labgate 0.5.40 → 0.5.43

package/dist/lib/ui.js

@@ -33,6 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.waitForWebTerminalStartupSummary = waitForWebTerminalStartupSummary;
+exports.selectTranscriptFileForSession = selectTranscriptFileForSession;
 exports.startUI = startUI;
 const http_1 = require("http");
 const fs_1 = require("fs");
@@ -55,11 +57,13 @@ const display_store_js_1 = require("./display-store.js");
 const policy_js_1 = require("./policy.js");
 const license_js_1 = require("./license.js");
 const web_terminal_js_1 = require("./web-terminal.js");
+const web_terminal_startup_readiness_js_1 = require("./web-terminal-startup-readiness.js");
 const explorer_js_1 = require("./explorer.js");
 const explorer_eval_js_1 = require("./explorer-eval.js");
 const explorer_store_js_1 = require("./explorer-store.js");
 const feedback_js_1 = require("./feedback.js");
 const automation_engine_js_1 = require("./automation-engine.js");
+const update_check_js_1 = require("./update-check.js");
 const log = __importStar(require("./log.js"));
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 const HTML_PATH = (0, path_1.resolve)(__dirname, '..', 'lib', 'ui.html');
@@ -83,7 +87,6 @@ const PODMAN_SETUP_MAX_BUFFER = 16 * 1024 * 1024;
 const EXPLORER_TSP_TEMPLATE_DIR = (0, path_1.resolve)(__dirname, '..', '..', 'templates', 'tsp-lab');
 const EXPLORER_TSP_TEMPLATE_SOURCE_REPO = (0, path_1.join)((0, config_js_1.getExplorerRootDir)(), 'templates', 'tsp-lab-source');
 const EXPLORER_ARTIFACT_READ_MAX_BYTES = 2 * 1024 * 1024;
-const UI_VERSION_NPM_PACKAGE = 'labgate';
 const UI_VERSION_CHECK_TIMEOUT_MS = 8_000;
 const UI_VERSION_CHECK_MAX_BUFFER = 256 * 1024;
 const UI_VERSION_CACHE_TTL_MS = 5 * 60 * 1000;
@@ -94,10 +97,34 @@ const SESSION_GIT_CACHE_TTL_MS = 4_000;
 const SESSION_GIT_COMMAND_TIMEOUT_MS = 1_500;
 const SESSION_GIT_COMMAND_MAX_BUFFER = 512 * 1024;
 const SESSION_GIT_MUTATION_TIMEOUT_MS = 5_000;
+const TEMPORARILY_DISABLED_WEB_UI_FEATURES = Object.freeze({
+    terminalBookmarks: true,
+});
 const BROWSE_DIR_GIT_STATUS_TIMEOUT_MS = 2_500;
 const FILE_PREVIEW_DEFAULT_MAX_BYTES = 256 * 1024;
 const FILE_PREVIEW_MAX_BYTES_LIMIT = 1 * 1024 * 1024;
 const FILE_PREVIEW_BINARY_SCAN_BYTES = 4096;
+const CLAUDE_BROWSER_URL_FILES = Array.from(new Set([
+    (0, path_1.join)((0, config_js_1.getSandboxHome)(), '.labgate', 'browser-url'),
+    (0, path_1.join)(config_js_1.LABGATE_DIR, 'ai-home', '.labgate', 'browser-url'),
+    (0, path_1.join)(config_js_1.LABGATE_DIR, '.labgate', 'browser-url'),
+]));
+const CLAUDE_BROWSER_URL_MAX_AGE_MS = 10 * 60 * 1000;
+const CLAUDE_AUTH_FALLBACK_URL_RE = /https:\/\/[A-Za-z0-9.-]+\/[^\s"'<>]+/g;
+const CLAUDE_AUTH_FLOW_MAX_OUTPUT_CHARS = 220_000;
+function parsePositiveIntEnv(raw, fallback) {
+    const text = String(raw || '').trim();
+    if (!text)
+        return fallback;
+    const parsed = Number.parseInt(text, 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return fallback;
+    return parsed;
+}
+const CLAUDE_AUTH_FLOW_URL_WAIT_TIMEOUT_MS = parsePositiveIntEnv(process.env.LABGATE_CLAUDE_AUTH_FLOW_URL_WAIT_TIMEOUT_MS, 18_000);
+const CLAUDE_AUTH_FLOW_CONFIRM_TIMEOUT_MS = 30_000;
+const CLAUDE_AUTH_FLOW_IDLE_TTL_MS = 10 * 60 * 1000;
+const CLAUDE_LOGIN_SUCCESS_RE = /login successful|successfully logged in|you are now logged in|logged in as\s+[^\s]+@[^\s]+/i;
 const IRIS_SAMPLE_README = '# Iris Flowers Dataset (Sample)\n' +
     '\n' +
     'Source: https://raw.githubusercontent.com/mwaskom/seaborn-data/master/iris.csv\n' +
@@ -118,6 +145,7 @@ let displayStore = null;
 const REQUIRED_SLURM_COMMANDS = ['sbatch', 'squeue', 'sacct', 'scancel'];
 const webTerminalBridges = new Map();
 const automationEngines = new Map();
+const claudeAuthLoginFlows = new Map();
 const WEB_TERMINAL_INIT_RETENTION_MS = 60 * 60 * 1000;
 const WEB_TERMINAL_IMAGE_PULL_TIMEOUT_MS = 60 * 60 * 1000;
 const WEB_TERMINAL_IMAGE_PULL_MAX_BUFFER = 64 * 1024 * 1024;
@@ -125,15 +153,18 @@ const WEB_TERMINAL_AGENT_PREP_TIMEOUT_MS = 30 * 60 * 1000;
 const WEB_TERMINAL_AGENT_PREP_MAX_BUFFER = 32 * 1024 * 1024;
 const WEB_TERMINAL_STARTUP_READY_TIMEOUT_MS = 90 * 1000;
 const WEB_TERMINAL_STARTUP_READY_POLL_MS = 120;
+const WEB_TERMINAL_STARTUP_PROGRESS_UPDATE_MS = 5_000;
 const WEB_TERMINAL_STARTUP_READY_BUFFER_LIMIT = 64 * 1024;
 const WEB_TERMINAL_STARTUP_ALIVE_CHECK_MS = 750;
+const WEB_TERMINAL_STARTUP_CAPTURE_FAST_CHECK_MS = 700;
+const WEB_TERMINAL_STARTUP_CAPTURE_SLOW_CHECK_MS = 2_500;
+const WEB_TERMINAL_STARTUP_CAPTURE_SKIP_ON_LIVE_MS = 900;
+const WEB_TERMINAL_STARTUP_CAPTURE_LINES = '-200';
 const WEB_TERMINAL_BUFFER_MAX_BYTES = 512_000;
 const WEB_TERMINAL_HISTORY_MAX_BYTES = 8 * 1024 * 1024;
 const WEB_TERMINAL_HISTORY_CHUNK_BYTES = 8 * 1024;
 const WEB_TERMINAL_HISTORY_PAGE_DEFAULT = 120;
 const WEB_TERMINAL_HISTORY_PAGE_MAX = 600;
-const WEB_TERMINAL_STARTUP_HEADER_RE = /(?:^|\n)\s*LabGate\s*(?:\n|$)/i;
-const WEB_TERMINAL_STARTUP_BLOCKED_RE = /(?:^|\n)\s*Blocked\s+\d+\s+patterns\b/i;
 const CLAUDE_HEADLESS_STDERR_LIMIT = 12_000;
 const webTerminalInitJobs = new Map();
 const webTerminalImagePullLocks = new Map();
@@ -230,29 +261,6 @@ function readPackageVersion() {
         return '0.0.0';
     }
 }
-function stripVersionPrefix(raw) {
-    return String(raw || '').trim().replace(/^v/i, '');
-}
-function parseSemverTriplet(version) {
-    const normalized = stripVersionPrefix(version).split('-', 1)[0];
-    const match = normalized.match(/^(\d+)\.(\d+)\.(\d+)$/);
-    if (!match)
-        return null;
-    return [Number(match[1]), Number(match[2]), Number(match[3])];
-}
-function compareSemverStrings(a, b) {
-    const left = parseSemverTriplet(a);
-    const right = parseSemverTriplet(b);
-    if (!left || !right)
-        return null;
-    for (let i = 0; i < 3; i += 1) {
-        if (left[i] > right[i])
-            return 1;
-        if (left[i] < right[i])
-            return -1;
-    }
-    return 0;
-}
 function getUiBuildId() {
     try {
         const st = (0, fs_1.statSync)(HTML_PATH);
@@ -262,77 +270,11 @@ function getUiBuildId() {
         return `${LABGATE_UI_VERSION}:unknown`;
     }
 }
-function normalizeNpmVersionValue(raw) {
-    if (typeof raw === 'string') {
-        const cleaned = stripVersionPrefix(raw).trim();
-        return cleaned || null;
-    }
-    if (Array.isArray(raw)) {
-        const versions = raw
-            .map((entry) => normalizeNpmVersionValue(entry))
-            .filter((entry) => !!entry);
-        if (versions.length === 0)
-            return null;
-        const sorted = [...versions].sort((a, b) => {
-            const cmp = compareSemverStrings(a, b);
-            if (cmp !== null)
-                return cmp;
-            return a.localeCompare(b);
-        });
-        return sorted[sorted.length - 1] || null;
-    }
-    return null;
-}
-function parseNpmVersionOutput(rawOutput) {
-    const text = String(rawOutput || '').trim();
-    if (!text)
-        return null;
-    try {
-        return normalizeNpmVersionValue(JSON.parse(text));
-    }
-    catch {
-        const cleaned = stripVersionPrefix(text.replace(/^"+|"+$/g, '').trim());
-        return cleaned || null;
-    }
-}
-function summarizeCommandError(err) {
-    const detail = commandErrorDetail(err);
-    const firstLine = detail
-        .split('\n')
-        .map((line) => line.trim())
-        .find((line) => line.length > 0);
-    if (!firstLine)
-        return 'Could not reach npm registry.';
-    return firstLine.length > 180 ? `${firstLine.slice(0, 177)}...` : firstLine;
-}
 async function fetchPublishedUiVersion() {
-    const checkedAt = new Date().toISOString();
-    try {
-        const result = await execFileAsync('npm', ['view', UI_VERSION_NPM_PACKAGE, 'version', '--json'], {
-            timeout: UI_VERSION_CHECK_TIMEOUT_MS,
-            maxBuffer: UI_VERSION_CHECK_MAX_BUFFER,
-        });
-        const latestVersion = parseNpmVersionOutput(String(result?.stdout || ''));
-        if (!latestVersion) {
-            return {
-                latestVersion: null,
-                checkedAt,
-                error: 'npm returned an unreadable version.',
-            };
-        }
-        return {
-            latestVersion,
-            checkedAt,
-            error: null,
-        };
-    }
-    catch (err) {
-        return {
-            latestVersion: null,
-            checkedAt,
-            error: summarizeCommandError(err),
-        };
-    }
+    return (0, update_check_js_1.fetchPublishedNpmVersion)(update_check_js_1.LABGATE_NPM_PACKAGE, {
+        timeoutMs: UI_VERSION_CHECK_TIMEOUT_MS,
+        maxBuffer: UI_VERSION_CHECK_MAX_BUFFER,
+    });
 }
 async function getPublishedUiVersionCached(force = false) {
     const now = Date.now();
@@ -436,13 +378,13 @@ function runUiSelfUpdate() {
         status: 'running',
         startedAt,
         finishedAt: null,
-        message: `Installing ${UI_VERSION_NPM_PACKAGE}@latest...`,
+        message: `Installing ${update_check_js_1.LABGATE_NPM_PACKAGE}@latest...`,
         error: null,
         latestVersion: null,
     };
     uiSelfUpdatePromise = (async () => {
         try {
-            await execFileAsync('npm', ['install', '-g', `${UI_VERSION_NPM_PACKAGE}@latest`], {
+            await execFileAsync('npm', ['install', '-g', `${update_check_js_1.LABGATE_NPM_PACKAGE}@latest`], {
                 timeout: UI_SELF_UPDATE_TIMEOUT_MS,
                 maxBuffer: UI_SELF_UPDATE_MAX_BUFFER,
             });
@@ -462,7 +404,7 @@ function runUiSelfUpdate() {
                 startedAt,
                 finishedAt: new Date().toISOString(),
                 message: 'Update failed.',
-                error: summarizeCommandError(err),
+                error: (0, update_check_js_1.summarizeCommandError)(err),
                 latestVersion: null,
             };
         }
@@ -647,20 +589,47 @@ async function ensureWebTerminalImageReady(runtime, image, onProgress) {
     const imagesDir = (0, config_js_1.getImagesDir)();
     const sifPath = (0, path_1.join)(imagesDir, (0, container_js_1.imageToSifName)(image));
     const pullLockPath = `${sifPath}.pull.lock`;
-    if ((0, fs_1.existsSync)(sifPath) && !(0, fs_1.existsSync)(pullLockPath))
+    if ((0, container_js_1.isUsableApptainerSif)('apptainer', sifPath) && !(0, fs_1.existsSync)(pullLockPath))
         return;
     (0, fs_1.mkdirSync)(imagesDir, { recursive: true });
     await withWebTerminalImagePullLock(`apptainer:${image}`, async () => {
-        if ((0, fs_1.existsSync)(sifPath) && !(0, fs_1.existsSync)(pullLockPath))
+        if ((0, container_js_1.isUsableApptainerSif)('apptainer', sifPath) && !(0, fs_1.existsSync)(pullLockPath))
             return;
         await (0, image_pull_lock_js_1.withImagePullFileLock)(pullLockPath, image, async () => {
-            if ((0, fs_1.existsSync)(sifPath))
+            if ((0, container_js_1.isUsableApptainerSif)('apptainer', sifPath))
                 return;
+            if ((0, fs_1.existsSync)(sifPath)) {
+                const message = `Cached image for ${image} failed validation. Re-pulling...`;
+                onProgress?.('image_pull', message);
+                if (!onProgress)
+                    log.warn(message);
+                try {
+                    (0, fs_1.unlinkSync)(sifPath);
+                }
+                catch {
+                    // Best effort; the pull below will surface remaining problems.
+                }
+            }
+            const tempSifPath = `${sifPath}.tmp-${process.pid}-${(0, crypto_1.randomBytes)(6).toString('hex')}`;
             onProgress?.('image_pull', `Pulling container image ${image}...`);
-            await execFileAsync('apptainer', ['pull', sifPath, `docker://${image}`], {
-                timeout: WEB_TERMINAL_IMAGE_PULL_TIMEOUT_MS,
-                maxBuffer: WEB_TERMINAL_IMAGE_PULL_MAX_BUFFER,
-            });
+            try {
+                await execFileAsync('apptainer', ['pull', tempSifPath, `docker://${image}`], {
+                    timeout: WEB_TERMINAL_IMAGE_PULL_TIMEOUT_MS,
+                    maxBuffer: WEB_TERMINAL_IMAGE_PULL_MAX_BUFFER,
+                });
+                if (!(0, container_js_1.isUsableApptainerSif)('apptainer', tempSifPath)) {
+                    throw new Error(`Pulled SIF failed validation: ${tempSifPath}`);
+                }
+                (0, fs_1.renameSync)(tempSifPath, sifPath);
+            }
+            finally {
+                try {
+                    (0, fs_1.unlinkSync)(tempSifPath);
+                }
+                catch {
+                    // Best effort cleanup for failed pulls.
