w as fileReviewDebounce, wt as assembleResponsesPayload, x as fileBaselineStore, xt as countTokens, y as stopGatePlanMode, yn as githubHeaders, yt as workerToolsEnabled, zt as buildWorkspaceHeaderHelperCommand } from "./peer-mcp-personas-rik0SIrg.js";
+import { a as isUnderClaudeConfigMirror, d as writeRuntimeFileSecure, i as ensurePaths, o as removeOwnClaudeConfigMirror, r as ensureClaudeConfigMirror, t as PATHS, u as writeArtifactCredsToMirror } from "./paths-BO22pMUb.js";
+import { c as killManagedTree, d as runCommandCapture, f as runCommandVoid, l as parseBoolEnv, s as killChildProcessTree, u as resolveExecutable } from "./lifecycle-D-1CYr1Y.js";
+import { a as sweepRegistry } from "./lifecycle-bPdiXjYB.js";
 import { defineCommand, runMain } from "citty";
 import consola from "consola";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -22,6 +22,7 @@ import { getProxyForUrl } from "proxy-from-env";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
 import { Marked } from "marked";
+import http from "node:http";
 import clipboard from "clipboardy";
 
 //#region src/auth.ts
@@ -539,25 +540,28 @@ function startProcessGuard(child) {
 }
 
 //#endregion
-//#region src/lib/launch.ts
+//#region src/lib/stripped-env-keys.ts
 /**
-* Auth-related env keys we strip from the parent before spawning the
-* child CLI. The proxy provides its own values for everything we care
-* about (ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN, OPENAI_BASE_URL,
-* OPENAI_API_KEY, CODEX_HOME, ANTHROPIC_MODEL); for the rest, we want
-* the child to behave as if the user had no parent-env auth at all.
+* Auth / routing / remote / wire-fingerprint environment keys that must never
+* reach a github-router-spawned Claude or Codex child — through ANY channel.
+*
+* Two channels carry these keys to a spawned agent, and both must be defended:
+*   1. The PARENT PROCESS ENV — a user's shell exports. Stripped by
+*      `sanitizeParentEnv` (`src/lib/launch.ts`) before the proxy's overrides.
+*   2. The serve mirror `settings.json` `env` BLOCK — a user's own
+*      `~/.claude/settings.json`, snapshot-mirrored and applied to the
+*      SDK-spawned claude via `settingSources`. Stripped by
+*      `sanitizeServeSettingsEnv` (`src/lib/mcp-permissions-settings.ts`).
 *
-* Why strip rather than override-with-empty-string:
-*   - Claude Code emits "Auth conflict" warnings whenever both
-*     ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY are present (regardless
-*     of value, even when both are "dummy"). Stripping API_KEY entirely
-*     suppresses the warning AND prevents an inherited real shell key
-*     from leaking via x-api-key.
-*   - Cloud-provider toggles (CLAUDE_CODE_USE_*) and OAUTH_TOKEN, etc.
-*     are simpler dropped than overridden — a missing env var is
-*     unambiguously falsy/absent in every code path that reads it.
-*/
-const STRIPPED_PARENT_ENV_KEYS = [
+* If any of these survived, a Bedrock/Vertex/gateway user's config would
+* re-route the session OFF the github-router proxy, inject real auth that wins
+* over the synthetic `.credentials.json`, or activate Claude Code's
+* unimplemented Bridge/remote code path. `CLAUDE_CODE_COORDINATOR_MODE` (a
+* toolset-stripper) is NOT here — it's serve-specific, added to the serve list
+* directly. `ANTHROPIC_SMALL_FAST_MODEL` is deliberately NOT stripped (users
+* legitimately rely on it; `resolveModel` translates unrecognized values).
+*/
+const STRIPPED_AUTH_ROUTING_ENV_KEYS = [
 	"ANTHROPIC_API_KEY",
 	"ANTHROPIC_AUTH_TOKEN",
 	"ANTHROPIC_BASE_URL",
@@ -585,6 +589,22 @@ const STRIPPED_PARENT_ENV_KEYS = [
 	"AIORDIE_TOKEN",
 	"AIORDIE_INSECURE_TLS"
 ];
+
+//#endregion
+//#region src/lib/launch.ts
+/**
+* Auth-related env keys we strip from the parent before spawning the child CLI.
+* The proxy provides its own values for everything we care about, so the child
+* behaves as if the user had no parent-env auth at all. The canonical list lives
+* in `./stripped-env-keys` (shared with serve's settings.json `env` strip).
+*
+* Why strip rather than override-with-empty-string: Claude Code emits "Auth
+* conflict" warnings whenever both ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY
+* are present (any value); stripping suppresses it AND prevents an inherited
+* real key from leaking. Cloud-provider toggles + OAuth tokens are simpler
+* dropped than overridden — a missing var is unambiguously absent everywhere.
+*/
+const STRIPPED_PARENT_ENV_KEYS = STRIPPED_AUTH_ROUTING_ENV_KEYS;
 /**
 * Strip auth-related keys from a parent-process env object. The result
 * is suitable to spread into a spawned child's env BEFORE the proxy's
@@ -1082,14 +1102,17 @@ function resolveCodexCliBackend(opts) {
 */
 function buildPeerMcpConfig(serverUrl, opts) {
 	const mcpServers = {};
+	const workspaceHeaderCmd = opts.workspaceHeaderCmd?.trim();
 	for (const group of MCP_GROUPS) {
 		const key = opts.groupKeys[group];
 		if (!key) continue;
-		mcpServers[key] = {
+		const entry = {
 			type: "http",
 			url: `${serverUrl}/mcp/${GROUP_META[group].urlSuffix}`,
 			headers: { Authorization: `Bearer ${opts.nonce}` }
 		};
+		if (workspaceHeaderCmd) entry.headersHelper = workspaceHeaderCmd;
+		mcpServers[key] = entry;
 	}
 	if (opts.codexCli) mcpServers["codex-cli"] = {
 		command: "codex",
@@ -1179,6 +1202,33 @@ function buildCoordinatorAgent(opts) {
 	};
 }
 /**
+* Claude Code's built-in subagents, which the interactive CLI provides natively
+* but the Agent SDK (used by CloudCLI under `serve`) does NOT register — so a
+* serve session shows `Agent type 'Explore' not found`. We re-register them as
+* custom subagents so the model's habitual `Agent(subagent_type:"…")` calls
+* resolve. SERVE-ONLY: never inject these for `github-router claude` (the CLI's
+* native, tuned built-ins would be shadowed by a same-name custom agent).
+*
+* No `tools:` restriction — each inherits the session's full toolset; the role
+* is steered by the prompt (matching the built-ins' behavior without the risk of
+* an over-narrow allowlist). `statusline-setup`/`output-style-setup` are omitted
+* (niche, rarely invoked).
+*/
+const BUILTIN_SUBAGENT_DEFINITIONS = {
+	"general-purpose": {
+		description: "General-purpose agent for researching complex questions, searching for code, and executing multi-step tasks. Use when searching for a keyword or file and you are not confident you will find the right match in the first few tries.",
+		prompt: "You are a general-purpose agent. Research the question or carry out the multi-step task you are given, using the full toolset (read, search, edit, run commands as needed). Work autonomously and return a single, complete final answer — your final message is the whole result, so include the findings, file paths, and any code the caller needs."
+	},
+	Explore: {
+		description: "Read-only search agent for broad fan-out searches — when answering means sweeping many files or directories and you only need the conclusion, not the file dumps. It locates code; it does not modify it.",
+		prompt: "You are a read-only exploration agent. Investigate the codebase to answer the question by reading and searching (Read/Glob/Grep and semantic code search); do NOT modify any files, run mutating commands, or make commits. Cast a wide net, then return a concise conclusion with the relevant file paths and line references — your final message is the whole answer."
+	},
+	Plan: {
+		description: "Software architect agent for designing implementation plans. Use when you need to plan the implementation strategy for a task. Returns a step-by-step plan, identifies critical files, and considers architectural trade-offs.",
+		prompt: "You are a planning agent. Read the codebase (read-only — do not modify files) to design a concrete, ordered implementation plan for the task: the approach, the specific files to change, reuse of existing utilities, risks, and how the result will be verified. Return the plan as your final message."
+	}
+};
+/**
 * Build the JSON payload for `claude --agents <path>`.
 *
 * Always includes the read-only personas applicable to the mode (gemini
@@ -1272,7 +1322,7 @@ function escapeYamlString(s) {
 * anything that wouldn't be a safe bare YAML scalar AND a safe path
 * component.
 */
-const VALID_AGENT_NAME = /^[a-z][a-z0-9-]*$/;
+const VALID_AGENT_NAME = /^[A-Za-z][A-Za-z0-9-]*$/;
 /** Build a single subagent .md file body (frontmatter + system prompt).
 *
 * `tools` (optional) becomes a `tools:` frontmatter allowlist RESTRICTING the
@@ -1452,7 +1502,8 @@ async function injectPeerMcpIntoMirror(serverUrl, opts) {
 		geminiAvailable: opts.geminiAvailable,
 		groupKeys: opts.groupKeys,
 		nonce: opts.nonce,
-		codexHome: opts.codexHome ?? PATHS.CODEX_HOME
+		codexHome: opts.codexHome ?? PATHS.CODEX_HOME,
+		workspaceHeaderCmd: buildWorkspaceHeaderHelperCommand(process.execPath, process.argv[1])
 	});
 	const conflicts = [];
 	for (const name$1 of Object.keys(peerConfig.mcpServers)) if (mcpServers[name$1] !== void 0) conflicts.push(name$1);
@@ -1510,7 +1561,8 @@ async function writePeerMcpRuntimeFiles(serverUrl, opts) {
 		geminiAvailable: opts.geminiAvailable,
 		groupKeys: opts.groupKeys,
 		nonce,
-		codexHome
+		codexHome,
+		workspaceHeaderCmd: buildWorkspaceHeaderHelperCommand(process.execPath, process.argv[1])
 	});
 	const agents = buildPeerAgentDefinitions({
 		codexCli: opts.codexCli,
@@ -1526,7 +1578,10 @@ async function writePeerMcpRuntimeFiles(serverUrl, opts) {
 	await fs.unlink(agentsPath).catch(() => {});
 	await writeRuntimeFileSecure(mcpConfigPath, JSON.stringify(mcpConfig, null, 2));
 	await writeRuntimeFileSecure(agentsPath, JSON.stringify(agents, null, 2));
-	const mdResult = await writePeerAgentMdFiles(agents, {
+	const mdResult = await writePeerAgentMdFiles(opts.builtinSubagents ? {
+		...agents,
+		...opts.builtinSubagents
+	} : agents, {
 		agentsDir: opts.agentsDir,
 		fileSuffix
 	});
@@ -1703,6 +1758,180 @@ function enableFileLogging() {
 	consola.options.stderr = nullStream;
 }
 
+//#endregion
+//#region src/lib/mcp-permissions-settings.ts
+/**
+* CLAUDE_CODE_* / auth / routing env keys that must NOT reach the CloudCLI-spawned
+* serve agent through the mirror `settings.json` `env` block. CloudCLI applies
+* that block via the Agent SDK's `settingSources`, so anything a user set in their
+* real `~/.claude/settings.json` (for their own workflow) is mirrored in and
+* mis-shapes the single serve chat agent — the exact mechanism behind the
+* coordinator-mode bug.
