github-router 0.3.250 → 0.3.255

package/dist/serve-sa_7c-yD.js

@@ -0,0 +1,1511 @@
+import { $ as scoutModel, C as buildToolbeltAwareness, Et as DEFAULT_CLAUDE_MODEL_FALLBACKS, G as brainstormModel, J as browserToolsEnabled, K as browseAgentEnabled, Nt as pickClaudeDefault, Q as reviewerModel, S as availableToolCommands, U as agentToolsEnabled, X as geminiAvailable, Y as fleetToolsEnabled, Z as nativeSubagentModel, _t as provisionAndIndexColbert, a as buildPeerAwarenessSnippet, et as scribeModel, ht as provisionBrowserAssets, nt as workerToolsEnabled, q as browserCompoundToolsEnabled, s as enumerateInjectedMcpToolNames, tt as standInToolEnabled, w as toolbeltEnabled, x as buildEnv } from "./peer-mcp-personas-BDet588n.js";
+import { t as getPackageVersion } from "./version-_Q1WpsQp.js";
+import { o as removeOwnClaudeConfigMirror, r as ensureClaudeConfigMirror, t as PATHS } from "./paths-C1cLZ7Ga.js";
+import { O as state, d as resolveModel, m as getGitHubUser } from "./token-R2ocFC3M.js";
+import { a as resolveExecutable, o as runCommandCapture, t as killChildProcessTree } from "./exec-DTO2oin0.js";
+import { a as sharedServerArgs, i as setupAndServe, l as runSelfUpdate, o as startKeepAwake, r as parseSharedArgs, s as stopKeepAwake, t as getClaudeCodeEnvVars } from "./server-setup-DcO9qvN3.js";
+import { r as getCodexVersion, t as provisionToolbelt } from "./provision-DSkPa5hY.js";
+import { s as injectStopHookIntoSettingsFile } from "./stop-gate-hook-DQc2KV7B.js";
+import { l as guardToolMatcher, n as activeDispatchModes, r as buildWorkerGuardHookCommand } from "./worker-dispatch-Bj1uYyG9.js";
+import { _ as injectPeerMcpIntoMirror, a as OPERATING_DEFAULTS_DIRECTIVE, b as workersKeyOf, d as SEAMLESS_BUILTIN_TOOLS, f as configureServeDefaultPermissionMode, g as BUILTIN_SUBAGENT_DEFINITIONS, h as sanitizeServeSettingsEnv, l as prependOperatingDefaultsToMirroredClaudeMd, m as planModeAllowRules, n as INJECTED_SKILLS, o as appendPeerAwarenessToMirroredClaudeMd, p as injectAllowRules, r as writeInjectedSkill, s as appendToolbeltAwarenessToMirroredClaudeMd, t as injectAttributionSuppressionIntoSettingsFile, u as prependStyleDirectiveToMirroredClaudeMd, v as resolveCodexCliBackend, x as writePeerMcpRuntimeFiles, y as resolveGroupKeysFromMirror } from "./attribution-settings-CegtE0TY.js";
+import { i as planReviewEnabled, t as buildPlanReviewHookCommand } from "./plan-review-hook-C8x0uKPf.js";
+import { t as buildPromptSubmitHookCommand } from "./prompt-submit-hook-BrkkLAAB.js";
+import { defineCommand } from "citty";
+import consola from "consola";
+import fs from "node:fs";
+import path from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+import fs$1 from "node:fs/promises";
+import os from "node:os";
+import { spawn } from "node:child_process";
+import http from "node:http";
+//#region src/lib/serve/cloudcli.ts
+const CLOUDCLI_PACKAGE = "@cloudcli-ai/cloudcli";
+/**
+* Build the env handed to the CloudCLI child. Starts from `buildEnv()` — the
+* vetted secret-stripping ALLOWLIST used for worker bash (drops GITHUB_TOKEN,
+* GH_ROUTER_*, ANTHROPIC_AUTH_TOKEN, OPENAI_API_KEY, COPILOT_TOKEN by omission)
+* — then layers the non-secret Anthropic/Claude vars. The spawned claude still
+* authenticates because that rides the synthetic `.credentials.json` FILE in
+* CLAUDE_CONFIG_DIR, not an env token. Load-bearing: CloudCLI exposes a browser
+* terminal that can read its own env, so no secret may live there.
+*/
+function composeCloudCliChildEnv(anthropicVars) {
+	return {
+		...buildEnv(),
+		...anthropicVars
+	};
+}
+const SERVER_ENTRY_REL = path.join("dist-server", "server", "index.js");
+/** Where the package's server entry lives under a given install root. */
+function serverEntryUnderRoot(root) {
+	return path.join(root, "node_modules", CLOUDCLI_PACKAGE, SERVER_ENTRY_REL);
+}
+async function exists(p) {
+	try {
+		await fs$1.access(p);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function readVersion(pkgRoot) {
+	try {
+		const raw = await fs$1.readFile(path.join(pkgRoot, "node_modules", CLOUDCLI_PACKAGE, "package.json"), "utf8");
+		return JSON.parse(raw).version ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Resolve the CloudCLI server entry, in order:
+*   1. an explicit `--cloudcli-path` (a package dir OR an install root),
+*   2. an existing pinned install in the router-owned dir,
+*   3. (unless `noInstall`) install the pinned version into the router-owned dir.
+* Never installs globally, never `@latest`.
+*/
+async function resolveCloudCli(opts) {
+	const version = opts.version ?? "1.36.1";
+	if (opts.cliPath) {
+		const direct = path.join(opts.cliPath, SERVER_ENTRY_REL);
+		const underRoot = serverEntryUnderRoot(opts.cliPath);
+		if (await exists(direct)) return {
+			serverEntry: direct,
+			version: null
+		};
+		if (await exists(underRoot)) return {
+			serverEntry: underRoot,
+			version: await readVersion(opts.cliPath)
+		};
+		throw new Error(`--cloudcli-path "${opts.cliPath}" does not contain a CloudCLI install (looked for ${SERVER_ENTRY_REL}).`);
+	}
+	const root = PATHS.CLOUDCLI_HOME;
+	const entry = serverEntryUnderRoot(root);
+	if (await exists(entry)) return {
+		serverEntry: entry,
+		version: await readVersion(root)
+	};
+	if (opts.noInstall) throw new Error(`CloudCLI is not installed and --no-install was given. Install it with:\n  npm i --prefix "${root}" ${CLOUDCLI_PACKAGE}@${version}`);
+	await installCloudCli(root, version);
+	if (!await exists(entry)) throw new Error(`CloudCLI install completed but the server entry is missing (${entry}).`);
+	return {
+		serverEntry: entry,
+		version: await readVersion(root)
+	};
+}
+async function installCloudCli(root, version) {
+	const npm = resolveExecutable("npm");
+	if (!npm) throw new Error("npm not found on PATH — cannot install CloudCLI. Install Node.js/npm, or pass --cloudcli-path to an existing install.");
+	await fs$1.mkdir(root, {
+		recursive: true,
+		mode: 448
+	});
+	const pkgJson = path.join(root, "package.json");
+	if (!await exists(pkgJson)) await fs$1.writeFile(pkgJson, JSON.stringify({
+		name: "gh-router-cloudcli-host",
+		private: true
+	}, null, 2));
+	consola.info(`Installing ${CLOUDCLI_PACKAGE}@${version} (one-time, ~a minute; builds native deps)…`);
+	const { code, stderr } = await runCommandCapture([
+		npm,
+		"install",
+		`${CLOUDCLI_PACKAGE}@${version}`,
+		"--prefix",
+		root,
+		"--no-audit",
+		"--no-fund",
+		"--loglevel=error"
+	], { timeoutMs: 6e5 });
+	if (code !== 0) throw new Error(`CloudCLI install failed (npm exit ${code}). This often means no network, a corporate proxy, or missing Windows build tools for native deps.\nInstall manually then re-run with --cloudcli-path:\n  npm i --prefix "${root}" ${CLOUDCLI_PACKAGE}@${version}\n${stderr.slice(0, 400)}`);
+}
+/** Spawn CloudCLI on a loopback port with the given (already-filtered) env. */
+function spawnCloudCli(opts) {
+	const databasePath = path.join(PATHS.CLOUDCLI_HOME, "auth.db");
+	const node = resolveExecutable("node") ?? process.execPath;
+	const logPath = process.env.GH_ROUTER_CLOUDCLI_LOG;
+	let stdio = "ignore";
+	if (logPath) try {
+		const fd = fs.openSync(logPath, "a");
+		stdio = [
+			"ignore",
+			fd,
+			fd
+		];
+	} catch {}
+	return {
+		child: spawn(node, [opts.serverEntry], {
+			env: {
+				...opts.env,
+				SERVER_PORT: String(opts.port),
+				HOST: "127.0.0.1",
+				DATABASE_PATH: databasePath,
+				VITE_IS_PLATFORM: ""
+			},
+			stdio,
+			windowsHide: true
+		}),
+		port: opts.port,
+		databasePath
+	};
+}
+function req(port, method, urlPath, body) {
+	return new Promise((resolve, reject) => {
+		const data = body === void 0 ? void 0 : JSON.stringify(body);
+		const r = http.request({
+			host: "127.0.0.1",
+			port,
+			path: urlPath,
+			method,
+			headers: data ? {
+				"content-type": "application/json",
+				"content-length": Buffer.byteLength(data)
+			} : {}
+		}, (res) => {
+			let b = "";
+			res.on("data", (d) => b += d);
+			res.on("end", () => resolve({
+				status: res.statusCode ?? 0,
+				body: b
+			}));
+		});
+		r.on("error", reject);
+		if (data) r.write(data);
+		r.end();
+	});
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** Poll /api/auth/status until the server answers. Returns `needsSetup`. */
+async function waitForCloudCliReady(port, timeoutMs = 6e4) {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		try {
+			const r = await req(port, "GET", "/api/auth/status");
+			if (r.status === 200) return { needsSetup: JSON.parse(r.body).needsSetup === true };
+		} catch {}
+		await sleep(1e3);
+	}
+	throw new Error(`CloudCLI did not become ready within ${timeoutMs}ms`);
+}
+const secretFile = () => path.join(PATHS.CLOUDCLI_HOME, ".serve-secret.json");
+async function loadPassword(username) {
+	try {
+		const raw = await fs$1.readFile(secretFile(), "utf8");
+		const parsed = JSON.parse(raw);
+		if (parsed.username === username && parsed.password) return parsed.password;
+	} catch {}
+	return null;
+}
+async function persistPassword(username, password) {
+	await fs$1.mkdir(PATHS.CLOUDCLI_HOME, {
+		recursive: true,
+		mode: 448
+	});
+	await fs$1.writeFile(secretFile(), JSON.stringify({
+		username,
+		password
+	}), { mode: 384 });
+}
+/**
+* Ensure a CloudCLI user exists and return a valid JWT. On a fresh (isolated)
+* DB we register (persisting the password only AFTER success); on an existing
+* DB we log in with the persisted password.
