labgate 0.5.36 → 0.5.38

package/dist/lib/ui.js

@@ -57,6 +57,8 @@ const web_terminal_js_1 = require("./web-terminal.js");
 const explorer_js_1 = require("./explorer.js");
 const explorer_eval_js_1 = require("./explorer-eval.js");
 const explorer_store_js_1 = require("./explorer-store.js");
+const feedback_js_1 = require("./feedback.js");
+const automation_engine_js_1 = require("./automation-engine.js");
 const log = __importStar(require("./log.js"));
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 const HTML_PATH = (0, path_1.resolve)(__dirname, '..', 'lib', 'ui.html');
@@ -86,6 +88,15 @@ const UI_VERSION_CHECK_MAX_BUFFER = 256 * 1024;
 const UI_VERSION_CACHE_TTL_MS = 5 * 60 * 1000;
 const UI_SELF_UPDATE_TIMEOUT_MS = 20 * 60 * 1000;
 const UI_SELF_UPDATE_MAX_BUFFER = 16 * 1024 * 1024;
+const OPEN_ONDEMAND_ENV_PREFIXES = ['OOD_', 'ONDEMAND_'];
+const SESSION_GIT_CACHE_TTL_MS = 4_000;
+const SESSION_GIT_COMMAND_TIMEOUT_MS = 1_500;
+const SESSION_GIT_COMMAND_MAX_BUFFER = 512 * 1024;
+const SESSION_GIT_MUTATION_TIMEOUT_MS = 5_000;
+const BROWSE_DIR_GIT_STATUS_TIMEOUT_MS = 2_500;
+const FILE_PREVIEW_DEFAULT_MAX_BYTES = 256 * 1024;
+const FILE_PREVIEW_MAX_BYTES_LIMIT = 1 * 1024 * 1024;
+const FILE_PREVIEW_BINARY_SCAN_BYTES = 4096;
 const IRIS_SAMPLE_README = '# Iris Flowers Dataset (Sample)\n' +
     '\n' +
     'Source: https://raw.githubusercontent.com/mwaskom/seaborn-data/master/iris.csv\n' +
@@ -105,6 +116,7 @@ let resultsStore = null;
 let displayStore = null;
 const REQUIRED_SLURM_COMMANDS = ['sbatch', 'squeue', 'sacct', 'scancel'];
 const webTerminalBridges = new Map();
+const automationEngines = new Map();
 const WEB_TERMINAL_INIT_RETENTION_MS = 60 * 60 * 1000;
 const WEB_TERMINAL_IMAGE_PULL_TIMEOUT_MS = 60 * 60 * 1000;
 const WEB_TERMINAL_IMAGE_PULL_MAX_BUFFER = 64 * 1024 * 1024;
@@ -125,6 +137,7 @@ const CLAUDE_HEADLESS_STDERR_LIMIT = 12_000;
 const webTerminalInitJobs = new Map();
 const webTerminalImagePullLocks = new Map();
 const webTerminalAgentPrepLocks = new Map();
+const sessionGitStateCache = new Map();
 const LABGATE_UI_VERSION = readPackageVersion();
 let uiPublishedVersionCache = null;
 let uiPublishedVersionInFlight = null;
@@ -522,11 +535,12 @@ async function prepareRuntimeForWebTerminal(preferred) {
 function createWebTerminalInitId() {
     return `wti-${Date.now().toString(36)}-${(0, crypto_1.randomBytes)(2).toString('hex')}`;
 }
-function createWebTerminalInitJob(agent, workdir) {
+function createWebTerminalInitJob(agent, workdir, permissionMode) {
     const now = new Date().toISOString();
     return {
         id: createWebTerminalInitId(),
         agent,
+        permissionMode,
         workdir,
         status: 'running',
         stage: 'queued',
@@ -567,6 +581,7 @@ function serializeWebTerminalInitJob(job) {
     return {
         id: job.id,
         agent: job.agent,
+        permissionMode: job.permissionMode,
         workdir: job.workdir,
         status: job.status,
         stage: job.stage,
@@ -873,7 +888,9 @@ async function startWebTerminalSession(agent, resolvedWorkdir, opts = {}) {
     (0, web_terminal_js_1.writeWebTerminalRecord)(record);
     onProgress?.('session_start', `Starting ${agent} terminal session...`);
     try {
-        await (0, web_terminal_js_1.startTmuxWebTerminalSession)(record, cliEntrypoint);
+        await (0, web_terminal_js_1.startTmuxWebTerminalSession)(record, cliEntrypoint, {
+            permissionMode: opts.permissionMode || 'default',
+        });
         (0, web_terminal_js_1.updateWebTerminalRecordStatus)(id, { status: 'running', exitCode: null, error: null });
     }
     catch (err) {
@@ -1192,6 +1209,16 @@ function normalizeWebTerminalAgent(raw) {
         return agent;
     return null;
 }
+function normalizeWebTerminalPermissionMode(raw) {
+    if (raw === undefined || raw === null)
+        return 'default';
+    const mode = String(raw || '').trim().toLowerCase();
+    if (!mode || mode === 'default')
+        return 'default';
+    if (mode === 'dangerous')
+        return 'dangerous';
+    return null;
+}
 function serializeWebTerminalSession(record) {
     return {
         id: record.id,
@@ -1477,13 +1504,32 @@ async function ensureWebTerminalBridge(record) {
         log.warn(`Could not resolve tmux binary for web terminal bridge ${record.id}: ${err?.message ?? String(err)}`);
         return null;
     }
-    try {
+    const sessionOptions = [
         // Keep web terminal copy/selection behavior reliable by letting xterm own
         // mouse selection instead of tmux copy-mode selection.
-        await execFileAsync(tmuxBin, ['set-option', '-t', record.tmuxSession, 'mouse', 'off'], { timeout: 10_000 });
+        ['mouse', 'off'],
+        // Hide tmux status/footer rows in web terminal sessions.
+        ['status', 'off'],
+    ];
+    for (const [key, value] of sessionOptions) {
+        try {
+            await execFileAsync(tmuxBin, ['set-option', '-t', record.tmuxSession, key, value], { timeout: 10_000 });
+        }
+        catch {
+            // Best effort only; attach should still proceed.
+        }
     }
-    catch {
-        // Best effort only; attach should still proceed.
+    const windowOptions = [
+        // Avoid tmux alternate-screen mode so TUI output remains scrollable in xterm/web UI.
+        ['alternate-screen', 'off'],
+    ];
+    for (const [key, value] of windowOptions) {
+        try {
+            await execFileAsync(tmuxBin, ['set-window-option', '-t', record.tmuxSession, key, value], { timeout: 10_000 });
+        }
+        catch {
+            // Best effort only; attach should still proceed.
+        }
     }
     if (existing && existing.pty)
         return existing;
@@ -1544,6 +1590,10 @@ async function ensureWebTerminalBridge(record) {
                 seqEnd: chunk.seq,
             });
         }
+        // Automation hook: feed output to engine if one exists for this terminal
+        const engine = automationEngines.get(record.id);
+        if (engine)
+            engine.onTerminalOutput(data);
     });
     ptyProcess.onExit(async () => {
         const stopRequested = bridge.stopRequested;
@@ -1551,14 +1601,20 @@ async function ensureWebTerminalBridge(record) {
         bridge.pty = null;
         const alive = await (0, web_terminal_js_1.hasTmuxSession)(record.tmuxSession);
         if (alive) {
-            if (stopRequested)
-                return;
-            // Another tmux client (for example `labgate continue`) may have force-detached this bridge.
-            // Clear stale alternate-screen data and require clients to reconnect for a clean reattach.
+            // The attach bridge process exited while tmux is still alive (for example
+            // after a deliberate detach during session switch). Drop transient bridge
+            // output to avoid replaying stale lifecycle lines like "[terminated]" on
+            // the next attach.
             bridge.buffer = '';
             bridge.history = [];
             bridge.historyBytes = 0;
-            closeWebTerminalBridgeClients(bridge);
+            bridge.nextSeq = 1;
+            if (!stopRequested) {
+                // Another tmux client (for example `labgate continue`) may have
+                // force-detached this bridge. Require clients to reconnect for a clean
+                // reattach.
+                closeWebTerminalBridgeClients(bridge);
+            }
             return;
         }
         const exitInfo = (0, web_terminal_js_1.readWebTerminalExitInfo)(record.id);
@@ -1582,6 +1638,12 @@ function stopWebTerminalBridge(bridge) {
     if (!bridge.pty)
         return;
     bridge.stopRequested = true;
+    // Clean up automation engine for this bridge
+    const engine = automationEngines.get(bridge.id);
+    if (engine) {
+        engine.stop();
+        automationEngines.delete(bridge.id);
+    }
     try {
         bridge.pty.kill('SIGTERM');
     }
@@ -1824,7 +1886,14 @@ async function startClaudeHeadlessWsRun(ws, record, prompt, resumeSessionId) {
 }
 function serveHTML(res) {
     try {
-        const html = (0, fs_1.readFileSync)(HTML_PATH, 'utf-8').replaceAll(WRITE_TOKEN_PLACEHOLDER, UI_WRITE_TOKEN);
+        let uname = '';
+        try {
+            uname = (0, os_1.userInfo)().username;
+        }
+        catch { }
+        const html = (0, fs_1.readFileSync)(HTML_PATH, 'utf-8')
+            .replaceAll(WRITE_TOKEN_PLACEHOLDER, UI_WRITE_TOKEN)
+            .replaceAll('__LABGATE_USER__', uname);
         res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
         res.end(html);
     }
@@ -1837,6 +1906,10 @@ function handleGetConfig(_req, res) {
     const effective = (0, config_js_1.loadEffectiveConfig)();
     const response = { ...effective.config };
     const slurmRuntime = getSlurmRuntimeStatus();
+    response._host = {
+        hostname: (0, os_1.hostname)(),
+        openondemand: isOpenOnDemandHostRuntime(),
+    };
     response._slurm = {
         available: slurmRuntime.available,
         missing_commands: slurmRuntime.missingCommands,
@@ -1855,6 +1928,16 @@ function handleGetConfig(_req, res) {
     }
     json(res, response);
 }
+function isOpenOnDemandHostRuntime(env = process.env) {
+    const keys = Object.keys(env);
+    for (const key of keys) {
+        for (const prefix of OPEN_ONDEMAND_ENV_PREFIXES) {
+            if (key.startsWith(prefix))
+                return true;
+        }
+    }
+    return false;
+}
 async function handlePostConfig(req, res) {
     try {
         const body = await readBody(req);
@@ -1925,6 +2008,8 @@ async function handlePostConfig(req, res) {
             obj.slurm = incoming.slurm;
         if (incoming.headless)
             obj.headless = incoming.headless;
+        if (incoming.plugins)
+            obj.plugins = incoming.plugins;
         const { writeFileSync } = await import('fs');
         writeFileSync(configPath, JSON.stringify(obj, null, 2) + '\n', { encoding: 'utf-8', mode: config_js_1.PRIVATE_FILE_MODE });
         (0, config_js_1.ensurePrivateFile)(configPath);
@@ -1937,6 +2022,266 @@ async function handlePostConfig(req, res) {
 function handleGetConfigPath(_req, res) {
     json(res, { path: (0, config_js_1.getConfigPath)() });
 }
+// ── Plugin API ──────────────────────────────────────────────
+function isPluginEnabledInConfig(config, pluginId) {
+    return config.plugins?.[pluginId] !== false;
+}
+function handleGetPlugins(_req, res) {
+    const effective = (0, config_js_1.loadEffectiveConfig)();
+    const plugins = effective.config.plugins ?? {};
+    json(res, { ok: true, plugins });
+}
+async function handlePostPlugins(req, res) {
+    try {
+        const body = await readBody(req);
+        const parsed = JSON.parse(body);
+        const pluginId = typeof parsed.pluginId === 'string' ? parsed.pluginId.trim() : '';