+*
+*   - {@link STRIPPED_AUTH_ROUTING_ENV_KEYS} (shared with the process-env strip in
+*     `launch.ts`): auth/routing/remote keys that would re-route the agent OFF the
+*     github-router proxy (`ANTHROPIC_BASE_URL`, `CLAUDE_CODE_USE_BEDROCK/VERTEX/
+*     FOUNDRY`, a personal gateway), inject real auth over the synthetic
+*     credential (`ANTHROPIC_API_KEY`/`AUTH_TOKEN`/`OAUTH_TOKEN`), pin a
+*     non-Copilot `ANTHROPIC_MODEL`, or activate the unimplemented Bridge/remote
+*     path. The settings.json `env` block is a SECOND vector for the same keys the
+*     process-env strip already blocks.
+*   - `CLAUDE_CODE_COORDINATOR_MODE`: strips the single agent to delegation-only
+*     (Glob/Read/Bash fail "not enabled in this context").
+*   - `CLAUDE_CODE_SUBAGENT_MODEL`: a rank-#1 hard override that would retarget
+*     the injected implementer/peer-critic subagents off their frontmatter models.
+*
+* `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS` is intentionally NOT stripped — purely
+* additive, matching `github-router claude` parity.
+*/
+const SERVE_STRIP_ENV_KEYS = [
+	...STRIPPED_AUTH_ROUTING_ENV_KEYS,
+	"CLAUDE_CODE_COORDINATOR_MODE",
+	"CLAUDE_CODE_SUBAGENT_MODEL"
+];
+async function readSettingsObject(settingsPath) {
+	let raw;
+	try {
+		raw = await fs.readFile(settingsPath, "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") return null;
+		throw err;
+	}
+	const parsed = JSON.parse(raw);
+	if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+	throw new Error(`settings.json at ${settingsPath} is not a JSON object; refusing to overwrite`);
+}
+async function writeSettingsObject(settingsPath, obj, suffix) {
+	const tmp = `${settingsPath}.${process.pid}.${suffix}.tmp`;
+	await fs.writeFile(tmp, `${JSON.stringify(obj, null, 2)}\n`, { mode: 384 });
+	await fs.rename(tmp, settingsPath);
+}
+/**
+* Remove serve-inappropriate CLAUDE_CODE_* keys (see {@link SERVE_STRIP_ENV_KEYS})
+* from the serve mirror `settings.json` `env` block. UNCONDITIONAL — unlike the
+* permission bypass this is NOT gated by `GH_ROUTER_SERVE_NO_AUTO_APPROVE`,
+* because a user who only wants permission prompts still needs a working toolset.
+* Serve mirror only; never the operator's real `~/.claude/settings.json`. Atomic
+* temp+rename, mode 0o600. Returns the keys it removed (empty if none present).
+*/
+async function sanitizeServeSettingsEnv(settingsPath) {
+	const existing = await readSettingsObject(settingsPath);
+	if (!existing) return { removed: [] };
+	const envRaw = existing.env;
+	if (!envRaw || typeof envRaw !== "object" || Array.isArray(envRaw)) return { removed: [] };
+	const env = { ...envRaw };
+	const removed = [];
+	for (const key of SERVE_STRIP_ENV_KEYS) if (key in env) {
+		delete env[key];
+		removed.push(key);
+	}
+	if (removed.length === 0) return { removed: [] };
+	await writeSettingsObject(settingsPath, {
+		...existing,
+		env
+	}, "serveenv");
+	return { removed };
+}
+/**
+* Native Claude Code tools worth auto-approving alongside our injected MCP
+* servers so PLAN mode is frictionless for research. These are read-only
+* discovery tools that plan mode would otherwise prompt for.
+*
+* Deliberately MINIMAL and safe:
+*   - `WebSearch` / `WebFetch` — network reads; exactly the research surface a
+*     planner reaches for, and they prompt by default in plan mode.
+*   - EXCLUDES `Read`/`Glob`/`Grep` — Claude Code already runs them in plan mode
+*     without a rule (its built-in safe list), so a rule would be redundant.
+*   - EXCLUDES `Bash` — can mutate (`rm`, redirects); blanket-allow is unsafe.
+*     Curated `Bash(<readonly cmd> *)` rules are the user's own call.
+*   - EXCLUDES `Task`/`Skill`/`Workflow`/`SendMessage` — spawn/delegate; a
+*     subagent launched in plan mode isn't guaranteed to inherit plan's
+*     read-only restriction, so auto-approving them is a plan-mode-bypass vector.
+*   - EXCLUDES `Edit`/`Write`/`NotebookEdit` etc. — plan mode gates them by
+*     design and we must not override that.
+*/
+const NATIVE_RESEARCH_ALLOW_RULES = ["WebSearch", "WebFetch"];
+/**
+* Merge arbitrary allow rules into a mirror `settings.json` `permissions.allow`
+* so the listed tools auto-run WITHOUT a permission prompt in every mode —
+* including plan mode, where a matched allow rule bypasses the prompt for any
+* tool NOT on plan mode's file-edit/shell-write restricted list (MCP tools and
+* read-only natives like WebSearch/WebFetch). See {@link NATIVE_RESEARCH_ALLOW_RULES}
+* for the native additions and the "Configure permissions" Claude Code doc for
+* the plan-mode semantics.
+*
+* Rules are literal allow strings (`mcp__peers`, `WebSearch`, …). Existing
+* `allow` entries and `deny`/`ask` are preserved; merge is idempotent (no write
+* when every rule is already present). Mirror only; never the operator's real
+* settings. Atomic temp+rename, mode 0o600.
+*/
+async function injectAllowRules(settingsPath, rules) {
+	const want = [...new Set(rules.filter(Boolean))];
+	if (want.length === 0) return { added: [] };
+	const existing = await readSettingsObject(settingsPath) ?? {};
+	const permsRaw = existing.permissions;
+	const perms = permsRaw && typeof permsRaw === "object" && !Array.isArray(permsRaw) ? { ...permsRaw } : {};
+	const allow = Array.isArray(perms.allow) ? [...perms.allow] : [];
+	const present = new Set(allow.filter((x) => typeof x === "string"));
+	const added = want.filter((rule) => !present.has(rule));
+	if (added.length === 0) return { added: [] };
+	perms.allow = [...allow, ...added];
+	await writeSettingsObject(settingsPath, {
+		...existing,
+		permissions: perms
+	}, "allowrules");
+	return { added };
+}
+/**
+* Build the full plan-mode allow-rule set: a bare `mcp__<server>` rule per
+* injected MCP server (whole-server allow) plus the native research tools. The
+* server keys are the RESOLVED mcpServers config keys (collision-aware —
+* `peers` or `gh-router-peers`, `codex-cli`, …) so each rule matches the server
+* name the model actually sees.
+*/
+function planModeAllowRules(serverKeys) {
+	return [...[...new Set(serverKeys.filter(Boolean))].map((k) => `mcp__${k}`), ...NATIVE_RESEARCH_ALLOW_RULES];
+}
+/**
+* Set the serve mirror's `settings.json` `permissions.defaultMode` to
+* `bypassPermissions` — the web-control-plane equivalent of `github-router
+* claude`'s default `--dangerously-skip-permissions`. Without it, CloudCLI's
+* Agent-SDK `canUseTool` callback posts a browser `permission_request` and AWAITS
+* approval for every not-yet-allowed tool, stalling the chat on each injected
+* `mcp__*` and native call.
+*
+* PRESERVES the user's `allow`/`deny`/`ask` posture verbatim — their curated
+* permission rules carry into serve unchanged, so a session switched off bypass
+* (plan / default mode via the composer) behaves exactly as their own Claude Code
+* would. We used to CLEAR `allow` on a since-debunked theory that a non-empty
+* allow narrows the toolset; empirically it does NOT (a 13-rule allow yields the
+* full 27-tool set incl Glob/Bash/Edit), and CloudCLI's `allowedTools` comes only
+* from the client `localStorage['claude-settings']` seed (`[]`), never from
+* `permissions.allow`. The real toolset-narrowing was `CLAUDE_CODE_COORDINATOR_MODE`,
+* stripped separately by {@link sanitizeServeSettingsEnv}. Not clearing `allow`
+* is what keeps serve at parity with the user's own Claude Code permission posture.
+*
+* Only ever rewrites the per-launch serve mirror, never the operator's real
+* `~/.claude/settings.json`. Atomic temp+rename, mode 0o600. A non-object
+* settings.json throws (never clobber a file we don't understand); the caller
+* wraps this in warn-and-continue so a hiccup never blocks launch.
+*
+* Opt out with `GH_ROUTER_SERVE_NO_AUTO_APPROVE=1` (the caller skips this) — the
+* mirrored `defaultMode` is then left exactly as snapshotted.
+*/
+async function configureServePermissionsBypass(settingsPath) {
+	const existing = await readSettingsObject(settingsPath) ?? {};
+	const permsRaw = existing.permissions;
+	const perms = permsRaw && typeof permsRaw === "object" && !Array.isArray(permsRaw) ? { ...permsRaw } : {};
+	if (perms.defaultMode === "bypassPermissions") return { written: false };
+	perms.defaultMode = "bypassPermissions";
+	await writeSettingsObject(settingsPath, {
+		...existing,
+		permissions: perms
+	}, "servebypass");
+	return { written: true };
+}
+
 //#endregion
 //#region src/lib/model-validation.ts
 const ENDPOINT_ALIASES = {
@@ -2568,7 +2797,7 @@ async function discoverGateCommands(cwd, opts) {
 	if (files.length === 0) return null;
 	let result;
 	try {
-		const { runWorkerAgent } = await import("./engine-D7mUKnIZ.js");
+		const { runWorkerAgent } = await import("./engine-CIt6z9K3.js");
 		result = await runWorkerAgent({
 			mode: "explore",
 			workspace: root,
@@ -4728,7 +4957,7 @@ function initProxyFromEnv() {
 //#endregion
 //#region package.json
 var name = "github-router";
-var version$1 = "0.3.178";
+var version$1 = "0.3.202";
 
 //#endregion
 //#region src/lib/approval.ts
@@ -4745,7 +4974,7 @@ async function checkRateLimit(state$1) {
 	const ticket = { aborted: false };
 	const myTurn = rateLimitChain.then(() => doCheck(state$1, ticket));
 	rateLimitChain = myTurn.catch(() => {});
-	return Promise.race([myTurn, sleep(RATE_LIMIT_QUEUE_TIMEOUT_MS).then(() => {
+	return Promise.race([myTurn, sleep$1(RATE_LIMIT_QUEUE_TIMEOUT_MS).then(() => {
 		ticket.aborted = true;
 		throw new HTTPError("Rate limit queue wait exceeded", Response.json({
 			type: "error",
@@ -4776,7 +5005,7 @@ async function doCheck(state$1, ticket) {
 	}
 	const waitTimeMs = waitTimeSeconds * 1e3;
 	consola.warn(`Rate limit reached. Waiting ${waitTimeSeconds} seconds before proceeding...`);
-	await sleep(waitTimeMs);
+	await sleep$1(waitTimeMs);
 	if (ticket.aborted) return;
 	state$1.lastRequestTimestamp = Date.now();
 	consola.info("Rate limit wait completed, proceeding with request");
@@ -8552,6 +8781,12 @@ const claude = defineCommand({
 				} catch (err) {
 					consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`);
 				}
+				try {
+					const res = await injectAllowRules(nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json"), planModeAllowRules(injected.ok ? injected.serversAdded : [...Object.values(groupKeys).filter((k) => Boolean(k)), ...backend === "cli" ? ["codex-cli"] : []]));
+					if (res.added.length) consola.debug(`Auto-approved for plan mode: ${res.added.join(", ")}`);
+				} catch (err) {
+					consola.warn(`Could not auto-approve injected tools: ${String(err)}`);
+				}
 				if (!injected.ok) consola.warn("Workers non-blocking guard NOT registered: subagent MCP injection fell back to parent-only (--mcp-config), so worker-* dispatchers cannot reach the workers server. Raw (blocking) worker tools remain usable on the main thread this session.");
 				else if (process$1.env.GH_ROUTER_DISABLE_WORKER_GUARD === "1") consola.info("Workers non-blocking guard disabled via GH_ROUTER_DISABLE_WORKER_GUARD=1 — raw mcp__workers__* is callable on the main thread (blocking); the worker-* background agents remain the steered, non-blocking default.");
 				else try {
@@ -9196,6 +9431,26 @@ const internalSessionBind = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/internal-workspace-header.ts
+function workspaceHeaderJsonForCwd(cwd = process.cwd()) {
+	return buildWorkspaceHeaderJson(cwd);
+}
+const internalWorkspaceHeader = defineCommand({
+	meta: {
+		name: "internal-workspace-header",
+		description: "Internal: headersHelper for HTTP MCP connections. Prints the current working directory as pure JSON headers."