+*/
+async function mintJwt(port, username, needsSetup) {
+	const existing = await loadPassword(username);
+	if (needsSetup) {
+		const password = existing ?? randomBytes(24).toString("base64url");
+		const r = await req(port, "POST", "/api/auth/register", {
+			username,
+			password
+		});
+		if (r.status === 200) {
+			const token = JSON.parse(r.body).token;
+			if (token) {
+				await persistPassword(username, password);
+				return token;
+			}
+		}
+	}
+	const password = existing;
+	if (!password) throw new Error(`CloudCLI already has a user but no stored password for "${username}". Delete ${path.join(PATHS.CLOUDCLI_HOME, "auth.db")} and retry.`);
+	const r = await req(port, "POST", "/api/auth/login", {
+		username,
+		password
+	});
+	if (r.status === 200) {
+		const token = JSON.parse(r.body).token;
+		if (token) return token;
+	}
+	throw new Error(`Could not obtain a CloudCLI session token (status ${r.status}). If a stale isolated DB exists, delete ${path.join(PATHS.CLOUDCLI_HOME, "auth.db")} and retry.`);
+}
+//#endregion
+//#region src/lib/serve/devtunnel.ts
+const SERVE_TUNNEL_LABEL = "github-router-serve";
+function serveTunnelMachineLabel(hostname = os.hostname()) {
+	return `ghr-machine-${createHash("sha256").update(hostname).digest("hex").slice(0, 12)}`;
+}
+/**
+* Stable, deterministic tunnel ID for THIS machine, so `serve --tunnel` REUSES
+* one tunnel across launches → a stable, bookmarkable public URL. Derived from a
+* hash of the hostname (valid tunnel-id charset: lowercase alnum + hyphens,
+* bounded length). NOTE: the hosting URL's subdomain is a devtunnels-assigned
+* token, NOT this id — the id only anchors find/reuse; the URL is stable because
+* the same tunnel is re-hosted, not because the id appears in it.
+*/
+function serveTunnelId(hostname = os.hostname()) {
+	return `ghr-serve-${createHash("sha256").update(hostname).digest("hex").slice(0, 12)}`;
+}
+/**
+* Reconcile a reused tunnel's ports to exactly `[desired]`: which existing ports
+* to delete and whether the desired port must be created. Pure (unit-tested).
+* This is why reuse works across `--port` changes — `devtunnel host <id>
+* -p <newport>` fails ("Batch update of ports is not supported"), but per-port
+* `port delete` + `port create` does not.
+*/
+function portsToReconcile(currentPorts, desired) {
+	return {
+		toDelete: currentPorts.filter((p) => p !== desired),
+		toCreate: currentPorts.includes(desired) ? null : desired
+	};
+}
+/**
+* The IDs of our own idle tunnels for this machine to sweep — EXCLUDING the
+* stable reused tunnel (`exceptId`), which we keep and re-host. Pure
+* (unit-tested). A tunnel with a live host connection (a concurrent serve
+* instance) is never swept. Cleans up pre-migration random-named tunnels + any
+* crash-orphaned duplicates while preserving the one stable tunnel.
+*/
+function serveTunnelIdsToSweep(tunnels, machineLabel, exceptId) {
+	return tunnels.filter((t) => (t.labels ?? []).includes(machineLabel) && !t.hostConnections).map((t) => t.tunnelId).filter((id) => !exceptId || id.split(".")[0] !== exceptId);
+}
+/** List the tunnels serve owns (label-filtered). Best-effort: [] on any error. */
+async function listServeTunnels(cli) {
+	try {
+		const { stdout, code } = await runCommandCapture([
+			cli,
+			"list",
+			"-l",
+			SERVE_TUNNEL_LABEL,
+			"-j"
+		], { timeoutMs: 15e3 });
+		if (code !== 0) return [];
+		const parsed = JSON.parse(stdout);
+		return Array.isArray(parsed?.tunnels) ? parsed.tunnels : [];
+	} catch {
+		return [];
+	}
+}
+/** Best-effort delete of a single tunnel by full id (e.g. `fancy-fog-x.inc1`). */
+async function deleteTunnel(cli, tunnelId) {
+	try {
+		await runCommandCapture([
+			cli,
+			"delete",
+			tunnelId,
+			"-f"
+		], { timeoutMs: 15e3 });
+	} catch {}
+}
+/** Current port numbers configured on a tunnel. Best-effort: [] on any error. */
+async function getTunnelPorts(cli, tunnelId) {
+	try {
+		const { stdout, code } = await runCommandCapture([
+			cli,
+			"port",
+			"list",
+			tunnelId,
+			"-j"
+		], { timeoutMs: 15e3 });
+		if (code !== 0) return [];
+		return (JSON.parse(stdout)?.ports ?? []).map((p) => p.portNumber).filter((n) => typeof n === "number");
+	} catch {
+		return [];
+	}
+}
+/**
+* Ensure the stable per-machine tunnel exists (create it labeled if absent).
+* Returns true when the stable tunnel is present + owned by us (safe to reuse),
+* false to fall back to the anonymous-labeled host path. `existing` is the
+* pre-fetched label-scoped list (so we don't re-list).