+                }
+            }
         }, {
             onWait: () => {
                 const message = `Waiting for another session to finish pulling ${image}...`;
@@ -825,15 +794,38 @@ function toRuntimeUnavailableResult(runtimeReady) {
     };
 }
 async function startWebTerminalSession(agent, resolvedWorkdir, opts = {}) {
+    const startupStartedAt = Date.now();
+    const startupTimings = [];
+    const recordStartupTiming = (label, startedAt) => {
+        startupTimings.push([label, Math.max(0, Date.now() - startedAt)]);
+    };
+    const formatStartupTiming = (ms) => (ms < 1000 ? `${Math.round(ms)}ms` : ms < 10_000 ? `${(ms / 1000).toFixed(1)}s` : `${Math.round(ms / 1000)}s`);
+    const flushStartupTimingLog = (readiness, outcome) => {
+        const parts = startupTimings
+            .filter(([, ms]) => Number.isFinite(ms))
+            .map(([label, ms]) => `${label}=${formatStartupTiming(ms)}`);
+        if (readiness) {
+            parts.push(`readiness_source=${readiness.source}`);
+            parts.push(`readiness_wait=${formatStartupTiming(readiness.elapsedMs)}`);
+            parts.push(`capture_checks=${readiness.captureChecks}`);
+        }
+        parts.push(`total=${formatStartupTiming(Date.now() - startupStartedAt)}`);
+        log.step(`[labgate] web terminal startup (${agent}, ${outcome}): ${parts.join(', ')}`);
+    };
     const onProgress = opts.onProgress;
-    const config = (0, config_js_1.loadConfig)();
+    const effective = (0, config_js_1.loadEffectiveConfig)();
+    const config = effective.config;
     onProgress?.('runtime_setup', 'Checking container runtime...');
+    const runtimeStartedAt = Date.now();
     const runtimeReady = await prepareRuntimeForWebTerminal(config.runtime);
+    recordStartupTiming('runtime_setup', runtimeStartedAt);
     if (!runtimeReady.ok) {
+        flushStartupTimingLog(null, 'failed');
         return toRuntimeUnavailableResult(runtimeReady);
     }
     const runtimeCheck = (0, runtime_js_1.checkRuntime)(config.runtime);
     if (!runtimeCheck.ok || !runtimeCheck.runtime) {
+        flushStartupTimingLog(null, 'failed');
         return {
             ok: false,
             status: runtimeReady.initialized ? 502 : 503,
@@ -849,6 +841,7 @@ async function startWebTerminalSession(agent, resolvedWorkdir, opts = {}) {
     // Preflight tmux before any slow image/agent preparation to avoid unnecessary side effects.
     const tmuxAvailable = await (0, web_terminal_js_1.ensureTmuxAvailable)();
     if (!tmuxAvailable.ok) {
+        flushStartupTimingLog(null, 'failed');
         return {
             ok: false,
             status: 500,
@@ -856,10 +849,14 @@ async function startWebTerminalSession(agent, resolvedWorkdir, opts = {}) {
         };
     }
     if (opts.prewarmImage) {
+        const imagePrepareStartedAt = Date.now();
         try {
             await ensureWebTerminalImageReady(runtimeCheck.runtime, config.image, onProgress);
+            recordStartupTiming('image_prepare', imagePrepareStartedAt);
         }
         catch (err) {
+            recordStartupTiming('image_prepare', imagePrepareStartedAt);
+            flushStartupTimingLog(null, 'failed');
             const detail = commandErrorDetail(err);
             return {
                 ok: false,
@@ -876,10 +873,14 @@ async function startWebTerminalSession(agent, resolvedWorkdir, opts = {}) {
         }
     }
     if (opts.prewarmAgent) {
+        const agentPrepareStartedAt = Date.now();
         try {
             await ensureWebTerminalAgentReady(runtimeCheck.runtime, config.image, agent, resolvedWorkdir, config.network.mode, onProgress);
+            recordStartupTiming('agent_prepare', agentPrepareStartedAt);
         }
         catch (err) {
+            recordStartupTiming('agent_prepare', agentPrepareStartedAt);
+            flushStartupTimingLog(null, 'failed');
             const detail = commandErrorDetail(err);
             return {
                 ok: false,
@@ -907,15 +908,19 @@ async function startWebTerminalSession(agent, resolvedWorkdir, opts = {}) {
     });
     (0, web_terminal_js_1.writeWebTerminalRecord)(record);
     onProgress?.('session_start', `Starting ${agent} terminal session...`);
+    const tmuxSessionStartedAt = Date.now();
     try {
         await (0, web_terminal_js_1.startTmuxWebTerminalSession)(record, cliEntrypoint, {
             permissionMode: opts.permissionMode || 'default',
         });
         (0, web_terminal_js_1.updateWebTerminalRecordStatus)(id, { status: 'running', exitCode: null, error: null });
+        recordStartupTiming('tmux_session_start', tmuxSessionStartedAt);
     }
     catch (err) {
+        recordStartupTiming('tmux_session_start', tmuxSessionStartedAt);
         const message = err?.message ?? String(err);
         (0, web_terminal_js_1.updateWebTerminalRecordStatus)(id, { status: 'failed', exitCode: 1, error: message });
+        flushStartupTimingLog(null, 'failed');
         return {
             ok: false,
             status: 500,
@@ -934,6 +939,7 @@ async function startWebTerminalSession(agent, resolvedWorkdir, opts = {}) {
             exitCode: 1,
             error: 'node-pty bridge unavailable',
         });
+        flushStartupTimingLog(null, 'failed');
         return {
             ok: false,
             status: 500,
@@ -943,7 +949,27 @@ async function startWebTerminalSession(agent, resolvedWorkdir, opts = {}) {
             },
         };
     }
-    await waitForWebTerminalStartupSummary(record, bridge, onProgress);
+    const readinessWaitStartedAt = Date.now();
+    const readiness = await waitForWebTerminalStartupSummary(record, bridge, onProgress);
+    recordStartupTiming('web_terminal_readiness_wait', readinessWaitStartedAt);
+    if (!readiness.ready && readiness.source !== 'timeout') {
+        const message = readiness.source === 'bridge-detached'
+            ? 'Terminal bridge detached before startup completed.'
+            : readiness.source === 'tmux-exited'
+                ? 'tmux session exited before startup completed.'
+                : 'Terminal startup did not complete.';
+        (0, web_terminal_js_1.updateWebTerminalRecordStatus)(id, { status: 'failed', exitCode: 1, error: message });
+        flushStartupTimingLog(readiness, 'failed');
+        return {
+            ok: false,
+            status: 500,
+            body: { ok: false, error: message },
+        };
+    }
+    flushStartupTimingLog(readiness, 'ready');
+    if (!readiness.ready) {
+        onProgress?.('session_start', 'Terminal started. LabGate startup summary timed out; continuing with live session output.');
+    }
     return {
         ok: true,
         session: serializeWebTerminalSession(record),
@@ -1243,6 +1269,7 @@ function serializeWebTerminalSession(record) {
     return {
         id: record.id,
         name: record.name || '',
+        starred: record.starred === true,
         agent: record.agent,
         runtime: record.runtime || '',
         workdir: record.workdir,
@@ -1368,6 +1395,49 @@ function collectClaudeTextFromContent(content) {
     }
     return text;
 }
+function collectToolResultText(value) {
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value)) {
+        let text = '';
+        for (const item of value) {
+            text += collectToolResultText(item);
+        }
+        return text;
+    }
+    if (!value || typeof value !== 'object')
+        return '';
+    const record = value;
+    if (record.type === 'text' && typeof record.text === 'string')
+        return record.text;
+    if (typeof record.content === 'string')
+        return record.content;
+    if (record.content !== undefined)
+        return collectToolResultText(record.content);
+    if (typeof record.text === 'string')
+        return record.text;
+    return '';
+}
+function summarizeToolResultDetail(raw, max = 420) {
+    const compact = String(raw || '').replace(/\r/g, '').trim();
+    if (!compact)
+        return '';
+    if (compact.length <= max)
+        return compact;
+    return `${compact.slice(0, Math.max(1, max - 3))}...`;
+}
+function extractToolResultDetailFromBlock(block) {
+    const fromContent = summarizeToolResultDetail(collectToolResultText(block.content));
+    if (fromContent)
+        return fromContent;
+    const fromError = summarizeToolResultDetail(readRecordString(block, 'error'));
+    if (fromError)
+        return fromError;
+    const fromMessage = summarizeToolResultDetail(readRecordString(block, 'message'));
+    if (fromMessage)
+        return fromMessage;
+    return '';
+}
 function extractClaudeStreamSessionId(event) {
     const direct = readRecordString(event, 'session_id').trim();
     if (direct)
@@ -1402,87 +1472,288 @@ function isClaudeAuthenticationFailure(event, assistantSnapshot, stderrText) {
     const authRe = /oauth token has expired|authentication_error|failed to authenticate|api error:\s*401/i;
     return authRe.test(packed) || authRe.test(message);
 }
-function buildClaudeHeadlessApptainerArgs(config, workdir, prompt, resumeSessionId, runWithAllowedPermissions) {
-    const sandboxHome = (0, config_js_1.getSandboxHome)();
-    const sifPath = (0, path_1.join)((0, config_js_1.getImagesDir)(), (0, container_js_1.imageToSifName)(config.image));
-    const resume = resumeSessionId.trim();
-    // Ensure display.json exists before bind-mounting it
+function isDisplayWidgetToolName(rawName) {
+    const normalized = normalizeToolName(rawName)
+        .replace(/[\s.-]+/g, '_');
+    if (!normalized)
+        return false;
+    return normalized === 'display_widget'
+        || normalized.endsWith('__display_widget')
+        || normalized.endsWith('_display_widget');
+}
+function ensureDisplayDbFileReady() {
     const displayDbPath = (0, config_js_1.getDisplayDbPath)();
-    if (!(0, fs_1.existsSync)(displayDbPath)) {
-        (0, config_js_1.ensurePrivateDir)((0, path_1.dirname)(displayDbPath));
-        (0, fs_1.writeFileSync)(displayDbPath, JSON.stringify({ version: 1, events: [] }, null, 2) + '\n', {
-            encoding: 'utf-8',
-            mode: config_js_1.PRIVATE_FILE_MODE,
-        });
+    if ((0, fs_1.existsSync)(displayDbPath))
+        return;
+    (0, config_js_1.ensurePrivateDir)((0, path_1.dirname)(displayDbPath));
+    (0, fs_1.writeFileSync)(displayDbPath, JSON.stringify({ version: 1, events: [] }, null, 2) + '\n', {
+        encoding: 'utf-8',
+        mode: config_js_1.PRIVATE_FILE_MODE,
+    });
+}
+function buildClaudeHeadlessAddDirArgs(config) {
+    const dirs = new Set();
+    let hasExtraMounts = false;
+    let hasDatasets = false;
+    for (const mount of config.filesystem.extra_paths || []) {
+        if (!mount || typeof mount.path !== 'string')
+            continue;
+        const resolved = mount.path.replace(/^~/, (0, os_1.homedir)());
+        const target = `/mnt/${(0, path_1.basename)(resolved)}`;
+        hasExtraMounts = true;
+        dirs.add(target);
     }
+    for (const ds of config.datasets || []) {
+        if (!ds || typeof ds.name !== 'string')
+            continue;
+        const name = ds.name.trim();
+        if (!name)
+            continue;
+        hasDatasets = true;
+        dirs.add(`/datasets/${name}`);
+    }
+    if (hasExtraMounts)
+        dirs.add('/mnt');
+    if (hasDatasets)
+        dirs.add('/datasets');
+    return Array.from(dirs).flatMap((dir) => ['--add-dir', dir]);
+}
+function buildClaudeHeadlessAllowedToolsArgs() {
+    // Keep approvals enabled globally, but pre-allow the tools needed for
+    // headless discovery + web lookups in mounted workspaces.
+    return ['--allowed-tools', 'Glob,Read,Grep,WebFetch'];
+}
+function buildClaudeHeadlessInvocationArgs(config, prompt, resumeSessionId, runWithAllowedPermissions) {
+    const resume = resumeSessionId.trim();
     return [
-        'exec',
-        '--containall',
-        '--cleanenv',
-        '--home', `${sandboxHome}:/home/sandbox`,
-        '--bind', `${workdir}:/work`,
-        '--pwd', '/work',
-        ...config.filesystem.extra_paths.flatMap(({ path: p, mode }) => {
-            const resolved = p.replace(/^~/, (0, os_1.homedir)());
-            const target = `/mnt/${(0, path_1.basename)(resolved)}`;
-            const bindSpec = mode === 'ro' ? `${resolved}:${target}:ro` : `${resolved}:${target}`;
-            return ['--bind', bindSpec];
-        }),
-        ...(config.datasets || []).flatMap(({ path: p, name, mode }) => {
-            const resolved = p.replace(/^~/, (0, os_1.homedir)());
-            const bindSpec = mode === 'ro' ? `${resolved}:/datasets/${name}:ro` : `${resolved}:/datasets/${name}`;
-            return ['--bind', bindSpec];
-        }),
-        ...((0, fs_1.existsSync)((0, config_js_1.getConfigPath)()) ? ['--bind', `${(0, config_js_1.getConfigPath)()}:/labgate-config/config.json`] : []),
-        '--bind', `${(0, config_js_1.getDisplayDbPath)()}:/labgate-config/display.json`,
-        '--env', 'HOME=/home/sandbox',
-        '--env', 'ANTHROPIC_API_KEY=',
-        sifPath,
         '/home/sandbox/.npm-global/bin/claude',
         '-p',
         '--verbose',
         '--output-format',
         'stream-json',
         '--include-partial-messages',
+        ...buildClaudeHeadlessAddDirArgs(config),
+        ...buildClaudeHeadlessAllowedToolsArgs(),
         ...(runWithAllowedPermissions ? ['--dangerously-skip-permissions'] : []),
         ...(resume ? ['--resume', resume] : []),
         prompt,
     ];
 }
+function buildClaudeHeadlessRuntimeCommand(runtime, config, workdir, prompt, resumeSessionId, runWithAllowedPermissions) {
+    const sandboxHome = (0, config_js_1.getSandboxHome)();
+    // Ensure display.json exists before bind-mounting it
+    ensureDisplayDbFileReady();
+    const displayDbPath = (0, config_js_1.getDisplayDbPath)();
+    const claudeArgs = buildClaudeHeadlessInvocationArgs(config, prompt, resumeSessionId, runWithAllowedPermissions);
+    if (runtime === 'podman') {
+        return {
+            command: 'podman',
+            args: [
+                'run',
+                '--rm',
+                '--workdir', '/work',
+                '--volume', `${sandboxHome}:/home/sandbox`,
+                '--volume', `${workdir}:/work`,
+                ...config.filesystem.extra_paths.flatMap(({ path: p, mode }) => {
+                    const resolved = p.replace(/^~/, (0, os_1.homedir)());
+                    const target = `/mnt/${(0, path_1.basename)(resolved)}`;
+                    const volSpec = mode === 'ro' ? `${resolved}:${target}:ro` : `${resolved}:${target}`;
+                    return ['--volume', volSpec];
+                }),
+                ...(config.datasets || []).flatMap(({ path: p, name, mode }) => {
+                    const resolved = p.replace(/^~/, (0, os_1.homedir)());
+                    const volSpec = mode === 'ro' ? `${resolved}:/datasets/${name}:ro` : `${resolved}:/datasets/${name}`;
+                    return ['--volume', volSpec];
+                }),
+                ...((0, fs_1.existsSync)((0, config_js_1.getConfigPath)()) ? ['--volume', `${(0, config_js_1.getConfigPath)()}:/labgate-config/config.json`] : []),
+                '--volume', `${displayDbPath}:/labgate-config/display.json`,
+                ...getPodmanPrewarmNetworkArgs(config.network.mode),
+                '--env', 'HOME=/home/sandbox',
+                '--env', 'ANTHROPIC_API_KEY=',
+                config.image,
+                ...claudeArgs,
+            ],
+        };
+    }
+    const sifPath = (0, path_1.join)((0, config_js_1.getImagesDir)(), (0, container_js_1.imageToSifName)(config.image));
+    return {
+        command: 'apptainer',
+        args: [
+            'exec',
+            '--containall',
+            '--cleanenv',
+            '--home', `${sandboxHome}:/home/sandbox`,
+            '--bind', `${workdir}:/work`,
+            '--pwd', '/work',
+            ...config.filesystem.extra_paths.flatMap(({ path: p, mode }) => {
+                const resolved = p.replace(/^~/, (0, os_1.homedir)());
+                const target = `/mnt/${(0, path_1.basename)(resolved)}`;
+                const bindSpec = mode === 'ro' ? `${resolved}:${target}:ro` : `${resolved}:${target}`;
+                return ['--bind', bindSpec];
+            }),
+            ...(config.datasets || []).flatMap(({ path: p, name, mode }) => {
+                const resolved = p.replace(/^~/, (0, os_1.homedir)());
+                const bindSpec = mode === 'ro' ? `${resolved}:/datasets/${name}:ro` : `${resolved}:/datasets/${name}`;
+                return ['--bind', bindSpec];
+            }),
+            ...((0, fs_1.existsSync)((0, config_js_1.getConfigPath)()) ? ['--bind', `${(0, config_js_1.getConfigPath)()}:/labgate-config/config.json`] : []),
+            '--bind', `${displayDbPath}:/labgate-config/display.json`,
+            '--env', 'HOME=/home/sandbox',
+            '--env', 'ANTHROPIC_API_KEY=',
+            sifPath,
+            ...claudeArgs,
+        ],
+    };
+}
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function stripAnsiForStartupReadiness(text) {
-    return String(text || '')
-        .replace(/\u001b\][^\u0007]*(?:\u0007|\u001b\\)/g, '')
-        .replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, '')
-        .replace(/\r/g, '\n');
-}
-function hasWebTerminalStartupSummary(buffer) {
-    const plain = stripAnsiForStartupReadiness(buffer);
-    return WEB_TERMINAL_STARTUP_HEADER_RE.test(plain) && WEB_TERMINAL_STARTUP_BLOCKED_RE.test(plain);
-}
-async function waitForWebTerminalStartupSummary(record, bridge, onProgress) {
-    const deadline = Date.now() + WEB_TERMINAL_STARTUP_READY_TIMEOUT_MS;
+async function waitForWebTerminalStartupSummary(record, bridge, onProgress, deps = {}) {
+    const formatElapsedLabel = (elapsedMs) => {
+        const totalSeconds = Math.max(1, Math.round(elapsedMs / 1000));
+        if (totalSeconds < 60)
+            return `${totalSeconds}s`;
+        const minutes = Math.floor(totalSeconds / 60);
+        const seconds = totalSeconds % 60;
+        return seconds > 0 ? `${minutes}m ${seconds}s` : `${minutes}m`;
+    };
+    const describeWait = (sawLaunchSignal, sawSummary, elapsedMs) => {
+        const agentLabel = record.agent === 'claude' ? 'Claude' : 'Codex';
+        let message = `Waiting for ${agentLabel} startup output`;
+        if (sawLaunchSignal && !sawSummary) {
+            message = `${agentLabel} launched. Waiting for LabGate startup summary`;
+        }
+        else if (!sawLaunchSignal && sawSummary) {
+            message = `LabGate startup summary detected. Waiting for ${agentLabel} launch banner`;
+        }
+        if (!Number.isFinite(elapsedMs) || !elapsedMs || elapsedMs <= 0)
+            return `${message}...`;
+        const slowHint = elapsedMs >= 30_000 ? '; initial auth/setup can be slow' : '';
+        return `${message}... (${formatElapsedLabel(elapsedMs)} elapsed${slowHint})`;
+    };
+    const nowFn = deps.now ?? Date.now;
+    const sleepFn = deps.sleep ?? sleep;
+    const hasTmuxSessionFn = deps.hasTmuxSession ?? web_terminal_js_1.hasTmuxSession;
+    const getTmuxBinaryFn = deps.getTmuxBinary ?? web_terminal_js_1.getTmuxBinary;