+	},
+	run() {
+		try {
+			process.stdout.write(workspaceHeaderJsonForCwd(process.cwd()));
+		} catch {
+			process.stdout.write("{}");
+		}
+		process.exitCode = 0;
+	}
+});
+
 //#endregion
 //#region src/lib/artifact/plan-html.ts
 function escapeHtml(s) {
@@ -9951,6 +10206,1481 @@ function formatTokens(n) {
 	return `${n}`;
 }
 
+//#endregion
+//#region src/lib/serve/cloudcli.ts
+const CLOUDCLI_PACKAGE = "@cloudcli-ai/cloudcli";
+/** Pinned, tested known-good version. Never `@latest` (see docs/serve-control-plane.md). */
+const CLOUDCLI_PINNED_VERSION = "1.36.1";
+/**
+* Build the env handed to the CloudCLI child. Starts from `buildEnv()` — the
+* vetted secret-stripping ALLOWLIST used for worker bash (drops GITHUB_TOKEN,
+* GH_ROUTER_*, ANTHROPIC_AUTH_TOKEN, OPENAI_API_KEY, COPILOT_TOKEN by omission)
+* — then layers the non-secret Anthropic/Claude vars. The spawned claude still
+* authenticates because that rides the synthetic `.credentials.json` FILE in
+* CLAUDE_CONFIG_DIR, not an env token. Load-bearing: CloudCLI exposes a browser
+* terminal that can read its own env, so no secret may live there.
+*/
+function composeCloudCliChildEnv(anthropicVars) {
+	return {
+		...buildEnv(),
+		...anthropicVars
+	};
+}
+const SERVER_ENTRY_REL = nodePath.join("dist-server", "server", "index.js");
+/** Where the package's server entry lives under a given install root. */
+function serverEntryUnderRoot(root) {
+	return nodePath.join(root, "node_modules", CLOUDCLI_PACKAGE, SERVER_ENTRY_REL);
+}
+async function exists(p) {
+	try {
+		await fs.access(p);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function readVersion(pkgRoot) {
+	try {
+		const raw = await fs.readFile(nodePath.join(pkgRoot, "node_modules", CLOUDCLI_PACKAGE, "package.json"), "utf8");
+		return JSON.parse(raw).version ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Resolve the CloudCLI server entry, in order:
+*   1. an explicit `--cloudcli-path` (a package dir OR an install root),
+*   2. an existing pinned install in the router-owned dir,
+*   3. (unless `noInstall`) install the pinned version into the router-owned dir.
+* Never installs globally, never `@latest`.
+*/
+async function resolveCloudCli(opts) {
+	const version$2 = opts.version ?? CLOUDCLI_PINNED_VERSION;
+	if (opts.cliPath) {
+		const direct = nodePath.join(opts.cliPath, SERVER_ENTRY_REL);
+		const underRoot = serverEntryUnderRoot(opts.cliPath);
+		if (await exists(direct)) return {
+			serverEntry: direct,
+			version: null
+		};
+		if (await exists(underRoot)) return {
+			serverEntry: underRoot,
+			version: await readVersion(opts.cliPath)
+		};
+		throw new Error(`--cloudcli-path "${opts.cliPath}" does not contain a CloudCLI install (looked for ${SERVER_ENTRY_REL}).`);
+	}
+	const root = PATHS.CLOUDCLI_HOME;
+	const entry = serverEntryUnderRoot(root);
+	if (await exists(entry)) return {
+		serverEntry: entry,
+		version: await readVersion(root)
+	};
+	if (opts.noInstall) throw new Error(`CloudCLI is not installed and --no-install was given. Install it with:\n  npm i --prefix "${root}" ${CLOUDCLI_PACKAGE}@${version$2}`);
+	await installCloudCli(root, version$2);
+	if (!await exists(entry)) throw new Error(`CloudCLI install completed but the server entry is missing (${entry}).`);
+	return {
+		serverEntry: entry,
+		version: await readVersion(root)
+	};
+}
+async function installCloudCli(root, version$2) {
+	const npm = resolveExecutable("npm");
+	if (!npm) throw new Error("npm not found on PATH — cannot install CloudCLI. Install Node.js/npm, or pass --cloudcli-path to an existing install.");
+	await fs.mkdir(root, {
+		recursive: true,
+		mode: 448
+	});
+	const pkgJson = nodePath.join(root, "package.json");
+	if (!await exists(pkgJson)) await fs.writeFile(pkgJson, JSON.stringify({
+		name: "gh-router-cloudcli-host",
+		private: true
+	}, null, 2));
+	consola.info(`Installing ${CLOUDCLI_PACKAGE}@${version$2} (one-time, ~a minute; builds native deps)…`);
+	const { code, stderr } = await runCommandCapture([
+		npm,
+		"install",
+		`${CLOUDCLI_PACKAGE}@${version$2}`,
+		"--prefix",
+		root,
+		"--no-audit",
+		"--no-fund",
+		"--loglevel=error"
+	], { timeoutMs: 10 * 6e4 });
+	if (code !== 0) throw new Error(`CloudCLI install failed (npm exit ${code}). This often means no network, a corporate proxy, or missing Windows build tools for native deps.\nInstall manually then re-run with --cloudcli-path:\n  npm i --prefix "${root}" ${CLOUDCLI_PACKAGE}@${version$2}\n${stderr.slice(0, 400)}`);
+}
+/** Spawn CloudCLI on a loopback port with the given (already-filtered) env. */
+function spawnCloudCli(opts) {
+	const databasePath = nodePath.join(PATHS.CLOUDCLI_HOME, "auth.db");
+	const node = resolveExecutable("node") ?? process.execPath;
+	const logPath = process.env.GH_ROUTER_CLOUDCLI_LOG;
+	let stdio = "ignore";
+	if (logPath) try {
+		const fd = fs$1.openSync(logPath, "a");
+		stdio = [
+			"ignore",
+			fd,
+			fd
+		];
+	} catch {}
+	return {
+		child: spawn(node, [opts.serverEntry], {
+			env: {
+				...opts.env,
+				SERVER_PORT: String(opts.port),
+				HOST: "127.0.0.1",
+				DATABASE_PATH: databasePath,
+				VITE_IS_PLATFORM: ""
+			},
+			stdio,
+			windowsHide: true
+		}),
+		port: opts.port,
+		databasePath
+	};
+}
+function req(port, method, urlPath, body) {
+	return new Promise((resolve, reject) => {
+		const data = body === void 0 ? void 0 : JSON.stringify(body);
+		const r = http.request({
+			host: "127.0.0.1",
+			port,
+			path: urlPath,
+			method,
+			headers: data ? {
+				"content-type": "application/json",
+				"content-length": Buffer.byteLength(data)
+			} : {}
+		}, (res) => {
+			let b = "";
+			res.on("data", (d) => b += d);
+			res.on("end", () => resolve({
+				status: res.statusCode ?? 0,
+				body: b
+			}));
+		});
+		r.on("error", reject);
+		if (data) r.write(data);
+		r.end();
+	});
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** Poll /api/auth/status until the server answers. Returns `needsSetup`. */
+async function waitForCloudCliReady(port, timeoutMs = 6e4) {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		try {
+			const r = await req(port, "GET", "/api/auth/status");
+			if (r.status === 200) return { needsSetup: JSON.parse(r.body).needsSetup === true };
+		} catch {}
+		await sleep(1e3);
+	}
+	throw new Error(`CloudCLI did not become ready within ${timeoutMs}ms`);
+}
+const secretFile = () => nodePath.join(PATHS.CLOUDCLI_HOME, ".serve-secret.json");
+async function loadPassword(username) {
+	try {
+		const raw = await fs.readFile(secretFile(), "utf8");
+		const parsed = JSON.parse(raw);
+		if (parsed.username === username && parsed.password) return parsed.password;
+	} catch {}
+	return null;
+}
+async function persistPassword(username, password) {
+	await fs.mkdir(PATHS.CLOUDCLI_HOME, {
+		recursive: true,
+		mode: 448
+	});
+	await fs.writeFile(secretFile(), JSON.stringify({
+		username,
+		password
+	}), { mode: 384 });
+}
+/**
+* Ensure a CloudCLI user exists and return a valid JWT. On a fresh (isolated)
+* DB we register (persisting the password only AFTER success); on an existing
+* DB we log in with the persisted password.
+*/
+async function mintJwt(port, username, needsSetup) {
+	const existing = await loadPassword(username);
+	if (needsSetup) {
+		const password$1 = existing ?? randomBytes(24).toString("base64url");
+		const r$1 = await req(port, "POST", "/api/auth/register", {
+			username,
+			password: password$1
+		});
+		if (r$1.status === 200) {
+			const token = JSON.parse(r$1.body).token;
+			if (token) {
+				await persistPassword(username, password$1);
+				return token;
+			}
+		}
+	}
+	const password = existing;
+	if (!password) throw new Error(`CloudCLI already has a user but no stored password for "${username}". Delete ${nodePath.join(PATHS.CLOUDCLI_HOME, "auth.db")} and retry.`);
+	const r = await req(port, "POST", "/api/auth/login", {
+		username,
+		password
+	});
+	if (r.status === 200) {
+		const token = JSON.parse(r.body).token;
+		if (token) return token;
+	}
+	throw new Error(`Could not obtain a CloudCLI session token (status ${r.status}). If a stale isolated DB exists, delete ${nodePath.join(PATHS.CLOUDCLI_HOME, "auth.db")} and retry.`);
+}
+
+//#endregion
+//#region src/lib/serve/devtunnel.ts
+const SERVE_TUNNEL_LABEL = "github-router-serve";
+function serveTunnelMachineLabel(hostname = os.hostname()) {
+	return `ghr-machine-${createHash("sha256").update(hostname).digest("hex").slice(0, 12)}`;
+}
+/**
+* Stable, deterministic tunnel ID for THIS machine, so `serve --tunnel` REUSES
+* one tunnel across launches → a stable, bookmarkable public URL. Derived from a
+* hash of the hostname (valid tunnel-id charset: lowercase alnum + hyphens,
+* bounded length). NOTE: the hosting URL's subdomain is a devtunnels-assigned
+* token, NOT this id — the id only anchors find/reuse; the URL is stable because
+* the same tunnel is re-hosted, not because the id appears in it.