+*/
+async function ensureStableTunnel(cli, stableId, machineLabel, existing) {
+	if (existing.some((t) => t.tunnelId.split(".")[0] === stableId)) return true;
+	try {
+		const { code } = await runCommandCapture([
+			cli,
+			"create",
+			stableId,
+			"-l",
+			SERVE_TUNNEL_LABEL,
+			"-l",
+			machineLabel,
+			"-d",
+			"github-router-serve-control-plane"
+		], { timeoutMs: 2e4 });
+		return code === 0;
+	} catch {
+		return false;
+	}
+}
+/** Reconcile the tunnel's ports to exactly `[port]` (delete stale, create missing). */
+async function reconcileTunnelPorts(cli, tunnelId, port) {
+	const { toDelete, toCreate } = portsToReconcile(await getTunnelPorts(cli, tunnelId), port);
+	for (const p of toDelete) await runCommandCapture([
+		cli,
+		"port",
+		"delete",
+		tunnelId,
+		"-p",
+		String(p)
+	], { timeoutMs: 15e3 }).catch(() => {});
+	if (toCreate != null) await runCommandCapture([
+		cli,
+		"port",
+		"create",
+		tunnelId,
+		"-p",
+		String(toCreate)
+	], { timeoutMs: 15e3 }).catch(() => {});
+}
+const DEVTUNNEL_URL_RE = /https:\/\/[a-z0-9][a-z0-9-]*(?:\.[a-z0-9-]+)*\.devtunnels\.ms\/?/i;
+var DevtunnelError = class extends Error {
+	kind;
+	constructor(kind, message) {
+		super(message);
+		this.name = "DevtunnelError";
+		this.kind = kind;
+	}
+};
+/** Absolute path to the `devtunnel` CLI, or null if not on PATH. */
+function resolveDevtunnelCli() {
+	return resolveExecutable("devtunnel");
+}
+/** Best-effort login check via `devtunnel user show`. */
+async function isDevtunnelLoggedIn(cli) {
+	try {
+		const { stdout, stderr, code } = await runCommandCapture([
+			cli,
+			"user",
+			"show"
+		], { timeoutMs: 15e3 });
+		const out = `${stdout}\n${stderr}`;
+		if (/not logged in/i.test(out)) return false;
+		if (/logged in as/i.test(out)) return true;
+		return code === 0;
+	} catch {
+		return false;
+	}
+}
+/** Extract the dev-tunnel browser URL from CLI output. Exported for tests. */
+function parseDevtunnelUrl(text) {
+	const m = text.match(DEVTUNNEL_URL_RE);
+	return m ? m[0].replace(/\/+$/, "") : null;
+}
+/**
+* Spawn `devtunnel <args>` and resolve once it prints its public URL. Shared by
+* the stable-reuse and anonymous-labeled host paths. Rejects (DevtunnelError) on
+* timeout, early exit, an auth error in the output, or a spawn failure.
+*/
+function hostTunnelProcess(cli, args, timeoutMs) {
+	const child = spawn(cli, args, {
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true
+	});
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const stop = () => {
+			try {
+				killChildProcessTree(child, { detachedGroup: process.platform !== "win32" });
+			} catch {
+				try {
+					child.kill();
+				} catch {}
+			}
+		};
+		const finish = (fn) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			fn();
+		};
+		const timer = setTimeout(() => finish(() => {
+			stop();
+			reject(new DevtunnelError("timeout", "dev tunnel did not report a URL in time"));
+		}), timeoutMs);
+		const onData = (buf) => {
+			const text = String(buf);
+			const url = parseDevtunnelUrl(text);
+			if (url) {
+				finish(() => resolve({
+					url,
+					stop
+				}));
+				return;
+			}
+			if (/not logged in|login (required|expired)|unauthorized/i.test(text)) finish(() => {
+				stop();
+				reject(new DevtunnelError("not-logged-in", "dev tunnel authentication failed; run `devtunnel user login`"));
+			});
+		};
+		child.stdout?.on("data", onData);
+		child.stderr?.on("data", onData);
+		child.once("error", (err) => finish(() => reject(new DevtunnelError("spawn", err.message))));
+		child.once("exit", (code) => finish(() => reject(new DevtunnelError("exited", `devtunnel exited (code ${code}) before printing a URL`))));
+	});
+}
+/**
+* Host an AUTHENTICATED (never anonymous) dev tunnel forwarding `port`, resolving
+* once its public URL is printed. NEVER `--allow-anonymous` (owner-only access).
+*
+* REUSES a stable per-machine tunnel (`serveTunnelId`) across launches → a
+* STABLE, bookmarkable public URL. Each launch: ensure the stable tunnel exists
+* (create it labeled if absent), reconcile its ports to exactly `[port]` via
+* per-port delete/create (`host <id> -p <newport>` can't change ports — it 400s
+* "Batch update of ports is not supported"), sweep our OTHER idle labeled tunnels
+* (pre-migration random-named ones / crash orphans), then `host <id>`. The URL's
+* subdomain is a devtunnels-assigned token (not the id), but it's stable because
+* the SAME tunnel is re-hosted every launch.
+*
+* If any stable-path step fails (id already taken by another owner, CLI hiccup),
+* falls back to hosting a fresh anonymous-labeled tunnel (the prior behavior) so
+* `--tunnel` always works — just without a stable URL that launch.
+*/
+async function startDevtunnel(port, opts = {}) {
+	const cli = resolveDevtunnelCli();
+	if (!cli) throw new DevtunnelError("not-installed", "The `devtunnel` CLI is not installed. Install it (winget install Microsoft.devtunnel  /  brew install --cask devtunnel) then run `devtunnel user login`.");
+	if (!await isDevtunnelLoggedIn(cli)) throw new DevtunnelError("not-logged-in", "Not signed in to dev tunnels. Run `devtunnel user login` (or `devtunnel user login -g` for GitHub) first.");
+	const timeoutMs = opts.timeoutMs ?? 4e4;
+	const machineLabel = serveTunnelMachineLabel();
+	const stableId = serveTunnelId();
+	try {
+		const owned = await listServeTunnels(cli);
+		if (await ensureStableTunnel(cli, stableId, machineLabel, owned)) {
+			await reconcileTunnelPorts(cli, stableId, port);
+			for (const id of serveTunnelIdsToSweep(owned, machineLabel, stableId)) await deleteTunnel(cli, id);
+			return await hostTunnelProcess(cli, ["host", stableId], timeoutMs);
+		}
+	} catch {}
+	try {
+		for (const id of serveTunnelIdsToSweep(await listServeTunnels(cli), machineLabel)) await deleteTunnel(cli, id);
+	} catch {}
+	return await hostTunnelProcess(cli, [
+		"host",
+		"-p",
+		String(port),
+		"-l",
+		SERVE_TUNNEL_LABEL,
+		"-l",
+		machineLabel,
+		"-d",
+		"github-router-serve-control-plane"
+	], timeoutMs);
+}
+//#endregion
+//#region src/lib/serve/enhancements.ts
+const NOOP = { cleanup: async () => {} };
+/**
+* Wire the github-router enhancement layer into the router-owned
+* CLAUDE_CONFIG_DIR mirror so a CloudCLI-spawned Claude session gets the same
+* tools `github-router claude` provides:
+*   - the scoped MCP servers (peers / search / orchestrate, plus workers /
+*     decide / browser / fleet / first-mate when their gate passes) — the
+*     SDK-spawned claude reads them from the mirror's `.claude.json`,
+*   - the peer-critic / worker / implementer subagents (`.md` files written into
+*     the mirror's `agents/`),
+*   - the gh-* skills (research / orchestrate / floor-keeper / worker).
+*
+* Best-effort: on any failure Claude still works, just without the extras.
+* Must run AFTER `ensureClaudeConfigMirror()` and BEFORE CloudCLI is spawned.
+* Tab-specific bits (ai-or-die hooks, artifact review) are intentionally left
+* out — they don't apply to the serve control plane.