+        const enabled = parsed.enabled;
+        if (!pluginId || typeof enabled !== 'boolean') {
+            json(res, { ok: false, errors: ['pluginId (string) and enabled (boolean) are required'] }, 400);
+            return;
+        }
+        if (!(0, config_js_1.isKnownPluginId)(pluginId)) {
+            json(res, { ok: false, errors: [`Unknown plugin id: ${pluginId}`] }, 400);
+            return;
+        }
+        // Read existing config file
+        const configPath = (0, config_js_1.getConfigPath)();
+        let obj = {};
+        if ((0, fs_1.existsSync)(configPath)) {
+            const rawText = (0, fs_1.readFileSync)(configPath, 'utf-8');
+            const stripped = rawText
+                .split('\n')
+                .filter(line => !line.trimStart().startsWith('//'))
+                .join('\n');
+            try {
+                obj = JSON.parse(stripped);
+            }
+            catch (err) {
+                json(res, { ok: false, errors: [`Could not parse existing config file: ${err.message ?? String(err)}`] }, 400);
+                return;
+            }
+        }
+        // Merge plugin state
+        const rawPlugins = (obj.plugins ?? {});
+        const plugins = {};
+        if (rawPlugins && typeof rawPlugins === 'object' && !Array.isArray(rawPlugins)) {
+            for (const [id, value] of Object.entries(rawPlugins)) {
+                if (!(0, config_js_1.isKnownPluginId)(id))
+                    continue;
+                if (typeof value !== 'boolean')
+                    continue;
+                plugins[id] = value;
+            }
+        }
+        plugins[pluginId] = enabled;
+        obj.plugins = plugins;
+        const { writeFileSync } = await import('fs');
+        writeFileSync(configPath, JSON.stringify(obj, null, 2) + '\n', { encoding: 'utf-8', mode: config_js_1.PRIVATE_FILE_MODE });
+        (0, config_js_1.ensurePrivateFile)(configPath);
+        json(res, { ok: true, plugins });
+    }
+    catch (err) {
+        json(res, { ok: false, errors: [err.message ?? String(err)] }, 400);
+    }
+}
+// ── Automation API ──────────────────────────────────────────
+function handleGetAutomationStatus(terminalId, res) {
+    const engine = automationEngines.get(terminalId);
+    if (!engine) {
+        json(res, { ok: true, active: false });
+        return;
+    }
+    const status = engine.getStatus();
+    const config = engine.getConfig();
+    // Strip api_key from response
+    const { api_key: _key, ...safeConfig } = config;
+    json(res, { ok: true, active: true, status, config: safeConfig });
+}
+async function handlePostAutomationEnable(req, res) {
+    try {
+        const body = await readBody(req);
+        const parsed = JSON.parse(body);
+        const terminalId = typeof parsed.terminalId === 'string' ? parsed.terminalId.trim() : '';
+        if (!terminalId) {
+            json(res, { ok: false, errors: ['terminalId is required'] }, 400);
+            return;
+        }
+        if (automationEngines.has(terminalId)) {
+            json(res, { ok: true, message: 'already enabled' });
+            return;
+        }
+        const bridge = webTerminalBridges.get(terminalId);
+        if (!bridge || !bridge.pty) {
+            json(res, { ok: false, errors: ['No active terminal bridge for this id'] }, 400);
+            return;
+        }
+        const effective = (0, config_js_1.loadEffectiveConfig)();
+        const autoConfig = effective.config.automation;
+        if (!autoConfig) {
+            json(res, { ok: false, errors: ['Automation config not found'] }, 400);
+            return;
+        }
+        const broadcastFn = (entry) => {
+            broadcastWebTerminalMessage(bridge, {
+                type: 'automation',
+                subtype: entry.type,
+                data: entry,
+            });
+        };
+        const broadcastTurnFn = (action, turn) => {
+            broadcastWebTerminalMessage(bridge, {
+                type: 'automation_turn',
+                action,
+                turn,
+            });
+        };
+        const writeFn = (data) => {
+            try {
+                bridge.pty?.write(data);
+            }
+            catch { /* best effort */ }
+        };
+        const engine = new automation_engine_js_1.AutomationEngine(terminalId, autoConfig, writeFn, broadcastFn, broadcastTurnFn);
+        automationEngines.set(terminalId, engine);
+        json(res, { ok: true });
+    }
+    catch (err) {
+        json(res, { ok: false, errors: [err.message ?? String(err)] }, 400);
+    }
+}
+async function handlePostAutomationDisable(req, res) {
+    try {
+        const body = await readBody(req);
+        const parsed = JSON.parse(body);
+        const terminalId = typeof parsed.terminalId === 'string' ? parsed.terminalId.trim() : '';
+        if (!terminalId) {
+            json(res, { ok: false, errors: ['terminalId is required'] }, 400);
+            return;
+        }
+        const engine = automationEngines.get(terminalId);
+        if (engine) {
+            engine.stop();
+            automationEngines.delete(terminalId);
+        }
+        json(res, { ok: true });
+    }
+    catch (err) {
+        json(res, { ok: false, errors: [err.message ?? String(err)] }, 400);
+    }
+}
+async function handlePostAutomationPause(req, res) {
+    try {
+        const body = await readBody(req);
+        const parsed = JSON.parse(body);
+        const terminalId = typeof parsed.terminalId === 'string' ? parsed.terminalId.trim() : '';
+        const engine = automationEngines.get(terminalId);
+        if (!engine) {
+            json(res, { ok: false, errors: ['No automation engine for this terminal'] }, 404);
+            return;
+        }
+        engine.pause();
+        json(res, { ok: true, status: engine.getStatus() });
+    }
+    catch (err) {
+        json(res, { ok: false, errors: [err.message ?? String(err)] }, 400);
+    }
+}
+async function handlePostAutomationResume(req, res) {
+    try {
+        const body = await readBody(req);
+        const parsed = JSON.parse(body);
+        const terminalId = typeof parsed.terminalId === 'string' ? parsed.terminalId.trim() : '';
+        const engine = automationEngines.get(terminalId);
+        if (!engine) {
+            json(res, { ok: false, errors: ['No automation engine for this terminal'] }, 404);
+            return;
+        }
+        engine.resume();
+        json(res, { ok: true, status: engine.getStatus() });
+    }
+    catch (err) {
+        json(res, { ok: false, errors: [err.message ?? String(err)] }, 400);
+    }
+}
+async function handlePostAutomationConfig(req, res) {
+    try {
+        const body = await readBody(req);
+        const parsed = JSON.parse(body);
+        const terminalId = typeof parsed.terminalId === 'string' ? parsed.terminalId.trim() : '';
+        const engine = automationEngines.get(terminalId);
+        if (!engine) {
+            json(res, { ok: false, errors: ['No automation engine for this terminal'] }, 404);
+            return;
+        }
+        const update = {};
+        if (typeof parsed.system_prompt === 'string')
+            update.system_prompt = parsed.system_prompt;
+        if (Array.isArray(parsed.trigger_patterns))
+            update.trigger_patterns = parsed.trigger_patterns;
+        if (typeof parsed.model === 'string')
+            update.model = parsed.model;
+        if (typeof parsed.delay_ms === 'number')
+            update.delay_ms = parsed.delay_ms;
+        if (typeof parsed.max_turns === 'number')
+            update.max_turns = parsed.max_turns;
+        if (typeof parsed.context_lines === 'number')
+            update.context_lines = parsed.context_lines;
+        if (typeof parsed.max_tokens === 'number')
+            update.max_tokens = parsed.max_tokens;
+        engine.updateConfig(update);
+        const config = engine.getConfig();
+        const { api_key: _key, ...safeConfig } = config;
+        json(res, { ok: true, config: safeConfig });
+    }
+    catch (err) {
+        json(res, { ok: false, errors: [err.message ?? String(err)] }, 400);
+    }
+}
+function handleGetAutomationTerminalStatus(terminalId, res) {
+    const engine = automationEngines.get(terminalId);
+    if (engine) {
+        json(res, { ok: true, status: engine.getTerminalStatus() });
+        return;
+    }
+    // Fallback: check bridge buffer directly
+    const bridge = webTerminalBridges.get(terminalId);
+    if (!bridge || !bridge.buffer) {
+        json(res, { ok: true, status: 'idle' });
+        return;
+    }
+    // Basic heuristic: check if last line looks like a prompt awaiting input
+    const stripped = bridge.buffer.replace(/\x1b(?:\[[0-9;?]*[A-Za-z]|\][^\x07\x1b]*(?:\x07|\x1b\\)?|[()][AB012]|[78DEHM=>])/g, '')
+        .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '');
+    const lines = stripped.split('\n');
+    const lastLines = lines.slice(-10).join('\n');
+    // Common patterns indicating waiting for input
+    const awaitingPatterns = [/\?\s*$/, /Y\/n\]?\s*$/, /\[yes\/no\]\s*$/i, />\s*$/, /\$\s*$/, /:\s*$/];
+    let isAwaiting = false;
+    for (const pat of awaitingPatterns) {
+        if (pat.test(lastLines)) {
+            isAwaiting = true;
+            break;
+        }
+    }
+    json(res, { ok: true, status: isAwaiting ? 'awaiting_input' : 'working' });
+}
+function handleGetAutomationLog(terminalId, res) {
+    const engine = automationEngines.get(terminalId);
+    if (!engine) {
+        json(res, { ok: true, log: [] });
+        return;
+    }
+    json(res, { ok: true, log: engine.getLog() });
+}
+function handleGetAutomationTurns(terminalId, res) {
+    const engine = automationEngines.get(terminalId);
+    if (!engine) {
+        json(res, { ok: true, turns: [] });
+        return;
+    }
+    json(res, { ok: true, turns: engine.getTurns() });
+}
 async function handleGetUiVersion(reqUrl, res) {
     const forceRefresh = reqUrl.searchParams.get('refresh') === '1';
     const published = await getPublishedUiVersionCached(forceRefresh);
@@ -2418,6 +2763,21 @@ function rememberTimestampedEntry(map, value, ts) {
     if (ts >= existing)
         map.set(value, ts);
 }
+/** Track a file access with action type. Write/edit actions upgrade read; newer timestamps win. */
+function rememberFileEntry(map, path, ts, action) {
+    if (!path)
+        return;
+    const existing = map.get(path);
+    if (!existing) {
+        map.set(path, { ts, action });
+        return;
+    }
+    // Keep the most significant action (edit > write > unknown > read)
+    const rank = { read: 0, unknown: 1, write: 2, edit: 3 };
+    const newAction = (rank[action] ?? 0) > (rank[existing.action] ?? 0) ? action : existing.action;