+*/
+function serveTunnelId(hostname = os.hostname()) {
+	return `ghr-serve-${createHash("sha256").update(hostname).digest("hex").slice(0, 12)}`;
+}
+/**
+* Reconcile a reused tunnel's ports to exactly `[desired]`: which existing ports
+* to delete and whether the desired port must be created. Pure (unit-tested).
+* This is why reuse works across `--port` changes — `devtunnel host <id>
+* -p <newport>` fails ("Batch update of ports is not supported"), but per-port
+* `port delete` + `port create` does not.
+*/
+function portsToReconcile(currentPorts, desired) {
+	return {
+		toDelete: currentPorts.filter((p) => p !== desired),
+		toCreate: currentPorts.includes(desired) ? null : desired
+	};
+}
+/**
+* The IDs of our own idle tunnels for this machine to sweep — EXCLUDING the
+* stable reused tunnel (`exceptId`), which we keep and re-host. Pure
+* (unit-tested). A tunnel with a live host connection (a concurrent serve
+* instance) is never swept. Cleans up pre-migration random-named tunnels + any
+* crash-orphaned duplicates while preserving the one stable tunnel.
+*/
+function serveTunnelIdsToSweep(tunnels, machineLabel, exceptId) {
+	return tunnels.filter((t) => (t.labels ?? []).includes(machineLabel) && !t.hostConnections).map((t) => t.tunnelId).filter((id) => !exceptId || id.split(".")[0] !== exceptId);
+}
+/** List the tunnels serve owns (label-filtered). Best-effort: [] on any error. */
+async function listServeTunnels(cli) {
+	try {
+		const { stdout, code } = await runCommandCapture([
+			cli,
+			"list",
+			"-l",
+			SERVE_TUNNEL_LABEL,
+			"-j"
+		], { timeoutMs: 15e3 });
+		if (code !== 0) return [];
+		const parsed = JSON.parse(stdout);
+		return Array.isArray(parsed?.tunnels) ? parsed.tunnels : [];
+	} catch {
+		return [];
+	}
+}
+/** Best-effort delete of a single tunnel by full id (e.g. `fancy-fog-x.inc1`). */
+async function deleteTunnel(cli, tunnelId) {
+	try {
+		await runCommandCapture([
+			cli,
+			"delete",
+			tunnelId,
+			"-f"
+		], { timeoutMs: 15e3 });
+	} catch {}
+}
+/** Current port numbers configured on a tunnel. Best-effort: [] on any error. */
+async function getTunnelPorts(cli, tunnelId) {
+	try {
+		const { stdout, code } = await runCommandCapture([
+			cli,
+			"port",
+			"list",
+			tunnelId,
+			"-j"
+		], { timeoutMs: 15e3 });
+		if (code !== 0) return [];
+		return (JSON.parse(stdout)?.ports ?? []).map((p) => p.portNumber).filter((n) => typeof n === "number");
+	} catch {
+		return [];
+	}
+}
+/**
+* Ensure the stable per-machine tunnel exists (create it labeled if absent).
+* Returns true when the stable tunnel is present + owned by us (safe to reuse),
+* false to fall back to the anonymous-labeled host path. `existing` is the
+* pre-fetched label-scoped list (so we don't re-list).
+*/
+async function ensureStableTunnel(cli, stableId, machineLabel, existing) {
+	if (existing.some((t) => t.tunnelId.split(".")[0] === stableId)) return true;
+	try {
+		const { code } = await runCommandCapture([
+			cli,
+			"create",
+			stableId,
+			"-l",
+			SERVE_TUNNEL_LABEL,
+			"-l",
+			machineLabel,
+			"-d",
+			"github-router-serve-control-plane"
+		], { timeoutMs: 2e4 });
+		return code === 0;
+	} catch {
+		return false;
+	}
+}
+/** Reconcile the tunnel's ports to exactly `[port]` (delete stale, create missing). */
+async function reconcileTunnelPorts(cli, tunnelId, port) {
+	const { toDelete, toCreate } = portsToReconcile(await getTunnelPorts(cli, tunnelId), port);
+	for (const p of toDelete) await runCommandCapture([
+		cli,
+		"port",
+		"delete",
+		tunnelId,
+		"-p",
+		String(p)
+	], { timeoutMs: 15e3 }).catch(() => {});
+	if (toCreate != null) await runCommandCapture([
+		cli,
+		"port",
+		"create",
+		tunnelId,
+		"-p",
+		String(toCreate)
+	], { timeoutMs: 15e3 }).catch(() => {});
+}
+const DEVTUNNEL_URL_RE = /https:\/\/[a-z0-9][a-z0-9-]*(?:\.[a-z0-9-]+)*\.devtunnels\.ms\/?/i;
+var DevtunnelError = class extends Error {
+	kind;
+	constructor(kind, message) {
+		super(message);
+		this.name = "DevtunnelError";
+		this.kind = kind;
+	}
+};
+/** Absolute path to the `devtunnel` CLI, or null if not on PATH. */
+function resolveDevtunnelCli() {
+	return resolveExecutable("devtunnel");
+}
+/** Best-effort login check via `devtunnel user show`. */
+async function isDevtunnelLoggedIn(cli) {
+	try {
+		const { stdout, stderr, code } = await runCommandCapture([
+			cli,
+			"user",
+			"show"
+		], { timeoutMs: 15e3 });
+		const out = `${stdout}\n${stderr}`;
+		if (/not logged in/i.test(out)) return false;
+		if (/logged in as/i.test(out)) return true;
+		return code === 0;
+	} catch {
+		return false;
+	}
+}
+/** Extract the dev-tunnel browser URL from CLI output. Exported for tests. */
+function parseDevtunnelUrl(text) {
+	const m = text.match(DEVTUNNEL_URL_RE);
+	return m ? m[0].replace(/\/+$/, "") : null;
+}
+/**
+* Spawn `devtunnel <args>` and resolve once it prints its public URL. Shared by
+* the stable-reuse and anonymous-labeled host paths. Rejects (DevtunnelError) on
+* timeout, early exit, an auth error in the output, or a spawn failure.
+*/
+function hostTunnelProcess(cli, args, timeoutMs) {
+	const child = spawn(cli, args, {
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true
+	});
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const stop = () => {
+			try {
+				killChildProcessTree(child, { detachedGroup: process.platform !== "win32" });
+			} catch {
+				try {
+					child.kill();
+				} catch {}
+			}
+		};
+		const finish = (fn) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			fn();
+		};
+		const timer = setTimeout(() => finish(() => {
+			stop();
+			reject(new DevtunnelError("timeout", "dev tunnel did not report a URL in time"));
+		}), timeoutMs);
+		const onData = (buf) => {
+			const text = String(buf);
+			const url = parseDevtunnelUrl(text);
+			if (url) {
+				finish(() => resolve({
+					url,
+					stop
+				}));
+				return;
+			}
+			if (/not logged in|login (required|expired)|unauthorized/i.test(text)) finish(() => {
+				stop();
+				reject(new DevtunnelError("not-logged-in", "dev tunnel authentication failed; run `devtunnel user login`"));
+			});
+		};
+		child.stdout?.on("data", onData);
+		child.stderr?.on("data", onData);
+		child.once("error", (err) => finish(() => reject(new DevtunnelError("spawn", err.message))));
+		child.once("exit", (code) => finish(() => reject(new DevtunnelError("exited", `devtunnel exited (code ${code}) before printing a URL`))));
+	});
+}
+/**
+* Host an AUTHENTICATED (never anonymous) dev tunnel forwarding `port`, resolving
+* once its public URL is printed. NEVER `--allow-anonymous` (owner-only access).
+*
+* REUSES a stable per-machine tunnel (`serveTunnelId`) across launches → a
+* STABLE, bookmarkable public URL. Each launch: ensure the stable tunnel exists
+* (create it labeled if absent), reconcile its ports to exactly `[port]` via
+* per-port delete/create (`host <id> -p <newport>` can't change ports — it 400s
+* "Batch update of ports is not supported"), sweep our OTHER idle labeled tunnels
+* (pre-migration random-named ones / crash orphans), then `host <id>`. The URL's
+* subdomain is a devtunnels-assigned token (not the id), but it's stable because
+* the SAME tunnel is re-hosted every launch.
+*
+* If any stable-path step fails (id already taken by another owner, CLI hiccup),
+* falls back to hosting a fresh anonymous-labeled tunnel (the prior behavior) so
+* `--tunnel` always works — just without a stable URL that launch.
+*/
+async function startDevtunnel(port, opts = {}) {
+	const cli = resolveDevtunnelCli();
+	if (!cli) throw new DevtunnelError("not-installed", "The `devtunnel` CLI is not installed. Install it (winget install Microsoft.devtunnel  /  brew install --cask devtunnel) then run `devtunnel user login`.");
+	if (!await isDevtunnelLoggedIn(cli)) throw new DevtunnelError("not-logged-in", "Not signed in to dev tunnels. Run `devtunnel user login` (or `devtunnel user login -g` for GitHub) first.");
+	const timeoutMs = opts.timeoutMs ?? 4e4;
+	const machineLabel = serveTunnelMachineLabel();
+	const stableId = serveTunnelId();
+	try {
+		const owned = await listServeTunnels(cli);
+		if (await ensureStableTunnel(cli, stableId, machineLabel, owned)) {
+			await reconcileTunnelPorts(cli, stableId, port);
+			for (const id of serveTunnelIdsToSweep(owned, machineLabel, stableId)) await deleteTunnel(cli, id);
+			return await hostTunnelProcess(cli, ["host", stableId], timeoutMs);
+		}
+	} catch {}
+	try {
+		for (const id of serveTunnelIdsToSweep(await listServeTunnels(cli), machineLabel)) await deleteTunnel(cli, id);
+	} catch {}
+	return await hostTunnelProcess(cli, [
+		"host",
+		"-p",
+		String(port),
+		"-l",
+		SERVE_TUNNEL_LABEL,
+		"-l",
+		machineLabel,
+		"-d",
+		"github-router-serve-control-plane"
+	], timeoutMs);
+}
+
+//#endregion
+//#region src/lib/serve/enhancements.ts
+const NOOP = { cleanup: async () => {} };
+/**
+* Wire the github-router enhancement layer into the router-owned
+* CLAUDE_CONFIG_DIR mirror so a CloudCLI-spawned Claude session gets the same
+* tools `github-router claude` provides:
+*   - the scoped MCP servers (peers / search / orchestrate, plus workers /
+*     decide / browser / fleet / first-mate when their gate passes) — the
+*     SDK-spawned claude reads them from the mirror's `.claude.json`,
+*   - the peer-critic / worker / implementer subagents (`.md` files written into
+*     the mirror's `agents/`),
+*   - the gh-* skills (research / orchestrate / floor-keeper / worker).
+*
+* Best-effort: on any failure Claude still works, just without the extras.
+* Must run AFTER `ensureClaudeConfigMirror()` and BEFORE CloudCLI is spawned.
+* Tab-specific bits (ai-or-die hooks, artifact review) are intentionally left
+* out — they don't apply to the serve control plane.