+*/
+async function provisionServeEnhancements(serverUrl, opts = {}) {
+	try {
+		const tunnelExposed = opts.tunnelExposed === true;
+		const browseAllowed = browserToolsEnabled() && (!tunnelExposed || opts.browseOverTunnel === true);
+		const firstMateAllowed = agentToolsEnabled() && (!tunnelExposed || opts.agentsOverTunnel === true);
+		const fleetAllowed = fleetToolsEnabled() && (!tunnelExposed || opts.fleetOverTunnel === true);
+		const enabledGroups = [
+			"peers",
+			"search",
+			"orchestrate"
+		];
+		if (workerToolsEnabled()) enabledGroups.push("workers");
+		if (standInToolEnabled()) enabledGroups.push("decide");
+		if (browseAllowed) enabledGroups.push("browser");
+		if (fleetAllowed) enabledGroups.push("fleet");
+		if (firstMateAllowed) enabledGroups.push("first-mate");
+		const gem = geminiAvailable();
+		const { keys: groupKeys } = await resolveGroupKeysFromMirror(enabledGroups);
+		const runtime = await writePeerMcpRuntimeFiles(serverUrl, {
+			codexCli: opts.codexCli === true,
+			geminiAvailable: gem,
+			groupKeys,
+			workerToolsAvailable: workerToolsEnabled(),
+			browseAvailable: browseAllowed && browseAgentEnabled(),
+			nativeSubagentModel: nativeSubagentModel(),
+			reviewerModel: reviewerModel(),
+			brainstormModel: brainstormModel(),
+			scoutModel: scoutModel(),
+			scribeModel: scribeModel(),
+			builtinSubagents: BUILTIN_SUBAGENT_DEFINITIONS
+		});
+		state.peerMcpNonce = runtime.nonce;
+		const injected = await injectPeerMcpIntoMirror(serverUrl, {
+			codexCli: opts.codexCli === true,
+			geminiAvailable: gem,
+			groupKeys,
+			nonce: runtime.nonce
+		});
+		const peerSnippet = buildPeerAwarenessSnippet({
+			codexCli: opts.codexCli === true,
+			geminiAvailable: gem,
+			workerToolsAvailable: workerToolsEnabled(),
+			standInAvailable: standInToolEnabled(),
+			browseAvailable: browseAllowed,
+			compoundBrowseAvailable: browseAllowed && browserCompoundToolsEnabled(),
+			powerBrowseAvailable: browseAllowed && state.powerBrowseEnabled,
+			agentToolsAvailable: firstMateAllowed,
+			scoutAvailable: scoutModel() != null,
+			groupKeys
+		});
+		await appendPeerAwarenessToMirroredClaudeMd(peerSnippet).catch((err) => consola.warn(`Peer-awareness CLAUDE.md append failed: ${String(err)}`));
+		await prependStyleDirectiveToMirroredClaudeMd().catch((err) => consola.warn(`Style-directive CLAUDE.md prepend failed: ${String(err)}`));
+		await prependOperatingDefaultsToMirroredClaudeMd(OPERATING_DEFAULTS_DIRECTIVE).catch((err) => consola.warn(`Operating-defaults CLAUDE.md prepend failed: ${String(err)}`));
+		if (toolbeltEnabled()) {
+			const toolbeltLine = buildToolbeltAwareness(availableToolCommands());
+			if (toolbeltLine) await appendToolbeltAwarenessToMirroredClaudeMd(toolbeltLine).catch((err) => consola.warn(`Toolbelt CLAUDE.md append failed: ${String(err)}`));
+		}
+		let skillsWritten = 0;
+		for (const s of INJECTED_SKILLS) {
+			if (s.name.startsWith("gh-first-mate") || s.name === "gh-artifact-review") continue;
+			if ((await writeInjectedSkill(s.name, s.md).catch(() => ({ written: false }))).written) skillsWritten++;
+		}
+		const settingsPath = path.join(PATHS.CLAUDE_CONFIG_DIR, "settings.json");
+		await injectAttributionSuppressionIntoSettingsFile(settingsPath).catch(() => {});
+		const strip = await sanitizeServeSettingsEnv(settingsPath).catch((err) => {
+			consola.warn(`Could not sanitize serve settings env: ${String(err)}`);
+			return { removed: [] };
+		});
+		if (strip.removed.length) consola.info(`Serve: removed ${strip.removed.join(", ")} from the mirror settings (single-agent surface).`);
+		if (process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== "1") await configureServeDefaultPermissionMode(settingsPath).catch((err) => consola.warn(`Could not set serve permission defaults: ${String(err)}`));
+		const injectedServerKeys = injected.ok ? injected.serversAdded : [...Object.values(groupKeys).filter((k) => Boolean(k)), ...opts.codexCli === true ? ["codex-cli"] : []];
+		await injectAllowRules(settingsPath, planModeAllowRules(injectedServerKeys)).catch((err) => consola.warn(`Could not auto-approve injected tools: ${String(err)}`));
+		if (workerToolsEnabled()) {
+			const promptCmd = buildPromptSubmitHookCommand(process.execPath, process.argv[1]);
+			await injectStopHookIntoSettingsFile(settingsPath, promptCmd, "UserPromptSubmit", 45).catch((err) => consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`));
+			if (!injected.ok) consola.warn("Workers non-blocking guard NOT registered: subagent MCP injection fell back to parent-only, so worker-* dispatchers cannot reach the workers server. Raw worker tools remain usable on the main thread.");
+			else if (process.env.GH_ROUTER_DISABLE_WORKER_GUARD !== "1") {
+				const workersKey = workersKeyOf(groupKeys);
+				const modes = activeDispatchModes({ browse: browseAllowed && browseAgentEnabled() });
+				const cmd = buildWorkerGuardHookCommand(process.execPath, process.argv[1], workersKey, modes);
+				const matcher = guardToolMatcher(workersKey, modes);
+				await injectStopHookIntoSettingsFile(settingsPath, cmd, "PreToolUse", 10, matcher).catch((err) => consola.warn(`Could not register the workers PreToolUse guard hook: ${String(err)}`));
+			} else consola.info("Workers non-blocking guard disabled via GH_ROUTER_DISABLE_WORKER_GUARD=1; raw worker tools remain callable on the main thread.");
+		}
+		if (planReviewEnabled()) try {
+			const command = buildPlanReviewHookCommand(process.execPath, process.argv[1]);
+			await injectStopHookIntoSettingsFile(settingsPath, command, "PostToolUse", void 0, "ExitPlanMode");
+		} catch (err) {
+			consola.warn(`Could not register the advisory plan-review hook: ${String(err)}`);
+		}
+		const servers = injected.ok ? injected.serversAdded.join(", ") : "parent-only (user mcpServers collision)";
+		consola.info(`github-router tools wired into Claude sessions: MCP [${servers}], ${runtime.personas.length} subagents, ${skillsWritten} skills.`);
+		return {
+			cleanup: runtime.cleanup,
+			nonce: runtime.nonce,
+			mcpToolNames: enumerateInjectedMcpToolNames(groupKeys, { codexCli: opts.codexCli === true })
+		};
+	} catch (err) {
+		consola.warn(`Could not wire the github-router MCP/skills layer: ${err instanceof Error ? err.message : String(err)}. Claude still works, without the extra tools.`);
+		return NOOP;
+	}
+}
+//#endregion
+//#region src/lib/serve/provider-facade.ts
+function isObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function envelopedData(value) {
+	if (!isObject(value) || !isObject(value.data)) return null;
+	return value.data;
+}
+function cloneObject(value) {
+	return { ...value };
+}
+/**
+* Requests serve answers DIRECTLY (never forwarded to CloudCLI) with a canned
+* JSON body. `POST /api/system/update` is CloudCLI's "update available" button,
+* which runs a GLOBAL `npm install -g @cloudcli-ai/cloudcli@latest` in the user's
+* home dir (`server/index.js`) — mutating their global npm and never applying to
+* serve's pinned, router-owned install. Blocking it prevents that surprise
+* mutation and tells the user how updates actually work. HTTP 200 + `success:
+* false` so the UI neither runs the update nor throws an error toast. Returns
+* null for anything not blocked.
+*/
+function facadeBlockedRequest(method, pathname) {
+	if (method.toUpperCase() === "POST" && pathname === "/api/system/update") return {
+		status: 200,
+		json: {
+			success: false,
+			managed: true,
+			message: "CloudCLI is managed by github-router (a pinned, router-owned install). To update, run `npm i -g github-router@latest`, then restart `github-router serve`."