+    const newTs = ts >= existing.ts ? ts : existing.ts;
+    map.set(path, { ts: newTs, action: newAction });
+}
 function collectWebsiteUrls(value, accessedUrls, ts, keyHint = '') {
     if (typeof value === 'string') {
         for (const url of extractWebsiteUrlsFromText(value)) {
@@ -2494,14 +2854,20 @@ function tailLastJsonlEntry(filePath) {
                             continue;
                         const name = block.name || '';
                         collectWebsiteUrls(block.input, accessedUrls, ts);
+                        // Classify tool action
+                        const toolAction = (name === 'Edit' || name === 'edit') ? 'edit' :
+                            (name === 'Write' || name === 'write' || name === 'NotebookEdit') ? 'write' :
+                                (name === 'Read' || name === 'read' || name === 'Glob' || name === 'glob') ? 'read' :
+                                    (name === 'Grep' || name === 'grep') ? 'read' :
+                                        'unknown';
                         // Direct file_path from Read/Edit/Write/Glob tools
                         const fp = block.input.file_path || block.input.path || '';
-                        if (fp && !accessedFiles.has(fp)) {
-                            rememberTimestampedEntry(accessedFiles, fp, ts);
+                        if (fp) {
+                            rememberFileEntry(accessedFiles, fp, ts, toolAction);
                         }
                         // Grep pattern → search path
                         if ((name === 'Grep' || name === 'grep') && block.input.path) {
-                            rememberTimestampedEntry(accessedFiles, block.input.path, ts);
+                            rememberFileEntry(accessedFiles, block.input.path, ts, 'read');
                         }
                         // Extract file paths from Bash commands
                         if (name === 'Bash' || name === 'bash') {
@@ -2511,7 +2877,7 @@ function tailLastJsonlEntry(filePath) {
                             if (absMatches) {
                                 for (const p of absMatches) {
                                     const clean = p.replace(/['"`;,)}\]]+$/, '');
-                                    rememberTimestampedEntry(accessedFiles, clean, ts);
+                                    rememberFileEntry(accessedFiles, clean, ts, 'unknown');
                                 }
                             }
                             for (const url of extractWebsiteUrlsFromText(cmd)) {
@@ -2527,7 +2893,7 @@ function tailLastJsonlEntry(filePath) {
                                     const fileArg = tokens[tokens.length - 1] || '';
                                     if (fileArg && !fileArg.startsWith('/') && !fileArg.startsWith('-') && (fileArg.includes('/') || fileArg.includes('.'))) {
                                         const full = '/work/' + fileArg;
-                                        rememberTimestampedEntry(accessedFiles, full, ts);
+                                        rememberFileEntry(accessedFiles, full, ts, 'unknown');
                                     }
                                 }
                             }
@@ -2545,7 +2911,7 @@ function tailLastJsonlEntry(filePath) {
                         if (pathMatches) {
                             for (const p of pathMatches.slice(0, 20)) { // cap to avoid perf issues
                                 const clean = p.replace(/['"`;,)}\]]+$/, '');
-                                rememberTimestampedEntry(accessedFiles, clean, ts);
+                                rememberFileEntry(accessedFiles, clean, ts, 'unknown');
                             }
                         }
                         for (const url of extractWebsiteUrlsFromText(text).slice(0, 30)) {
@@ -2581,13 +2947,25 @@ function tailLastJsonlEntry(filePath) {
         return null;
     }
 }
-/** Cache for JSONL file scanning (refreshed every 3s) */
+/** Cache for JSONL file scanning and short-lived session activity snapshots. */
 let jsonlCache = null;
+const JSONL_CACHE_TTL_MS = 10_000;
+const JSONL_SCAN_MAX_ENTRIES = 6_000;
+const SESSION_ACTIVITY_CACHE_TTL_MS = 8_000;
+const sessionActivityCache = new Map();
 function getTranscriptRoots(agent, sandboxHome) {
     if (agent === 'claude') {
         return [(0, path_1.join)(sandboxHome, '.claude', 'projects')];
     }
     if (agent === 'codex') {
+        const primaryRoots = [
+            (0, path_1.join)(sandboxHome, '.codex', 'sessions'),
+            (0, path_1.join)(sandboxHome, '.openai', 'codex', 'sessions'),
+            (0, path_1.join)(sandboxHome, '.config', 'codex', 'sessions'),
+        ];
+        const existingPrimary = primaryRoots.filter((root) => (0, fs_1.existsSync)(root));
+        if (existingPrimary.length > 0)
+            return existingPrimary;
         return [
             (0, path_1.join)(sandboxHome, '.codex'),
             (0, path_1.join)(sandboxHome, '.openai', 'codex'),
@@ -2596,16 +2974,22 @@ function getTranscriptRoots(agent, sandboxHome) {
     }
     return [];
 }
-function scanJsonlFiles(root, maxDepth = 4) {
+function scanJsonlFiles(root, maxDepth = 4, maxEntries = JSONL_SCAN_MAX_ENTRIES) {
     const files = [];
     const stack = [{ dir: root, depth: 0 }];
+    let visitedEntries = 0;
     while (stack.length > 0) {
+        if (visitedEntries >= maxEntries)
+            break;
         const current = stack.pop();
         if (!current)
             continue;
         try {
             const entries = (0, fs_1.readdirSync)(current.dir);
             for (const entry of entries) {
+                if (visitedEntries >= maxEntries)
+                    break;
+                visitedEntries += 1;
                 const fullPath = (0, path_1.join)(current.dir, entry);
                 try {
                     const st = (0, fs_1.statSync)(fullPath);
@@ -2632,14 +3016,14 @@ function scanJsonlFiles(root, maxDepth = 4) {
 }
 /**
  * Scan sandbox home for agent conversation JSONL files.
- * Results are cached for 3 seconds.
+ * Results are cached briefly to keep `/api/sessions` responsive.
  */
 function findProjectJsonlFiles(agent) {
     const normalizedAgent = (agent || '').toLowerCase();
     const now = Date.now();
     if (jsonlCache &&
         jsonlCache.agent === normalizedAgent &&
-        now - jsonlCache.ts < 2000) {
+        now - jsonlCache.ts < JSONL_CACHE_TTL_MS) {
         return jsonlCache.files;
     }
     const files = [];
@@ -2783,7 +3167,7 @@ function scanBlockedEvents() {
     return events;
 }
 // ── Per-session accumulated file history (persists across tail reads) ──
-/** sessionId → (path → most recent access timestamp) */
+/** sessionId → (path → { ts, action }) */
 const fileHistoryCache = new Map();
 const FILE_HISTORY_TTL = 60 * 60 * 1000; // 1 hour
 const websiteHistoryCache = new Map();
@@ -2798,18 +3182,16 @@ function mergeFileHistory(sessionId, newAccessed) {
         history = new Map();
         fileHistoryCache.set(sessionId, history);
     }
-    // Merge new accesses (keep newest timestamp per path)
-    for (const [path, ts] of newAccessed) {
-        if (!ts || isNaN(ts))
+    // Merge new accesses (keep newest timestamp and most significant action per path)
+    for (const [path, entry] of newAccessed) {
+        if (!entry.ts || isNaN(entry.ts))
             continue;
-        const existing = history.get(path) || 0;
-        if (ts >= existing)
-            history.set(path, ts);
+        rememberFileEntry(history, path, entry.ts, entry.action);
     }
     // Evict entries older than 1 hour
     const cutoff = Date.now() - FILE_HISTORY_TTL;
-    for (const [path, ts] of history) {
-        if (ts < cutoff)
+    for (const [path, entry] of history) {
+        if (entry.ts < cutoff)
             history.delete(path);
     }
     return history;
@@ -2846,7 +3228,7 @@ function getAccessedFiles(accessedFiles, workdir) {
         return [];
     const files = [];
     const seen = new Set();
-    for (const [p, ts] of accessedFiles) {
+    for (const [p, entry] of accessedFiles) {
         const rel = p.startsWith('/work/') ? p.slice(6) : p;
         if (!rel || seen.has(rel))
             continue;
@@ -2871,8 +3253,9 @@ function getAccessedFiles(accessedFiles, workdir) {
         files.push({
             name: rel,
             path: p,
-            accessedAt: ts,
+            accessedAt: entry.ts,
             isDir,
+            action: entry.action,
         });
     }
     // Sort by recency (most recently accessed first)
@@ -2900,27 +3283,63 @@ function getAccessedWebsites(accessedUrls) {
     websites.sort((a, b) => (b.accessedAt || 0) - (a.accessedAt || 0));
     return websites.slice(0, 30);
 }
-/**
- * Determine an agent session's current activity by reading transcript JSONL.
- * Correlates session → JSONL by matching session start time with file creation time.
- */
-function getAgentActivity(session) {
-    const emptyFiles = [];
-    const emptyWebsites = [];
-    const unknown = {
+function createUnknownActivity() {
+    return {
         status: 'unknown',
         label: '',
         detail: '',
         prompt: '',
         since: 0,
         lastActive: 0,
-        files: emptyFiles,
-        websites: emptyWebsites,
+        files: [],
+        websites: [],
     };
+}
+function getSessionActivityCacheKey(session) {
+    const id = String(session?.id || '').trim();
+    if (!id)
+        return '';
+    const agent = String(session?.agent || '').trim().toLowerCase();
+    const started = String(session?.started || '').trim();
+    const workdir = String(session?.workdir || '').trim();
+    return `${id}|${agent}|${started}|${workdir}`;
+}
+function getCachedSessionActivity(session, now = Date.now()) {
+    const key = getSessionActivityCacheKey(session);
+    if (!key)
+        return null;
+    const cached = sessionActivityCache.get(key);
+    if (!cached)
+        return null;
+    if ((now - cached.ts) > SESSION_ACTIVITY_CACHE_TTL_MS) {
+        sessionActivityCache.delete(key);
+        return null;
+    }
+    return cached.activity;
+}
+function setCachedSessionActivity(session, activity, now = Date.now()) {
+    const key = getSessionActivityCacheKey(session);
+    if (!key)
+        return;
+    sessionActivityCache.set(key, { activity, ts: now });
+}
+function pruneSessionActivityCache(now = Date.now()) {
+    for (const [key, entry] of sessionActivityCache) {
+        if ((now - entry.ts) > SESSION_ACTIVITY_CACHE_TTL_MS) {
+            sessionActivityCache.delete(key);
+        }
+    }
+}
+/**
+ * Determine an agent session's current activity by reading transcript JSONL.
+ * Correlates session → JSONL by matching session start time with file creation time.