+    const capturePane = deps.capturePane ?? (async (tmuxBin, sessionName) => {
+        const { stdout } = await execFileAsync(tmuxBin, ['capture-pane', '-p', '-S', WEB_TERMINAL_STARTUP_CAPTURE_LINES, '-t', sessionName], { timeout: 2_000, maxBuffer: WEB_TERMINAL_STARTUP_READY_BUFFER_LIMIT });
+        return String(stdout || '');
+    });
+    const startMs = nowFn();
+    const deadline = startMs + WEB_TERMINAL_STARTUP_READY_TIMEOUT_MS;
     let lastAliveCheck = 0;
-    onProgress?.('session_start', `Finalizing ${record.agent} startup...`);
-    while (Date.now() < deadline) {
+    let lastCaptureCheck = 0;
+    let lastProgressBucket = 0;
+    let lastLiveOutputAt = startMs;
+    let lastObservedBufferLength = 0;
+    let tmuxBin = null;
+    let sawLaunchSignal = false;
+    let sawSummary = false;
+    let sawDeviceAuth = false;
+    let captureChecks = 0;
+    const captureIntervalFor = (elapsedMs) => {
+        if (sawLaunchSignal || sawSummary)
+            return WEB_TERMINAL_STARTUP_CAPTURE_SLOW_CHECK_MS;
+        return elapsedMs < 5_000 ? WEB_TERMINAL_STARTUP_CAPTURE_FAST_CHECK_MS : WEB_TERMINAL_STARTUP_CAPTURE_SLOW_CHECK_MS;
+    };
+    const observeStartupSignals = (text, source) => {
+        const signals = (0, web_terminal_startup_readiness_js_1.getWebTerminalStartupSignals)(record.agent, text);
+        const hadLaunchSignal = sawLaunchSignal;
+        const hadSummary = sawSummary;
+        sawLaunchSignal ||= signals.hasLaunchSignal;
+        sawSummary ||= signals.hasSummary;
+        sawDeviceAuth ||= signals.launchKind === 'device-auth';
+        if (!sawLaunchSignal || !sawSummary)
+            return null;
+        if (sawDeviceAuth)
+            return 'device-auth';
+        if (signals.hasLaunchSignal && signals.hasSummary) {
+            return source === 'live' ? 'live-bridge' : 'tmux-capture';
+        }
+        if (hadLaunchSignal !== sawLaunchSignal || hadSummary !== sawSummary) {
+            return 'latched-launch+summary';
+        }
+        return source === 'live' ? 'live-bridge' : 'tmux-capture';
+    };
+    onProgress?.('session_start', describeWait(false, false));
+    while (nowFn() < deadline) {
+        if (bridge.buffer.length !== lastObservedBufferLength) {
+            lastObservedBufferLength = bridge.buffer.length;
+            lastLiveOutputAt = nowFn();
+        }
         const recent = bridge.buffer.length > WEB_TERMINAL_STARTUP_READY_BUFFER_LIMIT
             ? bridge.buffer.slice(-WEB_TERMINAL_STARTUP_READY_BUFFER_LIMIT)
             : bridge.buffer;
-        if (hasWebTerminalStartupSummary(recent))
-            return;
-        if (!bridge.pty)
-            return;
-        const now = Date.now();
+        const liveReadySource = (0, web_terminal_startup_readiness_js_1.isWebTerminalStartupReady)(record.agent, recent)
+            ? ((0, web_terminal_startup_readiness_js_1.getWebTerminalStartupSignals)(record.agent, recent).launchKind === 'device-auth' ? 'device-auth' : 'live-bridge')
+            : observeStartupSignals(recent, 'live');
+        if (liveReadySource) {
+            return {
+                ready: true,
+                source: liveReadySource,
+                elapsedMs: Math.max(0, nowFn() - startMs),
+                captureChecks,
+            };
+        }
+        if (!bridge.pty) {
+            return {
+                ready: false,
+                source: 'bridge-detached',
+                elapsedMs: Math.max(0, nowFn() - startMs),
+                captureChecks,
+            };
+        }
+        const now = nowFn();
         if (now - lastAliveCheck >= WEB_TERMINAL_STARTUP_ALIVE_CHECK_MS) {
             lastAliveCheck = now;
-            const alive = await (0, web_terminal_js_1.hasTmuxSession)(record.tmuxSession);
-            if (!alive)
-                return;
+            const alive = await hasTmuxSessionFn(record.tmuxSession);
+            if (!alive) {
+                return {
+                    ready: false,
+                    source: 'tmux-exited',
+                    elapsedMs: Math.max(0, nowFn() - startMs),
+                    captureChecks,
+                };
+            }
+        }
+        const captureIntervalMs = captureIntervalFor(now - startMs);
+        const recentLiveOutput = (now - lastLiveOutputAt) < WEB_TERMINAL_STARTUP_CAPTURE_SKIP_ON_LIVE_MS;
+        if ((now - lastCaptureCheck) >= captureIntervalMs && !(recentLiveOutput && (sawLaunchSignal || sawSummary))) {
+            lastCaptureCheck = now;
+            try {
+                tmuxBin ||= await getTmuxBinaryFn();
+                captureChecks += 1;
+                const captured = await capturePane(tmuxBin, record.tmuxSession);
+                const captureReadySource = (0, web_terminal_startup_readiness_js_1.isWebTerminalStartupReady)(record.agent, captured)
+                    ? ((0, web_terminal_startup_readiness_js_1.getWebTerminalStartupSignals)(record.agent, captured).launchKind === 'device-auth' ? 'device-auth' : 'tmux-capture')
+                    : observeStartupSignals(captured, 'capture');
+                if (captureReadySource) {
+                    return {
+                        ready: true,
+                        source: captureReadySource,
+                        elapsedMs: Math.max(0, nowFn() - startMs),
+                        captureChecks,
+                    };
+                }
+            }
+            catch {
+                // Best effort only. Live bridge output remains the primary signal.
+            }
         }
-        await sleep(WEB_TERMINAL_STARTUP_READY_POLL_MS);
+        const elapsedMs = nowFn() - startMs;
+        const progressBucket = Math.floor(elapsedMs / WEB_TERMINAL_STARTUP_PROGRESS_UPDATE_MS);
+        if (progressBucket > lastProgressBucket) {
+            lastProgressBucket = progressBucket;
+            onProgress?.('session_start', describeWait(sawLaunchSignal, sawSummary, elapsedMs));
+        }
+        await sleepFn(WEB_TERMINAL_STARTUP_READY_POLL_MS);
     }
+    return {
+        ready: false,
+        source: 'timeout',
+        elapsedMs: Math.max(0, nowFn() - startMs),
+        captureChecks,
+    };
 }
 function broadcastWebTerminalMessage(bridge, payload) {
     for (const ws of bridge.clients) {
@@ -1571,12 +1842,12 @@ async function ensureWebTerminalBridge(record) {
         env,
     };
     try {
-        ptyProcess = ptyModule.spawn(tmuxBin, ['attach-session', '-t', record.tmuxSession], spawnOpts);
+        ptyProcess = ptyModule.spawn(tmuxBin, ['attach-session', '-d', '-t', record.tmuxSession], spawnOpts);
     }
     catch (err) {
         const shell = (process.env.SHELL || '/bin/bash').trim() || '/bin/bash';
         const quote = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
-        const launch = `${quote(tmuxBin)} attach-session -t ${quote(record.tmuxSession)}`;
+        const launch = `${quote(tmuxBin)} attach-session -d -t ${quote(record.tmuxSession)}`;
         try {
             ptyProcess = ptyModule.spawn(shell, ['-lc', launch], spawnOpts);
         }
@@ -1599,6 +1870,18 @@ async function ensureWebTerminalBridge(record) {
     bridge.stopRequested = false;
     bridge.pty = ptyProcess;
     webTerminalBridges.set(record.id, bridge);
+    if (!existing && bridge.history.length === 0) {
+        try {
+            const { stdout } = await execFileAsync(tmuxBin, ['capture-pane', '-p', '-S', WEB_TERMINAL_STARTUP_CAPTURE_LINES, '-t', record.tmuxSession], { timeout: 2_000, maxBuffer: WEB_TERMINAL_STARTUP_READY_BUFFER_LIMIT });
+            const snapshot = String(stdout || '');
+            if (snapshot) {
+                appendWebTerminalBuffer(bridge, snapshot);
+            }
+        }
+        catch {
+            // Best effort only; live bridge output continues to stream after attach.
+        }
+    }
     ptyProcess.onData((data) => {
         const appended = appendWebTerminalBuffer(bridge, data);
         for (const chunk of appended) {
@@ -1682,7 +1965,8 @@ async function startClaudeHeadlessWsRun(ws, record, prompt, resumeSessionId) {
     }
     send({ type: 'status', stage: 'runtime_setup', message: 'Checking container runtime...' });
     const config = (0, config_js_1.loadConfig)();
-    const runtimeReady = await prepareRuntimeForWebTerminal(config.runtime);
+    const runtimePreference = record.runtime || config.runtime;
+    const runtimeReady = await prepareRuntimeForWebTerminal(runtimePreference);
     if (!runtimeReady.ok) {
         send({
             type: 'error',
@@ -1691,7 +1975,7 @@ async function startClaudeHeadlessWsRun(ws, record, prompt, resumeSessionId) {
         });
         return () => { };
     }
-    const runtimeCheck = (0, runtime_js_1.checkRuntime)(config.runtime);
+    const runtimeCheck = (0, runtime_js_1.checkRuntime)(runtimePreference);
     if (!runtimeCheck.ok || !runtimeCheck.runtime) {
         send({
             type: 'error',
@@ -1700,16 +1984,17 @@ async function startClaudeHeadlessWsRun(ws, record, prompt, resumeSessionId) {
         });
         return () => { };
     }
-    if (runtimeCheck.runtime !== 'apptainer') {
+    const runtime = runtimeCheck.runtime;
+    if (runtime !== 'apptainer' && runtime !== 'podman') {
         send({
             type: 'error',
             code: 'runtime_unsupported',
-            error: `Headless Claude chat currently supports Apptainer only (detected: ${runtimeCheck.runtime}).`,
+            error: `Headless Claude chat requires an Apptainer or Podman runtime (detected: ${runtime}).`,
         });
         return () => { };
     }
     try {
-        await ensureWebTerminalImageReady(runtimeCheck.runtime, config.image, (stage, message) => {
+        await ensureWebTerminalImageReady(runtime, config.image, (stage, message) => {
             send({ type: 'status', stage, message });
         });
     }
@@ -1722,7 +2007,7 @@ async function startClaudeHeadlessWsRun(ws, record, prompt, resumeSessionId) {
         return () => { };
     }
     try {
-        await ensureWebTerminalAgentReady(runtimeCheck.runtime, config.image, 'claude', record.workdir, config.network.mode, (stage, message) => send({ type: 'status', stage, message }));
+        await ensureWebTerminalAgentReady(runtime, config.image, 'claude', record.workdir, config.network.mode, (stage, message) => send({ type: 'status', stage, message }));
     }
     catch (err) {
         send({
@@ -1732,8 +2017,8 @@ async function startClaudeHeadlessWsRun(ws, record, prompt, resumeSessionId) {
         });
         return () => { };
     }
-    const args = buildClaudeHeadlessApptainerArgs(config, record.workdir, trimmedPrompt, resumeSessionId, (0, config_js_1.shouldClaudeHeadlessRunWithAllowedPermissions)(config));
-    const child = (0, child_process_1.spawn)('apptainer', args, {
+    const command = buildClaudeHeadlessRuntimeCommand(runtime, config, record.workdir, trimmedPrompt, resumeSessionId, (0, config_js_1.shouldClaudeHeadlessRunWithAllowedPermissions)(config));
+    const child = (0, child_process_1.spawn)(command.command, command.args, {
         cwd: record.workdir,
         env: process.env,
         stdio: ['ignore', 'pipe', 'pipe'],
@@ -1744,6 +2029,7 @@ async function startClaudeHeadlessWsRun(ws, record, prompt, resumeSessionId) {
     let emittedAssistantText = '';
     let doneSent = false;
     let syntheticToolUseSeq = 0;
+    let authRequiredSent = false;
     const sendDone = (exitCode) => {
         if (doneSent)
             return;
@@ -1806,12 +2092,12 @@ async function startClaudeHeadlessWsRun(ws, record, prompt, resumeSessionId) {
                             const detail = extractToolDetailFromToolUseBlock(toolBlock);
                             const toolUseId = normalizeToolUseId(toolBlock.id) || `tool-${Date.now().toString(36)}-${(++syntheticToolUseSeq).toString(36)}`;
                             // Intercept display_widget calls and forward rich content payload
-                            if (toolName === 'display_widget') {
-                                const input = toolBlock.input;
-                                if (input && typeof input.widget === 'string') {
+                            if (isDisplayWidgetToolName(toolName)) {
+                                const input = parseToolInput(toolBlock.input ?? toolBlock.arguments ?? toolBlock.params);
+                                if (typeof input.widget === 'string' && input.widget.trim()) {
                                     send({
                                         type: 'rich_content',
-                                        widget: String(input.widget),
+                                        widget: String(input.widget).trim(),
                                         title: input.title ? String(input.title) : undefined,
                                         data: (input.data && typeof input.data === 'object') ? input.data : {},
                                         id: toolUseId,
@@ -1832,19 +2118,22 @@ async function startClaudeHeadlessWsRun(ws, record, prompt, resumeSessionId) {
                         if (block && typeof block === 'object' && !Array.isArray(block) && block.type === 'tool_result') {
                             const resultBlock = block;
                             const toolUseId = normalizeToolUseId(resultBlock.tool_use_id);
+                            const detail = extractToolResultDetailFromBlock(resultBlock);
                             send({
                                 type: 'tool_result',
                                 tool_use_id: toolUseId || undefined,
                                 is_error: !!resultBlock.is_error,
+                                detail: detail || undefined,
                             });
                         }
                     }
                 }
             }
-            if (isClaudeAuthenticationFailure(event, snapshot, stderrBuffer)) {
+            if (!authRequiredSent && isClaudeAuthenticationFailure(event, snapshot, stderrBuffer)) {
+                authRequiredSent = true;
                 send({
                     type: 'auth_required',
-                    error: 'Claude authentication is required. Run /login in raw terminal mode to refresh session.',
+                    error: 'Claude authentication is required. Type /login in chat (or run `claude auth login` in raw mode) to refresh session.',
                 });
             }
         }
@@ -2000,21 +2289,7 @@ async function handlePostConfig(req, res) {
             }
         }
         const configPath = (0, config_js_1.getConfigPath)();
-        // Read existing raw file and parse (strip comments)
-        let obj = {};
-        if ((0, fs_1.existsSync)(configPath)) {
-            const rawText = (0, fs_1.readFileSync)(configPath, 'utf-8');
-            const stripped = rawText
-                .split('\n')
-                .filter(line => !line.trimStart().startsWith('//'))
-                .join('\n');
-            try {
-                obj = JSON.parse(stripped);
-            }
-            catch {
-                obj = {};
-            }
-        }
+        const obj = (0, config_js_1.readRawConfigFile)(configPath);
         // Merge incoming config
         obj.runtime = incoming.runtime;
         obj.image = incoming.image;
@@ -2030,9 +2305,7 @@ async function handlePostConfig(req, res) {
             obj.headless = incoming.headless;
         if (incoming.plugins)
             obj.plugins = incoming.plugins;
-        const { writeFileSync } = await import('fs');
-        writeFileSync(configPath, JSON.stringify(obj, null, 2) + '\n', { encoding: 'utf-8', mode: config_js_1.PRIVATE_FILE_MODE });
-        (0, config_js_1.ensurePrivateFile)(configPath);
+        (0, config_js_1.writeRawConfigFile)(obj, configPath);
         json(res, { ok: true });
     }
     catch (err) {
@@ -2067,20 +2340,13 @@ async function handlePostPlugins(req, res) {
         }
         // Read existing config file
         const configPath = (0, config_js_1.getConfigPath)();
-        let obj = {};
-        if ((0, fs_1.existsSync)(configPath)) {
-            const rawText = (0, fs_1.readFileSync)(configPath, 'utf-8');
-            const stripped = rawText
-                .split('\n')
-                .filter(line => !line.trimStart().startsWith('//'))
-                .join('\n');
-            try {
-                obj = JSON.parse(stripped);
-            }
-            catch (err) {
-                json(res, { ok: false, errors: [`Could not parse existing config file: ${err.message ?? String(err)}`] }, 400);
-                return;
-            }
+        let obj;
+        try {
+            obj = (0, config_js_1.readRawConfigFile)(configPath);
+        }
+        catch (err) {
+            json(res, { ok: false, errors: [`Could not parse existing config file: ${err.message ?? String(err)}`] }, 400);
+            return;
         }
         // Merge plugin state
         const rawPlugins = (obj.plugins ?? {});
@@ -2096,9 +2362,7 @@ async function handlePostPlugins(req, res) {
         }
         plugins[pluginId] = enabled;
         obj.plugins = plugins;
-        const { writeFileSync } = await import('fs');
-        writeFileSync(configPath, JSON.stringify(obj, null, 2) + '\n', { encoding: 'utf-8', mode: config_js_1.PRIVATE_FILE_MODE });
-        (0, config_js_1.ensurePrivateFile)(configPath);
+        (0, config_js_1.writeRawConfigFile)(obj, configPath);
         json(res, { ok: true, plugins });
     }
     catch (err) {
@@ -2307,13 +2571,7 @@ async function handleGetUiVersion(reqUrl, res) {
     const published = await getPublishedUiVersionCached(forceRefresh);
     const runningVersion = LABGATE_UI_VERSION;
     const latestVersion = published.latestVersion;
-    let updateAvailable = false;
-    if (latestVersion) {
-        const cmp = compareSemverStrings(latestVersion, runningVersion);
-        updateAvailable = cmp === null
-            ? stripVersionPrefix(latestVersion) !== stripVersionPrefix(runningVersion)
-            : cmp > 0;
-    }
+    const updateAvailable = (0, update_check_js_1.isVersionNewer)(latestVersion, runningVersion);
     json(res, {
         ok: true,
         runningVersion,
@@ -2321,7 +2579,7 @@ async function handleGetUiVersion(reqUrl, res) {
         latestVersion,
         latestCheckedAt: published.checkedAt,
         updateAvailable,
-        updateCommand: `npm install -g ${UI_VERSION_NPM_PACKAGE}@latest`,
+        updateCommand: (0, update_check_js_1.getUpdateCommand)(update_check_js_1.LABGATE_NPM_PACKAGE),
         restartCommand: 'labgate ui',
         checkError: published.error,
     });
@@ -2832,6 +3090,182 @@ function collectWebsiteUrls(value, accessedUrls, ts, keyHint = '') {
         }
     }
 }
+function normalizeToolName(rawName) {
+    return String(rawName || '').trim().toLowerCase();
+}
+function parseToolInput(rawInput) {
+    if (rawInput && typeof rawInput === 'object' && !Array.isArray(rawInput)) {
+        return rawInput;
+    }
+    if (typeof rawInput === 'string') {
+        try {
+            const parsed = JSON.parse(rawInput);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                return parsed;
+            }
+        }
+        catch {
+            // Some tools pass non-JSON strings; ignore.