+		}
+	};
+	return null;
+}
+function facadeInterceptKind(method, pathname) {
+	const normalizedMethod = method.toUpperCase();
+	if (normalizedMethod === "POST" && pathname === "/api/commands/list") return "commands";
+	if (normalizedMethod !== "GET") return null;
+	switch (pathname) {
+		case "/api/providers/claude/models": return "models";
+		case "/api/providers/claude/mcp/servers": return "mcp";
+		case "/api/providers/claude/skills": return "skills";
+		case "/api/providers/claude/auth/status": return "auth";
+		default: return null;
+	}
+}
+async function rewriteProviderResponse(kind, upstreamJson, ctx, query) {
+	try {
+		switch (kind) {
+			case "models": return rewriteModels(upstreamJson, ctx);
+			case "mcp": return rewriteMcp(upstreamJson, ctx, query);
+			case "skills": return rewriteSkills(upstreamJson, ctx);
+			case "commands": return rewriteCommands(upstreamJson, ctx);
+			case "auth": return rewriteAuth(upstreamJson);
+		}
+	} catch {
+		return null;
+	}
+}
+function rewriteModels(upstreamJson, ctx) {
+	if (!isObject(upstreamJson)) return null;
+	const data = envelopedData(upstreamJson);
+	if (!data || !isObject(data.models) || data.cache === void 0) return null;
+	const models = ctx.getModels()?.data;
+	if (!Array.isArray(models) || models.length === 0) return null;
+	const options = models.filter(isPickerModel).map((m) => {
+		const option = {
+			value: m.id,
+			label: m.name || m.id,
+			description: `${m.vendor} · ${m.capabilities.family}`
+		};
+		const efforts = m.capabilities.supports?.reasoning_effort;
+		if (Array.isArray(efforts) && efforts.length > 0) option.effort = {
+			default: efforts.includes("high") ? "high" : efforts[efforts.length - 1],
+			values: efforts.map((e) => ({ value: e }))
+		};
+		return option;
+	});
+	if (options.length === 0) return null;
+	const values = new Set(options.map((o) => o.value));
+	const upstreamDefault = typeof data.models.DEFAULT === "string" ? data.models.DEFAULT : void 0;
+	const DEFAULT = values.has(ctx.defaultModel) ? ctx.defaultModel : options[0]?.value ?? upstreamDefault;
+	const nextData = cloneObject(data);
+	nextData.models = {
+		OPTIONS: options,
+		DEFAULT
+	};
+	return {
+		...upstreamJson,
+		data: nextData
+	};
+}
+function isPickerModel(model) {
+	return isObject(model) && typeof model.id === "string" && model.model_picker_enabled !== false && typeof model.vendor === "string" && (model.name === void 0 || typeof model.name === "string") && isObject(model.capabilities) && typeof model.capabilities.family === "string";
+}
+async function rewriteMcp(upstreamJson, ctx, query) {
+	if (!isObject(upstreamJson) || query.get("scope") !== "user") return null;
+	const data = envelopedData(upstreamJson);
+	if (!data || !Array.isArray(data.servers)) return null;
+	const mirror = await readJson(path.join(ctx.claudeConfigDir, ".claude.json"));
+	if (!isObject(mirror) || !isObject(mirror.mcpServers)) return null;
+	const existing = new Set(data.servers.filter(isObject).map((s) => s.name).filter((name) => typeof name === "string"));
+	const additions = [];
+	for (const [name, entry] of Object.entries(mirror.mcpServers)) {
+		if (existing.has(name) || !isObject(entry)) continue;
+		const server = {
+			provider: "claude",
+			name,
+			scope: "user",
+			transport: entry.type === "http" ? "http" : "stdio"
+		};
+		if (typeof entry.url === "string") server.url = entry.url;
+		additions.push(server);
+		existing.add(name);
+	}
+	if (additions.length === 0) return null;
+	const nextData = cloneObject(data);
+	nextData.servers = [...data.servers, ...additions];
+	return {
+		...upstreamJson,
+		data: nextData
+	};
+}
+async function rewriteSkills(upstreamJson, ctx) {
+	if (!isObject(upstreamJson)) return null;
+	const data = envelopedData(upstreamJson);
+	if (!data || !Array.isArray(data.skills)) return null;
+	const skills = await readSkillDirs(path.join(ctx.claudeConfigDir, "skills"));
+	if (skills.length === 0) return null;
+	const existing = new Set(data.skills.filter(isObject).map((s) => s.command).filter((command) => typeof command === "string"));
+	const additions = skills.filter((skill) => !existing.has(skill.name)).map((skill) => ({
+		provider: "claude",
+		name: skill.name,
+		description: skill.description,
+		command: skill.name,
+		scope: "user"
+	}));
+	if (additions.length === 0) return null;
+	const nextData = cloneObject(data);
+	nextData.skills = [...data.skills, ...additions];
+	return {
+		...upstreamJson,
+		data: nextData
+	};
+}
+async function rewriteCommands(upstreamJson, ctx) {
+	if (!isObject(upstreamJson) || !Array.isArray(upstreamJson.custom)) return null;
+	const dirs = [path.join(ctx.claudeConfigDir, "commands"), path.join(ctx.claudeConfigDir, ".claude", "commands")];
+	const commandFiles = (await Promise.all(dirs.map(readCommandFiles))).flat();
+	if (commandFiles.length === 0) return null;
+	const existing = new Set(upstreamJson.custom.filter(isObject).map((c) => c.name).filter((name) => typeof name === "string"));
+	const additions = commandFiles.filter((command) => !existing.has(command.name)).map((command) => ({
+		name: command.name,
+		path: command.relativePath,
+		relativePath: command.relativePath,
+		description: command.description,
+		namespace: "user",
+		metadata: { type: "custom" }
+	}));
+	if (additions.length === 0) return null;
+	const custom = [...upstreamJson.custom, ...additions];
+	return {
+		...upstreamJson,
+		custom,
+		count: countCommands(upstreamJson.builtIn) + custom.length
+	};
+}
+function rewriteAuth(upstreamJson) {
+	if (!isObject(upstreamJson)) return null;
+	const data = envelopedData(upstreamJson);
+	if (!data) return null;
+	return {
+		...upstreamJson,
+		data: {
+			...data,
+			authenticated: true,
+			installed: true
+		}
+	};
+}
+async function readJson(filePath) {
+	try {
+		return JSON.parse(await fs$1.readFile(filePath, "utf8"));
+	} catch {
+		return null;
+	}
+}
+async function readSkillDirs(skillsDir) {
+	try {
+		const entries = await fs$1.readdir(skillsDir, { withFileTypes: true });
+		return await Promise.all(entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("gh-")).map(async (entry) => {
+			const sourcePath = path.join(skillsDir, entry.name, "SKILL.md");
+			let description = "";
+			try {
+				description = parseFrontmatterField(await fs$1.readFile(sourcePath, "utf8"), "description") ?? "";
+			} catch {}
+			return {
+				name: entry.name,
+				description,
+				sourcePath
+			};
+		}));
+	} catch {
+		return [];
+	}
+}
+async function readCommandFiles(commandsDir) {
+	try {
+		if (!(await fs$1.stat(commandsDir)).isDirectory()) return [];
+	} catch {
+		return [];
+	}
+	return readCommandFilesRecursive(commandsDir, commandsDir);
+}
+async function readCommandFilesRecursive(root, dir) {
+	let entries;
+	try {
+		entries = await fs$1.readdir(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	const out = [];
+	for (const entry of entries) {
+		const filePath = path.join(dir, entry.name);
+		if (entry.isDirectory()) {
+			out.push(...await readCommandFilesRecursive(root, filePath));
+			continue;
+		}
+		if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
+		const relativePath = normalizeRelative(path.relative(root, filePath));
+		const name = relativePath.replace(/\.md$/i, "");
+		let description = "";
+		try {
+			const md = await fs$1.readFile(filePath, "utf8");
+			description = parseFrontmatterField(md, "description") ?? firstMarkdownLine(md);
+		} catch {}
+		out.push({
+			name,
+			relativePath,
+			filePath,
+			description
+		});
+	}
+	return out;
+}
+function parseFrontmatterField(markdown, field) {
+	if (!markdown.startsWith("---")) return null;
+	const end = markdown.indexOf("\n---", 3);
+	if (end < 0) return null;
+	const frontmatter = markdown.slice(3, end).split(/\r?\n/);
+	for (const line of frontmatter) {
+		const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
+		if (!match || match[1] !== field) continue;
+		return match[2].replace(/^['"]|['"]$/g, "").trim();
+	}
+	return null;
+}
+function firstMarkdownLine(markdown) {
+	const body = markdown.startsWith("---") ? markdown.slice(markdown.indexOf("\n---", 3) + 4) : markdown;
+	for (const line of body.split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (trimmed) return trimmed.replace(/^#+\s*/, "");
+	}
+	return "";
+}
+function normalizeRelative(value) {
+	return value.split(path.sep).join("/");
+}
+function countCommands(builtIn) {
+	return Array.isArray(builtIn) ? builtIn.length : 0;
+}
+//#endregion
+//#region src/lib/serve/reverse-proxy.ts
+/**
+* Loopback-only identity endpoint served directly by the reverse proxy (never
+* forwarded to CloudCLI). A second `github-router serve` probes this on the
+* intended port to detect an already-running instance (single-instance guard),
+* so it can attach/refuse instead of starting a duplicate CloudCLI. Carries no
+* secret — just a service marker + version + origin.
+*/
+const SERVE_IDENTITY_PATH = "/__github-router-serve__";
+const SERVE_IDENTITY_SERVICE = "github-router-serve";
+const HEAD_CLOSE = "</head>";
+/** CloudCLI's localStorage key for per-tool chat permission settings. */
+const CLAUDE_SETTINGS_KEY = "claude-settings";
+/**
+* The two interaction tools CloudCLI routes to the human (its
+* `TOOLS_REQUIRING_INTERACTION`). They must NEVER appear in the seeded
+* `allowedTools` — an exact-name match there would auto-approve them and defeat
+* the question widget / plan card. Stripped defensively at the seed chokepoint
+* so no upstream list (mcp names, a future caller) can reintroduce them.
+*/
+const NEVER_AUTO_APPROVE = /* @__PURE__ */ new Set(["AskUserQuestion", "ExitPlanMode"]);
+/**
+* Embed the token as a JS string literal. JSON.stringify escapes quotes and
+* backslashes; we additionally neutralize `<` so the value can never break out
+* of the surrounding <script> element regardless of contents.
+*
+* When `seedToolSettings` is set, also seed CloudCLI's `claude-settings`
+* localStorage with `{allowedTools:<routine+mcp>, disallowedTools:[], skipPermissions:false}`.