+ */
+function getAgentActivity(session) {
+    const unknown = createUnknownActivity();
     const agent = String(session.agent || '').toLowerCase();
     const jsonlFiles = findProjectJsonlFiles(agent);
     if (jsonlFiles.length === 0) {
-        return { ...unknown, files: [], websites: [] };
+        return unknown;
     }
     const sessionStartMs = session.started ? new Date(session.started).getTime() : 0;
     if (!sessionStartMs)
@@ -2949,43 +3368,592 @@ function getAgentActivity(session) {
     if (age > 60_000) {
         activity = { status: 'idle', label: 'Idle', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
     }
-    else if (type === 'user') {
-        const content = entry.message?.content;
-        if (Array.isArray(content) && content.some((b) => b.type === 'tool_result')) {
-            activity = { status: 'thinking', label: 'Processing...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
-        }
-        else {
-            activity = { status: 'thinking', label: 'Thinking...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
-        }
+    else if (type === 'user') {
+        const content = entry.message?.content;
+        if (Array.isArray(content) && content.some((b) => b.type === 'tool_result')) {
+            activity = { status: 'thinking', label: 'Processing...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+        }
+        else {
+            activity = { status: 'thinking', label: 'Thinking...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+        }
+    }
+    else if (type === 'human') {
+        activity = { status: 'thinking', label: 'Thinking...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+    }
+    else if (type === 'assistant') {
+        const content = entry.message?.content;
+        if (Array.isArray(content)) {
+            const hasToolUse = content.some((b) => b.type === 'tool_use');
+            if (hasToolUse) {
+                const detail = extractToolDetail(entry);
+                const toolBlock = content.find((b) => b.type === 'tool_use');
+                const toolName = toolBlock?.name || 'tool';
+                activity = { status: 'tool_use', label: `Running ${toolName}...`, detail, prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+            }
+            else if (content.some((b) => b.type === 'thinking')) {
+                activity = { status: 'thinking', label: 'Thinking...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+            }
+            else {
+                activity = { status: 'waiting', label: 'Waiting for input', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+            }
+        }
+        else {
+            activity = { status: 'waiting', label: 'Waiting for input', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+        }
+    }
+    else {
+        activity = { ...unknown, files, websites };
+    }
+    return activity;
+}
+function compactGitErrorText(value, max = 180) {
+    const compact = String(value || '').replace(/\s+/g, ' ').trim();
+    if (!compact)
+        return 'git state unavailable';
+    if (compact.length <= max)
+        return compact;
+    return `${compact.slice(0, max - 3)}...`;
+}
+function createSessionGitState(patch = {}) {
+    const merged = {
+        available: true,
+        initialized: false,
+        branch: null,
+        detached: false,
+        head: null,
+        staged: 0,
+        unstaged: 0,
+        untracked: 0,
+        conflicted: 0,
+        dirty: false,
+        clean: true,
+        ahead: null,
+        behind: null,
+        checked_at: new Date().toISOString(),
+        ...patch,
+    };
+    const dirtyCount = merged.staged + merged.unstaged + merged.untracked + merged.conflicted;
+    merged.dirty = patch.dirty !== undefined ? patch.dirty === true : dirtyCount > 0;
+    merged.clean = !merged.dirty;
+    if (!merged.checked_at)
+        merged.checked_at = new Date().toISOString();
+    if (merged.error !== undefined && !merged.error)
+        delete merged.error;
+    return merged;
+}
+function parseSessionGitStatusPorcelain(stdout) {
+    const lines = String(stdout || '').split(/\r?\n/);
+    let branch = null;
+    let detached = false;
+    let head = null;
+    let ahead = null;
+    let behind = null;
+    let staged = 0;
+    let unstaged = 0;
+    let untracked = 0;
+    let conflicted = 0;
+    for (const rawLine of lines) {
+        const line = rawLine.trim();
+        if (!line)
+            continue;
+        if (line.startsWith('# branch.head ')) {
+            const value = line.slice('# branch.head '.length).trim();
+            if (value === '(detached)') {
+                detached = true;
+                branch = null;
+            }
+            else if (value && value !== '(unknown)') {
+                branch = value;
+            }
+            continue;
+        }
+        if (line.startsWith('# branch.oid ')) {
+            const value = line.slice('# branch.oid '.length).trim();
+            if (/^[0-9a-f]{7,40}$/i.test(value)) {
+                head = value.slice(0, 12);
+            }
+            continue;
+        }
+        if (line.startsWith('# branch.ab ')) {
+            const match = line.match(/^# branch\.ab \+(\d+) -(\d+)$/);
+            if (match) {
+                ahead = Number.parseInt(match[1], 10);
+                behind = Number.parseInt(match[2], 10);
+            }
+            continue;
+        }
+        const kind = line.charAt(0);
+        if (kind === '1' || kind === '2') {
+            const match = line.match(/^[12] ([^ ]{2}) /);
+            const xy = match?.[1] || '..';
+            const x = xy.charAt(0);
+            const y = xy.charAt(1);
+            if (x && x !== '.')
+                staged += 1;
+            if (y && y !== '.')
+                unstaged += 1;
+            continue;
+        }
+        if (kind === 'u') {
+            conflicted += 1;
+            continue;
+        }
+        if (kind === '?') {
+            untracked += 1;
+        }
+    }
+    return createSessionGitState({
+        available: true,
+        initialized: true,
+        branch,
+        detached,
+        head,
+        staged,
+        unstaged,
+        untracked,
+        conflicted,
+        ahead,
+        behind,
+    });
+}
+async function collectSessionGitState(workdir) {
+    const fullWorkdir = (0, path_1.resolve)(workdir);
+    const now = Date.now();
+    const cached = sessionGitStateCache.get(fullWorkdir);
+    if (cached && (now - cached.checkedAtMs) <= SESSION_GIT_CACHE_TTL_MS) {
+        return cached.state;
+    }
+    let state;
+    try {
+        const result = await execFileAsync('git', ['-C', fullWorkdir, 'status', '--porcelain=v2', '--branch'], {
+            encoding: 'utf-8',
+            timeout: SESSION_GIT_COMMAND_TIMEOUT_MS,
+            maxBuffer: SESSION_GIT_COMMAND_MAX_BUFFER,
+        });
+        state = parseSessionGitStatusPorcelain(String(result.stdout || ''));
+    }
+    catch (err) {
+        const code = typeof err?.code === 'string' ? err.code : '';
+        const detail = `${String(err?.stderr || '')}\n${String(err?.stdout || '')}\n${String(err?.message || '')}`.trim();
+        const lower = detail.toLowerCase();
+        if (code === 'ENOENT' || lower.includes('spawn git enonent')) {
+            state = createSessionGitState({
+                available: false,
+                initialized: false,
+                error: 'git command not available on host',
+            });
+        }
+        else if (lower.includes('not a git repository')) {
+            state = createSessionGitState({
+                available: true,
+                initialized: false,
+            });
+        }
+        else if (code === 'ETIMEDOUT' || lower.includes('timed out')) {
+            state = createSessionGitState({
+                available: true,
+                initialized: false,
+                error: 'git status timed out',
+            });
+        }
+        else if (lower.includes('cannot change to') || lower.includes('no such file or directory')) {
+            state = createSessionGitState({
+                available: true,
+                initialized: false,
+                error: 'workdir is unavailable',
+            });
+        }
+        else {
+            state = createSessionGitState({
+                available: true,
+                initialized: false,
+                error: compactGitErrorText(detail),
+            });
+        }
+    }
+    sessionGitStateCache.set(fullWorkdir, {
+        state,
+        checkedAtMs: Date.now(),
+    });
+    if (sessionGitStateCache.size > 512) {
+        const cutoff = Date.now() - (SESSION_GIT_CACHE_TTL_MS * 4);
+        for (const [pathKey, entry] of sessionGitStateCache.entries()) {
+            if (entry.checkedAtMs < cutoff) {
+                sessionGitStateCache.delete(pathKey);
+            }
+        }
+    }
+    return state;
+}
+async function annotateSessionsWithGitState(sessions) {
+    if (!Array.isArray(sessions) || sessions.length === 0)
+        return;
+    const inflightByWorkdir = new Map();
+    await Promise.all(sessions.map(async (session) => {
+        const rawWorkdir = typeof session?.workdir === 'string' ? session.workdir.trim() : '';
+        if (!rawWorkdir) {
+            session.git = createSessionGitState({
+                available: true,
+                initialized: false,
+                error: 'missing workdir',
+            });
+            return;
+        }
+        const fullWorkdir = (0, path_1.resolve)(rawWorkdir);
+        let inflight = inflightByWorkdir.get(fullWorkdir);
+        if (!inflight) {
+            inflight = collectSessionGitState(fullWorkdir);
+            inflightByWorkdir.set(fullWorkdir, inflight);
+        }
+        try {
+            session.git = await inflight;
+        }
+        catch {
+            session.git = createSessionGitState({
+                available: true,
+                initialized: false,
+                error: 'git state unavailable',
+            });
+        }
+    }));
+}
+function clearSessionGitStateCache(workdir) {
+    const fullWorkdir = (0, path_1.resolve)(workdir);
+    sessionGitStateCache.delete(fullWorkdir);
+}
+function parseSessionIdFromPath(pathname, pattern) {
+    const match = pathname.match(pattern);
+    if (!match)
+        return null;
+    const decoded = decodeURIComponent(match[1] || '').trim();
+    const normalized = normalizeSessionId(decoded);
+    if (normalized)
+        return normalized;
+    if ((0, web_terminal_js_1.isValidWebTerminalId)(decoded))
+        return decoded;
+    return null;
+}
+function resolveSessionGitWorkdir(sessionId) {
+    const session = getSessionRecord(sessionId);
+    if (session) {
+        const localHost = (0, os_1.hostname)();
+        if (session.node !== localHost) {
+            return { ok: false, status: 400, error: `Session is on a different node (${session.node})` };
+        }
+    }
+    if (session && typeof session.workdir === 'string' && session.workdir.trim()) {
+        const workdir = (0, path_1.resolve)(session.workdir);
+        return { ok: true, workdir };
+    }
+    const webSession = (0, web_terminal_js_1.readWebTerminalRecord)(sessionId);
+    if (!webSession) {
+        return { ok: false, status: 404, error: 'Session not found' };
+    }
+    if (webSession.node !== (0, os_1.hostname)()) {
+        return { ok: false, status: 400, error: `Session is on a different node (${webSession.node})` };
+    }
+    if (typeof webSession.workdir !== 'string' || !webSession.workdir.trim()) {
+        return { ok: false, status: 400, error: 'Session has no valid workdir' };
+    }
+    return { ok: true, workdir: (0, path_1.resolve)(webSession.workdir) };
+}
+function resolveSessionGitErrorStatus(detail) {
+    const lower = String(detail || '').toLowerCase();
+    if (!lower)
+        return 500;
+    if (lower.includes('already exists'))
+        return 409;
+    if (lower.includes('not a git repository'))
+        return 409;
+    if (lower.includes('pathspec') && lower.includes('did not match'))
+        return 404;
+    if (lower.includes('local changes') && lower.includes('would be overwritten'))
+        return 409;
+    if (lower.includes('would be overwritten by checkout'))
+        return 409;
+    if (lower.includes('timed out'))
+        return 504;
+    if (lower.includes('cannot change to') || lower.includes('no such file or directory'))
+        return 400;
+    return 500;
+}
+function parseGitUpstreamTrack(trackRaw) {
+    const track = String(trackRaw || '');
+    const aheadMatch = track.match(/ahead\s+(\d+)/i);
+    const behindMatch = track.match(/behind\s+(\d+)/i);
+    return {
+        ahead: aheadMatch ? Number.parseInt(aheadMatch[1], 10) : 0,
+        behind: behindMatch ? Number.parseInt(behindMatch[1], 10) : 0,
+    };
+}
+function parseSessionGitBranchList(stdout) {
+    const branches = [];
+    for (const rawLine of String(stdout || '').split(/\r?\n/)) {
+        if (!rawLine)
+            continue;
+        const parts = rawLine.split('\t');
+        const name = String(parts[0] || '').trim();
+        if (!name)
+            continue;
+        const current = String(parts[1] || '').trim() === '*';
+        const upstreamText = String(parts[2] || '').trim();
+        const { ahead, behind } = parseGitUpstreamTrack(String(parts[3] || '').trim());
+        branches.push({
+            name,
+            current,
+            upstream: upstreamText || null,
+            ahead,
+            behind,
+        });
+    }
+    return branches;
+}
+async function collectSessionGitBranches(workdir) {
+    const result = await execFileAsync('git', [
+        '-C',
+        workdir,
+        'for-each-ref',
+        '--sort=refname',
+        '--format=%(refname:short)%09%(HEAD)%09%(upstream:short)%09%(upstream:track)',
+        'refs/heads',
+    ], {
+        encoding: 'utf-8',
+        timeout: SESSION_GIT_MUTATION_TIMEOUT_MS,
+        maxBuffer: SESSION_GIT_COMMAND_MAX_BUFFER,
+    });
+    return parseSessionGitBranchList(String(result.stdout || ''));
+}
+async function ensureSessionGitReady(workdir) {
+    const git = await collectSessionGitState(workdir);
+    if (git.available === false) {
+        return {
+            ok: false,
+            status: 503,
+            error: git.error || 'git command not available on host',
+            git,
+        };
+    }
+    if (!git.initialized) {
+        return {
+            ok: false,
+            status: 409,
+            error: git.error || 'No git repository initialized in this workdir',
+            git,
+        };
+    }
+    return { ok: true, git };
+}