+        }
+    }
+    return {};
+}
+function classifyToolAction(toolName) {
+    if (toolName === 'edit' ||
+        toolName === 'multiedit' ||
+        toolName === 'apply_patch' ||
+        toolName.endsWith('.apply_patch') ||
+        toolName === 'mcp__obsidian__patch_note')
+        return 'edit';
+    if (toolName === 'write' ||
+        toolName === 'notebookedit' ||
+        toolName === 'mcp__obsidian__write_note' ||
+        toolName === 'mcp__obsidian__update_frontmatter' ||
+        toolName === 'mcp__obsidian__move_note' ||
+        toolName === 'mcp__obsidian__delete_note' ||
+        toolName === 'mcp__obsidian__manage_tags')
+        return 'write';
+    if (toolName === 'read' ||
+        toolName === 'glob' ||
+        toolName === 'grep' ||
+        toolName === 'mcp__obsidian__read_note' ||
+        toolName === 'mcp__obsidian__read_multiple_notes' ||
+        toolName === 'mcp__obsidian__get_frontmatter' ||
+        toolName === 'mcp__obsidian__get_notes_info' ||
+        toolName === 'mcp__obsidian__get_vault_stats' ||
+        toolName === 'mcp__obsidian__list_directory' ||
+        toolName === 'mcp__obsidian__search_notes')
+        return 'read';
+    return 'unknown';
+}
+function normalizeTrackedPath(rawPath) {
+    const token = sanitizeTokenEdge(rawPath || '');
+    if (!token)
+        return '';
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(token))
+        return '';
+    if (token.startsWith('/'))
+        return token;
+    if (/^[A-Za-z]:[\\/]/.test(token))
+        return token;
+    if (token === '.' || token === '..')
+        return '';
+    const relative = token.replace(/^\.\/+/, '');
+    return relative ? `/work/${relative}` : '';
+}
+function rememberToolPathValue(accessedFiles, value, ts, action) {
+    if (typeof value === 'string') {
+        const normalized = normalizeTrackedPath(value);
+        if (normalized)
+            rememberFileEntry(accessedFiles, normalized, ts, action);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            if (typeof item === 'string') {
+                const normalized = normalizeTrackedPath(item);
+                if (normalized)
+                    rememberFileEntry(accessedFiles, normalized, ts, action);
+            }
+        }
+    }
+}
+function classifyCommandVerbAction(command) {
+    const verb = String(command || '').trim().toLowerCase();
+    if (!verb)
+        return 'unknown';
+    if ([
+        'cat', 'head', 'tail', 'less', 'more', 'wc', 'diff', 'grep', 'rg', 'awk',
+        'find', 'ls', 'stat', 'realpath', 'readlink',
+    ].includes(verb))
+        return 'read';
+    if (['vi', 'vim', 'nano', 'code', 'sed', 'perl'].includes(verb))
+        return 'edit';
+    if (['write', 'cp', 'mv', 'rm', 'touch', 'chmod', 'chown', 'mkdir', 'rmdir', 'truncate', 'tee'].includes(verb))
+        return 'write';
+    return 'unknown';
+}
+function collectFileAccessFromCommand(commandRaw, ts, accessedFiles, accessedUrls) {
+    const cmd = typeof commandRaw === 'string' ? commandRaw : '';
+    if (!cmd.trim())
+        return;
+    for (const url of extractWebsiteUrlsFromText(cmd)) {
+        rememberTimestampedEntry(accessedUrls, url, ts);
+    }
+    const segments = cmd.split(/(?:\|\||&&|[|;])/).map((part) => part.trim()).filter(Boolean);
+    for (const segment of segments) {
+        const words = segment.split(/\s+/).filter(Boolean);
+        if (words.length === 0)
+            continue;
+        const verb = words[0].replace(/^[^A-Za-z0-9._-]+/, '').replace(/[^\w.-]+$/, '');
+        const action = classifyCommandVerbAction(verb);
+        const absMatches = segment.match(/\/work\/\S+/g);
+        if (absMatches) {
+            for (const p of absMatches) {
+                const clean = p.replace(/['"`;,)}\]]+$/, '');
+                rememberFileEntry(accessedFiles, clean, ts, action);
+            }
+        }
+        for (let idx = 1; idx < words.length; idx += 1) {
+            const token = sanitizeTokenEdge(words[idx]);
+            if (!token || token.startsWith('-') || token === '.' || token === '..')
+                continue;
+            if (/^[a-z][a-z0-9+.-]*:\/\//i.test(token))
+                continue;
+            if (token.startsWith('/')) {
+                if (token.startsWith('/work/'))
+                    rememberFileEntry(accessedFiles, token, ts, action);
+                continue;
+            }
+            if (token.includes('=') && !token.includes('/') && !token.includes('.'))
+                continue;
+            if (token.includes('/') || token.includes('.')) {
+                const relative = token.replace(/^\.\/+/, '');
+                if (relative)
+                    rememberFileEntry(accessedFiles, `/work/${relative}`, ts, action);
+            }
+        }
+    }
+}
+function collectFileAccessFromPatch(patchRaw, ts, accessedFiles) {
+    const patch = typeof patchRaw === 'string' ? patchRaw : '';
+    if (!patch)
+        return;
+    const fileLineRe = /\*\*\* (?:Add|Update|Delete) File:\s+([^\n\r]+)/g;
+    let match;
+    while ((match = fileLineRe.exec(patch)) !== null) {
+        const normalized = normalizeTrackedPath(match[1] || '');
+        if (normalized)
+            rememberFileEntry(accessedFiles, normalized, ts, 'edit');
+    }
+}
+function collectFileAccessFromToolCall(rawName, rawInput, ts, accessedFiles, accessedUrls) {
+    const toolName = normalizeToolName(rawName);
+    const input = parseToolInput(rawInput);
+    const action = classifyToolAction(toolName);
+    collectWebsiteUrls(input, accessedUrls, ts);
+    rememberToolPathValue(accessedFiles, input.file_path, ts, action);
+    rememberToolPathValue(accessedFiles, input.path, ts, action);
+    rememberToolPathValue(accessedFiles, input.paths, ts, action);
+    rememberToolPathValue(accessedFiles, input.oldPath, ts, action);
+    rememberToolPathValue(accessedFiles, input.newPath, ts, action);
+    rememberToolPathValue(accessedFiles, input.confirmPath, ts, action);
+    if (toolName === 'grep') {
+        rememberToolPathValue(accessedFiles, input.path, ts, 'read');
+    }
+    if (toolName === 'bash' || toolName === 'exec_command' || toolName.endsWith('.exec_command')) {
+        const command = typeof input.command === 'string'
+            ? input.command
+            : (typeof input.cmd === 'string' ? input.cmd : '');
+        collectFileAccessFromCommand(command, ts, accessedFiles, accessedUrls);
+    }
+    if (toolName === 'apply_patch' || toolName.endsWith('.apply_patch')) {
+        const patchText = typeof input.input === 'string'
+            ? input.input
+            : (typeof input.patch === 'string' ? input.patch : '');
+        collectFileAccessFromPatch(patchText, ts, accessedFiles);
+    }
+}
 /**
  * Tail-read the last ~16KB of a file and return the last parseable
  * non-snapshot JSONL entry, last user prompt, and recently accessed files.
@@ -2854,106 +3288,171 @@ function tailLastJsonlEntry(filePath) {
         const text = buf.toString('utf-8');
         const lines = text.split('\n').filter(l => l.trim().length > 0);
         let lastEntry = null;
+        let lastEntryTsMs = 0;
         let lastUserPrompt = '';
         const accessedFiles = new Map();
         const accessedUrls = new Map();
+        let timestampOffsetMs = null;
         // Walk backwards through all parseable lines
         for (let i = lines.length - 1; i >= 0; i--) {
             try {
                 const obj = JSON.parse(lines[i]);
-                if (obj.type === 'summary' || obj.type === 'snapshot' || obj.type === 'file-history-snapshot')
+                const entryType = String(obj.type || '');
+                if (entryType === 'summary' || entryType === 'snapshot' || entryType === 'file-history-snapshot')
                     continue;
-                if (!lastEntry)
-                    lastEntry = obj;
-                const parsed = obj.timestamp ? new Date(obj.timestamp).getTime() : 0;
-                const ts = (parsed && !isNaN(parsed)) ? parsed : Date.now();
+                const payload = (obj.payload && typeof obj.payload === 'object' && !Array.isArray(obj.payload))
+                    ? obj.payload
+                    : null;
+                const parsed = typeof obj.timestamp === 'string' ? new Date(obj.timestamp).getTime() : 0;
+                const hasParsedTimestamp = parsed && !isNaN(parsed);
+                if (timestampOffsetMs === null && hasParsedTimestamp) {
+                    timestampOffsetMs = computeTranscriptTimestampOffsetMs(parsed, st.mtimeMs);
+                }
+                const ts = hasParsedTimestamp
+                    ? applyTranscriptTimestampOffset(parsed, timestampOffsetMs || 0)
+                    : Date.now();
                 // Collect file paths from tool_use entries
-                if (obj.type === 'assistant' && Array.isArray(obj.message?.content)) {
-                    for (const block of obj.message.content) {
-                        if (block.type !== 'tool_use' || !block.input)
-                            continue;
-                        const name = block.name || '';
-                        collectWebsiteUrls(block.input, accessedUrls, ts);
-                        // Classify tool action
-                        const toolAction = (name === 'Edit' || name === 'edit') ? 'edit' :
-                            (name === 'Write' || name === 'write' || name === 'NotebookEdit') ? 'write' :
-                                (name === 'Read' || name === 'read' || name === 'Glob' || name === 'glob') ? 'read' :
-                                    (name === 'Grep' || name === 'grep') ? 'read' :
-                                        'unknown';
-                        // Direct file_path from Read/Edit/Write/Glob tools
-                        const fp = block.input.file_path || block.input.path || '';
-                        if (fp) {
-                            rememberFileEntry(accessedFiles, fp, ts, toolAction);
-                        }
-                        // Grep pattern → search path
-                        if ((name === 'Grep' || name === 'grep') && block.input.path) {
-                            rememberFileEntry(accessedFiles, block.input.path, ts, 'read');
-                        }
-                        // Extract file paths from Bash commands
-                        if (name === 'Bash' || name === 'bash') {
-                            const cmd = block.input.command || '';
-                            // Absolute /work/ paths
-                            const absMatches = cmd.match(/\/work\/\S+/g);
-                            if (absMatches) {
-                                for (const p of absMatches) {
-                                    const clean = p.replace(/['"`;,)}\]]+$/, '');
-                                    rememberFileEntry(accessedFiles, clean, ts, 'unknown');
-                                }
-                            }
-                            for (const url of extractWebsiteUrlsFromText(cmd)) {
-                                rememberTimestampedEntry(accessedUrls, url, ts);
-                            }
-                            // Relative paths from file-accessing commands (cat, head, tail, less, vi, etc.)
-                            // Also handles: python script.py, node file.js, chmod, cp, mv, rm, etc.
-                            const argMatches = cmd.match(/(?:cat|head|tail|less|more|vi|vim|nano|code|python3?|node|chmod|cp|mv|rm|touch|wc|diff|grep|rg|sed|awk|source|bash|sh)\s+(?:-\S+\s+)*([^\s|>&;]+)/g);
-                            if (argMatches) {
-                                for (const m of argMatches) {
-                                    // Extract the file argument (last non-flag token)
-                                    const tokens = m.split(/\s+/).filter((t) => !t.startsWith('-'));
-                                    const fileArg = tokens[tokens.length - 1] || '';
-                                    if (fileArg && !fileArg.startsWith('/') && !fileArg.startsWith('-') && (fileArg.includes('/') || fileArg.includes('.'))) {
-                                        const full = '/work/' + fileArg;
-                                        rememberFileEntry(accessedFiles, full, ts, 'unknown');
-                                    }
-                                }
-                            }
+                if (entryType === 'assistant') {
+                    const message = (obj.message && typeof obj.message === 'object' && !Array.isArray(obj.message))
+                        ? obj.message
+                        : null;
+                    const content = message?.content;
+                    if (Array.isArray(content)) {
+                        for (const block of content) {
+                            if (!block || typeof block !== 'object' || Array.isArray(block))
+                                continue;
+                            const typedBlock = block;
+                            if (typedBlock.type !== 'tool_use')
+                                continue;
+                            collectFileAccessFromToolCall(typedBlock.name, typedBlock.input, ts, accessedFiles, accessedUrls);
                         }
                     }
                 }
-                // Also extract paths from tool_result content (file listings, etc.)