+* This is serve's "seamless routine + decisions to the user" model: `canUseTool`
+* stays LIVE (skipPermissions:false, NOT bypass), routine tools in `allowedTools`
+* auto-run with no prompt, and `AskUserQuestion`/`ExitPlanMode` — deliberately
+* NOT in the list and hard-cased by CloudCLI into `TOOLS_REQUIRING_INTERACTION` —
+* always reach the human as a real question widget / plan Approve-Reject card.
+* `skipPermissions:true` (bypass) would skip `canUseTool` entirely and silently
+* auto-answer those two, which is exactly what we are fixing.
+*/
+function buildInjection(token, seedToolSettings = false, seedAllowedTools = []) {
+	let body = `localStorage.setItem('auth-token',${JSON.stringify(token).replace(/</g, "\\u003c")});`;
+	if (seedToolSettings) {
+		const settings = JSON.stringify({
+			allowedTools: seedAllowedTools.filter((t) => !NEVER_AUTO_APPROVE.has(t)),
+			disallowedTools: [],
+			skipPermissions: false
+		});
+		const safeSettings = JSON.stringify(settings).replace(/</g, "\\u003c");
+		body += `localStorage.setItem('${CLAUDE_SETTINGS_KEY}',${safeSettings});`;
+	}
+	return `<script>try{${body}}catch(e){}<\/script>`;
+}
+function headerLines(headers) {
+	return Object.entries(headers).map(([k, v]) => `${k}: ${Array.isArray(v) ? v.join(", ") : v}`).join("\r\n");
+}
+async function startReverseProxy(opts) {
+	const { targetHost, targetPort, bindHost, bindPort, authToken } = opts;
+	const ownOrigin = `http://${bindHost}:${bindPort}`;
+	const injection = buildInjection(authToken, opts.seedToolSettings === true, opts.seedAllowedTools ?? []);
+	const allowedHosts = /* @__PURE__ */ new Set([
+		`127.0.0.1:${bindPort}`,
+		`localhost:${bindPort}`,
+		`[::1]:${bindPort}`,
+		...(opts.extraAllowedHosts ?? []).map((h) => h.toLowerCase())
+	]);
+	const loopbackHosts = /* @__PURE__ */ new Set([
+		`127.0.0.1:${bindPort}`,
+		`localhost:${bindPort}`,
+		`[::1]:${bindPort}`
+	]);
+	const allowedOrigins = /* @__PURE__ */ new Set([
+		`http://127.0.0.1:${bindPort}`,
+		`http://localhost:${bindPort}`,
+		`http://[::1]:${bindPort}`,
+		...(opts.extraAllowedOrigins ?? []).map((o) => o.toLowerCase())
+	]);
+	const DEVTUNNEL_RE = /(^|\.)devtunnels\.ms$/i;
+	const isDevtunnelHost = (host) => !!opts.allowDevtunnelHosts && DEVTUNNEL_RE.test(host.replace(/:\d+$/, ""));
+	const isDevtunnelOrigin = (origin) => {
+		if (!opts.allowDevtunnelHosts) return false;
+		try {
+			const u = new URL(origin);
+			return u.protocol === "https:" && DEVTUNNEL_RE.test(u.hostname);
+		} catch {
+			return false;
+		}
+	};
+	const hostAllowed = (host) => !!host && (allowedHosts.has(host.toLowerCase()) || isDevtunnelHost(host.toLowerCase()));
+	const originAllowed = (origin) => !origin || allowedOrigins.has(origin.toLowerCase()) || isDevtunnelOrigin(origin);
+	const liveSockets = /* @__PURE__ */ new Set();
+	const server = http.createServer((clientReq, clientRes) => {
+		clientReq.on("error", () => clientRes.destroy());
+		clientRes.on("error", () => clientReq.destroy());
+		if (!hostAllowed(clientReq.headers.host) || !originAllowed(clientReq.headers.origin)) {
+			clientRes.writeHead(403, { "content-type": "text/plain" });
+			clientRes.end("Forbidden");
+			return;
+		}
+		if ((clientReq.url ?? "").split("?")[0] === "/__github-router-serve__") {
+			if (!loopbackHosts.has(String(clientReq.headers.host ?? "").toLowerCase())) {
+				clientRes.writeHead(404, { "content-type": "text/plain" });
+				clientRes.end("Not found");
+				return;
+			}
+			clientRes.writeHead(200, { "content-type": "application/json" });
+			clientRes.end(JSON.stringify({
+				service: SERVE_IDENTITY_SERVICE,
+				version: getPackageVersion()
+			}));
+			return;
+		}
+		const requestUrl = new URL(clientReq.url ?? "/", ownOrigin);
+		const blocked = opts.providerFacade?.blockedRequest?.(clientReq.method ?? "GET", requestUrl.pathname);
+		if (blocked) {
+			clientReq.resume();
+			clientRes.writeHead(blocked.status, { "content-type": "application/json" });
+			clientRes.end(JSON.stringify(blocked.json));
+			return;
+		}
+		const facadeKind = opts.providerFacade?.kindFor(clientReq.method ?? "GET", requestUrl.pathname) ?? null;
+		const headers = { ...clientReq.headers };
+		delete headers["accept-encoding"];
+		const proxyReq = http.request({
+			host: targetHost,
+			port: targetPort,
+			path: clientReq.url,
+			method: clientReq.method,
+			headers
+		}, (proxyRes) => {
+			proxyRes.on("error", () => clientRes.destroy());
+			const contentType = String(proxyRes.headers["content-type"] ?? "");
+			if (facadeKind) {
+				const chunks = [];
+				proxyRes.on("data", (d) => chunks.push(Buffer.from(d)));
+				proxyRes.on("end", () => {
+					const original = Buffer.concat(chunks);
+					const sendOriginal = () => {
+						const outHeaders = { ...proxyRes.headers };
+						delete outHeaders["content-length"];
+						delete outHeaders["content-encoding"];
+						delete outHeaders["transfer-encoding"];
+						clientRes.writeHead(proxyRes.statusCode ?? 502, outHeaders);
+						clientRes.end(original);
+					};
+					if (proxyRes.statusCode !== 200) {
+						sendOriginal();
+						return;
+					}
+					(async () => {
+						try {
+							const parsed = JSON.parse(original.toString("utf8"));
+							const rewritten = await opts.providerFacade?.rewrite(facadeKind, parsed, requestUrl.searchParams);
+							if (rewritten == null) {
+								sendOriginal();
+								return;
+							}
+							const outHeaders = { ...proxyRes.headers };
+							delete outHeaders["content-length"];
+							delete outHeaders["content-encoding"];
+							delete outHeaders["transfer-encoding"];
+							outHeaders["content-type"] = "application/json";
+							clientRes.writeHead(200, outHeaders);
+							clientRes.end(JSON.stringify(rewritten));
+						} catch {
+							sendOriginal();
+						}
+					})();
+				});
+			} else if (contentType.includes("text/html")) {
+				const chunks = [];
+				proxyRes.on("data", (d) => chunks.push(Buffer.from(d)));
+				proxyRes.on("end", () => {
+					let html = Buffer.concat(chunks).toString("utf8");
+					html = html.includes(HEAD_CLOSE) ? html.replace(HEAD_CLOSE, injection + HEAD_CLOSE) : injection + html;
+					const outHeaders = { ...proxyRes.headers };
+					delete outHeaders["content-length"];
+					delete outHeaders["content-encoding"];
+					delete outHeaders["transfer-encoding"];
+					clientRes.writeHead(proxyRes.statusCode ?? 502, outHeaders);
+					clientRes.end(html);
+				});
+			} else {
+				clientRes.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
+				proxyRes.pipe(clientRes);
+			}
+		});
+		proxyReq.on("error", (err) => {
+			if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "text/plain" });
+			clientRes.end(`Bad gateway: ${err.message}`);
+		});
+		clientReq.pipe(proxyReq);
+	});
+	server.on("upgrade", (clientReq, clientSock, clientHead) => {
+		clientSock.on("error", () => clientSock.destroy());
+		liveSockets.add(clientSock);
+		clientSock.once("close", () => liveSockets.delete(clientSock));
+		if (!hostAllowed(clientReq.headers.host) || !originAllowed(clientReq.headers.origin)) {
+			clientSock.destroy();
+			return;
+		}
+		const proxyReq = http.request({
+			host: targetHost,