+async function handleGetSessionGitBranches(pathname, res) {
+    const sessionId = parseSessionIdFromPath(pathname, /^\/api\/sessions\/([^/]+)\/git\/branches$/);
+    if (!sessionId) {
+        json(res, { ok: false, error: 'Invalid session id' }, 400);
+        return;
+    }
+    const resolved = resolveSessionGitWorkdir(sessionId);
+    if (!resolved.ok) {
+        json(res, { ok: false, error: resolved.error }, resolved.status);
+        return;
+    }
+    const ready = await ensureSessionGitReady(resolved.workdir);
+    if (!ready.ok) {
+        json(res, { ok: false, error: ready.error, git: ready.git }, ready.status);
+        return;
+    }
+    try {
+        const branches = await collectSessionGitBranches(resolved.workdir);
+        json(res, {
+            ok: true,
+            sessionId,
+            workdir: resolved.workdir,
+            git: ready.git,
+            branches,
+        });
+    }
+    catch (err) {
+        const detail = compactGitErrorText(commandErrorDetail(err) || (err?.message ?? String(err)), 220);
+        json(res, { ok: false, error: detail }, resolveSessionGitErrorStatus(detail));
+    }
+}
+async function handleGetSessionGitDag(pathname, reqUrl, res) {
+    const sessionId = parseSessionIdFromPath(pathname, /^\/api\/sessions\/([^/]+)\/git\/dag$/);
+    if (!sessionId) {
+        json(res, { ok: false, error: 'Invalid session id' }, 400);
+        return;
+    }
+    let limit = 120;
+    const limitRaw = String(reqUrl.searchParams.get('limit') || '').trim();
+    if (limitRaw) {
+        const parsed = Number(limitRaw);
+        if (!Number.isFinite(parsed)) {
+            json(res, { ok: false, error: 'Invalid limit' }, 400);
+            return;
+        }
+        limit = Math.max(20, Math.min(400, Math.floor(parsed)));
+    }
+    const resolved = resolveSessionGitWorkdir(sessionId);
+    if (!resolved.ok) {
+        json(res, { ok: false, error: resolved.error }, resolved.status);
+        return;
+    }
+    const ready = await ensureSessionGitReady(resolved.workdir);
+    if (!ready.ok) {
+        json(res, { ok: false, error: ready.error, git: ready.git }, ready.status);
+        return;
+    }
+    try {
+        const result = await execFileAsync('git', [
+            '-C',
+            resolved.workdir,
+            'log',
+            '--graph',
+            '--decorate',
+            '--oneline',
+            '--all',
+            `--max-count=${limit}`,
+            '--color=never',
+        ], {
+            encoding: 'utf-8',
+            timeout: SESSION_GIT_MUTATION_TIMEOUT_MS,
+            maxBuffer: SESSION_GIT_COMMAND_MAX_BUFFER,
+        });
+        const graph = String(result.stdout || '').replace(/\s+$/u, '');
+        const lines = graph ? graph.split(/\r?\n/) : [];
+        json(res, {
+            ok: true,
+            sessionId,
+            workdir: resolved.workdir,
+            git: ready.git,
+            graph,
+            lineCount: lines.length,
+            truncated: lines.length >= limit,
+            limit,
+        });
+    }
+    catch (err) {
+        const detail = compactGitErrorText(commandErrorDetail(err) || (err?.message ?? String(err)), 220);
+        const lower = detail.toLowerCase();
+        if (lower.includes('does not have any commits yet')) {
+            json(res, {
+                ok: true,
+                sessionId,
+                workdir: resolved.workdir,
+                git: ready.git,
+                graph: '',
+                lineCount: 0,
+                truncated: false,
+                limit,
+            });
+            return;
+        }
+        json(res, { ok: false, error: detail }, resolveSessionGitErrorStatus(detail));
+    }
+}
+async function handlePostSessionGitCheckout(pathname, req, res) {
+    const sessionId = parseSessionIdFromPath(pathname, /^\/api\/sessions\/([^/]+)\/git\/checkout$/);
+    if (!sessionId) {
+        json(res, { ok: false, error: 'Invalid session id' }, 400);
+        return;
+    }
+    const resolved = resolveSessionGitWorkdir(sessionId);
+    if (!resolved.ok) {
+        json(res, { ok: false, error: resolved.error }, resolved.status);
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(await readBody(req));
+    }
+    catch {
+        json(res, { ok: false, error: 'Invalid JSON' }, 400);
+        return;
+    }
+    const branch = String(parsed.branch || '').trim();
+    if (!branch) {
+        json(res, { ok: false, error: 'branch is required' }, 400);
+        return;
+    }
+    const ready = await ensureSessionGitReady(resolved.workdir);
+    if (!ready.ok) {
+        json(res, { ok: false, error: ready.error, git: ready.git }, ready.status);
+        return;
+    }
+    if (!ready.git.detached && ready.git.branch === branch) {
+        json(res, { ok: true, sessionId, unchanged: true, git: ready.git });
+        return;
+    }
+    try {
+        await execFileAsync('git', ['-C', resolved.workdir, 'checkout', branch], {
+            encoding: 'utf-8',
+            timeout: SESSION_GIT_MUTATION_TIMEOUT_MS,
+            maxBuffer: SESSION_GIT_COMMAND_MAX_BUFFER,
+        });
+        clearSessionGitStateCache(resolved.workdir);
+        const git = await collectSessionGitState(resolved.workdir);
+        json(res, { ok: true, sessionId, git });
+    }
+    catch (err) {
+        const detail = compactGitErrorText(commandErrorDetail(err) || (err?.message ?? String(err)), 220);
+        json(res, { ok: false, error: detail }, resolveSessionGitErrorStatus(detail));
+    }
+}
+async function handlePostSessionGitBranchCreate(pathname, req, res) {
+    const sessionId = parseSessionIdFromPath(pathname, /^\/api\/sessions\/([^/]+)\/git\/branches$/);
+    if (!sessionId) {
+        json(res, { ok: false, error: 'Invalid session id' }, 400);
+        return;
+    }
+    const resolved = resolveSessionGitWorkdir(sessionId);
+    if (!resolved.ok) {
+        json(res, { ok: false, error: resolved.error }, resolved.status);
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(await readBody(req));
+    }
+    catch {
+        json(res, { ok: false, error: 'Invalid JSON' }, 400);
+        return;
     }
-    else if (type === 'human') {
-        activity = { status: 'thinking', label: 'Thinking...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+    const name = String(parsed.name || '').trim();
+    const from = String(parsed.from || '').trim();
+    if (!name) {
+        json(res, { ok: false, error: 'name is required' }, 400);
+        return;
     }
-    else if (type === 'assistant') {
-        const content = entry.message?.content;
-        if (Array.isArray(content)) {
-            const hasToolUse = content.some((b) => b.type === 'tool_use');
-            if (hasToolUse) {
-                const detail = extractToolDetail(entry);
-                const toolBlock = content.find((b) => b.type === 'tool_use');
-                const toolName = toolBlock?.name || 'tool';
-                activity = { status: 'tool_use', label: `Running ${toolName}...`, detail, prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
-            }
-            else if (content.some((b) => b.type === 'thinking')) {
-                activity = { status: 'thinking', label: 'Thinking...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
-            }
-            else {
-                activity = { status: 'waiting', label: 'Waiting for input', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
-            }
-        }
-        else {
-            activity = { status: 'waiting', label: 'Waiting for input', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
-        }
+    const ready = await ensureSessionGitReady(resolved.workdir);
+    if (!ready.ok) {
+        json(res, { ok: false, error: ready.error, git: ready.git }, ready.status);
+        return;
     }
-    else {
-        activity = { ...unknown, files, websites };
+    try {
+        await execFileAsync('git', ['check-ref-format', '--branch', name], {
+            encoding: 'utf-8',
+            timeout: SESSION_GIT_COMMAND_TIMEOUT_MS,
+            maxBuffer: SESSION_GIT_COMMAND_MAX_BUFFER,
+        });
+    }
+    catch {
+        json(res, { ok: false, error: 'Invalid git branch name' }, 400);
+        return;
+    }
+    try {
+        const args = ['-C', resolved.workdir, 'checkout', '-b', name];
+        if (from)
+            args.push(from);
+        await execFileAsync('git', args, {
+            encoding: 'utf-8',
+            timeout: SESSION_GIT_MUTATION_TIMEOUT_MS,
+            maxBuffer: SESSION_GIT_COMMAND_MAX_BUFFER,
+        });
+        clearSessionGitStateCache(resolved.workdir);
+        const git = await collectSessionGitState(resolved.workdir);
+        json(res, { ok: true, sessionId, created: name, git });
+    }
+    catch (err) {
+        const detail = compactGitErrorText(commandErrorDetail(err) || (err?.message ?? String(err)), 220);
+        json(res, { ok: false, error: detail }, resolveSessionGitErrorStatus(detail));
     }
-    return activity;
 }
 function getSessionStatus(workdir) {
     try {
@@ -3007,6 +3975,8 @@ async function handleGetSessions(_req, res) {
     const localHost = (0, os_1.hostname)();
     const files = (0, fs_1.readdirSync)(dir).filter((f) => f.endsWith('.json'));
     const sessions = [];
+    const now = Date.now();
+    pruneSessionActivityCache(now);
     for (const file of files) {
         try {
             const data = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(dir, file), 'utf-8'));
@@ -3025,11 +3995,19 @@ async function handleGetSessions(_req, res) {
                 }
             }
             data.status = getSessionStatus(data.workdir);
-            data.activity = getAgentActivity(data);
+            const cachedActivity = getCachedSessionActivity(data, now);
+            if (cachedActivity) {
+                data.activity = cachedActivity;
+            }
+            else {
+                data.activity = getAgentActivity(data);
+                setCachedSessionActivity(data, data.activity, now);
+            }
             sessions.push(data);
         }
         catch { /* skip unparseable files */ }
     }
+    await annotateSessionsWithGitState(sessions);
     // Collect container resource stats
     const sessionIds = sessions.map((s) => s.id).filter(Boolean);
     try {
@@ -3223,11 +4201,16 @@ async function handlePostWebTerminalStart(req, res) {
         const body = await readBody(req);
         const parsed = JSON.parse(body || '{}');
         const agent = normalizeWebTerminalAgent(parsed.agent || 'claude');
+        const permissionMode = normalizeWebTerminalPermissionMode(parsed.permission_mode);
         const rawWorkdir = String(parsed.workdir || '').trim();
         if (!agent) {
             json(res, { ok: false, error: 'agent must be "claude" or "codex"' }, 400);
             return;
         }
+        if (!permissionMode) {
+            json(res, { ok: false, error: 'permission_mode must be "default" or "dangerous"' }, 400);
+            return;
+        }
         if (!rawWorkdir) {
             json(res, { ok: false, error: 'workdir is required' }, 400);
             return;
@@ -3249,7 +4232,7 @@ async function handlePostWebTerminalStart(req, res) {
             json(res, { ok: false, error: `workdir is not a directory: ${resolvedWorkdir}` }, 400);
             return;
         }
-        const result = await startWebTerminalSession(agent, resolvedWorkdir);
+        const result = await startWebTerminalSession(agent, resolvedWorkdir, { permissionMode });
         if (!result.ok) {
             json(res, result.body, result.status);
             return;
@@ -3275,6 +4258,7 @@ async function runWebTerminalInitJob(id) {
         const result = await startWebTerminalSession(job.agent, job.workdir, {
             prewarmImage: true,
             prewarmAgent: true,
+            permissionMode: job.permissionMode,
             onProgress: progress,
         });
         if (result.ok) {
@@ -3325,11 +4309,16 @@ async function handlePostWebTerminalInit(req, res) {
         const body = await readBody(req);
         const parsed = JSON.parse(body || '{}');
         const agent = normalizeWebTerminalAgent(parsed.agent || 'claude');
+        const permissionMode = normalizeWebTerminalPermissionMode(parsed.permission_mode);
         const rawWorkdir = String(parsed.workdir || '').trim();
         if (!agent) {
             json(res, { ok: false, error: 'agent must be "claude" or "codex"' }, 400);
             return;
         }
+        if (!permissionMode) {
+            json(res, { ok: false, error: 'permission_mode must be "default" or "dangerous"' }, 400);
+            return;
+        }
         if (!rawWorkdir) {
             json(res, { ok: false, error: 'workdir is required' }, 400);
             return;
@@ -3352,7 +4341,7 @@ async function handlePostWebTerminalInit(req, res) {
             return;
         }
         pruneWebTerminalInitJobs();
-        const job = createWebTerminalInitJob(agent, resolvedWorkdir);
+        const job = createWebTerminalInitJob(agent, resolvedWorkdir, permissionMode);
         webTerminalInitJobs.set(job.id, job);
         void runWebTerminalInitJob(job.id);
         json(res, { ok: true, init: serializeWebTerminalInitJob(job) }, 202);
@@ -3455,11 +4444,36 @@ async function handleGetWebTerminalInit(reqUrl, res) {
 async function handleGetWebTerminalSessions(res) {
     const records = (0, web_terminal_js_1.listWebTerminalRecords)();
     const localNode = (0, os_1.hostname)();
-    for (const record of records) {
+    const now = Date.now();
+    const TMUX_STATUS_PROBE_MAX = 16;
+    const TMUX_RECENT_NON_RUNNING_PROBE_MS = 45_000;
+    function parseRecordTimeMs(record) {
+        const raw = String(record.updatedAt || record.createdAt || '').trim();
+        if (!raw)
+            return 0;
+        const ms = Date.parse(raw);
+        return Number.isFinite(ms) ? ms : 0;
+    }
+    const probeCandidates = records
+        .filter((record) => {
+        if (record.node !== localNode)
+            return false;
+        if (record.status === 'running')
+            return true;
+        const ageMs = now - parseRecordTimeMs(record);
+        return ageMs >= 0 && ageMs <= TMUX_RECENT_NON_RUNNING_PROBE_MS;
+    })
+        .sort((a, b) => {
+        const aRunning = a.status === 'running' ? 0 : 1;
+        const bRunning = b.status === 'running' ? 0 : 1;
+        if (aRunning !== bRunning)
+            return aRunning - bRunning;
+        return parseRecordTimeMs(b) - parseRecordTimeMs(a);
+    })
+        .slice(0, TMUX_STATUS_PROBE_MAX);
+    for (const record of probeCandidates) {
         // Shared home directories may contain records from other nodes.