+*/
+async function provisionServeEnhancements(serverUrl, opts = {}) {
+	try {
+		const tunnelExposed = opts.tunnelExposed === true;
+		const browseAllowed = browserToolsEnabled() && (!tunnelExposed || opts.browseOverTunnel === true);
+		const firstMateAllowed = agentToolsEnabled() && (!tunnelExposed || opts.agentsOverTunnel === true);
+		const fleetAllowed = fleetToolsEnabled() && (!tunnelExposed || opts.fleetOverTunnel === true);
+		const enabledGroups = [
+			"peers",
+			"search",
+			"orchestrate"
+		];
+		if (workerToolsEnabled()) enabledGroups.push("workers");
+		if (standInToolEnabled()) enabledGroups.push("decide");
+		if (browseAllowed) enabledGroups.push("browser");
+		if (fleetAllowed) enabledGroups.push("fleet");
+		if (firstMateAllowed) enabledGroups.push("first-mate");
+		const gem = geminiAvailable();
+		const { keys: groupKeys } = await resolveGroupKeysFromMirror(enabledGroups);
+		const runtime = await writePeerMcpRuntimeFiles(serverUrl, {
+			codexCli: opts.codexCli === true,
+			geminiAvailable: gem,
+			groupKeys,
+			workerToolsAvailable: workerToolsEnabled(),
+			browseAvailable: browseAllowed && browseAgentEnabled(),
+			nativeSubagentModel: nativeSubagentModel(),
+			builtinSubagents: BUILTIN_SUBAGENT_DEFINITIONS
+		});
+		state.peerMcpNonce = runtime.nonce;
+		const injected = await injectPeerMcpIntoMirror(serverUrl, {
+			codexCli: opts.codexCli === true,
+			geminiAvailable: gem,
+			groupKeys,
+			nonce: runtime.nonce
+		});
+		await appendPeerAwarenessToMirroredClaudeMd(buildPeerAwarenessSnippet({
+			codexCli: opts.codexCli === true,
+			geminiAvailable: gem,
+			workerToolsAvailable: workerToolsEnabled(),
+			standInAvailable: standInToolEnabled(),
+			browseAvailable: browseAllowed,
+			compoundBrowseAvailable: browseAllowed && browserCompoundToolsEnabled(),
+			powerBrowseAvailable: browseAllowed && state.powerBrowseEnabled,
+			agentToolsAvailable: firstMateAllowed,
+			groupKeys
+		})).catch((err) => consola.warn(`Peer-awareness CLAUDE.md append failed: ${String(err)}`));
+		await prependStyleDirectiveToMirroredClaudeMd().catch((err) => consola.warn(`Style-directive CLAUDE.md prepend failed: ${String(err)}`));
+		await prependOperatingDefaultsToMirroredClaudeMd(OPERATING_DEFAULTS_DIRECTIVE).catch((err) => consola.warn(`Operating-defaults CLAUDE.md prepend failed: ${String(err)}`));
+		if (toolbeltEnabled()) {
+			const toolbeltLine = buildToolbeltAwareness(availableToolCommands());
+			if (toolbeltLine) await appendToolbeltAwarenessToMirroredClaudeMd(toolbeltLine).catch((err) => consola.warn(`Toolbelt CLAUDE.md append failed: ${String(err)}`));
+		}
+		let skillsWritten = 0;
+		for (const s of INJECTED_SKILLS) {
+			if (s.name.startsWith("gh-first-mate") || s.name === "gh-artifact-review") continue;
+			if ((await writeInjectedSkill(s.name, s.md).catch(() => ({ written: false }))).written) skillsWritten++;
+		}
+		const settingsPath = nodePath.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+		await injectAttributionSuppressionIntoSettingsFile(settingsPath).catch(() => {});
+		const strip = await sanitizeServeSettingsEnv(settingsPath).catch((err) => {
+			consola.warn(`Could not sanitize serve settings env: ${String(err)}`);
+			return { removed: [] };
+		});
+		if (strip.removed.length) consola.info(`Serve: removed ${strip.removed.join(", ")} from the mirror settings (single-agent surface).`);
+		if (process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== "1") await configureServePermissionsBypass(settingsPath).catch((err) => consola.warn(`Could not set serve permission defaults: ${String(err)}`));
+		await injectAllowRules(settingsPath, planModeAllowRules(injected.ok ? injected.serversAdded : [...Object.values(groupKeys).filter((k) => Boolean(k)), ...opts.codexCli === true ? ["codex-cli"] : []])).catch((err) => consola.warn(`Could not auto-approve injected tools: ${String(err)}`));
+		if (workerToolsEnabled()) {
+			await injectStopHookIntoSettingsFile(settingsPath, buildPromptSubmitHookCommand(process.execPath, process.argv[1]), "UserPromptSubmit", 45).catch((err) => consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`));
+			if (!injected.ok) consola.warn("Workers non-blocking guard NOT registered: subagent MCP injection fell back to parent-only, so worker-* dispatchers cannot reach the workers server. Raw worker tools remain usable on the main thread.");
+			else if (process.env.GH_ROUTER_DISABLE_WORKER_GUARD !== "1") {
+				const workersKey = workersKeyOf(groupKeys);
+				const modes = activeDispatchModes({ browse: browseAllowed && browseAgentEnabled() });
+				await injectStopHookIntoSettingsFile(settingsPath, buildWorkerGuardHookCommand(process.execPath, process.argv[1], workersKey, modes), "PreToolUse", 10, guardToolMatcher(workersKey, modes)).catch((err) => consola.warn(`Could not register the workers PreToolUse guard hook: ${String(err)}`));
+			} else consola.info("Workers non-blocking guard disabled via GH_ROUTER_DISABLE_WORKER_GUARD=1; raw worker tools remain callable on the main thread.");
+		}
+		if (planReviewEnabled()) try {
+			await injectStopHookIntoSettingsFile(settingsPath, buildPlanReviewHookCommand(process.execPath, process.argv[1]), "PostToolUse", void 0, "ExitPlanMode");
+		} catch (err) {
+			consola.warn(`Could not register the advisory plan-review hook: ${String(err)}`);
+		}
+		const servers = injected.ok ? injected.serversAdded.join(", ") : "parent-only (user mcpServers collision)";
+		consola.info(`github-router tools wired into Claude sessions: MCP [${servers}], ${runtime.personas.length} subagents, ${skillsWritten} skills.`);
+		return {
+			cleanup: runtime.cleanup,
+			nonce: runtime.nonce,
+			mcpToolNames: enumerateInjectedMcpToolNames(groupKeys, { codexCli: opts.codexCli === true })
+		};
+	} catch (err) {
+		consola.warn(`Could not wire the github-router MCP/skills layer: ${err instanceof Error ? err.message : String(err)}. Claude still works, without the extra tools.`);
+		return NOOP;
+	}
+}
+
+//#endregion
+//#region src/lib/serve/provider-facade.ts
+function isObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function envelopedData(value) {
+	if (!isObject(value) || !isObject(value.data)) return null;
+	return value.data;
+}
+function cloneObject(value) {
+	return { ...value };
+}
+/**
+* Requests serve answers DIRECTLY (never forwarded to CloudCLI) with a canned
+* JSON body. `POST /api/system/update` is CloudCLI's "update available" button,
+* which runs a GLOBAL `npm install -g @cloudcli-ai/cloudcli@latest` in the user's
+* home dir (`server/index.js`) — mutating their global npm and never applying to
+* serve's pinned, router-owned install. Blocking it prevents that surprise
+* mutation and tells the user how updates actually work. HTTP 200 + `success:
+* false` so the UI neither runs the update nor throws an error toast. Returns
+* null for anything not blocked.
+*/
+function facadeBlockedRequest(method, pathname) {
+	if (method.toUpperCase() === "POST" && pathname === "/api/system/update") return {
+		status: 200,
+		json: {
+			success: false,
+			managed: true,
+			message: "CloudCLI is managed by github-router (a pinned, router-owned install). To update, run `npm i -g github-router@latest`, then restart `github-router serve`."
+		}
+	};
+	return null;
+}
+function facadeInterceptKind(method, pathname) {
+	const normalizedMethod = method.toUpperCase();
+	if (normalizedMethod === "POST" && pathname === "/api/commands/list") return "commands";
+	if (normalizedMethod !== "GET") return null;
+	switch (pathname) {
+		case "/api/providers/claude/models": return "models";
+		case "/api/providers/claude/mcp/servers": return "mcp";
+		case "/api/providers/claude/skills": return "skills";
+		case "/api/providers/claude/auth/status": return "auth";
+		default: return null;
+	}
+}
+async function rewriteProviderResponse(kind, upstreamJson, ctx, query) {
+	try {
+		switch (kind) {
+			case "models": return rewriteModels(upstreamJson, ctx);
+			case "mcp": return rewriteMcp(upstreamJson, ctx, query);
+			case "skills": return rewriteSkills(upstreamJson, ctx);
+			case "commands": return rewriteCommands(upstreamJson, ctx);
+			case "auth": return rewriteAuth(upstreamJson);
+		}
+	} catch {
+		return null;
+	}
+}
+function rewriteModels(upstreamJson, ctx) {
+	if (!isObject(upstreamJson)) return null;
+	const data = envelopedData(upstreamJson);
+	if (!data || !isObject(data.models) || data.cache === void 0) return null;
+	const models$1 = ctx.getModels()?.data;
+	if (!Array.isArray(models$1) || models$1.length === 0) return null;
+	const options = models$1.filter(isPickerModel).map((m) => {
+		const option = {
+			value: m.id,
+			label: m.name || m.id,
+			description: `${m.vendor} · ${m.capabilities.family}`
+		};
+		const efforts = m.capabilities.supports?.reasoning_effort;
+		if (Array.isArray(efforts) && efforts.length > 0) option.effort = {
+			default: efforts.includes("high") ? "high" : efforts[efforts.length - 1],
+			values: efforts.map((e) => ({ value: e }))
+		};
+		return option;
+	});
+	if (options.length === 0) return null;
+	const values = new Set(options.map((o) => o.value));
+	const upstreamDefault = typeof data.models.DEFAULT === "string" ? data.models.DEFAULT : void 0;
+	const DEFAULT = values.has(ctx.defaultModel) ? ctx.defaultModel : options[0]?.value ?? upstreamDefault;
+	const nextData = cloneObject(data);
+	nextData.models = {
+		OPTIONS: options,
+		DEFAULT
+	};
+	return {
+		...upstreamJson,
+		data: nextData
+	};
+}
+function isPickerModel(model) {
+	return isObject(model) && typeof model.id === "string" && model.model_picker_enabled !== false && typeof model.vendor === "string" && (model.name === void 0 || typeof model.name === "string") && isObject(model.capabilities) && typeof model.capabilities.family === "string";
+}
+async function rewriteMcp(upstreamJson, ctx, query) {
+	if (!isObject(upstreamJson) || query.get("scope") !== "user") return null;
+	const data = envelopedData(upstreamJson);
+	if (!data || !Array.isArray(data.servers)) return null;
+	const mirror = await readJson(nodePath.join(ctx.claudeConfigDir, ".claude.json"));
+	if (!isObject(mirror) || !isObject(mirror.mcpServers)) return null;
+	const existing = new Set(data.servers.filter(isObject).map((s) => s.name).filter((name$1) => typeof name$1 === "string"));
+	const additions = [];
+	for (const [name$1, entry] of Object.entries(mirror.mcpServers)) {