+			port: targetPort,
+			path: clientReq.url,
+			method: clientReq.method,
+			headers: clientReq.headers
+		});
+		proxyReq.on("upgrade", (proxyRes, proxySock, proxyHead) => {
+			clientSock.write(`HTTP/1.1 ${proxyRes.statusCode} ${proxyRes.statusMessage}\r\n${headerLines(proxyRes.headers)}\r\n\r\n`);
+			if (clientHead && clientHead.length) proxySock.write(clientHead);
+			if (proxyHead && proxyHead.length) proxySock.unshift(proxyHead);
+			proxySock.pipe(clientSock);
+			clientSock.pipe(proxySock);
+			const cleanup = () => {
+				proxySock.destroy();
+				clientSock.destroy();
+			};
+			clientSock.on("error", cleanup);
+			proxySock.on("error", cleanup);
+			clientSock.on("close", cleanup);
+			proxySock.on("close", cleanup);
+		});
+		proxyReq.on("response", (proxyRes) => {
+			try {
+				clientSock.write(`HTTP/1.1 ${proxyRes.statusCode} ${proxyRes.statusMessage}\r\n${headerLines(proxyRes.headers)}\r\n\r\n`);
+			} catch {}
+			proxyRes.on("data", (d) => {
+				clientSock.write(d);
+			});
+			proxyRes.on("end", () => clientSock.end());
+			proxyRes.on("error", () => clientSock.destroy());
+		});
+		proxyReq.on("error", () => clientSock.destroy());
+		proxyReq.end();
+	});
+	await new Promise((resolve, reject) => {
+		const onError = (err) => reject(err);
+		server.once("error", onError);
+		server.listen(bindPort, bindHost, () => {
+			server.removeListener("error", onError);
+			resolve();
+		});
+	});
+	const addr = server.address();
+	if (addr && addr.address !== "127.0.0.1" && addr.address !== "::1") {
+		await new Promise((r) => server.close(() => r()));
+		throw new Error(`reverse proxy refused non-loopback bind (got ${addr.address})`);
+	}
+	return {
+		url: ownOrigin,
+		port: bindPort,
+		close: () => new Promise((resolve) => {
+			for (const s of liveSockets) s.destroy();
+			liveSockets.clear();
+			const t = setTimeout(resolve, 1500);
+			server.close(() => {
+				clearTimeout(t);
+				resolve();
+			});
+		})
+	};
+}
+//#endregion
+//#region src/serve.ts
+async function getFreePort() {
+	return new Promise((resolve, reject) => {
+		const s = http.createServer();
+		s.once("error", reject);
+		s.listen(0, "127.0.0.1", () => {
+			const port = s.address().port;
+			s.close(() => resolve(port));
+		});
+	});
+}
+/** Default user-facing control-plane port when `--port` is not given. */
+const DEFAULT_SERVE_PORT = 5454;
+function isPortFree(port) {
+	return new Promise((resolve) => {
+		const s = http.createServer();
+		s.once("error", () => resolve(false));
+		s.listen(port, "127.0.0.1", () => s.close(() => resolve(true)));
+	});
+}
+/**
+* Probe a loopback port for an already-running `github-router serve` (its
+* identity endpoint). Returns true when the port hosts OUR serve, else false
+* (free, or a foreign process). `serve` is designed to run ONCE per machine
+* (a single machine-wide control plane for all repos), so a second launch
+* attaches to the running one instead of spawning a duplicate CloudCLI +
+* contending on the shared auth DB. We intentionally do NOT trust any URL the
+* probed service reports — a local squatter could forge the identity marker, so
+* the caller only ever opens a locally-constructed loopback origin.
+*/
+function probeExistingServe(port) {
+	return new Promise((resolve) => {
+		const req = http.get({
+			host: "127.0.0.1",
+			port,
+			path: SERVE_IDENTITY_PATH,
+			headers: { host: `127.0.0.1:${port}` },
+			timeout: 1500
+		}, (res) => {
+			if (res.statusCode !== 200) {
+				res.resume();
+				resolve(false);
+				return;
+			}
+			const chunks = [];
+			res.on("data", (d) => chunks.push(Buffer.from(d)));
+			res.on("end", () => {
+				try {
+					resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")).service === SERVE_IDENTITY_SERVICE);
+				} catch {
+					resolve(false);
+				}
+			});
+			res.on("error", () => resolve(false));
+		});
+		req.on("timeout", () => req.destroy());
+		req.on("error", () => resolve(false));
+	});
+}
+/**
+* Resolve the user-facing port: honor an explicit `--port`; otherwise use 5454
+* when free, else fall back to a random free port. (Single-instance detection —
+* an already-running github-router serve on the intended port — is handled by
+* the earlier `probeExistingServe` attach/refuse in `run`.)
+*/
+async function resolveServePort(requested) {
+	if (requested != null) return requested;
+	if (await isPortFree(DEFAULT_SERVE_PORT)) return DEFAULT_SERVE_PORT;
+	const fallback = await getFreePort();
+	consola.info(`Port ${DEFAULT_SERVE_PORT} is in use; using ${fallback} instead.`);
+	return fallback;
+}
+function openBrowser(url) {
+	try {
+		if (process.platform === "win32") spawn("cmd", [
+			"/c",
+			"start",
+			"",
+			url
+		], {
+			detached: true,
+			stdio: "ignore",
+			windowsHide: true
+		}).unref();
+		else if (process.platform === "darwin") spawn("open", [url], {
+			detached: true,
+			stdio: "ignore"
+		}).unref();
+		else spawn("xdg-open", [url], {
+			detached: true,
+			stdio: "ignore"
+		}).unref();
+	} catch {}
+}
+const serve = defineCommand({
+	meta: {
+		name: "serve",
+		description: "Serve a browser control plane (CloudCLI) with Claude routed through the proxy"
+	},
+	args: {
+		...sharedServerArgs,
+		model: {
+			alias: "m",
+			type: "string",
+			description: "Override the default Claude model"
+		},
+		"cloudcli-path": {
+			type: "string",
+			description: "Use an existing CloudCLI install instead of the managed one"
+		},
+		"cloudcli-version": {
+			type: "string",
+			description: "Override the pinned CloudCLI version to install"
+		},
+		"codex-cli": {
+			type: "boolean",
+			default: false,
+			description: "Route Codex personas through a local `codex mcp-server` (requires codex 0.129+; falls back to HTTP if missing)"
+		},
+		"browse-over-tunnel": {
+			type: "boolean",
+			default: false,
+			description: "Expose the server-side browser MCP even when tunnel-exposed (session-hijack / SSRF risk — only with fully-trusted tunnel access)"
+		},
+		"agents-over-tunnel": {
+			type: "boolean",
+			default: false,
+			description: "Expose first-mate (mints a repo+workflow GitHub write token) even when tunnel-exposed (only with fully-trusted tunnel access)"
+		},
+		"fleet-over-tunnel": {
+			type: "boolean",
+			default: false,
+			description: "Expose the fleet MCP (drives remote coding sessions with your fleet credentials) even when tunnel-exposed (only with fully-trusted tunnel access)"
+		},
+		"no-install": {
+			type: "boolean",
+			default: false,
+			description: "Do not auto-install CloudCLI; require an existing install"
+		},
+		"no-open": {
+			type: "boolean",
+			default: false,
+			description: "Do not open the browser automatically"
+		},
+		"public-url": {
+			type: "string",
+			description: "Public URL(s) this is reachable at (e.g. a dev-tunnel https URL), comma-separated — allowlists their host+origin for remote access"
+		},
+		tunnel: {
+			type: "boolean",
+			default: false,
+			description: "Auto-create + host an AUTHENTICATED (never anonymous) Microsoft dev tunnel for the serve port and print its public URL, so you can reach the control plane from anywhere. Requires the `devtunnel` CLI + `devtunnel user login`."