         // Only mutate runtime status for sessions that belong to this node.
-        if (record.node !== localNode)
-            continue;
         const alive = await (0, web_terminal_js_1.hasTmuxSession)(record.tmuxSession);
         if (alive && record.status !== 'running') {
             (0, web_terminal_js_1.updateWebTerminalRecordStatus)(record.id, { status: 'running', exitCode: null, error: null });
@@ -3475,8 +4489,25 @@ async function handleGetWebTerminalSessions(res) {
             });
         }
     }
-    const sessions = (0, web_terminal_js_1.listWebTerminalRecords)().map(serializeWebTerminalSession);
-    json(res, { ok: true, sessions });
+    function parseSessionSortMs(session) {
+        const raw = String(session.updatedAt || session.createdAt || '').trim();
+        if (!raw)
+            return 0;
+        const ms = Date.parse(raw);
+        return Number.isFinite(ms) ? ms : 0;
+    }
+    const allSessions = (0, web_terminal_js_1.listWebTerminalRecords)().map(serializeWebTerminalSession);
+    const activeSessions = allSessions.filter((session) => session.status === 'running');
+    const recentInactive = allSessions
+        .filter((session) => session.status !== 'running')
+        .sort((a, b) => parseSessionSortMs(b) - parseSessionSortMs(a))
+        .slice(0, 24);
+    const sessions = activeSessions.concat(recentInactive);
+    pruneWebTerminalInitJobs();
+    const initJobs = Array.from(webTerminalInitJobs.values())
+        .filter((job) => job.status === 'running')
+        .map((job) => serializeWebTerminalInitJob(job));
+    json(res, { ok: true, sessions, initJobs });
 }
 async function handleGetWebTerminalHistory(reqUrl, res) {
     const id = String(reqUrl.searchParams.get('id') || '').trim();
@@ -3627,6 +4658,95 @@ async function handleValidatePath(req, res) {
     }
 }
 // ── Directory browse helper ─────────────────────────────
+const BROWSE_DIR_GIT_BADGE_PRIORITY = {
+    '!': 6,
+    M: 5,
+    R: 4,
+    A: 3,
+    D: 2,
+    '?': 1,
+};
+function resolveBrowseDirGitBadgeFromPorcelain(kind, xy) {
+    const x = String(xy || '..').charAt(0);
+    const y = String(xy || '..').charAt(1);
+    if (kind === 'u' || x === 'U' || y === 'U')
+        return '!';
+    if (kind === '?')
+        return '?';
+    if (x === 'M' || y === 'M' || x === 'T' || y === 'T' || x === 'C' || y === 'C')
+        return 'M';
+    if (x === 'R' || y === 'R')
+        return 'R';
+    if (x === 'A' || y === 'A')
+        return 'A';
+    if (x === 'D' || y === 'D')
+        return 'D';
+    return '';
+}
+function pickBrowseDirGitBadge(current, next) {
+    if (!current)
+        return next;
+    const currentPriority = BROWSE_DIR_GIT_BADGE_PRIORITY[current] || 0;
+    const nextPriority = BROWSE_DIR_GIT_BADGE_PRIORITY[next] || 0;
+    return nextPriority > currentPriority ? next : current;
+}
+async function collectBrowseDirGitStatus(resolvedDir) {
+    const statusByName = new Map();
+    let stdout = '';
+    try {
+        const result = await execFileAsync('git', ['-C', resolvedDir, 'status', '--porcelain=v2', '--', '.'], {
+            encoding: 'utf-8',
+            timeout: BROWSE_DIR_GIT_STATUS_TIMEOUT_MS,
+            maxBuffer: SESSION_GIT_COMMAND_MAX_BUFFER,
+        });
+        stdout = String(result.stdout || '');
+    }
+    catch {
+        return statusByName;
+    }
+    const lines = stdout.split(/\r?\n/);
+    for (const rawLine of lines) {
+        const line = rawLine.trimEnd();
+        if (!line || line.startsWith('#'))
+            continue;
+        const kind = line.charAt(0);
+        let xy = '..';
+        let relativePath = '';
+        if (kind === '?') {
+            relativePath = line.slice(2).trim();
+            xy = '??';
+        }
+        else if (kind === '1' || kind === '2' || kind === 'u') {
+            const tabParts = line.split('\t');
+            if (tabParts.length < 2)
+                continue;
+            const metaParts = tabParts[0].split(' ');
+            if (metaParts.length >= 2)
+                xy = String(metaParts[1] || '..');
+            relativePath = String(tabParts[1] || '').trim();
+        }
+        else {
+            continue;
+        }
+        if (!relativePath)
+            continue;
+        const normalized = relativePath
+            .replace(/\\/g, '/')
+            .replace(/^\.\/+/, '')
+            .replace(/^"+|"+$/g, '');
+        if (!normalized)
+            continue;
+        const firstSegment = normalized.split('/')[0];
+        if (!firstSegment)
+            continue;
+        const badge = resolveBrowseDirGitBadgeFromPorcelain(kind, xy);
+        if (!badge)
+            continue;
+        const existing = statusByName.get(firstSegment);
+        statusByName.set(firstSegment, pickBrowseDirGitBadge(existing, badge));
+    }
+    return statusByName;
+}
 async function handleBrowseDir(req, res) {
     try {
         const body = await readBody(req);
@@ -3634,6 +4754,7 @@ async function handleBrowseDir(req, res) {
         const rawPath = typeof parsed.path === 'string' ? parsed.path : '~';
         const includeFiles = !!parsed.includeFiles;
         const includeHidden = !!parsed.includeHidden;
+        const includeGitStatus = !!parsed.includeGitStatus;
         const rawLimit = Number(parsed.maxEntries);
         const maxEntries = Number.isFinite(rawLimit)
             ? Math.max(100, Math.min(5000, Math.floor(rawLimit)))
@@ -3661,10 +4782,10 @@ async function handleBrowseDir(req, res) {
             try {
                 const st = (0, fs_1.statSync)(full);
                 if (st.isDirectory()) {
-                    dirs.push({ name: entry, path: full });
+                    dirs.push({ name: entry, path: full, mtime_ms: Math.round(st.mtimeMs) });
                 }
                 else if (includeFiles && st.isFile()) {
-                    files.push({ name: entry, path: full });
+                    files.push({ name: entry, path: full, mtime_ms: Math.round(st.mtimeMs) });
                 }
             }
             catch { /* skip inaccessible */ }
@@ -3675,15 +4796,24 @@ async function handleBrowseDir(req, res) {
         }
         dirs.sort((a, b) => a.name.localeCompare(b.name));
         files.sort((a, b) => a.name.localeCompare(b.name));
+        const gitStatusByName = includeGitStatus ? await collectBrowseDirGitStatus(resolved) : new Map();
+        const dirsOut = dirs.map((dir) => {
+            const gitStatus = gitStatusByName.get(dir.name);
+            return gitStatus ? { ...dir, git_status: gitStatus } : dir;
+        });
+        const filesOut = files.map((file) => {
+            const gitStatus = gitStatusByName.get(file.name);
+            return gitStatus ? { ...file, git_status: gitStatus } : file;
+        });
         const entriesOut = [
-            ...dirs.map((d) => ({ name: d.name, path: d.path, type: 'dir' })),
-            ...files.map((f) => ({ name: f.name, path: f.path, type: 'file' })),
+            ...dirsOut.map((d) => ({ name: d.name, path: d.path, type: 'dir', mtime_ms: d.mtime_ms, git_status: d.git_status })),
+            ...filesOut.map((f) => ({ name: f.name, path: f.path, type: 'file', mtime_ms: f.mtime_ms, git_status: f.git_status })),
         ];
         json(res, {
             ok: true,
             path: resolved,
-            dirs,
-            files: includeFiles ? files : undefined,
+            dirs: dirsOut,
+            files: includeFiles ? filesOut : undefined,
             entries: includeFiles ? entriesOut : undefined,
             truncated,
         });
@@ -3692,6 +4822,136 @@ async function handleBrowseDir(req, res) {
         json(res, { ok: false, error: err.message ?? String(err) }, 400);
     }
 }
+function collectFilePreviewAllowedRoots() {
+    const roots = new Set();
+    const addRoot = (rawPath) => {
+        if (typeof rawPath !== 'string')
+            return;
+        const trimmed = rawPath.trim();
+        if (!trimmed)
+            return;
+        const resolved = trimmed.replace(/^~/, (0, os_1.homedir)());
+        try {
+            const real = (0, fs_1.realpathSync)(resolved);
+            if (!(0, fs_1.statSync)(real).isDirectory())
+                return;
+            roots.add(real);
+        }
+        catch {
+            // Ignore missing/inaccessible roots.
+        }
+    };
+    try {
+        for (const record of (0, web_terminal_js_1.listWebTerminalRecords)()) {
+            addRoot(record.workdir);
+        }
+    }
+    catch {
+        // Best-effort root discovery.