-                if (obj.type === 'user' && Array.isArray(obj.message?.content)) {
-                    for (const block of obj.message.content) {
-                        if (block.type !== 'tool_result')
-                            continue;
-                        const text = extractTextContent(block.content);
-                        // Look for /work/ paths in tool output
-                        const pathMatches = text.match(/\/work\/[^\s:]+/g);
+                // Codex transcript format: response_item.function_call entries
+                if (entryType === 'response_item' && payload) {
+                    const payloadType = String(payload.type || '').toLowerCase();
+                    if (payloadType === 'function_call') {
+                        collectFileAccessFromToolCall(payload.name, payload.arguments, ts, accessedFiles, accessedUrls);
+                        if (!lastEntry) {
+                            lastEntry = {
+                                type: 'assistant',
+                                timestamp: obj.timestamp || null,
+                                message: {
+                                    content: [{
+                                            type: 'tool_use',
+                                            name: String(payload.name || ''),
+                                            input: parseToolInput(payload.arguments),
+                                        }],
+                                },
+                            };
+                            lastEntryTsMs = ts;
+                        }
+                    }
+                    else if (payloadType === 'function_call_output') {
+                        const outputText = extractTextContent(payload.output);
+                        const pathMatches = outputText.match(/\/work\/[^\s:]+/g);
                         if (pathMatches) {
-                            for (const p of pathMatches.slice(0, 20)) { // cap to avoid perf issues
+                            for (const p of pathMatches.slice(0, 20)) {
                                 const clean = p.replace(/['"`;,)}\]]+$/, '');
                                 rememberFileEntry(accessedFiles, clean, ts, 'unknown');
                             }
                         }
-                        for (const url of extractWebsiteUrlsFromText(text).slice(0, 30)) {
+                        for (const url of extractWebsiteUrlsFromText(outputText).slice(0, 30)) {
                             rememberTimestampedEntry(accessedUrls, url, ts);
                         }
                     }
+                    else if (payloadType === 'message' && !lastEntry) {
+                        const role = String(payload.role || '').toLowerCase();
+                        if (role === 'assistant' || role === 'user') {
+                            lastEntry = {
+                                type: role,
+                                timestamp: obj.timestamp || null,
+                                message: { content: Array.isArray(payload.content) ? payload.content : [] },
+                            };
+                            lastEntryTsMs = ts;
+                        }
+                    }
+                }
+                // Also extract paths from tool_result content (file listings, etc.)
+                if (entryType === 'user') {
+                    const message = (obj.message && typeof obj.message === 'object' && !Array.isArray(obj.message))
+                        ? obj.message
+                        : null;
+                    const content = message?.content;
+                    if (Array.isArray(content)) {
+                        for (const block of content) {
+                            if (!block || typeof block !== 'object' || Array.isArray(block))
+                                continue;
+                            const typedBlock = block;
+                            if (typedBlock.type !== 'tool_result')
+                                continue;
+                            const blockText = extractTextContent(typedBlock.content);
+                            // Look for /work/ paths in tool output
+                            const pathMatches = blockText.match(/\/work\/[^\s:]+/g);
+                            if (pathMatches) {
+                                for (const p of pathMatches.slice(0, 20)) { // cap to avoid perf issues
+                                    const clean = p.replace(/['"`;,)}\]]+$/, '');
+                                    rememberFileEntry(accessedFiles, clean, ts, 'unknown');
+                                }
+                            }
+                            for (const url of extractWebsiteUrlsFromText(blockText).slice(0, 30)) {
+                                rememberTimestampedEntry(accessedUrls, url, ts);
+                            }
+                        }
+                    }
                 }
                 // Find the last real user prompt
-                if (!lastUserPrompt && obj.type === 'user' && !obj.isMeta) {
-                    const content = obj.message?.content;
+                if (!lastUserPrompt && entryType === 'user' && !obj.isMeta) {
+                    const message = (obj.message && typeof obj.message === 'object' && !Array.isArray(obj.message))
+                        ? obj.message
+                        : null;
+                    const content = message?.content;
                     if (typeof content === 'string' && content.length > 0) {
                         if (!content.includes('<local-command-caveat>')) {
                             lastUserPrompt = content.slice(0, 500);
                         }
                     }
                     else if (Array.isArray(content)) {
-                        const textBlock = content.find((b) => b.type === 'text' && b.text);
-                        if (textBlock && !textBlock.text.includes('<local-command-caveat>')) {
+                        const textBlock = content.find((b) => {
+                            if (!b || typeof b !== 'object' || Array.isArray(b))
+                                return false;
+                            const typed = b;
+                            return typed.type === 'text' && typeof typed.text === 'string' && typed.text.length > 0;
+                        });
+                        if (textBlock && typeof textBlock.text === 'string' && !textBlock.text.includes('<local-command-caveat>')) {
                             lastUserPrompt = textBlock.text.slice(0, 500);
                         }
                     }
                 }
+                // Codex transcript format: response_item.message entries carry prompts as input_text blocks.
+                if (!lastUserPrompt && entryType === 'response_item' && payload) {
+                    const payloadType = String(payload.type || '').toLowerCase();
+                    const role = String(payload.role || '').toLowerCase();
+                    if (payloadType === 'message' && role === 'user') {
+                        const content = payload.content;
+                        if (typeof content === 'string' && !content.includes('<local-command-caveat>')) {
+                            lastUserPrompt = content.slice(0, 500);
+                        }
+                        else if (Array.isArray(content)) {
+                            const textBlock = content.find((b) => {
+                                if (!b || typeof b !== 'object' || Array.isArray(b))
+                                    return false;
+                                const typed = b;
+                                if (typeof typed.text !== 'string' || typed.text.length === 0)
+                                    return false;
+                                const blockType = String(typed.type || '');
+                                return blockType === 'input_text' || blockType === 'text';
+                            });
+                            if (textBlock && typeof textBlock.text === 'string' && !textBlock.text.includes('<local-command-caveat>')) {
+                                lastUserPrompt = textBlock.text.slice(0, 500);
+                            }
+                        }
+                    }
+                }
+                if (!lastEntry && (entryType === 'assistant' || entryType === 'user' || entryType === 'human')) {
+                    lastEntry = obj;
+                    lastEntryTsMs = ts;
+                }
             }
             catch {
                 // Line may be truncated at the start of our read window — skip it
@@ -2961,7 +3460,14 @@ function tailLastJsonlEntry(filePath) {
         }
         if (!lastEntry)
             return null;
-        return { entry: lastEntry, lastUserPrompt, accessedFiles, accessedUrls, mtimeMs: st.mtimeMs };
+        return {
+            entry: lastEntry,
+            entryTsMs: lastEntryTsMs,
+            lastUserPrompt,
+            accessedFiles,
+            accessedUrls,
+            mtimeMs: st.mtimeMs,
+        };
     }
     catch {
         return null;
@@ -3020,7 +3526,12 @@ function scanJsonlFiles(root, maxDepth = 4, maxEntries = JSONL_SCAN_MAX_ENTRIES)
                         continue;
                     }
                     if (entry.endsWith('.jsonl')) {
-                        files.push({ path: fullPath, mtimeMs: st.mtimeMs, ctimeMs: st.ctimeMs });
+                        files.push({
+                            path: fullPath,
+                            mtimeMs: st.mtimeMs,
+                            ctimeMs: st.ctimeMs,
+                            birthtimeMs: st.birthtimeMs,
+                        });
                     }
                 }
                 catch {
@@ -3034,6 +3545,81 @@ function scanJsonlFiles(root, maxDepth = 4, maxEntries = JSONL_SCAN_MAX_ENTRIES)
     }
     return files;
 }
+function normalizeFileTimestampMs(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : 0;
+}
+function computeTranscriptTimestampOffsetMs(transcriptTsMs, fileMtimeMs) {
+    const transcriptMs = normalizeFileTimestampMs(transcriptTsMs);
+    const mtimeMs = normalizeFileTimestampMs(fileMtimeMs);
+    if (!transcriptMs || !mtimeMs)
+        return 0;
+    const offsetMs = mtimeMs - transcriptMs;
+    if (Math.abs(offsetMs) < (2 * 60 * 1000))
+        return 0;
+    if (Math.abs(offsetMs) > (12 * 60 * 60 * 1000))
+        return 0;
+    return offsetMs;
+}
+function applyTranscriptTimestampOffset(tsMs, offsetMs) {
+    const ts = normalizeFileTimestampMs(tsMs);
+    if (!ts || !offsetMs)
+        return ts;
+    const adjusted = ts + offsetMs;
+    return adjusted > 0 ? adjusted : ts;
+}
+function getStableJsonlBirthtimeMs(file) {
+    const birthtimeMs = normalizeFileTimestampMs(file.birthtimeMs);
+    if (!birthtimeMs)
+        return 0;
+    const ctimeMs = normalizeFileTimestampMs(file.ctimeMs);
+    const mtimeMs = normalizeFileTimestampMs(file.mtimeMs);
+    if (mtimeMs && birthtimeMs > (mtimeMs + 1_000))
+        return 0;
+    // Some filesystems synthesize birthtime from ctime; reject that once the
+    // file has clearly been modified after creation.
+    if (ctimeMs &&
+        Math.abs(birthtimeMs - ctimeMs) <= 1_000 &&
+        mtimeMs &&
+        Math.abs(mtimeMs - ctimeMs) > 1_000) {
+        return 0;
+    }
+    return birthtimeMs;
+}
+function selectTranscriptFileForSession(sessionStartMs, jsonlFiles) {
+    if (!Number.isFinite(sessionStartMs) || sessionStartMs <= 0 || jsonlFiles.length === 0) {
+        return null;
+    }
+    const birthCandidates = jsonlFiles
+        .map((file) => {
+        const birthtimeMs = getStableJsonlBirthtimeMs(file);
+        const mtimeMs = normalizeFileTimestampMs(file.mtimeMs);
+        return {
+            file,
+            birthtimeMs,
+            birthDelta: birthtimeMs > 0 ? Math.abs(birthtimeMs - sessionStartMs) : Number.POSITIVE_INFINITY,
+            mtimeDelta: Math.abs(mtimeMs - sessionStartMs),
+        };
+    })
+        .filter((entry) => entry.birthtimeMs > 0)
+        .sort((a, b) => a.birthDelta - b.birthDelta
+        || a.mtimeDelta - b.mtimeDelta
+        || b.file.mtimeMs - a.file.mtimeMs);
+    if (birthCandidates.length > 0) {
+        return birthCandidates[0].file;
+    }
+    const futureByMtime = [...jsonlFiles]
+        .filter((file) => normalizeFileTimestampMs(file.mtimeMs) >= sessionStartMs)
+        .sort((a, b) => (normalizeFileTimestampMs(a.mtimeMs) - sessionStartMs)
+        - (normalizeFileTimestampMs(b.mtimeMs) - sessionStartMs)
+        || b.mtimeMs - a.mtimeMs);
+    if (futureByMtime.length > 0) {
+        return futureByMtime[0];
+    }
+    const closestByMtime = [...jsonlFiles].sort((a, b) => Math.abs(normalizeFileTimestampMs(a.mtimeMs) - sessionStartMs)
+        - Math.abs(normalizeFileTimestampMs(b.mtimeMs) - sessionStartMs)
+        || b.mtimeMs - a.mtimeMs);
+    return closestByMtime[0] || null;
+}
 /**
  * Scan sandbox home for agent conversation JSONL files.
  * Results are cached briefly to keep `/api/sessions` responsive.
@@ -3068,33 +3654,34 @@ function findProjectJsonlFiles(agent) {
  */
 function extractToolDetailFromToolUseBlock(block) {
     const name = String(block.name || '');
+    const normalizedName = name.toLowerCase();
     const inputRaw = block.input;
     const input = inputRaw && typeof inputRaw === 'object' && !Array.isArray(inputRaw)
         ? inputRaw
         : {};
-    if (name === 'Bash' || name === 'bash') {
+    if (normalizedName === 'bash') {
         const cmd = String(input.command || '').slice(0, 60);
         return cmd ? `Ran \`${cmd}\`` : 'Running Bash';
     }
-    if (name === 'Edit' || name === 'edit') {
+    if (normalizedName === 'edit' || normalizedName === 'multiedit') {
         const file = String(input.file_path || '').split('/').pop() || '';
         return file ? `Edited ${file}` : 'Editing a file';
     }
-    if (name === 'Read' || name === 'read') {
+    if (normalizedName === 'read') {
         const file = String(input.file_path || '').split('/').pop() || '';
         return file ? `Read ${file}` : 'Reading a file';
     }
-    if (name === 'Write' || name === 'write') {
+    if (normalizedName === 'write') {
         const file = String(input.file_path || '').split('/').pop() || '';
         return file ? `Wrote ${file}` : 'Writing a file';
     }
-    if (name === 'Grep' || name === 'grep') {
+    if (normalizedName === 'grep') {
         return `Searching for "${String(input.pattern || '').slice(0, 40)}"`;
     }
-    if (name === 'Glob' || name === 'glob') {
+    if (normalizedName === 'glob') {
         return `Finding files: ${String(input.pattern || '').slice(0, 40)}`;
     }
-    if (name === 'Task' || name === 'task') {
+    if (normalizedName === 'task') {
         return 'Spawned subagent';
     }
     return `Using ${name}`;
@@ -3253,6 +3840,9 @@ function getAccessedFiles(accessedFiles, workdir) {
         if (!rel || seen.has(rel))
             continue;
         seen.add(rel);
+        const mappedPath = p.startsWith('/work/')
+            ? (workdir ? (0, path_1.join)(workdir, rel) : p)
+            : p;
         let isDir = false;
         if (p.startsWith('/work/')) {
             const hostPath = (0, path_1.join)(workdir, rel);
@@ -3272,7 +3862,7 @@ function getAccessedFiles(accessedFiles, workdir) {
         }
         files.push({
             name: rel,
-            path: p,
+            path: mappedPath,
             accessedAt: entry.ts,
             isDir,
             action: entry.action,
@@ -3352,7 +3942,7 @@ function pruneSessionActivityCache(now = Date.now()) {
 }
 /**
  * Determine an agent session's current activity by reading transcript JSONL.
- * Correlates session → JSONL by matching session start time with file creation time.
+ * Correlates session → JSONL by matching session start time with transcript creation time.
  */
 function getAgentActivity(session) {
     const unknown = createUnknownActivity();
@@ -3364,20 +3954,16 @@ function getAgentActivity(session) {
     const sessionStartMs = session.started ? new Date(session.started).getTime() : 0;
     if (!sessionStartMs)
         return unknown;
-    const sorted = [...jsonlFiles].sort((a, b) => b.mtimeMs - a.mtimeMs);
-    let bestFile = sorted.find(f => Math.abs(f.ctimeMs - sessionStartMs) < 5 * 60 * 1000);
-    if (!bestFile) {
-        bestFile = sorted.find(f => f.mtimeMs >= sessionStartMs);
-    }
+    const bestFile = selectTranscriptFileForSession(sessionStartMs, jsonlFiles);
     if (!bestFile)
         return unknown;
     const result = tailLastJsonlEntry(bestFile.path);
     if (!result)
         return unknown;
-    const { entry, lastUserPrompt, accessedFiles, accessedUrls, mtimeMs } = result;
+    const { entry, entryTsMs, lastUserPrompt, accessedFiles, accessedUrls, mtimeMs } = result;
     const age = Date.now() - mtimeMs;
     const type = entry.type || '';
-    const entryTs = entry.timestamp ? new Date(entry.timestamp).getTime() : mtimeMs;
+    const entryTs = entryTsMs || mtimeMs;
     // Merge tail-read file accesses into persistent per-session history
     const mergedHistory = mergeFileHistory(session.id || '', accessedFiles);
     const files = getAccessedFiles(mergedHistory, session.workdir || '');
@@ -4038,57 +4624,554 @@ async function handleGetSessions(_req, res) {
                 session.stats = s;
         }
     }
-    catch { /* stats unavailable */ }
-    // Annotate sessions with restart-required status
-    annotateRestartRequired(sessions);
-    json(res, { sessions });
+    catch { /* stats unavailable */ }
+    // Annotate sessions with restart-required status
+    annotateRestartRequired(sessions);
+    json(res, { sessions });
+}
+/**
+ * Compare each session's config fingerprint against the current config.