+		}
+	},
+	async run({ args }) {
+		state.serveMode = true;
+		if (process.versions.bun) consola.warn("`serve` should run under Node.js. Bun's node:http upgrade sockets cannot relay the CloudCLI terminal/chat WebSockets; run the installed `github-router` binary (Node).");
+		const parsed = parseSharedArgs(args);
+		const intendedPort = parsed.port ?? DEFAULT_SERVE_PORT;
+		if (await probeExistingServe(intendedPort)) {
+			const existingUrl = `http://127.0.0.1:${intendedPort}`;
+			consola.box(`github-router control plane already running\n\n${existingUrl}\n\nOpening it — stop that instance first if you want a fresh one.`);
+			if (args["no-open"] !== true) openBrowser(existingUrl);
+			return;
+		}
+		const { server, serverUrl } = await setupAndServe({
+			...parsed,
+			port: void 0,
+			silent: true
+		});
+		try {
+			await ensureClaudeConfigMirror();
+		} catch (err) {
+			consola.error(`Failed to provision CLAUDE_CONFIG_DIR mirror: ${err instanceof Error ? err.message : String(err)}`);
+			process.exit(1);
+		}
+		runSelfUpdate({ selfUpdate: args["self-update"] !== false });
+		provisionAndIndexColbert({ skipCwdIndex: true });
+		provisionToolbelt().catch((err) => consola.debug("Toolbelt provisioning failed:", err));
+		startKeepAwake();
+		if (browserToolsEnabled()) provisionBrowserAssets().catch((err) => consola.debug("Browser extension provisioning failed:", err));
+		const opusFamilyShorthand = args.model?.match(/^(\d+\.\d+)$/)?.[1];
+		let chosenSlug = opusFamilyShorthand ? pickClaudeDefault(opusFamilyShorthand) : args.model ?? pickClaudeDefault();
+		if (!args.model && state.models) {
+			const inCache = (slug) => state.models?.data.some((m) => m.id === resolveModel(slug)) ?? false;
+			if (!inCache(chosenSlug)) {
+				for (const fb of DEFAULT_CLAUDE_MODEL_FALLBACKS) if (inCache(fb)) {
+					consola.info(`Default model "${chosenSlug}" not in your Copilot model list; falling back to "${fb}".`);
+					chosenSlug = fb;
+					break;
+				}
+			}
+		}
+		const requestedCli = args["codex-cli"] === true;
+		const backend = resolveCodexCliBackend({
+			requested: requestedCli,
+			codexInfo: requestedCli ? getCodexVersion() : null
+		});
+		const tunnelExposed = args.tunnel === true || String(args["public-url"] ?? "").split(",").map((s) => s.trim()).filter(Boolean).length > 0;
+		if (tunnelExposed && browserToolsEnabled() && args["browse-over-tunnel"] !== true) consola.info("Browser MCP is disabled over the tunnel (session-hijack/SSRF risk). Pass --browse-over-tunnel to enable it for fully-trusted access.");
+		if (tunnelExposed && state.agentsEnabled && args["agents-over-tunnel"] !== true) consola.info("first-mate is disabled over the tunnel (it mints a GitHub write token). Pass --agents-over-tunnel to enable it for fully-trusted access.");
+		if (tunnelExposed && state.fleetEnabled && args["fleet-over-tunnel"] !== true) consola.info("Fleet MCP is disabled over the tunnel (it drives remote coding sessions with your fleet credentials). Pass --fleet-over-tunnel to enable it for fully-trusted access.");
+		const enhancements = await provisionServeEnhancements(serverUrl, {
+			codexCli: backend === "cli",
+			tunnelExposed,
+			browseOverTunnel: args["browse-over-tunnel"] === true,
+			agentsOverTunnel: args["agents-over-tunnel"] === true,
+			fleetOverTunnel: args["fleet-over-tunnel"] === true
+		});
+		const anthropicVars = getClaudeCodeEnvVars(serverUrl, chosenSlug);
+		delete anthropicVars.CLAUDE_CODE_FORK_SUBAGENT;
+		if (enhancements.nonce) {
+			anthropicVars.GH_ROUTER_HOOK_MCP_URL = serverUrl;
+			anthropicVars.GH_ROUTER_HOOK_NONCE = enhancements.nonce;
+		}
+		const childEnv = composeCloudCliChildEnv(anthropicVars);
+		childEnv.ANTHROPIC_API_KEY = "sk-ant-github-router-proxy-placeholder";
+		let cloudcli;
+		try {
+			cloudcli = await resolveCloudCli({
+				cliPath: args["cloudcli-path"],
+				noInstall: args["no-install"] === true,
+				version: args["cloudcli-version"]
+			});
+		} catch (err) {
+			consola.error(err instanceof Error ? err.message : String(err));
+			process.exit(1);
+		}
+		const ccPort = await getFreePort();
+		const cc = spawnCloudCli({
+			serverEntry: cloudcli.serverEntry,
+			port: ccPort,
+			env: childEnv
+		});
+		let shuttingDown = false;
+		let reverseClose = null;
+		let tunnelStop = null;
+		const shutdown = async () => {
+			if (shuttingDown) return;
+			shuttingDown = true;
+			if (tunnelStop) try {
+				tunnelStop();
+			} catch {}
+			try {
+				killChildProcessTree(cc.child, { detachedGroup: process.platform !== "win32" });
+			} catch {}
+			if (reverseClose) await reverseClose().catch(() => {});
+			try {
+				server.close?.();
+			} catch {}
+			await stopKeepAwake().catch(() => {});
+			await enhancements.cleanup().catch(() => {});
+			await removeOwnClaudeConfigMirror().catch(() => {});
+		};
+		process.once("SIGINT", () => void shutdown().then(() => process.exit(0)));
+		process.once("SIGTERM", () => void shutdown().then(() => process.exit(0)));
+		cc.child.once("exit", (code) => {
+			if (!shuttingDown) {
+				consola.error(`CloudCLI exited unexpectedly (code ${code}).`);
+				shutdown().then(() => process.exit(1));
+			}
+		});
+		cc.child.once("error", (err) => {
+			if (!shuttingDown) {
+				consola.error(`CloudCLI failed to start: ${err.message}`);
+				shutdown().then(() => process.exit(1));
+			}
+		});
+		let ready;
+		try {
+			ready = await waitForCloudCliReady(ccPort);
+		} catch (err) {
+			consola.error(err instanceof Error ? err.message : String(err));
+			await shutdown();
+			process.exit(1);
+		}
+		let username = "github-router";
+		try {
+			username = (await getGitHubUser()).login;
+		} catch {}
+		let token;
+		try {
+			token = await mintJwt(ccPort, username, ready.needsSetup);
+		} catch (err) {
+			consola.error(err instanceof Error ? err.message : String(err));
+			await shutdown();
+			process.exit(1);
+		}
+		const publicUrls = String(args["public-url"] ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+		const extraAllowedHosts = [];
+		const extraAllowedOrigins = [];
+		for (const u of publicUrls) try {
+			const url = new URL(u);
+			extraAllowedHosts.push(url.host);
+			extraAllowedOrigins.push(url.origin);
+		} catch {
+			consola.warn(`Ignoring invalid --public-url "${u}"`);
+		}
+		const tunnelMode = args.tunnel === true;
+		if (extraAllowedHosts.length || tunnelMode) consola.warn("Remote access enabled: anyone who reaches this through the tunnel AND passes its authentication gets FULL control-plane access — including a shell on this machine. The tunnel is authenticated (never anonymous); only grant access to people you fully trust.");
+		const servePort = await resolveServePort(parsed.port);
+		const providerFacade = {
+			kindFor: facadeInterceptKind,
+			blockedRequest: facadeBlockedRequest,
+			rewrite: (kind, json, query) => rewriteProviderResponse(kind, json, {
+				getModels: () => state.models,
+				defaultModel: resolveModel(chosenSlug),
+				claudeConfigDir: PATHS.CLAUDE_CONFIG_DIR
+			}, query)
+		};
+		let reverse;
+		try {
+			reverse = await startReverseProxy({
+				targetHost: "127.0.0.1",
+				targetPort: ccPort,
+				bindHost: "127.0.0.1",
+				bindPort: servePort,
+				authToken: token,
+				seedToolSettings: process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== "1",
+				seedAllowedTools: [...SEAMLESS_BUILTIN_TOOLS, ...enhancements.mcpToolNames ?? []],
+				extraAllowedHosts,
+				extraAllowedOrigins,
+				allowDevtunnelHosts: tunnelMode,
+				providerFacade
+			});
+		} catch (err) {
+			consola.error(`Failed to bind the control-plane port ${servePort}: ${err instanceof Error ? err.message : String(err)}. Is it already in use? Pass --port <n>.`);
+			await shutdown();
+			process.exit(1);
+		}
+		reverseClose = reverse.close;
+		let tunnelUrl = null;
+		if (tunnelMode) {
+			consola.info("Creating an authenticated dev tunnel…");
+			try {
+				const tunnel = await startDevtunnel(servePort);
+				tunnelUrl = tunnel.url;
+				tunnelStop = tunnel.stop;
+			} catch (err) {
+				const msg = err instanceof DevtunnelError ? err.message : String(err);
+				consola.warn(`Could not auto-host a dev tunnel: ${msg}\nServing locally only. To host manually once fixed: devtunnel host -p ${servePort}`);
+			}
+		}
+		const publicLines = [...publicUrls.map((u) => `remote: ${u}`), ...tunnelUrl ? [`remote (tunnel): ${tunnelUrl}  (stable — bookmark it; same URL every launch)`] : []];
+		const publicBlock = publicLines.length ? `\n${publicLines.join("\n")}` : "";
+		consola.box(`🖥️  github-router control plane\n\nlocal:  ${reverse.url}${publicBlock}\n\nsigned in as ${username} · model ${chosenSlug}\nCtrl+C to stop`);
+		if (args["no-open"] !== true) openBrowser(reverse.url);
+	}
+});
+//#endregion
+export { serve };
+
+//# sourceMappingURL=serve-sa_7c-yD.js.map