+    }
+    const config = (0, config_js_1.loadConfig)();
+    const extraPaths = Array.isArray(config.filesystem?.extra_paths) ? config.filesystem.extra_paths : [];
+    for (const entry of extraPaths) {
+        if (entry && typeof entry === 'object') {
+            addRoot(entry.path);
+        }
+    }
+    return [...roots];
+}
+function isPathWithinAllowedRoot(filePath, rootPath) {
+    const rel = (0, path_1.relative)(rootPath, filePath);
+    if (!rel)
+        return true;
+    return !rel.startsWith('..') && !(0, path_1.isAbsolute)(rel);
+}
+function handleReadWorkspaceFile(reqUrl, res) {
+    const rawPath = String(reqUrl.searchParams.get('path') || '').trim();
+    if (!rawPath) {
+        json(res, { ok: false, error: 'Missing path parameter' }, 400);
+        return;
+    }
+    if (rawPath.includes('\0')) {
+        json(res, { ok: false, error: 'Invalid path' }, 400);
+        return;
+    }
+    const requestedMaxBytes = Number(reqUrl.searchParams.get('max_bytes'));
+    const maxBytes = Number.isFinite(requestedMaxBytes)
+        ? Math.max(4096, Math.min(FILE_PREVIEW_MAX_BYTES_LIMIT, Math.floor(requestedMaxBytes)))
+        : FILE_PREVIEW_DEFAULT_MAX_BYTES;
+    const resolved = rawPath.replace(/^~/, (0, os_1.homedir)());
+    let realFilePath;
+    try {
+        realFilePath = (0, fs_1.realpathSync)(resolved);
+    }
+    catch {
+        json(res, { ok: false, error: 'File not found' }, 404);
+        return;
+    }
+    let fileStat;
+    try {
+        fileStat = (0, fs_1.statSync)(realFilePath);
+    }
+    catch {
+        json(res, { ok: false, error: 'File not found' }, 404);
+        return;
+    }
+    if (!fileStat.isFile()) {
+        json(res, { ok: false, error: 'Path is not a file' }, 400);
+        return;
+    }
+    const allowedRoots = collectFilePreviewAllowedRoots();
+    if (allowedRoots.length === 0) {
+        json(res, { ok: false, error: 'No allowed file roots are available' }, 403);
+        return;
+    }
+    if (!allowedRoots.some((rootPath) => isPathWithinAllowedRoot(realFilePath, rootPath))) {
+        json(res, { ok: false, error: 'Path is outside allowed file roots' }, 403);
+        return;
+    }
+    const readBytes = Math.min(fileStat.size, maxBytes + 1);
+    let fd;
+    try {
+        fd = (0, fs_1.openSync)(realFilePath, 'r');
+    }
+    catch {
+        json(res, { ok: false, error: 'Failed to open file' }, 500);
+        return;
+    }
+    const buffer = Buffer.alloc(readBytes);
+    let bytesRead = 0;
+    try {
+        bytesRead = (0, fs_1.readSync)(fd, buffer, 0, readBytes, 0);
+    }
+    catch {
+        json(res, { ok: false, error: 'Failed to read file' }, 500);
+        return;
+    }
+    finally {
+        try {
+            (0, fs_1.closeSync)(fd);
+        }
+        catch {
+            // noop
+        }
+    }
+    const payload = buffer.subarray(0, bytesRead);
+    const binaryScan = payload.subarray(0, Math.min(payload.length, FILE_PREVIEW_BINARY_SCAN_BYTES));
+    if (binaryScan.includes(0)) {
+        json(res, { ok: false, error: 'Binary file preview is not supported', code: 'binary_file' }, 415);
+        return;
+    }
+    const truncated = fileStat.size > maxBytes;
+    const contentBuffer = truncated ? payload.subarray(0, Math.min(payload.length, maxBytes)) : payload;
+    const content = contentBuffer.toString('utf-8');
+    json(res, {
+        ok: true,
+        path: realFilePath,
+        size: fileStat.size,
+        truncated,
+        max_bytes: maxBytes,
+        content,
+    });
+}
 // ── Dataset stats helpers ───────────────────────────────
 function formatBytesUI(bytes) {
     if (bytes === 0)
@@ -3938,6 +5198,78 @@ async function handlePostDatasetExampleInstall(req, res) {
         json(res, { ok: false, error: err?.message ?? String(err) }, 500);
     }
 }
+function readRecentAuditLogEntries(maxEntries = 50) {
+    const config = (0, config_js_1.loadConfig)();
+    if (!config.audit.enabled)
+        return [];
+    const logDir = (0, config_js_1.getLogDir)(config);
+    if (!(0, fs_1.existsSync)(logDir))
+        return [];
+    const files = (0, fs_1.readdirSync)(logDir)
+        .filter((file) => file.endsWith('.jsonl'))
+        .sort()
+        .reverse();
+    const entries = [];
+    for (const file of files) {
+        if (entries.length >= maxEntries)
+            break;
+        const filePath = (0, path_1.resolve)(logDir, file);
+        try {
+            const content = (0, fs_1.readFileSync)(filePath, 'utf-8');
+            const lines = content.split('\n').filter((line) => line.trim().length > 0);
+            for (let idx = lines.length - 1; idx >= 0; idx -= 1) {
+                if (entries.length >= maxEntries)
+                    break;
+                try {
+                    const parsed = JSON.parse(lines[idx]);
+                    if (parsed && typeof parsed === 'object') {
+                        entries.push(parsed);
+                    }
+                }
+                catch {
+                    // Skip malformed log lines.
+                }
+            }
+        }
+        catch {
+            // Skip unreadable files.
+        }
+    }
+    return entries;
+}
+function buildFeedbackDiagnostics() {
+    const config = (0, config_js_1.loadConfig)();
+    let username = null;
+    try {
+        username = (0, os_1.userInfo)().username;
+    }
+    catch {
+        username = null;
+    }
+    const logDir = (0, config_js_1.getLogDir)(config);
+    return {
+        collected_at: new Date().toISOString(),
+        app: {
+            name: 'labgate-ui',
+            version: readPackageVersion(),
+        },
+        host: {
+            platform: (0, os_1.platform)(),
+            hostname: (0, os_1.hostname)(),
+            node_version: process.version,
+            user: username,
+        },
+        config: {
+            runtime: config.runtime,
+            network_mode: config.network?.mode ?? null,
+            slurm_enabled: !!config.slurm?.enabled,
+            audit_enabled: !!config.audit?.enabled,
+            log_dir: logDir,
+        },
+        slurm_runtime: getSlurmRuntimeStatus(),
+        audit_logs: readRecentAuditLogEntries(80),
+    };
+}
 function handleGetLogs(_req, res) {
     const config = (0, config_js_1.loadConfig)();
     if (!config.audit.enabled) {
@@ -3949,36 +5281,51 @@ function handleGetLogs(_req, res) {
         json(res, { entries: [], message: 'No audit logs found yet' });
         return;
     }
-    const files = (0, fs_1.readdirSync)(logDir)
-        .filter((f) => f.endsWith('.jsonl'))
-        .sort()
-        .reverse();
-    if (files.length === 0) {
-        json(res, { entries: [], message: 'No audit logs found yet' });
+    const entries = readRecentAuditLogEntries(50);
+    if (entries.length === 0) {
+        json(res, { entries: [], message: 'Log file is empty' });
         return;
     }
-    const logFile = (0, path_1.resolve)(logDir, files[0]);
+    json(res, { entries });
+}
+async function handlePostFeedback(req, res) {
     try {
-        const content = (0, fs_1.readFileSync)(logFile, 'utf-8').trim();
-        if (!content) {
-            json(res, { entries: [], message: 'Log file is empty' });
+        const rawBody = await readBody(req);
+        let payload = {};
+        if (rawBody.trim().length > 0) {
+            try {
+                payload = JSON.parse(rawBody);
+            }
+            catch {
+                json(res, { ok: false, error: 'Invalid JSON body' }, 400);
+                return;
+            }
+        }
+        const message = typeof payload.message === 'string' ? payload.message.trim() : '';
+        if (!message) {
+            json(res, { ok: false, error: 'Feedback message is required' }, 400);
             return;
         }
-        const allLines = content.split('\n');
-        const lines = allLines.slice(-50);
-        const entries = lines
-            .map(line => { try {
-            return JSON.parse(line);
+        if (message.length > 8000) {
+            json(res, { ok: false, error: 'Feedback message is too long (max 8000 chars)' }, 400);
+            return;
         }
-        catch {
-            return null;
-        } })
-            .filter(Boolean)
-            .reverse();
-        json(res, { entries });
+        const attachLogs = payload.attach_logs === true || payload.attachLogs === true;
+        const metadata = {
+            attach_logs: attachLogs,
+        };
+        const userAgent = req.headers['user-agent'];
+        if (typeof userAgent === 'string' && userAgent.trim().length > 0) {
+            metadata.user_agent = userAgent.trim().slice(0, 512);
+        }
+        if (attachLogs) {
+            metadata.diagnostics = buildFeedbackDiagnostics();
+        }
+        const result = await (0, feedback_js_1.submitFeedback)(message, { source: 'ui', metadata });
+        json(res, { ok: true, mode: result.mode, detail: result.detail });
     }
     catch (err) {
-        json(res, { entries: [], message: 'Could not read log file: ' + (err.message ?? String(err)) });
+        json(res, { ok: false, error: err?.message ?? String(err) }, 500);
     }
 }
 let containerStatsCache = new Map();
@@ -4083,8 +5430,9 @@ function normalizeMcpEntryForHost(entry, sandboxHome) {
 function collectMcpState() {
     const config = (0, config_js_1.loadConfig)();
     const { sandboxHome, mcpConfigPath, mcpConfigExists, registeredServers } = readMcpConfigData();
-    const slurmConfigured = config.slurm.enabled && config.slurm.mcp_server;
-    const clusterConfigured = config.slurm.enabled && config.slurm.mcp_server;
+    const slurmPluginEnabled = isPluginEnabledInConfig(config, 'slurm');
+    const slurmConfigured = slurmPluginEnabled && config.slurm.enabled && config.slurm.mcp_server;
+    const clusterConfigured = slurmPluginEnabled && config.slurm.enabled && config.slurm.mcp_server;
     const datasetsConfigured = true;
     const resultsConfigured = true;
     const slurmEntry = registeredServers['labgate-slurm'];
@@ -4186,7 +5534,13 @@ function collectMcpState() {
             tools: [
                 { name: 'list_results', title: 'List Results', description: 'List recorded results with filtering and pagination' },
                 { name: 'register_result', title: 'Register Result', description: 'Create a new structured result entry' },
+                {
+                    name: 'register_reproducible_result',
+                    title: 'Register Reproducible Result',
+                    description: 'Register a result with script, inputs, requirements, and optional execution/submission',
+                },
                 { name: 'get_result', title: 'Get Result', description: 'Retrieve one result by id' },
+                { name: 'list_result_versions', title: 'List Result Versions', description: 'List all versions for a result lineage' },
                 { name: 'update_result', title: 'Update Result', description: 'Update an existing result entry' },
                 { name: 'delete_result', title: 'Delete Result', description: 'Delete a result entry' },
             ],
@@ -4380,18 +5734,40 @@ function parseResultPayload(raw, mode) {
     if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
         return { ok: false, error: 'Body must be a JSON object.' };
     }
-    if (mode === 'create' && typeof raw.title !== 'string') {
-        return { ok: false, error: 'title is required and must be a string.' };
-    }
-    const optionalStringFields = ['title', 'summary', 'source', 'session_id', 'workdir'];
+    if (mode === 'create' &&
+        typeof raw.title !== 'string' &&
+        typeof raw.version_of !== 'string') {
+        return { ok: false, error: 'title is required and must be a string (or provide version_of).' };
+    }
+    if (mode === 'update' && raw.version_of !== undefined) {
+        return { ok: false, error: 'version_of is only supported when creating a new result.' };
+    }
+    const optionalStringFields = [
+        'id',
+        'title',
+        'summary',
+        'source',
+        'session_id',
+        'workdir',
+        'lineage_id',
+        'previous_result_id',
+        'version_of',
+    ];
     for (const field of optionalStringFields) {
         if (raw[field] !== undefined && raw[field] !== null && typeof raw[field] !== 'string') {
             return { ok: false, error: `${field} must be a string or null.` };
         }
     }
+    if (raw.starred !== undefined && typeof raw.starred !== 'boolean') {
+        return { ok: false, error: 'starred must be a boolean.' };