+		if (existing.has(name$1) || !isObject(entry)) continue;
+		const server$1 = {
+			provider: "claude",
+			name: name$1,
+			scope: "user",
+			transport: entry.type === "http" ? "http" : "stdio"
+		};
+		if (typeof entry.url === "string") server$1.url = entry.url;
+		additions.push(server$1);
+		existing.add(name$1);
+	}
+	if (additions.length === 0) return null;
+	const nextData = cloneObject(data);
+	nextData.servers = [...data.servers, ...additions];
+	return {
+		...upstreamJson,
+		data: nextData
+	};
+}
+async function rewriteSkills(upstreamJson, ctx) {
+	if (!isObject(upstreamJson)) return null;
+	const data = envelopedData(upstreamJson);
+	if (!data || !Array.isArray(data.skills)) return null;
+	const skills = await readSkillDirs(nodePath.join(ctx.claudeConfigDir, "skills"));
+	if (skills.length === 0) return null;
+	const existing = new Set(data.skills.filter(isObject).map((s) => s.command).filter((command) => typeof command === "string"));
+	const additions = skills.filter((skill) => !existing.has(skill.name)).map((skill) => ({
+		provider: "claude",
+		name: skill.name,
+		description: skill.description,
+		command: skill.name,
+		scope: "user"
+	}));
+	if (additions.length === 0) return null;
+	const nextData = cloneObject(data);
+	nextData.skills = [...data.skills, ...additions];
+	return {
+		...upstreamJson,
+		data: nextData
+	};
+}
+async function rewriteCommands(upstreamJson, ctx) {
+	if (!isObject(upstreamJson) || !Array.isArray(upstreamJson.custom)) return null;
+	const dirs = [nodePath.join(ctx.claudeConfigDir, "commands"), nodePath.join(ctx.claudeConfigDir, ".claude", "commands")];
+	const commandFiles = (await Promise.all(dirs.map(readCommandFiles))).flat();
+	if (commandFiles.length === 0) return null;
+	const existing = new Set(upstreamJson.custom.filter(isObject).map((c) => c.name).filter((name$1) => typeof name$1 === "string"));
+	const additions = commandFiles.filter((command) => !existing.has(command.name)).map((command) => ({
+		name: command.name,
+		path: command.relativePath,
+		relativePath: command.relativePath,
+		description: command.description,
+		namespace: "user",
+		metadata: { type: "custom" }
+	}));
+	if (additions.length === 0) return null;
+	const custom = [...upstreamJson.custom, ...additions];
+	return {
+		...upstreamJson,
+		custom,
+		count: countCommands(upstreamJson.builtIn) + custom.length
+	};
+}
+function rewriteAuth(upstreamJson) {
+	if (!isObject(upstreamJson)) return null;
+	const data = envelopedData(upstreamJson);
+	if (!data) return null;
+	return {
+		...upstreamJson,
+		data: {
+			...data,
+			authenticated: true,
+			installed: true
+		}
+	};
+}
+async function readJson(filePath) {
+	try {
+		return JSON.parse(await fs.readFile(filePath, "utf8"));
+	} catch {
+		return null;
+	}
+}
+async function readSkillDirs(skillsDir) {
+	try {
+		const entries = await fs.readdir(skillsDir, { withFileTypes: true });
+		return await Promise.all(entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("gh-")).map(async (entry) => {
+			const sourcePath = nodePath.join(skillsDir, entry.name, "SKILL.md");
+			let description = "";
+			try {
+				description = parseFrontmatterField(await fs.readFile(sourcePath, "utf8"), "description") ?? "";
+			} catch {}
+			return {
+				name: entry.name,
+				description,
+				sourcePath
+			};
+		}));
+	} catch {
+		return [];
+	}
+}
+async function readCommandFiles(commandsDir) {
+	try {
+		if (!(await fs.stat(commandsDir)).isDirectory()) return [];
+	} catch {
+		return [];
+	}
+	return readCommandFilesRecursive(commandsDir, commandsDir);
+}
+async function readCommandFilesRecursive(root, dir) {
+	let entries;
+	try {
+		entries = await fs.readdir(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	const out = [];
+	for (const entry of entries) {
+		const filePath = nodePath.join(dir, entry.name);
+		if (entry.isDirectory()) {
+			out.push(...await readCommandFilesRecursive(root, filePath));
+			continue;
+		}
+		if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
+		const relativePath = normalizeRelative(nodePath.relative(root, filePath));
+		const name$1 = relativePath.replace(/\.md$/i, "");
+		let description = "";
+		try {
+			const md = await fs.readFile(filePath, "utf8");
+			description = parseFrontmatterField(md, "description") ?? firstMarkdownLine(md);
+		} catch {}
+		out.push({
+			name: name$1,
+			relativePath,
+			filePath,
+			description
+		});
+	}
+	return out;
+}
+function parseFrontmatterField(markdown, field) {
+	if (!markdown.startsWith("---")) return null;
+	const end = markdown.indexOf("\n---", 3);
+	if (end < 0) return null;
+	const frontmatter = markdown.slice(3, end).split(/\r?\n/);
+	for (const line of frontmatter) {
+		const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
+		if (!match || match[1] !== field) continue;
+		return match[2].replace(/^['"]|['"]$/g, "").trim();
+	}
+	return null;
+}
+function firstMarkdownLine(markdown) {
+	const body = markdown.startsWith("---") ? markdown.slice(markdown.indexOf("\n---", 3) + 4) : markdown;
+	for (const line of body.split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (trimmed) return trimmed.replace(/^#+\s*/, "");
+	}
+	return "";
+}
+function normalizeRelative(value) {
+	return value.split(nodePath.sep).join("/");
+}
+function countCommands(builtIn) {
+	return Array.isArray(builtIn) ? builtIn.length : 0;
+}
+
+//#endregion
+//#region src/lib/serve/reverse-proxy.ts
+/**
+* Loopback-only identity endpoint served directly by the reverse proxy (never
+* forwarded to CloudCLI). A second `github-router serve` probes this on the
+* intended port to detect an already-running instance (single-instance guard),
+* so it can attach/refuse instead of starting a duplicate CloudCLI. Carries no
+* secret — just a service marker + version + origin.
+*/
+const SERVE_IDENTITY_PATH = "/__github-router-serve__";
+const SERVE_IDENTITY_SERVICE = "github-router-serve";
+const HEAD_CLOSE = "</head>";
+/** CloudCLI's localStorage key for per-tool chat permission settings. */
+const CLAUDE_SETTINGS_KEY = "claude-settings";
+/**
+* Embed the token as a JS string literal. JSON.stringify escapes quotes and
+* backslashes; we additionally neutralize `<` so the value can never break out
+* of the surrounding <script> element regardless of contents.
+*
+* When `seedToolSettings` is set, also seed CloudCLI's `claude-settings`
+* localStorage with `{allowedTools:[], disallowedTools:[], skipPermissions:true}`
+* so the SDK-spawned Claude gets the FULL built-in toolset with no permission
+* prompts. This is the server-side, zero-user-action fix for two CloudCLI
+* behaviors: (1) a non-empty `allowedTools` is an availability allow-list in the
+* Agent SDK (so any tool not in it is "not enabled"), and (2) `allowedTools`
+* accumulates client-side on every "allow & remember" click — so prior approvals
+* silently clamp the toolset. Forcing empty `allowedTools` + `skipPermissions`
+* gives `github-router claude`-parity (`--dangerously-skip-permissions`).
+*/
+function buildInjection(token, seedToolSettings = false, seedAllowedTools = []) {
+	let body = `localStorage.setItem('auth-token',${JSON.stringify(token).replace(/</g, "\\u003c")});`;
+	if (seedToolSettings) {
+		const settings = JSON.stringify({
+			allowedTools: seedAllowedTools,
+			disallowedTools: [],
+			skipPermissions: true
+		});
+		const safeSettings = JSON.stringify(settings).replace(/</g, "\\u003c");
+		body += `localStorage.setItem('${CLAUDE_SETTINGS_KEY}',${safeSettings});`;
+	}
+	return `<script>try{${body}}catch(e){}<\/script>`;
+}
+function headerLines(headers) {
+	return Object.entries(headers).map(([k, v]) => `${k}: ${Array.isArray(v) ? v.join(", ") : v}`).join("\r\n");
+}
+async function startReverseProxy(opts) {
+	const { targetHost, targetPort, bindHost, bindPort, authToken } = opts;
+	const ownOrigin = `http://${bindHost}:${bindPort}`;
+	const injection = buildInjection(authToken, opts.seedToolSettings === true, opts.seedAllowedTools ?? []);
+	const allowedHosts = new Set([
+		`127.0.0.1:${bindPort}`,
+		`localhost:${bindPort}`,
+		`[::1]:${bindPort}`,
+		...(opts.extraAllowedHosts ?? []).map((h) => h.toLowerCase())
+	]);
+	const loopbackHosts = new Set([
+		`127.0.0.1:${bindPort}`,
+		`localhost:${bindPort}`,
+		`[::1]:${bindPort}`
+	]);
+	const allowedOrigins = new Set([
+		`http://127.0.0.1:${bindPort}`,
+		`http://localhost:${bindPort}`,
+		`http://[::1]:${bindPort}`,
+		...(opts.extraAllowedOrigins ?? []).map((o) => o.toLowerCase())
+	]);
+	const DEVTUNNEL_RE = /(^|\.)devtunnels\.ms$/i;
+	const isDevtunnelHost = (host) => !!opts.allowDevtunnelHosts && DEVTUNNEL_RE.test(host.replace(/:\d+$/, ""));
+	const isDevtunnelOrigin = (origin) => {
+		if (!opts.allowDevtunnelHosts) return false;
+		try {
+			const u = new URL(origin);
+			return u.protocol === "https:" && DEVTUNNEL_RE.test(u.hostname);
+		} catch {
+			return false;
+		}
+	};
+	const hostAllowed = (host) => !!host && (allowedHosts.has(host.toLowerCase()) || isDevtunnelHost(host.toLowerCase()));
+	const originAllowed = (origin) => !origin || allowedOrigins.has(origin.toLowerCase()) || isDevtunnelOrigin(origin);
+	const liveSockets = /* @__PURE__ */ new Set();
+	const server$1 = http.createServer((clientReq, clientRes) => {
+		clientReq.on("error", () => clientRes.destroy());
+		clientRes.on("error", () => clientReq.destroy());
+		if (!hostAllowed(clientReq.headers.host) || !originAllowed(clientReq.headers.origin)) {
+			clientRes.writeHead(403, { "content-type": "text/plain" });
+			clientRes.end("Forbidden");
+			return;
+		}
+		if ((clientReq.url ?? "").split("?")[0] === SERVE_IDENTITY_PATH) {
+			if (!loopbackHosts.has(String(clientReq.headers.host ?? "").toLowerCase())) {
+				clientRes.writeHead(404, { "content-type": "text/plain" });
+				clientRes.end("Not found");
+				return;
+			}
+			clientRes.writeHead(200, { "content-type": "application/json" });
+			clientRes.end(JSON.stringify({
+				service: SERVE_IDENTITY_SERVICE,
+				version: getPackageVersion()
+			}));
+			return;
+		}
+		const requestUrl = new URL(clientReq.url ?? "/", ownOrigin);
+		const blocked = opts.providerFacade?.blockedRequest?.(clientReq.method ?? "GET", requestUrl.pathname);
+		if (blocked) {
+			clientReq.resume();
+			clientRes.writeHead(blocked.status, { "content-type": "application/json" });
+			clientRes.end(JSON.stringify(blocked.json));