+ * Annotates sessions with `restartRequired` and `restartReasons` when they
+ * are running with a stale mount configuration.
+ */
+function annotateRestartRequired(sessions) {
+    const config = (0, config_js_1.loadConfig)();
+    const currentFingerprint = (0, container_js_1.computeMountFingerprint)(config);
+    for (const session of sessions) {
+        if (session.configFingerprint && session.configFingerprint !== currentFingerprint) {
+            session.restartRequired = true;
+            const reasons = [];
+            if (session.image !== config.image)
+                reasons.push('Container image changed');
+            if (session.network !== config.network.mode)
+                reasons.push('Network mode changed');
+            if (reasons.length === 0)
+                reasons.push('Mount config changed (datasets or paths)');
+            session.restartReasons = reasons;
+        }
+        else {
+            session.restartRequired = false;
+        }
+    }
+}
+function handleGetSecurity(_req, res) {
+    const config = (0, config_js_1.loadConfig)();
+    const blockedEvents = scanBlockedEvents();
+    json(res, {
+        blockedCommands: blockedEvents.slice(0, 20),
+        blockedCount: blockedEvents.length,
+        protection: {
+            blacklistedCommands: config.commands.blacklist.length,
+            blockedPatterns: config.filesystem.blocked_patterns.length,
+            networkMode: config.network.mode,
+        },
+    });
+}
+function handleGetClaudeAuthStatus(_req, res) {
+    const auth = readClaudeCredentialSnapshot();
+    json(res, {
+        ok: true,
+        provider: 'claude',
+        loggedIn: auth.loggedIn,
+        email: auth.email,
+        checkedAt: new Date().toISOString(),
+    });
+}
+function isClaudeAuthHost(hostnameRaw) {
+    const host = String(hostnameRaw || '').trim().toLowerCase();
+    return host === 'claude.ai' || host === 'platform.claude.com' || host === 'console.anthropic.com';
+}
+function isLikelyClaudeAuthPath(pathnameRaw) {
+    const path = String(pathnameRaw || '').trim().toLowerCase();
+    if (!path)
+        return false;
+    return path.startsWith('/oauth')
+        || path.startsWith('/login')
+        || path.startsWith('/auth')
+        || path.startsWith('/code/callback');
+}
+function maybeRewriteClaudeOauthRedirectUri(parsed) {
+    const rawRedirectUri = (parsed.searchParams.get('redirect_uri') || '').trim();
+    if (!rawRedirectUri)
+        return;
+    try {
+        const redirectUri = new URL(rawRedirectUri);
+        const host = String(redirectUri.hostname || '').trim().toLowerCase();
+        if (host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1') {
+            parsed.searchParams.set('redirect_uri', 'https://platform.claude.com/oauth/code/callback');
+        }
+    }
+    catch {
+        // Keep original redirect URI when parsing fails.
+    }
+}
+function normalizeClaudeAuthUrlCandidate(candidate) {
+    if (!candidate)
+        return null;
+    try {
+        const parsed = new URL(String(candidate || '').trim());
+        if (parsed.protocol !== 'https:')
+            return null;
+        if (!isClaudeAuthHost(parsed.hostname))
+            return null;
+        if (!isLikelyClaudeAuthPath(parsed.pathname))
+            return null;
+        if (parsed.hostname.toLowerCase() === 'claude.ai' && parsed.pathname === '/oauth/authorize') {
+            maybeRewriteClaudeOauthRedirectUri(parsed);
+        }
+        return parsed.toString();
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeClaudeOauthUrlFromText(raw) {
+    const source = String(raw || '');
+    const osc8Urls = [];
+    const osc8Re = /\x1b\]8;[^\x07\x1b]*?;([^\x07\x1b]*)(?:\x07|\x1b\\)/g;
+    for (const match of source.matchAll(osc8Re)) {
+        const candidate = String(match[1] || '').trim();
+        if (candidate)
+            osc8Urls.push(candidate);
+    }
+    let cleaned = source
+        .replace(/\x1b\][\s\S]*?(?:\x07|\x1b\\)/g, '')
+        .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, '')
+        .replace(/\x1b[P^_][\s\S]*?\x1b\\/g, '')
+        .replace(/\x1b[@-_]/g, '')
+        .replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, '');
+    if (osc8Urls.length) {
+        cleaned += '\n' + osc8Urls.join('\n');
+    }
+    if (!cleaned)
+        return null;
+    const strictMatch = cleaned.match(/https:\/\/claude\.ai\/oauth\/authorize\?[A-Za-z0-9\-._~%!$&'()*+,;=:@/?#[\]]+/);
+    if (strictMatch && strictMatch[0]) {
+        const strictUrl = normalizeClaudeAuthUrlCandidate(strictMatch[0]);
+        if (strictUrl)
+            return strictUrl;
+    }
+    const fallbackMatches = cleaned.match(CLAUDE_AUTH_FALLBACK_URL_RE) || [];
+    for (const match of fallbackMatches) {
+        const normalized = normalizeClaudeAuthUrlCandidate(match);
+        if (normalized)
+            return normalized;
+    }
+    return null;
+}
+function stripTerminalControlForClaudeAuthFlow(text) {
+    return String(text || '')
+        .replace(/\x1b\][\s\S]*?(?:\x07|\x1b\\)/g, '')
+        .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, '')
+        .replace(/\x1b[P^_][\s\S]*?\x1b\\/g, '')
+        .replace(/\x1b[@-_]/g, '')
+        .replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, '');
+}
+function sanitizeClaudeOauthCodeForCli(raw) {
+    let text = stripTerminalControlForClaudeAuthFlow(String(raw || ''))
+        .replace(/^["'\s]+|["'\s]+$/g, '')
+        .trim();
+    if (!text)
+        return '';
+    const hashCodeMatch = text.match(/^([A-Za-z0-9._~-]{24,})#[A-Za-z0-9._~-]{6,}$/);
+    if (hashCodeMatch && hashCodeMatch[1]) {
+        return hashCodeMatch[1].trim();
+    }
+    const urlInText = text.match(/https?:\/\/[^\s"'<>]+/i);
+    if (urlInText && urlInText[0]) {
+        try {
+            const parsedUrl = new URL(urlInText[0]);
+            const codeFromUrl = (parsedUrl.searchParams.get('code') || '').trim();
+            if (codeFromUrl)
+                return codeFromUrl;
+        }
+        catch {
+            // Continue with regex fallback below.
+        }
+    }
+    const hashOnlyMatch = text.match(/^([A-Za-z0-9._~-]{24,})#/);
+    if (hashOnlyMatch && hashOnlyMatch[1]) {
+        return hashOnlyMatch[1].trim();
+    }
+    const codeMatch = text.match(/[?&#]code=([^&#\s]+)/i) || text.match(/\bcode=([^\s&]+)/i);
+    if (codeMatch && codeMatch[1]) {
+        try {
+            return decodeURIComponent(codeMatch[1]).trim();
+        }
+        catch {
+            return codeMatch[1].trim();
+        }
+    }
+    return text;
+}
+function resolveClaudeCliBinaryForSandboxHome(sandboxHome) {
+    const fromSandboxHome = (0, path_1.join)(sandboxHome, '.npm-global', 'bin', 'claude');
+    if ((0, fs_1.existsSync)(fromSandboxHome))
+        return fromSandboxHome;
+    return 'claude';
+}
+function notifyClaudeAuthFlowUrlWaiters(flow, url) {
+    if (!flow.urlWaiters.length)
+        return;
+    const waiters = flow.urlWaiters.splice(0, flow.urlWaiters.length);
+    for (const waiter of waiters) {
+        try {
+            waiter(url);
+        }
+        catch { /* best effort */ }
+    }
+}
+function notifyClaudeAuthFlowResultWaiters(flow, ok) {
+    if (!flow.resultWaiters.length)
+        return;
+    const waiters = flow.resultWaiters.splice(0, flow.resultWaiters.length);
+    for (const waiter of waiters) {
+        try {
+            waiter(ok);
+        }
+        catch { /* best effort */ }
+    }
+}
+function pruneClaudeAuthLoginFlows() {
+    const now = Date.now();
+    for (const [sessionId, flow] of claudeAuthLoginFlows.entries()) {
+        const ageMs = now - flow.updatedAtMs;
+        if (!flow.finished && ageMs <= CLAUDE_AUTH_FLOW_IDLE_TTL_MS)
+            continue;
+        if (!flow.finished) {
+            try {
+                flow.child.kill('SIGTERM');
+            }
+            catch { /* best effort */ }
+        }
+        notifyClaudeAuthFlowUrlWaiters(flow, flow.url || null);
+        notifyClaudeAuthFlowResultWaiters(flow, flow.success === true);
+        claudeAuthLoginFlows.delete(sessionId);
+    }
+}
+function waitForClaudeAuthFlowUrl(flow, timeoutMs) {
+    if (flow.url)
+        return Promise.resolve(flow.url);
+    if (flow.finished)
+        return Promise.resolve(null);
+    return new Promise((resolve) => {
+        const waiter = (url) => {
+            clearTimeout(timeout);
+            resolve(url || null);
+        };
+        const timeout = setTimeout(() => {
+            const idx = flow.urlWaiters.indexOf(waiter);
+            if (idx >= 0)
+                flow.urlWaiters.splice(idx, 1);
+            resolve(flow.url || null);
+        }, Math.max(500, timeoutMs));
+        flow.urlWaiters.push(waiter);
+    });
+}
+function waitForClaudeAuthFlowResult(flow, timeoutMs) {
+    if (flow.success)
+        return Promise.resolve(true);
+    if (flow.finished)
+        return Promise.resolve(false);
+    return new Promise((resolve) => {
+        const waiter = (ok) => {
+            clearTimeout(timeout);
+            resolve(ok);
+        };
+        const timeout = setTimeout(() => {
+            const idx = flow.resultWaiters.indexOf(waiter);
+            if (idx >= 0)
+                flow.resultWaiters.splice(idx, 1);
+            resolve(flow.success === true);
+        }, Math.max(500, timeoutMs));
+        flow.resultWaiters.push(waiter);
+    });
+}
+function summarizeClaudeAuthFlowFailure(flow) {
+    const plainBuffer = stripTerminalControlForClaudeAuthFlow(flow.buffer);
+    const plainStderr = stripTerminalControlForClaudeAuthFlow(flow.stderr);
+    const combined = (plainStderr + '\n' + plainBuffer)
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    if (!combined.length) {
+        return 'Claude login link not detected. Try again, or run `claude auth login` directly in the attached terminal.';
+    }
+    const sample = combined.slice(-6).join(' | ').slice(0, 420);
+    return `Claude login link not detected. Last output: ${sample}`;
+}
+function summarizeClaudeAuthFlowCodeFailure(flow) {
+    const plainBuffer = stripTerminalControlForClaudeAuthFlow(flow.buffer);
+    const plainStderr = stripTerminalControlForClaudeAuthFlow(flow.stderr);
+    const combined = (plainStderr + '\n' + plainBuffer)
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    if (!combined.length) {
+        return 'Claude login confirmation was not detected. The code may be invalid or expired.';
+    }
+    const sample = combined.slice(-6).join(' | ').slice(0, 420);
+    return `Claude login confirmation was not detected. Last output: ${sample}`;
+}
+function startClaudeAuthLoginFlow(sessionId, workdir) {
+    pruneClaudeAuthLoginFlows();
+    const existing = claudeAuthLoginFlows.get(sessionId);
+    if (existing && !existing.finished)
+        return existing;
+    if (existing) {
+        try {
+            existing.child.kill('SIGTERM');
+        }
+        catch { /* best effort */ }
+        claudeAuthLoginFlows.delete(sessionId);
+    }
+    const sandboxHome = (0, config_js_1.getSandboxHome)();
+    const claudeBinary = resolveClaudeCliBinaryForSandboxHome(sandboxHome);
+    const env = {
+        ...process.env,
+        HOME: sandboxHome,
+    };
+    const child = (0, child_process_1.spawn)(claudeBinary, ['auth', 'login'], {
+        cwd: workdir || sandboxHome,
+        env,
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const flow = {
+        sessionId,
+        child,
+        startedAtMs: Date.now(),
+        updatedAtMs: Date.now(),
+        buffer: '',
+        stderr: '',
+        url: null,
+        finished: false,
+        success: false,
+        exitCode: null,
+        codeSubmitted: false,
+        urlWaiters: [],
+        resultWaiters: [],
+    };
+    claudeAuthLoginFlows.set(sessionId, flow);
+    const handleOutput = (text, isStderr) => {
+        if (!text)
+            return;
+        flow.updatedAtMs = Date.now();
+        if (isStderr) {
+            flow.stderr = (flow.stderr + text).slice(-CLAUDE_AUTH_FLOW_MAX_OUTPUT_CHARS);
+        }
+        flow.buffer = (flow.buffer + text).slice(-CLAUDE_AUTH_FLOW_MAX_OUTPUT_CHARS);
+        if (!flow.url) {
+            const normalizedUrl = normalizeClaudeOauthUrlFromText(flow.buffer);
+            if (normalizedUrl) {
+                flow.url = normalizedUrl;
+                notifyClaudeAuthFlowUrlWaiters(flow, normalizedUrl);
+            }
+        }
+        if (!flow.success) {
+            const plainChunk = stripTerminalControlForClaudeAuthFlow(text);
+            if (CLAUDE_LOGIN_SUCCESS_RE.test(plainChunk)) {
+                flow.success = true;
+                notifyClaudeAuthFlowResultWaiters(flow, true);
+            }
+        }
+    };
+    child.stdout.on('data', (chunk) => {
+        handleOutput(chunk.toString('utf-8'), false);
+    });
+    child.stderr.on('data', (chunk) => {
+        handleOutput(chunk.toString('utf-8'), true);
+    });
+    child.on('error', (err) => {
+        flow.finished = true;
+        flow.updatedAtMs = Date.now();
+        flow.stderr = (flow.stderr + '\n' + String(err.message || err)).slice(-CLAUDE_AUTH_FLOW_MAX_OUTPUT_CHARS);
+        notifyClaudeAuthFlowUrlWaiters(flow, flow.url || null);
+        notifyClaudeAuthFlowResultWaiters(flow, false);
+    });
+    child.on('close', (code) => {
+        flow.finished = true;
+        flow.updatedAtMs = Date.now();
+        flow.exitCode = Number.isFinite(code) ? Math.trunc(code) : null;
+        if (flow.codeSubmitted && !flow.success && flow.exitCode === 0) {
+            flow.success = true;
+        }
+        notifyClaudeAuthFlowUrlWaiters(flow, flow.url || null);
+        notifyClaudeAuthFlowResultWaiters(flow, flow.success === true);
+    });
+    return flow;
+}
+function resolveClaudeAuthSessionForLocalNode(sessionIdRaw) {
+    const sessionId = String(sessionIdRaw || '').trim();
+    if (!(0, web_terminal_js_1.isValidWebTerminalId)(sessionId)) {
+        return { ok: false, status: 400, error: 'Invalid terminal session id.' };
+    }
+    const record = (0, web_terminal_js_1.readWebTerminalRecord)(sessionId);
+    if (!record) {
+        return { ok: false, status: 404, error: 'Terminal session not found.' };
+    }
+    if (record.node !== (0, os_1.hostname)()) {
+        return {
+            ok: false,
+            status: 400,
+            error: `Terminal session is on a different node (${record.node})`,
+        };
+    }
+    if (String(record.agent || '').toLowerCase() !== 'claude') {
+        return { ok: false, status: 400, error: 'Terminal session is not a Claude session.' };
+    }
+    return { ok: true, record };
+}
+async function handlePostClaudeAuthLoginStart(req, res) {
+    try {
+        const body = JSON.parse(await readBody(req) || '{}');
+        const resolved = resolveClaudeAuthSessionForLocalNode(body.sessionId || '');
+        if (!resolved.ok) {
+            json(res, { ok: false, error: resolved.error }, resolved.status);
+            return;
+        }
+        const sessionId = resolved.record.id;
+        const flow = startClaudeAuthLoginFlow(sessionId, resolved.record.workdir);
+        const url = await waitForClaudeAuthFlowUrl(flow, CLAUDE_AUTH_FLOW_URL_WAIT_TIMEOUT_MS);
+        if (url) {
+            json(res, {
+                ok: true,
+                sessionId,
+                url,
+            });
+            return;
+        }
+        json(res, {
+            ok: false,
+            sessionId,
+            error: summarizeClaudeAuthFlowFailure(flow),
+        }, 504);
+        if (!flow.finished) {
+            try {
+                flow.child.kill('SIGTERM');
+            }
+            catch { /* best effort */ }
+        }
+        if (claudeAuthLoginFlows.get(sessionId) === flow) {
+            claudeAuthLoginFlows.delete(sessionId);
+        }
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message ?? String(err) }, 500);
+    }
+}
+async function handlePostClaudeAuthLoginCode(req, res) {
+    try {
+        const body = JSON.parse(await readBody(req) || '{}');
+        const resolved = resolveClaudeAuthSessionForLocalNode(body.sessionId || '');
+        if (!resolved.ok) {
+            json(res, { ok: false, error: resolved.error }, resolved.status);
+            return;
+        }
+        const sessionId = resolved.record.id;
+        const code = sanitizeClaudeOauthCodeForCli(String(body.code || ''));
+        if (!code) {
+            json(res, { ok: false, error: 'No login code detected.' }, 400);
+            return;
+        }
+        const flow = claudeAuthLoginFlows.get(sessionId);
+        if (!flow || flow.finished) {
+            json(res, {
+                ok: false,
+                error: 'No active Claude login flow. Start /login again to request a fresh link.',
+            }, 409);
+            return;
+        }
+        flow.codeSubmitted = true;
+        flow.updatedAtMs = Date.now();
+        try {
+            flow.child.stdin.write(code + '\n');
+        }
+        catch (err) {
+            json(res, { ok: false, error: err?.message ?? String(err) }, 500);
+            return;
+        }
+        const confirmed = await waitForClaudeAuthFlowResult(flow, CLAUDE_AUTH_FLOW_CONFIRM_TIMEOUT_MS);
+        if (confirmed) {
+            flow.success = true;
+            flow.updatedAtMs = Date.now();
+            try {
+                flow.child.kill('SIGTERM');
+            }
+            catch { /* best effort */ }
+            claudeAuthLoginFlows.delete(sessionId);
+            json(res, { ok: true, sessionId, confirmed: true });
+            return;
+        }
+        json(res, {
+            ok: false,
+            sessionId,
+            error: summarizeClaudeAuthFlowCodeFailure(flow),
+        }, 504);
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message ?? String(err) }, 500);
+    }
 }
-/**
- * Compare each session's config fingerprint against the current config.