+    }
     if (raw.details !== undefined && raw.details !== null && typeof raw.details !== 'string') {
         return { ok: false, error: 'details must be a string or null.' };
     }
+    if (raw.version !== undefined &&
+        (!Number.isInteger(raw.version) || raw.version < 1)) {
+        return { ok: false, error: 'version must be an integer >= 1.' };
+    }
     if (raw.tags !== undefined &&
         (!Array.isArray(raw.tags) || raw.tags.some((v) => typeof v !== 'string'))) {
         return { ok: false, error: 'tags must be an array of strings.' };
@@ -4405,33 +5781,111 @@ function parseResultPayload(raw, mode) {
         (typeof raw.metadata !== 'object' || Array.isArray(raw.metadata))) {
         return { ok: false, error: 'metadata must be an object or null.' };
     }
+    if (raw.reproducibility !== undefined &&
+        raw.reproducibility !== null &&
+        (typeof raw.reproducibility !== 'object' || Array.isArray(raw.reproducibility))) {
+        return { ok: false, error: 'reproducibility must be an object or null.' };
+    }
+    if (raw.reproducibility && typeof raw.reproducibility === 'object') {
+        const repro = raw.reproducibility;
+        const reproStringFields = [
+            'script_path',
+            'script_kind',
+            'script_sha256',
+            'runtime',
+            'strategy',
+            'precomputed_reason',
+        ];
+        for (const field of reproStringFields) {
+            if (repro[field] !== undefined && repro[field] !== null && typeof repro[field] !== 'string') {
+                return { ok: false, error: `reproducibility.${field} must be a string or null.` };
+            }
+        }
+        if (repro.input_files !== undefined &&
+            (!Array.isArray(repro.input_files) || repro.input_files.some((v) => typeof v !== 'string'))) {
+            return { ok: false, error: 'reproducibility.input_files must be an array of strings.' };
+        }
+        if (repro.requirements !== undefined &&
+            (!Array.isArray(repro.requirements) || repro.requirements.some((v) => typeof v !== 'string'))) {
+            return { ok: false, error: 'reproducibility.requirements must be an array of strings.' };
+        }
+        if (repro.execution !== undefined &&
+            repro.execution !== null &&
+            (typeof repro.execution !== 'object' || Array.isArray(repro.execution))) {
+            return { ok: false, error: 'reproducibility.execution must be an object or null.' };
+        }
+        if (repro.execution && typeof repro.execution === 'object') {
+            const execution = repro.execution;
+            const execStringFields = ['status', 'command', 'ran_at', 'signal', 'stdout_tail', 'stderr_tail', 'slurm_job_id'];
+            for (const field of execStringFields) {
+                if (execution[field] !== undefined && execution[field] !== null && typeof execution[field] !== 'string') {
+                    return { ok: false, error: `reproducibility.execution.${field} must be a string or null.` };
+                }
+            }
+            if (execution.duration_ms !== undefined &&
+                execution.duration_ms !== null &&
+                (!Number.isInteger(execution.duration_ms) || execution.duration_ms < 0)) {
+                return { ok: false, error: 'reproducibility.execution.duration_ms must be an integer >= 0.' };
+            }
+            if (execution.exit_code !== undefined &&
+                execution.exit_code !== null &&
+                !Number.isInteger(execution.exit_code)) {
+                return { ok: false, error: 'reproducibility.execution.exit_code must be an integer or null.' };
+            }
+        }
+    }
     const payload = {
+        id: raw.id,
         title: raw.title,
         summary: raw.summary,
         details: raw.details,
         source: raw.source,
+        starred: raw.starred,
         session_id: raw.session_id,
         workdir: raw.workdir,
+        lineage_id: raw.lineage_id,
+        version: raw.version,
+        previous_result_id: raw.previous_result_id,
+        version_of: raw.version_of,
         tags: raw.tags,
         artifacts: raw.artifacts,
         metadata: raw.metadata,
+        reproducibility: raw.reproducibility,
     };
     if (mode === 'update') {
         const hasPatch = payload.title !== undefined ||
             payload.summary !== undefined ||
             payload.details !== undefined ||
             payload.source !== undefined ||
+            payload.starred !== undefined ||
             payload.session_id !== undefined ||
             payload.workdir !== undefined ||
+            payload.lineage_id !== undefined ||
+            payload.version !== undefined ||
+            payload.previous_result_id !== undefined ||
+            payload.version_of !== undefined ||
             payload.tags !== undefined ||
             payload.artifacts !== undefined ||
-            payload.metadata !== undefined;
+            payload.metadata !== undefined ||
+            payload.reproducibility !== undefined;
         if (!hasPatch) {
             return { ok: false, error: 'No update fields provided.' };
         }
     }
     return { ok: true, payload };
 }
+function parseOptionalBooleanQuery(value) {
+    if (value === null)
+        return undefined;
+    const normalized = String(value).trim().toLowerCase();
+    if (!normalized)
+        return undefined;
+    if (normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'on')
+        return true;
+    if (normalized === '0' || normalized === 'false' || normalized === 'no' || normalized === 'off')
+        return false;
+    return undefined;
+}
 function handleGetResults(reqUrl, res) {
     const parsedLimit = parseInt(reqUrl.searchParams.get('limit') || '100', 10);
     const parsedOffset = parseInt(reqUrl.searchParams.get('offset') || '0', 10);
@@ -4442,6 +5896,8 @@ function handleGetResults(reqUrl, res) {
         search: reqUrl.searchParams.get('search') || undefined,
         source: reqUrl.searchParams.get('source') || undefined,
         tag: reqUrl.searchParams.get('tag') || undefined,
+        lineage: reqUrl.searchParams.get('lineage') || undefined,
+        starred: parseOptionalBooleanQuery(reqUrl.searchParams.get('starred')),
         limit,
         offset,
     });
@@ -4988,6 +6444,7 @@ function startSSEBroadcast() {
                 catch { /* skip */ }
             }
         }
+        await annotateSessionsWithGitState(sessions);
         // Collect container resource stats
         const sessionIds = sessions.map((s) => s.id).filter(Boolean);
         try {
@@ -6004,6 +7461,10 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             if (!current || !current.pty)
                 return;
             if (parsed?.type === 'input' && typeof parsed.data === 'string') {
+                // Cancel pending automation when human types
+                const autoEngine = automationEngines.get(id);
+                if (autoEngine)
+                    autoEngine.cancelPending();
                 try {
                     current.pty.write(parsed.data);
                 }
@@ -6157,6 +7618,20 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
                 !requireWriteToken(req, res)) {
                 return;
             }
+            if (pathname.startsWith('/api/explorer/')) {
+                const config = (0, config_js_1.loadConfig)();
+                if (!isPluginEnabledInConfig(config, 'explorer')) {
+                    json(res, { ok: false, error: 'Explorer plugin is disabled.' }, 403);
+                    return;
+                }
+            }
+            if (pathname.startsWith('/api/automation/')) {
+                const config = (0, config_js_1.loadConfig)();
+                if (!isPluginEnabledInConfig(config, 'automation')) {
+                    json(res, { ok: false, error: 'Automation plugin is disabled.' }, 403);
+                    return;
+                }
+            }
             if (pathname === '/' && method === 'GET') {
                 serveHTML(res);
             }
@@ -6169,6 +7644,43 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             else if (pathname === '/api/config/path' && method === 'GET') {
                 handleGetConfigPath(req, res);
             }
+            else if (pathname === '/api/plugins' && method === 'GET') {
+                handleGetPlugins(req, res);
+            }
+            else if (pathname === '/api/plugins' && method === 'POST') {
+                await handlePostPlugins(req, res);
+            }
+            else if (/^\/api\/automation\/status\/[^/]+$/.test(pathname) && method === 'GET') {
+                const terminalId = pathname.split('/').pop();
+                handleGetAutomationStatus(terminalId, res);
+            }
+            else if (pathname === '/api/automation/enable' && method === 'POST') {
+                await handlePostAutomationEnable(req, res);
+            }
+            else if (pathname === '/api/automation/disable' && method === 'POST') {
+                await handlePostAutomationDisable(req, res);
+            }
+            else if (pathname === '/api/automation/pause' && method === 'POST') {
+                await handlePostAutomationPause(req, res);
+            }
+            else if (pathname === '/api/automation/resume' && method === 'POST') {
+                await handlePostAutomationResume(req, res);
+            }
+            else if (pathname === '/api/automation/config' && method === 'POST') {
+                await handlePostAutomationConfig(req, res);
+            }
+            else if (/^\/api\/automation\/log\/[^/]+$/.test(pathname) && method === 'GET') {
+                const terminalId = pathname.split('/').pop();
+                handleGetAutomationLog(terminalId, res);
+            }
+            else if (/^\/api\/automation\/turns\/[^/]+$/.test(pathname) && method === 'GET') {
+                const terminalId = pathname.split('/').pop();
+                handleGetAutomationTurns(decodeURIComponent(terminalId), res);
+            }
+            else if (/^\/api\/automation\/terminal-status\/[^/]+$/.test(pathname) && method === 'GET') {
+                const terminalId = pathname.split('/').pop();
+                handleGetAutomationTerminalStatus(terminalId, res);
+            }
             else if (pathname === '/api/ui/version' && method === 'GET') {
                 await handleGetUiVersion(reqUrl, res);
             }
@@ -6187,12 +7699,27 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             else if (pathname === '/api/sessions/restart' && method === 'POST') {
                 await handleRestartSession(req, res);
             }
+            else if (/^\/api\/sessions\/[^/]+\/git\/branches$/.test(pathname) && method === 'GET') {
+                await handleGetSessionGitBranches(pathname, res);
+            }
+            else if (/^\/api\/sessions\/[^/]+\/git\/dag$/.test(pathname) && method === 'GET') {
+                await handleGetSessionGitDag(pathname, reqUrl, res);
+            }
+            else if (/^\/api\/sessions\/[^/]+\/git\/checkout$/.test(pathname) && method === 'POST') {
+                await handlePostSessionGitCheckout(pathname, req, res);
+            }
+            else if (/^\/api\/sessions\/[^/]+\/git\/branches$/.test(pathname) && method === 'POST') {
+                await handlePostSessionGitBranchCreate(pathname, req, res);
+            }
             else if (pathname === '/api/validate-path' && method === 'POST') {
                 await handleValidatePath(req, res);
             }
             else if (pathname === '/api/browse-dir' && method === 'POST') {
                 await handleBrowseDir(req, res);
             }
+            else if (pathname === '/api/files/read' && method === 'GET') {
+                handleReadWorkspaceFile(reqUrl, res);
+            }
             else if (pathname === '/api/dataset-stats' && method === 'GET') {
                 handleGetDatasetStats(req, res);
             }
@@ -6211,6 +7738,9 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             else if (pathname === '/api/logs' && method === 'GET') {
                 handleGetLogs(req, res);
             }
+            else if (pathname === '/api/feedback' && method === 'POST') {
+                await handlePostFeedback(req, res);
+            }
             else if (pathname === '/api/security' && method === 'GET') {
                 handleGetSecurity(req, res);
             }