+			return;
+		}
+		const facadeKind = opts.providerFacade?.kindFor(clientReq.method ?? "GET", requestUrl.pathname) ?? null;
+		const headers = { ...clientReq.headers };
+		delete headers["accept-encoding"];
+		const proxyReq = http.request({
+			host: targetHost,
+			port: targetPort,
+			path: clientReq.url,
+			method: clientReq.method,
+			headers
+		}, (proxyRes) => {
+			proxyRes.on("error", () => clientRes.destroy());
+			const contentType = String(proxyRes.headers["content-type"] ?? "");
+			if (facadeKind) {
+				const chunks = [];
+				proxyRes.on("data", (d) => chunks.push(Buffer.from(d)));
+				proxyRes.on("end", () => {
+					const original = Buffer.concat(chunks);
+					const sendOriginal = () => {
+						const outHeaders = { ...proxyRes.headers };
+						delete outHeaders["content-length"];
+						delete outHeaders["content-encoding"];
+						delete outHeaders["transfer-encoding"];
+						clientRes.writeHead(proxyRes.statusCode ?? 502, outHeaders);
+						clientRes.end(original);
+					};
+					if (proxyRes.statusCode !== 200) {
+						sendOriginal();
+						return;
+					}
+					(async () => {
+						try {
+							const parsed = JSON.parse(original.toString("utf8"));
+							const rewritten = await opts.providerFacade?.rewrite(facadeKind, parsed, requestUrl.searchParams);
+							if (rewritten == null) {
+								sendOriginal();
+								return;
+							}
+							const outHeaders = { ...proxyRes.headers };
+							delete outHeaders["content-length"];
+							delete outHeaders["content-encoding"];
+							delete outHeaders["transfer-encoding"];
+							outHeaders["content-type"] = "application/json";
+							clientRes.writeHead(200, outHeaders);
+							clientRes.end(JSON.stringify(rewritten));
+						} catch {
+							sendOriginal();
+						}
+					})();
+				});
+			} else if (contentType.includes("text/html")) {
+				const chunks = [];
+				proxyRes.on("data", (d) => chunks.push(Buffer.from(d)));
+				proxyRes.on("end", () => {
+					let html = Buffer.concat(chunks).toString("utf8");
+					html = html.includes(HEAD_CLOSE) ? html.replace(HEAD_CLOSE, injection + HEAD_CLOSE) : injection + html;
+					const outHeaders = { ...proxyRes.headers };
+					delete outHeaders["content-length"];
+					delete outHeaders["content-encoding"];
+					delete outHeaders["transfer-encoding"];
+					clientRes.writeHead(proxyRes.statusCode ?? 502, outHeaders);
+					clientRes.end(html);
+				});
+			} else {
+				clientRes.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
+				proxyRes.pipe(clientRes);
+			}
+		});
+		proxyReq.on("error", (err) => {
+			if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "text/plain" });
+			clientRes.end(`Bad gateway: ${err.message}`);
+		});
+		clientReq.pipe(proxyReq);
+	});
+	server$1.on("upgrade", (clientReq, clientSock, clientHead) => {
+		clientSock.on("error", () => clientSock.destroy());
+		liveSockets.add(clientSock);
+		clientSock.once("close", () => liveSockets.delete(clientSock));
+		if (!hostAllowed(clientReq.headers.host) || !originAllowed(clientReq.headers.origin)) {
+			clientSock.destroy();
+			return;
+		}
+		const proxyReq = http.request({
+			host: targetHost,
+			port: targetPort,
+			path: clientReq.url,
+			method: clientReq.method,
+			headers: clientReq.headers
+		});
+		proxyReq.on("upgrade", (proxyRes, proxySock, proxyHead) => {
+			clientSock.write(`HTTP/1.1 ${proxyRes.statusCode} ${proxyRes.statusMessage}\r\n${headerLines(proxyRes.headers)}\r\n\r\n`);
+			if (clientHead && clientHead.length) proxySock.write(clientHead);
+			if (proxyHead && proxyHead.length) proxySock.unshift(proxyHead);
+			proxySock.pipe(clientSock);
+			clientSock.pipe(proxySock);
+			const cleanup = () => {
+				proxySock.destroy();
+				clientSock.destroy();
+			};
+			clientSock.on("error", cleanup);
+			proxySock.on("error", cleanup);
+			clientSock.on("close", cleanup);
+			proxySock.on("close", cleanup);
+		});
+		proxyReq.on("response", (proxyRes) => {
+			try {
+				clientSock.write(`HTTP/1.1 ${proxyRes.statusCode} ${proxyRes.statusMessage}\r\n${headerLines(proxyRes.headers)}\r\n\r\n`);
+			} catch {}
+			proxyRes.on("data", (d) => {
+				clientSock.write(d);
+			});
+			proxyRes.on("end", () => clientSock.end());
+			proxyRes.on("error", () => clientSock.destroy());
+		});
+		proxyReq.on("error", () => clientSock.destroy());
+		proxyReq.end();
+	});
+	await new Promise((resolve, reject) => {
+		const onError = (err) => reject(err);
+		server$1.once("error", onError);
+		server$1.listen(bindPort, bindHost, () => {
+			server$1.removeListener("error", onError);
+			resolve();
+		});
+	});
+	const addr = server$1.address();
+	if (addr && addr.address !== "127.0.0.1" && addr.address !== "::1") {
+		await new Promise((r) => server$1.close(() => r()));
+		throw new Error(`reverse proxy refused non-loopback bind (got ${addr.address})`);
+	}
+	return {
+		url: ownOrigin,
+		port: bindPort,
+		close: () => new Promise((resolve) => {
+			for (const s of liveSockets) s.destroy();
+			liveSockets.clear();
+			const t = setTimeout(resolve, 1500);
+			server$1.close(() => {
+				clearTimeout(t);
+				resolve();
+			});
+		})
+	};
+}
+
+//#endregion
+//#region src/serve.ts
+async function getFreePort() {
+	return new Promise((resolve, reject) => {
+		const s = http.createServer();
+		s.once("error", reject);
+		s.listen(0, "127.0.0.1", () => {
+			const port = s.address().port;
+			s.close(() => resolve(port));
+		});
+	});
+}
+/** Default user-facing control-plane port when `--port` is not given. */
+const DEFAULT_SERVE_PORT = 5454;
+function isPortFree(port) {
+	return new Promise((resolve) => {
+		const s = http.createServer();
+		s.once("error", () => resolve(false));
+		s.listen(port, "127.0.0.1", () => s.close(() => resolve(true)));
+	});
+}
+/**
+* Probe a loopback port for an already-running `github-router serve` (its
+* identity endpoint). Returns true when the port hosts OUR serve, else false
+* (free, or a foreign process). `serve` is designed to run ONCE per machine
+* (a single machine-wide control plane for all repos), so a second launch
+* attaches to the running one instead of spawning a duplicate CloudCLI +
+* contending on the shared auth DB. We intentionally do NOT trust any URL the
+* probed service reports — a local squatter could forge the identity marker, so
+* the caller only ever opens a locally-constructed loopback origin.
+*/
+function probeExistingServe(port) {
+	return new Promise((resolve) => {
+		const req$1 = http.get({
+			host: "127.0.0.1",
+			port,
+			path: SERVE_IDENTITY_PATH,
+			headers: { host: `127.0.0.1:${port}` },
+			timeout: 1500
+		}, (res) => {
+			if (res.statusCode !== 200) {
+				res.resume();
+				resolve(false);
+				return;
+			}
+			const chunks = [];
+			res.on("data", (d) => chunks.push(Buffer.from(d)));
+			res.on("end", () => {
+				try {
+					resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")).service === SERVE_IDENTITY_SERVICE);
+				} catch {
+					resolve(false);
+				}
+			});
+			res.on("error", () => resolve(false));
+		});
+		req$1.on("timeout", () => req$1.destroy());
+		req$1.on("error", () => resolve(false));
+	});
+}
+/**
+* Resolve the user-facing port: honor an explicit `--port`; otherwise use 5454
+* when free, else fall back to a random free port. (Single-instance detection —
+* an already-running github-router serve on the intended port — is handled by
+* the earlier `probeExistingServe` attach/refuse in `run`.)
+*/
+async function resolveServePort(requested) {
+	if (requested != null) return requested;
+	if (await isPortFree(DEFAULT_SERVE_PORT)) return DEFAULT_SERVE_PORT;
+	const fallback = await getFreePort();
+	consola.info(`Port ${DEFAULT_SERVE_PORT} is in use; using ${fallback} instead.`);
+	return fallback;
+}
+function openBrowser(url) {
+	try {
+		if (process.platform === "win32") spawn("cmd", [
+			"/c",
+			"start",
+			"",
+			url
+		], {
+			detached: true,
+			stdio: "ignore",
+			windowsHide: true
+		}).unref();
+		else if (process.platform === "darwin") spawn("open", [url], {
+			detached: true,
+			stdio: "ignore"
+		}).unref();
+		else spawn("xdg-open", [url], {
+			detached: true,
+			stdio: "ignore"
+		}).unref();
+	} catch {}
+}
+const serve$1 = defineCommand({
+	meta: {
+		name: "serve",
+		description: "Serve a browser control plane (CloudCLI) with Claude routed through the proxy"
+	},
+	args: {
+		...sharedServerArgs,
+		model: {
+			alias: "m",
+			type: "string",
+			description: "Override the default Claude model"
+		},
+		"cloudcli-path": {
+			type: "string",
+			description: "Use an existing CloudCLI install instead of the managed one"
+		},
+		"cloudcli-version": {
+			type: "string",
+			description: "Override the pinned CloudCLI version to install"
+		},
+		"codex-cli": {
+			type: "boolean",
+			default: false,
+			description: "Route Codex personas through a local `codex mcp-server` (requires codex 0.129+; falls back to HTTP if missing)"
+		},
+		"browse-over-tunnel": {
+			type: "boolean",
+			default: false,
+			description: "Expose the server-side browser MCP even when tunnel-exposed (session-hijack / SSRF risk — only with fully-trusted tunnel access)"
+		},
+		"agents-over-tunnel": {
+			type: "boolean",
+			default: false,
+			description: "Expose first-mate (mints a repo+workflow GitHub write token) even when tunnel-exposed (only with fully-trusted tunnel access)"
+		},
+		"fleet-over-tunnel": {
+			type: "boolean",
+			default: false,
+			description: "Expose the fleet MCP (drives remote coding sessions with your fleet credentials) even when tunnel-exposed (only with fully-trusted tunnel access)"
+		},
+		"no-install": {
+			type: "boolean",
+			default: false,
+			description: "Do not auto-install CloudCLI; require an existing install"
+		},
+		"no-open": {
+			type: "boolean",
+			default: false,
+			description: "Do not open the browser automatically"
+		},
+		"public-url": {
+			type: "string",
+			description: "Public URL(s) this is reachable at (e.g. a dev-tunnel https URL), comma-separated — allowlists their host+origin for remote access"
+		},
+		tunnel: {
+			type: "boolean",
+			default: false,
+			description: "Auto-create + host an AUTHENTICATED (never anonymous) Microsoft dev tunnel for the serve port and print its public URL, so you can reach the control plane from anywhere. Requires the `devtunnel` CLI + `devtunnel user login`."