- * Annotates sessions with `restartRequired` and `restartReasons` when they
- * are running with a stale mount configuration.
- */
-function annotateRestartRequired(sessions) {
-    const config = (0, config_js_1.loadConfig)();
-    const currentFingerprint = (0, container_js_1.computeMountFingerprint)(config);
-    for (const session of sessions) {
-        if (session.configFingerprint && session.configFingerprint !== currentFingerprint) {
-            session.restartRequired = true;
-            const reasons = [];
-            if (session.image !== config.image)
-                reasons.push('Container image changed');
-            if (session.network !== config.network.mode)
-                reasons.push('Network mode changed');
-            if (reasons.length === 0)
-                reasons.push('Mount config changed (datasets or paths)');
-            session.restartReasons = reasons;
+function readClaudeOauthBrowserUrlSnapshot(consume, minUpdatedAtMs) {
+    const candidates = [];
+    for (const filePath of CLAUDE_BROWSER_URL_FILES) {
+        if (!(0, fs_1.existsSync)(filePath))
+            continue;
+        try {
+            const st = (0, fs_1.statSync)(filePath);
+            const ageMs = Date.now() - st.mtimeMs;
+            if (!Number.isFinite(ageMs) || ageMs < 0 || ageMs > CLAUDE_BROWSER_URL_MAX_AGE_MS)
+                continue;
+            if (minUpdatedAtMs !== null && minUpdatedAtMs > 0 && st.mtimeMs < minUpdatedAtMs) {
+                continue;
+            }
+            const raw = (0, fs_1.readFileSync)(filePath, 'utf-8');
+            candidates.push({
+                path: filePath,
+                mtimeMs: st.mtimeMs,
+                updatedAt: new Date(st.mtimeMs).toISOString(),
+                raw,
+            });
         }
-        else {
-            session.restartRequired = false;
+        catch {
+            // Skip unreadable candidates.
         }
     }
-}
-function handleGetSecurity(_req, res) {
-    const config = (0, config_js_1.loadConfig)();
-    const blockedEvents = scanBlockedEvents();
-    json(res, {
-        blockedCommands: blockedEvents.slice(0, 20),
-        blockedCount: blockedEvents.length,
-        protection: {
-            blacklistedCommands: config.commands.blacklist.length,
-            blockedPatterns: config.filesystem.blocked_patterns.length,
-            networkMode: config.network.mode,
-        },
-    });
-}
-function handleGetClaudeAuthStatus(_req, res) {
-    const auth = readClaudeCredentialSnapshot();
+    candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+    let latestMeta = { updatedAt: null, path: null };
+    for (const candidate of candidates) {
+        latestMeta = { updatedAt: candidate.updatedAt, path: candidate.path };
+        const normalizedUrl = normalizeClaudeOauthUrlFromText(candidate.raw);
+        if (!normalizedUrl)
+            continue;
+        if (consume) {
+            try {
+                (0, fs_1.unlinkSync)(candidate.path);
+            }
+            catch { /* best effort */ }
+        }
+        return {
+            url: normalizedUrl,
+            updatedAt: candidate.updatedAt,
+            path: candidate.path,
+        };
+    }
+    return { url: null, updatedAt: latestMeta.updatedAt, path: latestMeta.path };
+}
+function handleGetClaudeOauthUrl(reqUrl, res) {
+    const consumeRaw = String(reqUrl.searchParams.get('consume') || '').trim().toLowerCase();
+    const consume = consumeRaw === '1' || consumeRaw === 'true' || consumeRaw === 'yes';
+    const minUpdatedAtRaw = String(reqUrl.searchParams.get('minUpdatedAtMs') || '').trim();
+    const parsedMinUpdatedAtMs = minUpdatedAtRaw ? Number(minUpdatedAtRaw) : NaN;
+    const minUpdatedAtMs = Number.isFinite(parsedMinUpdatedAtMs) && parsedMinUpdatedAtMs > 0
+        ? Math.floor(parsedMinUpdatedAtMs)
+        : null;
+    const snapshot = readClaudeOauthBrowserUrlSnapshot(consume, minUpdatedAtMs);
     json(res, {
         ok: true,
-        provider: 'claude',
-        loggedIn: auth.loggedIn,
-        email: auth.email,
-        checkedAt: new Date().toISOString(),
+        url: snapshot.url,
+        updatedAt: snapshot.updatedAt,
+        path: snapshot.path,
     });
 }
 async function handleStopSession(req, res) {
@@ -4517,8 +5600,12 @@ async function handleGetWebTerminalSessions(res) {
         return Number.isFinite(ms) ? ms : 0;
     }
     const allSessions = (0, web_terminal_js_1.listWebTerminalRecords)().map(serializeWebTerminalSession);
-    const activeSessions = allSessions.filter((session) => session.status === 'running');
-    const recentInactive = allSessions
+    const visibleSessions = allSessions.filter((session) => {
+        const sessionNode = String(session.node || '').trim();
+        return !sessionNode || sessionNode === localNode;
+    });
+    const activeSessions = visibleSessions.filter((session) => session.status === 'running');
+    const recentInactive = visibleSessions
         .filter((session) => session.status !== 'running')
         .sort((a, b) => parseSessionSortMs(b) - parseSessionSortMs(a))
         .slice(0, 24);
@@ -4529,21 +5616,107 @@ async function handleGetWebTerminalSessions(res) {
         .map((job) => serializeWebTerminalInitJob(job));
     json(res, { ok: true, sessions, initJobs });
 }
-async function handleGetWebTerminalHistory(reqUrl, res) {
-    const id = String(reqUrl.searchParams.get('id') || '').trim();
+async function getTmuxSessionForegroundCommand(tmuxSession) {
+    const target = String(tmuxSession || '').trim();
+    if (!target)
+        return '';
+    try {
+        const tmuxBin = await (0, web_terminal_js_1.getTmuxBinary)();
+        const { stdout } = await execFileAsync(tmuxBin, ['list-panes', '-t', target, '-F', '#{pane_active}\t#{pane_current_command}'], { timeout: 3_000 });
+        const lines = String(stdout || '').split(/\r?\n/);
+        let fallback = '';
+        for (const line of lines) {
+            if (!line)
+                continue;
+            const tabIndex = line.indexOf('\t');
+            const active = tabIndex >= 0 ? line.slice(0, tabIndex).trim() : '';
+            const command = tabIndex >= 0 ? line.slice(tabIndex + 1).trim() : line.trim();
+            if (!command)
+                continue;
+            if (!fallback)
+                fallback = command;
+            if (active === '1')
+                return command;
+        }
+        return fallback;
+    }
+    catch {
+        return '';
+    }
+}
+function resolveLocalWebTerminalRecord(idRaw) {
+    const id = String(idRaw || '').trim();
     if (!(0, web_terminal_js_1.isValidWebTerminalId)(id)) {
-        json(res, { ok: false, error: 'Invalid terminal session id' }, 400);
-        return;
+        return { ok: false, status: 400, error: 'Invalid terminal session id' };
     }
     const record = (0, web_terminal_js_1.readWebTerminalRecord)(id);
     if (!record) {
-        json(res, { ok: false, error: 'Terminal session not found' }, 404);
-        return;
+        return { ok: false, status: 404, error: 'Terminal session not found' };
     }
     if (record.node !== (0, os_1.hostname)()) {
-        json(res, { ok: false, error: `Terminal session is on a different node (${record.node})` }, 400);
+        return { ok: false, status: 400, error: `Terminal session is on a different node (${record.node})` };
+    }
+    return { ok: true, record };
+}
+function normalizeBookmarkField(raw, maxLength) {
+    const text = typeof raw === 'string' ? raw.trim() : '';
+    if (!text)
+        return '';
+    return text.slice(0, maxLength);
+}
+function normalizeBookmarkSeq(raw) {
+    if (raw === null || raw === undefined || raw === '')
+        return null;
+    const value = Number(raw);
+    if (!Number.isFinite(value))
+        return null;
+    return Math.max(0, Math.floor(value));
+}
+function normalizeBookmarkViewportHint(raw) {
+    const value = Number(raw);
+    if (!Number.isFinite(value))
+        return 0;
+    return Math.max(0, Math.floor(value));
+}
+function normalizeBookmarkHash(raw) {
+    return normalizeBookmarkField(raw, 128);
+}
+function stableBookmarkHash(parts) {
+    const normalized = parts
+        .map((part) => String(part || '').trim().replace(/\s+/g, ' ').toLowerCase())
+        .filter(Boolean)
+        .join('\n');
+    if (!normalized)
+        return '';
+    return (0, crypto_1.createHash)('sha1').update(normalized).digest('hex');
+}
+function isTerminalBookmarksFeatureEnabled() {
+    return !TEMPORARILY_DISABLED_WEB_UI_FEATURES.terminalBookmarks;
+}
+function serializeWebTerminalBookmark(bookmark) {
+    return {
+        id: bookmark.id,
+        sessionId: bookmark.sessionId,
+        label: bookmark.label || '',
+        createdAt: bookmark.createdAt,
+        anchorText: bookmark.anchorText,
+        previewText: bookmark.previewText,
+        viewportYHint: bookmark.viewportYHint,
+        aroundTopText: bookmark.aroundTopText || '',
+        aroundBottomText: bookmark.aroundBottomText || '',
+        latestSeqAtCapture: bookmark.latestSeqAtCapture,
+        oldestSeqLoadedAtCapture: bookmark.oldestSeqLoadedAtCapture,
+        anchorHash: bookmark.anchorHash || '',
+    };
+}
+async function handleGetWebTerminalHistory(reqUrl, res) {
+    const id = String(reqUrl.searchParams.get('id') || '').trim();
+    const resolvedRecord = resolveLocalWebTerminalRecord(id);
+    if (!resolvedRecord.ok) {
+        json(res, { ok: false, error: resolvedRecord.error }, resolvedRecord.status);
         return;
     }
+    const record = resolvedRecord.record;
     const beforeRaw = String(reqUrl.searchParams.get('before') || '').trim();
     let beforeSeq = null;
     if (beforeRaw) {
@@ -4565,20 +5738,124 @@ async function handleGetWebTerminalHistory(reqUrl, res) {
         limit = Math.max(1, Math.min(WEB_TERMINAL_HISTORY_PAGE_MAX, Math.floor(parsedLimit)));
     }
     const bridge = await ensureWebTerminalBridge(record);
+    const currentCommand = await getTmuxSessionForegroundCommand(record.tmuxSession);
     if (!bridge) {
-        json(res, { ok: false, error: 'Could not open terminal bridge' }, 500);
+        json(res, {
+            ok: true,
+            id: record.id,
+            currentCommand: currentCommand || null,
+            history: {
+                chunks: [],
+                hasMore: false,
+                nextBefore: null,
+                oldestSeq: null,
+                latestSeq: null,
+                limit,
+            },
+        });
         return;
     }
     const page = getWebTerminalHistoryPage(bridge, { beforeSeq, limit });
     json(res, {
         ok: true,
         id: record.id,
+        currentCommand: currentCommand || null,
         history: {
             ...page,
             limit,
         },
     });
 }
+async function handleGetWebTerminalBookmarks(reqUrl, res) {
+    if (!isTerminalBookmarksFeatureEnabled()) {
+        json(res, { ok: false, error: 'Terminal bookmarks are temporarily disabled.' }, 404);
+        return;
+    }
+    const id = String(reqUrl.searchParams.get('id') || '').trim();
+    const resolved = resolveLocalWebTerminalRecord(id);
+    if (!resolved.ok) {
+        json(res, { ok: false, error: resolved.error }, resolved.status);
+        return;
+    }
+    const bookmarks = (0, web_terminal_js_1.readWebTerminalBookmarks)(resolved.record.id).map(serializeWebTerminalBookmark);
+    json(res, { ok: true, id: resolved.record.id, bookmarks });
+}
+async function handlePostWebTerminalBookmarks(req, res) {
+    if (!isTerminalBookmarksFeatureEnabled()) {
+        json(res, { ok: false, error: 'Terminal bookmarks are temporarily disabled.' }, 404);
+        return;
+    }
+    try {
+        const body = await readBody(req);
+        const parsed = JSON.parse(body || '{}');
+        const id = String(parsed.id || '').trim();
+        const resolved = resolveLocalWebTerminalRecord(id);
+        if (!resolved.ok) {
+            json(res, { ok: false, error: resolved.error }, resolved.status);
+            return;
+        }
+        const anchorText = normalizeBookmarkField(parsed.anchorText, 1_200);
+        if (!anchorText) {
+            json(res, { ok: false, error: 'anchorText is required' }, 400);
+            return;
+        }
+        const previewText = normalizeBookmarkField(parsed.previewText, 2_000) || anchorText;
+        const label = normalizeBookmarkField(parsed.label, 160);
+        const aroundTopText = normalizeBookmarkField(parsed.aroundTopText, 500);
+        const aroundBottomText = normalizeBookmarkField(parsed.aroundBottomText, 500);
+        const latestSeqAtCapture = normalizeBookmarkSeq(parsed.latestSeqAtCapture);
+        const oldestSeqLoadedAtCapture = normalizeBookmarkSeq(parsed.oldestSeqLoadedAtCapture);
+        const viewportYHint = normalizeBookmarkViewportHint(parsed.viewportYHint);
+        const anchorHash = normalizeBookmarkHash(parsed.anchorHash)
+            || stableBookmarkHash([aroundTopText, anchorText, aroundBottomText]);
+        const result = (0, web_terminal_js_1.addWebTerminalBookmark)(resolved.record.id, {
+            ...(label ? { label } : {}),
+            anchorText,
+            previewText,
+            viewportYHint,
+            ...(aroundTopText ? { aroundTopText } : {}),
+            ...(aroundBottomText ? { aroundBottomText } : {}),
+            latestSeqAtCapture,
+            oldestSeqLoadedAtCapture,
+            ...(anchorHash ? { anchorHash } : {}),
+        });
+        if (!result.ok) {
+            json(res, { ok: false, error: result.error, code: result.code }, 404);
+            return;
+        }
+        json(res, {
+            ok: true,
+            id: resolved.record.id,
+            bookmark: serializeWebTerminalBookmark(result.bookmark),
+        });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message ?? String(err) }, 500);
+    }
+}
+async function handleDeleteWebTerminalBookmarks(reqUrl, res) {
+    if (!isTerminalBookmarksFeatureEnabled()) {
+        json(res, { ok: false, error: 'Terminal bookmarks are temporarily disabled.' }, 404);
+        return;
+    }
+    const id = String(reqUrl.searchParams.get('id') || '').trim();
+    const bookmarkId = String(reqUrl.searchParams.get('bookmarkId') || '').trim();
+    if (!bookmarkId) {
+        json(res, { ok: false, error: 'bookmarkId is required' }, 400);
+        return;
+    }
+    const resolved = resolveLocalWebTerminalRecord(id);
+    if (!resolved.ok) {
+        json(res, { ok: false, error: resolved.error }, resolved.status);
+        return;
+    }
+    const result = (0, web_terminal_js_1.deleteWebTerminalBookmark)(resolved.record.id, bookmarkId);
+    if (!result.ok) {
+        json(res, { ok: false, error: result.error, code: result.code }, 404);
+        return;
+    }
+    json(res, { ok: true, id: resolved.record.id, bookmarkId });
+}
 async function handlePostWebTerminalRename(req, res) {
     try {
         const body = await readBody(req);
@@ -4605,6 +5882,37 @@ async function handlePostWebTerminalRename(req, res) {
         json(res, { ok: false, error: err?.message ?? String(err) }, 500);
     }
 }
+async function handlePostWebTerminalStar(req, res) {
+    try {
+        const body = await readBody(req);
+        const parsed = JSON.parse(body || '{}');
+        const id = String(parsed.id || '').trim();
+        const starred = parsed.starred === true;
+        if (!(0, web_terminal_js_1.isValidWebTerminalId)(id)) {
+            json(res, { ok: false, error: 'Invalid terminal session id' }, 400);
+            return;
+        }
+        const record = (0, web_terminal_js_1.readWebTerminalRecord)(id);
+        if (!record) {
+            json(res, { ok: false, error: 'Terminal session not found' }, 404);
+            return;
+        }
+        if (record.node !== (0, os_1.hostname)()) {
+            json(res, { ok: false, error: `Terminal session is on a different node (${record.node})` }, 400);
+            return;
+        }
+        const result = (0, web_terminal_js_1.setWebTerminalRecordStarred)(id, starred);
+        if (!result.ok) {
+            const status = result.code === 'not_found' ? 404 : 400;
+            json(res, { ok: false, error: result.error, code: result.code }, status);
+            return;
+        }
+        json(res, { ok: true, session: serializeWebTerminalSession(result.record) });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err?.message ?? String(err) }, 500);
+    }
+}
 async function handlePostWebTerminalStop(req, res) {
     try {
         const body = await readBody(req);
@@ -5043,6 +6351,103 @@ function handleGetDatasetStats(_req, res) {
     }
     json(res, { stats });
 }
+function handleGetDatasetPreview(reqUrl, res) {
+    const name = String(reqUrl.searchParams.get('name') || '').trim();
+    const maxRows = Math.min(Math.max(1, Number(reqUrl.searchParams.get('rows')) || 5), 20);
+    if (!name) {
+        json(res, { ok: false, error: 'Missing name parameter' }, 400);
+        return;
+    }
+    const config = (0, config_js_1.loadConfig)();
+    const ds = (config.datasets || []).find((d) => d.name && String(d.name).toLowerCase() === name.toLowerCase());
+    if (!ds) {
+        json(res, { ok: false, error: `Dataset "${name}" not found` }, 404);
+        return;
+    }
+    const hostPath = ds.path
+        ? String(ds.path).replace(/^~/, (0, os_1.homedir)())
+        : '';
+    if (!hostPath || !(0, fs_1.existsSync)(hostPath)) {
+        json(res, { ok: false, error: 'Dataset path not found' }, 404);
+        return;
+    }
+    let entries;
+    try {
+        entries = (0, fs_1.readdirSync)(hostPath);
+    }
+    catch {
+        json(res, { ok: false, error: 'Cannot read dataset directory' }, 500);
+        return;
+    }
+    // Find first CSV/TSV/TXT file
+    const csvTsvFile = entries.find((f) => {
+        const lower = f.toLowerCase();
+        return lower.endsWith('.csv') || lower.endsWith('.tsv') || lower.endsWith('.txt');
+    });
+    if (!csvTsvFile) {
+        json(res, { ok: false, error: 'No CSV/TSV file found in dataset' }, 404);
+        return;
+    }
+    const filePath = (0, path_1.join)(hostPath, csvTsvFile);
+    let fileStat;
+    try {
+        fileStat = (0, fs_1.statSync)(filePath);
+    }
+    catch {
+        json(res, { ok: false, error: 'Cannot stat file' }, 500);
+        return;
+    }
+    if (!fileStat.isFile()) {
+        json(res, { ok: false, error: 'Not a file' }, 400);
+        return;
+    }
+    // Read first chunk (limit to 64KB)
+    const MAX_PREVIEW_BYTES = 65536;
+    let fd;
+    try {
+        fd = (0, fs_1.openSync)(filePath, 'r');
+    }
+    catch {
+        json(res, { ok: false, error: 'Cannot open file' }, 500);
+        return;
+    }
+    const readSize = Math.min(fileStat.size, MAX_PREVIEW_BYTES);
+    const buffer = Buffer.alloc(readSize);
+    let bytesRead = 0;
+    try {
+        bytesRead = (0, fs_1.readSync)(fd, buffer, 0, readSize, 0);
+    }
+    catch {
+        json(res, { ok: false, error: 'Cannot read file' }, 500);
+        return;
+    }
+    finally {
+        try {
+            (0, fs_1.closeSync)(fd);
+        }
+        catch { /* noop */ }
+    }
+    const content = buffer.subarray(0, bytesRead).toString('utf-8');
+    const lines = content.split(/\r?\n/).filter((l) => l.trim());
+    if (lines.length === 0) {
+        json(res, { ok: false, error: 'File is empty' }, 400);
+        return;
+    }
+    const delimiter = csvTsvFile.toLowerCase().endsWith('.tsv') ? '\t' : ',';
+    const columns = lines[0].split(delimiter).map((c) => c.trim().replace(/^["']|["']$/g, ''));
+    const rows = [];
+    for (let i = 1; i < lines.length && rows.length < maxRows; i++) {
+        const cells = lines[i].split(delimiter).map((c) => c.trim().replace(/^["']|["']$/g, ''));
+        rows.push(cells);
+    }
+    json(res, {
+        ok: true,
+        columns,
+        rows,
+        file: csvTsvFile,
+        total_rows: bytesRead < fileStat.size ? null : (lines.length - 1),
+    });
+}
 async function handlePostDatasetScan(req, res) {
     try {
         const body = await readBody(req);
@@ -5052,20 +6457,7 @@ async function handlePostDatasetScan(req, res) {
             return;
         }
         const configPath = (0, config_js_1.getConfigPath)();
-        let obj = {};
-        if ((0, fs_1.existsSync)(configPath)) {
-            const rawText = (0, fs_1.readFileSync)(configPath, 'utf-8');
-            const stripped = rawText
-                .split('\n')
-                .filter(line => !line.trimStart().startsWith('//'))
-                .join('\n');
-            try {
-                obj = JSON.parse(stripped);
-            }
-            catch {
-                obj = {};
-            }
-        }
+        const obj = (0, config_js_1.readRawConfigFile)(configPath);
         const datasets = (obj.datasets || []);
         const idx = datasets.findIndex((d) => d?.name && String(d.name).toLowerCase() === name.toLowerCase());
         if (idx < 0) {
@@ -5087,8 +6479,7 @@ async function handlePostDatasetScan(req, res) {
         };
         ds.stats = statsObj;
         obj.datasets = datasets;
-        (0, fs_1.writeFileSync)(configPath, JSON.stringify(obj, null, 2) + '\n', { encoding: 'utf-8', mode: config_js_1.PRIVATE_FILE_MODE });
-        (0, config_js_1.ensurePrivateFile)(configPath);
+        (0, config_js_1.writeRawConfigFile)(obj, configPath);
         json(res, { ok: true, stats: statsObj });
     }
     catch (err) {
@@ -5120,20 +6511,7 @@ async function handlePostDatasetExampleInstall(req, res) {
         const datasetMode = parsed.mode === 'rw' ? 'rw' : 'ro';
         const sourceUrl = resolveIrisSampleSourceUrl();
         const configPath = (0, config_js_1.getConfigPath)();
-        let obj = {};
-        if ((0, fs_1.existsSync)(configPath)) {
-            const rawText = (0, fs_1.readFileSync)(configPath, 'utf-8');
-            const stripped = rawText
-                .split('\n')
-                .filter((line) => !line.trimStart().startsWith('//'))
-                .join('\n');
-            try {
-                obj = JSON.parse(stripped);
-            }
-            catch {
-                obj = {};
-            }
-        }
+        const obj = (0, config_js_1.readRawConfigFile)(configPath);
         const datasets = Array.isArray(obj.datasets) ? obj.datasets : [];
         const byNameConflict = datasets.find((d) => {
             const n = typeof d.name === 'string' ? d.name : '';
@@ -5201,8 +6579,7 @@ async function handlePostDatasetExampleInstall(req, res) {
         };
         datasets.push(entry);
         obj.datasets = datasets;
-        (0, fs_1.writeFileSync)(configPath, JSON.stringify(obj, null, 2) + '\n', { encoding: 'utf-8', mode: config_js_1.PRIVATE_FILE_MODE });
-        (0, config_js_1.ensurePrivateFile)(configPath);
+        (0, config_js_1.writeRawConfigFile)(obj, configPath);
         json(res, {
             ok: true,
             dataset: entry,
@@ -5453,16 +6830,13 @@ function collectMcpState() {
     const slurmPluginEnabled = isPluginEnabledInConfig(config, 'slurm');
     const slurmConfigured = slurmPluginEnabled && config.slurm.enabled && config.slurm.mcp_server;
     const clusterConfigured = slurmPluginEnabled && config.slurm.enabled && config.slurm.mcp_server;
-    const datasetsConfigured = true;
-    const resultsConfigured = true;
+    const datasetsConfigured = isPluginEnabledInConfig(config, 'datasets');
     const slurmEntry = registeredServers['labgate-slurm'];
     const clusterEntry = registeredServers['labgate-cluster'];
     const datasetsEntry = registeredServers['labgate-datasets'];
-    const resultsEntry = registeredServers['labgate-results'];
     const slurmState = inferServerState('labgate-slurm', slurmConfigured, slurmEntry, sandboxHome);
     const clusterState = inferServerState('labgate-cluster', clusterConfigured, clusterEntry, sandboxHome);
     const datasetsState = inferServerState('labgate-datasets', datasetsConfigured, datasetsEntry, sandboxHome);
-    const resultsState = inferServerState('labgate-results', resultsConfigured, resultsEntry, sandboxHome);
     const servers = [
         {
             id: 'labgate-slurm',
@@ -5536,35 +6910,6 @@ function collectMcpState() {
                 { name: 'unregister_dataset', title: 'Unregister Dataset', description: 'Remove a dataset from the config' },
             ],
         },
-        {
-            id: 'labgate-results',
-            name: 'labgate-results',
-            description: 'Results registry. Record and retrieve structured findings across sessions.',
-            active: resultsState.ready,
-            configured: resultsState.configured,
-            registered: resultsState.registered,
-            ready: resultsState.ready,
-            reason: resultsState.reason,
-            command: resultsEntry?.command || null,
-            args: Array.isArray(resultsEntry?.args) ? resultsEntry.args : null,
-            env: resultsEntry?.env || null,
-            mcpConfigPath,
-            serverPath: resolveServerPathFromEntry(resultsEntry, sandboxHome),
-            dbPath: resolveDbPathFromEntry(resultsEntry, sandboxHome),
-            tools: [
-                { name: 'list_results', title: 'List Results', description: 'List recorded results with filtering and pagination' },
-                { name: 'register_result', title: 'Register Result', description: 'Create a new structured result entry' },
-                {
-                    name: 'register_reproducible_result',
-                    title: 'Register Reproducible Result',
-                    description: 'Register a result with script, inputs, requirements, and optional execution/submission',
-                },
-                { name: 'get_result', title: 'Get Result', description: 'Retrieve one result by id' },
-                { name: 'list_result_versions', title: 'List Result Versions', description: 'List all versions for a result lineage' },
-                { name: 'update_result', title: 'Update Result', description: 'Update an existing result entry' },
-                { name: 'delete_result', title: 'Delete Result', description: 'Delete a result entry' },
-            ],
-        },
     ];
     return {
         mcpConfigPath,
@@ -7652,6 +8997,20 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
                     return;
                 }
             }
+            if (pathname.startsWith('/api/dataset')) {
+                const config = (0, config_js_1.loadConfig)();
+                if (!isPluginEnabledInConfig(config, 'datasets')) {
+                    json(res, { ok: false, error: 'Datasets plugin is disabled.' }, 403);
+                    return;
+                }
+            }
+            if (pathname === '/api/results' || pathname.startsWith('/api/results/')) {
+                const config = (0, config_js_1.loadConfig)();
+                if (!isPluginEnabledInConfig(config, 'results')) {
+                    json(res, { ok: false, error: 'Results plugin is disabled.' }, 403);
+                    return;
+                }
+            }
             if (pathname === '/' && method === 'GET') {
                 serveHTML(res);
             }
@@ -7743,6 +9102,9 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             else if (pathname === '/api/dataset-stats' && method === 'GET') {
                 handleGetDatasetStats(req, res);
             }
+            else if (pathname === '/api/dataset-preview' && method === 'GET') {
+                handleGetDatasetPreview(reqUrl, res);
+            }
             else if (pathname === '/api/dataset-scan' && method === 'POST') {
                 await handlePostDatasetScan(req, res);
             }
@@ -7767,6 +9129,15 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             else if (pathname === '/api/claude/auth' && method === 'GET') {
                 handleGetClaudeAuthStatus(req, res);
             }
+            else if (pathname === '/api/claude/auth/login/start' && method === 'POST') {
+                await handlePostClaudeAuthLoginStart(req, res);
+            }
+            else if (pathname === '/api/claude/auth/login/code' && method === 'POST') {
+                await handlePostClaudeAuthLoginCode(req, res);
+            }
+            else if (pathname === '/api/claude/oauth-url' && method === 'GET') {
+                handleGetClaudeOauthUrl(reqUrl, res);
+            }
             else if (pathname === '/api/results' && method === 'GET') {
                 handleGetResults(reqUrl, res);
             }
@@ -7788,6 +9159,15 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             else if (pathname === '/api/terminal/history' && method === 'GET') {
                 await handleGetWebTerminalHistory(reqUrl, res);
             }
+            else if (pathname === '/api/terminal/bookmarks' && method === 'GET') {
+                await handleGetWebTerminalBookmarks(reqUrl, res);
+            }
+            else if (pathname === '/api/terminal/bookmarks' && method === 'POST') {
+                await handlePostWebTerminalBookmarks(req, res);
+            }
+            else if (pathname === '/api/terminal/bookmarks' && method === 'DELETE') {
+                await handleDeleteWebTerminalBookmarks(reqUrl, res);
+            }
             else if (pathname === '/api/terminal/init' && method === 'GET') {
                 await handleGetWebTerminalInit(reqUrl, res);
             }
@@ -7803,6 +9183,9 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
             else if (pathname === '/api/terminal/rename' && method === 'POST') {
                 await handlePostWebTerminalRename(req, res);
             }
+            else if (pathname === '/api/terminal/star' && method === 'POST') {
+                await handlePostWebTerminalStar(req, res);
+            }
             else if (pathname === '/api/terminal/stop' && method === 'POST') {
                 await handlePostWebTerminalStop(req, res);
             }
@@ -8015,7 +9398,7 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
         void (async () => {
             if (prewarmImageOnStartup) {
                 try {
-                    const cfg = (0, config_js_1.loadConfig)();
+                    const cfg = (0, config_js_1.loadEffectiveConfig)().config;
                     const runtimeReady = await prepareRuntimeForWebTerminal(cfg.runtime);
                     if (!runtimeReady.ok) {
                         const firstLine = String(runtimeReady.error || 'Container runtime unavailable.')
@@ -8048,10 +9431,10 @@ function startUI(optsOrPort = {}, standaloneArg = true) {
                                 }
                             }
                             else {
-                                imageExists = (0, fs_1.existsSync)((0, path_1.join)((0, config_js_1.getImagesDir)(), (0, container_js_1.imageToSifName)(image)));
+                                imageExists = (0, container_js_1.isUsableApptainerSif)('apptainer', (0, path_1.join)((0, config_js_1.getImagesDir)(), (0, container_js_1.imageToSifName)(image)));
                             }
                             if (!imageExists) {
-                                log.step(`No cached image found for ${image}. Preparing it before opening UI...`);
+                                log.step(`No usable cached image found for ${image}. Preparing it before opening UI...`);
                                 await ensureWebTerminalImageReady(runtime, image);
                                 log.success(`Prepared image ${image}.`);
                             }