+		}
+	},
+	async run({ args }) {
+		state.serveMode = true;
+		if (process.versions.bun) consola.warn("`serve` should run under Node.js. Bun's node:http upgrade sockets cannot relay the CloudCLI terminal/chat WebSockets; run the installed `github-router` binary (Node).");
+		const parsed = parseSharedArgs(args);
+		const intendedPort = parsed.port ?? DEFAULT_SERVE_PORT;
+		if (await probeExistingServe(intendedPort)) {
+			const existingUrl = `http://127.0.0.1:${intendedPort}`;
+			consola.box(`github-router control plane already running\n\n${existingUrl}\n\nOpening it — stop that instance first if you want a fresh one.`);
+			if (args["no-open"] !== true) openBrowser(existingUrl);
+			return;
+		}
+		const { server: server$1, serverUrl } = await setupAndServe({
+			...parsed,
+			port: void 0,
+			silent: true
+		});
+		try {
+			await ensureClaudeConfigMirror();
+		} catch (err) {
+			consola.error(`Failed to provision CLAUDE_CONFIG_DIR mirror: ${err instanceof Error ? err.message : String(err)}`);
+			process.exit(1);
+		}
+		runSelfUpdate({ selfUpdate: args["self-update"] !== false });
+		provisionAndIndexColbert({ skipCwdIndex: true });
+		provisionToolbelt().catch((err) => consola.debug("Toolbelt provisioning failed:", err));
+		startKeepAwake();
+		if (browserToolsEnabled()) provisionBrowserAssets().catch((err) => consola.debug("Browser extension provisioning failed:", err));
+		const opusFamilyShorthand = args.model?.match(/^(\d+\.\d+)$/)?.[1];
+		let chosenSlug = opusFamilyShorthand ? pickClaudeDefault(opusFamilyShorthand) : args.model ?? pickClaudeDefault();
+		if (!args.model && state.models) {
+			const inCache = (slug) => state.models?.data.some((m) => m.id === resolveModel(slug)) ?? false;
+			if (!inCache(chosenSlug)) {
+				for (const fb of DEFAULT_CLAUDE_MODEL_FALLBACKS) if (inCache(fb)) {
+					consola.info(`Default model "${chosenSlug}" not in your Copilot model list; falling back to "${fb}".`);
+					chosenSlug = fb;
+					break;
+				}
+			}
+		}
+		const requestedCli = args["codex-cli"] === true;
+		const backend = resolveCodexCliBackend({
+			requested: requestedCli,
+			codexInfo: requestedCli ? getCodexVersion() : null
+		});
+		const tunnelExposed = args.tunnel === true || String(args["public-url"] ?? "").split(",").map((s) => s.trim()).filter(Boolean).length > 0;
+		if (tunnelExposed && browserToolsEnabled() && args["browse-over-tunnel"] !== true) consola.info("Browser MCP is disabled over the tunnel (session-hijack/SSRF risk). Pass --browse-over-tunnel to enable it for fully-trusted access.");
+		if (tunnelExposed && state.agentsEnabled && args["agents-over-tunnel"] !== true) consola.info("first-mate is disabled over the tunnel (it mints a GitHub write token). Pass --agents-over-tunnel to enable it for fully-trusted access.");
+		if (tunnelExposed && state.fleetEnabled && args["fleet-over-tunnel"] !== true) consola.info("Fleet MCP is disabled over the tunnel (it drives remote coding sessions with your fleet credentials). Pass --fleet-over-tunnel to enable it for fully-trusted access.");
+		const enhancements = await provisionServeEnhancements(serverUrl, {
+			codexCli: backend === "cli",
+			tunnelExposed,
+			browseOverTunnel: args["browse-over-tunnel"] === true,
+			agentsOverTunnel: args["agents-over-tunnel"] === true,
+			fleetOverTunnel: args["fleet-over-tunnel"] === true
+		});
+		const anthropicVars = getClaudeCodeEnvVars(serverUrl, chosenSlug);
+		if (enhancements.nonce) {
+			anthropicVars.GH_ROUTER_HOOK_MCP_URL = serverUrl;
+			anthropicVars.GH_ROUTER_HOOK_NONCE = enhancements.nonce;
+		}
+		const childEnv = composeCloudCliChildEnv(anthropicVars);
+		childEnv.ANTHROPIC_API_KEY = "sk-ant-github-router-proxy-placeholder";
+		let cloudcli;
+		try {
+			cloudcli = await resolveCloudCli({
+				cliPath: args["cloudcli-path"],
+				noInstall: args["no-install"] === true,
+				version: args["cloudcli-version"]
+			});
+		} catch (err) {
+			consola.error(err instanceof Error ? err.message : String(err));
+			process.exit(1);
+		}
+		const ccPort = await getFreePort();
+		const cc = spawnCloudCli({
+			serverEntry: cloudcli.serverEntry,
+			port: ccPort,
+			env: childEnv
+		});
+		let shuttingDown = false;
+		let reverseClose = null;
+		let tunnelStop = null;
+		const shutdown = async () => {
+			if (shuttingDown) return;
+			shuttingDown = true;
+			if (tunnelStop) try {
+				tunnelStop();
+			} catch {}
+			try {
+				killChildProcessTree(cc.child, { detachedGroup: process.platform !== "win32" });
+			} catch {}
+			if (reverseClose) await reverseClose().catch(() => {});
+			try {
+				server$1.close?.();
+			} catch {}
+			await stopKeepAwake().catch(() => {});
+			await enhancements.cleanup().catch(() => {});
+			await removeOwnClaudeConfigMirror().catch(() => {});
+		};
+		process.once("SIGINT", () => void shutdown().then(() => process.exit(0)));
+		process.once("SIGTERM", () => void shutdown().then(() => process.exit(0)));
+		cc.child.once("exit", (code) => {
+			if (!shuttingDown) {
+				consola.error(`CloudCLI exited unexpectedly (code ${code}).`);
+				shutdown().then(() => process.exit(1));
+			}
+		});
+		cc.child.once("error", (err) => {
+			if (!shuttingDown) {
+				consola.error(`CloudCLI failed to start: ${err.message}`);
+				shutdown().then(() => process.exit(1));
+			}
+		});
+		let ready;
+		try {
+			ready = await waitForCloudCliReady(ccPort);
+		} catch (err) {
+			consola.error(err instanceof Error ? err.message : String(err));
+			await shutdown();
+			process.exit(1);
+		}
+		let username = "github-router";
+		try {
+			username = (await getGitHubUser()).login;
+		} catch {}
+		let token;
+		try {
+			token = await mintJwt(ccPort, username, ready.needsSetup);
+		} catch (err) {
+			consola.error(err instanceof Error ? err.message : String(err));
+			await shutdown();
+			process.exit(1);
+		}
+		const publicUrls = String(args["public-url"] ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+		const extraAllowedHosts = [];
+		const extraAllowedOrigins = [];
+		for (const u of publicUrls) try {
+			const url = new URL(u);
+			extraAllowedHosts.push(url.host);
+			extraAllowedOrigins.push(url.origin);
+		} catch {
+			consola.warn(`Ignoring invalid --public-url "${u}"`);
+		}
+		const tunnelMode = args.tunnel === true;
+		if (extraAllowedHosts.length || tunnelMode) consola.warn("Remote access enabled: anyone who reaches this through the tunnel AND passes its authentication gets FULL control-plane access — including a shell on this machine. The tunnel is authenticated (never anonymous); only grant access to people you fully trust.");
+		const servePort = await resolveServePort(parsed.port);
+		const providerFacade = {
+			kindFor: facadeInterceptKind,
+			blockedRequest: facadeBlockedRequest,
+			rewrite: (kind, json, query) => rewriteProviderResponse(kind, json, {
+				getModels: () => state.models,
+				defaultModel: resolveModel(chosenSlug),
+				claudeConfigDir: PATHS.CLAUDE_CONFIG_DIR
+			}, query)
+		};
+		let reverse;
+		try {
+			reverse = await startReverseProxy({
+				targetHost: "127.0.0.1",
+				targetPort: ccPort,
+				bindHost: "127.0.0.1",
+				bindPort: servePort,
+				authToken: token,
+				seedToolSettings: process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== "1",
+				seedAllowedTools: enhancements.mcpToolNames ?? [],
+				extraAllowedHosts,
+				extraAllowedOrigins,
+				allowDevtunnelHosts: tunnelMode,
+				providerFacade
+			});
+		} catch (err) {
+			consola.error(`Failed to bind the control-plane port ${servePort}: ${err instanceof Error ? err.message : String(err)}. Is it already in use? Pass --port <n>.`);
+			await shutdown();
+			process.exit(1);
+		}
+		reverseClose = reverse.close;
+		let tunnelUrl = null;
+		if (tunnelMode) {
+			consola.info("Creating an authenticated dev tunnel…");
+			try {
+				const tunnel = await startDevtunnel(servePort);
+				tunnelUrl = tunnel.url;
+				tunnelStop = tunnel.stop;
+			} catch (err) {
+				const msg = err instanceof DevtunnelError ? err.message : String(err);
+				consola.warn(`Could not auto-host a dev tunnel: ${msg}\nServing locally only. To host manually once fixed: devtunnel host -p ${servePort}`);
+			}
+		}
+		const publicLines = [...publicUrls.map((u) => `remote: ${u}`), ...tunnelUrl ? [`remote (tunnel): ${tunnelUrl}  (stable — bookmark it; same URL every launch)`] : []];
+		const publicBlock = publicLines.length ? `\n${publicLines.join("\n")}` : "";
+		consola.box(`🖥️  github-router control plane\n\nlocal:  ${reverse.url}${publicBlock}\n\nsigned in as ${username} · model ${chosenSlug}\nCtrl+C to stop`);
+		if (args["no-open"] !== true) openBrowser(reverse.url);
+	}
+});
+
 //#endregion
 //#region src/lib/shell.ts
 function getShell() {
@@ -10084,7 +11814,7 @@ process.on("uncaughtException", (error) => {
 const version = getPackageVersion();
 const argv = process.argv.slice(2);
 const isVersionFlag = argv.includes("--version");
-const isInternalHook = argv[0] === "internal-stop-hook" || argv[0] === "internal-prompt-submit" || argv[0] === "internal-stop-review" || argv[0] === "internal-plan-review" || argv[0] === "internal-session-bind" || argv[0] === "internal-artifact-open" || argv[0] === "internal-first-mate-guard" || argv[0] === "internal-worker-guard";
+const isInternalHook = argv[0] === "internal-stop-hook" || argv[0] === "internal-prompt-submit" || argv[0] === "internal-stop-review" || argv[0] === "internal-plan-review" || argv[0] === "internal-session-bind" || argv[0] === "internal-workspace-header" || argv[0] === "internal-artifact-open" || argv[0] === "internal-first-mate-guard" || argv[0] === "internal-worker-guard";
 if (!isVersionFlag && !isInternalHook) consola.info(`github-router v${version}`);
 await runMain(defineCommand({
 	meta: {
@@ -10097,6 +11827,7 @@ await runMain(defineCommand({
 		start,
 		claude,
 		codex,
+		serve: serve$1,
 		models,
 		"check-usage": checkUsage,
 		debug,
@@ -10105,6 +11836,7 @@ await runMain(defineCommand({
 		"internal-stop-review": internalStopReview,
 		"internal-plan-review": internalPlanReview,
 		"internal-session-bind": internalSessionBind,
+		"internal-workspace-header": internalWorkspaceHeader,
 		"internal-artifact-open": internalArtifactOpen,
 		"internal-first-mate-guard": internalFirstMateGuard,
 		"internal-worker-guard": internalWorkerGuard