leglas 1.1.2 → 1.2.1

package/dist/index.js

@@ -1,4 +1,5 @@
 // src/args.ts
+var SHARE_TUNNELS = ["cloudflared", "ngrok", "none"];
 var VALUE_FLAGS = /* @__PURE__ */ new Set(["--port", "--user-port", "--config"]);
 var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["--no-open", "--json"]);
 var MIN_SHOW_WIDTH = 320;
@@ -11,7 +12,7 @@ function parsePort(flag, raw) {
   if (port < 1 || port > 65535) {
     return { error: `${flag} must be between 1 and 65535, received ${port}.` };
   }
-  return port;
+  return { port };
 }
 function parseNew(rest) {
   let surface;
@@ -35,7 +36,6 @@ function parseNew(rest) {
       json = true;
       continue;
     }
-    if (argument === "--help" || argument === "-h") return { kind: "help" };
     if (argument.startsWith("-")) {
       return { kind: "error", message: `leglas new does not take ${argument}.` };
     }
@@ -71,7 +71,6 @@ function parseAdd(rest) {
       json = true;
       continue;
     }
-    if (argument === "--help" || argument === "-h") return { kind: "help" };
     const equals = argument.indexOf("=");
     const flag = equals === -1 ? argument : argument.slice(0, equals);
     let value;
@@ -141,7 +140,6 @@ function parseClassify(rest) {
       json = true;
       continue;
     }
-    if (argument === "--help" || argument === "-h") return { kind: "help" };
     const equals = argument.indexOf("=");
     const flag = equals === -1 ? argument : argument.slice(0, equals);
     if (flag !== "--change" && flag !== "--rewrite") {
@@ -166,7 +164,6 @@ function parseWatch(rest) {
   let port;
   for (let index = 0; index < rest.length; index += 1) {
     const argument = rest[index];
-    if (argument === "--help" || argument === "-h") return { kind: "help" };
     const equals = argument.indexOf("=");
     const flag = equals === -1 ? argument : argument.slice(0, equals);
     if (flag !== "--run" && flag !== "--port") {
@@ -184,12 +181,87 @@ function parseWatch(rest) {
       continue;
     }
     const parsed = parsePort(flag, value);
-    if (typeof parsed !== "number") return { kind: "error", message: parsed.error };
-    port = parsed;
+    if ("error" in parsed) return { kind: "error", message: parsed.error };
+    port = parsed.port;
   }
   return { kind: "watch", run: run4, port };
 }
+function parseShare(rest) {
+  const titles = [];
+  let reach = "open";
+  let reachGiven = false;
+  let tunnel = null;
+  let stop = false;
+  let port = null;
+  let json = false;
+  for (let index = 0; index < rest.length; index += 1) {
+    const argument = rest[index];
+    if (argument === "--json") {
+      json = true;
+      continue;
+    }
+    if (argument === "--stop") {
+      stop = true;
+      continue;
+    }
+    const equals = argument.indexOf("=");
+    const flag = equals === -1 ? argument : argument.slice(0, equals);
+    if (flag === "--reach" || flag === "--tunnel" || flag === "--port") {
+      const raw = equals === -1 ? rest[index += 1] : argument.slice(equals + 1);
+      if (raw === void 0 || raw === "") {
+        return { kind: "error", message: `${flag} needs a value.` };
+      }
+      if (flag === "--port") {
+        const parsed = parsePort(flag, raw);
+        if ("error" in parsed) return { kind: "error", message: parsed.error };
+        port = parsed.port;
+        continue;
+      }
+      if (flag === "--reach") {
+        if (raw !== "open" && raw !== "listed") {
+          return {
+            kind: "error",
+            message: `--reach is open or listed, received ${JSON.stringify(raw)}.`
+          };
+        }
+        reach = raw;
+        reachGiven = true;
+        continue;
+      }
+      const chosen = SHARE_TUNNELS.find((candidate) => candidate === raw);
+      if (chosen === void 0) {
+        return {
+          kind: "error",
+          message: `--tunnel is cloudflared, ngrok or none, received ${JSON.stringify(raw)}.`
+        };
+      }
+      tunnel = chosen;
+      continue;
+    }
+    if (argument.startsWith("-")) {
+      return { kind: "error", message: `leglas share does not take ${argument}.` };
+    }
+    titles.push(argument);
+  }
+  if (stop && (titles.length > 0 || reachGiven || tunnel !== null)) {
+    return {
+      kind: "error",
+      message: "leglas share --stop ends the share; it takes no directions, reach or tunnel."
+    };
+  }
+  if (titles.length > 2) {
+    return {
+      kind: "error",
+      message: "leglas share takes one direction to share alone, or two to compare. Name none to share the rail."
+    };
+  }
+  return { kind: "share", titles, reach, tunnel, stop, port, json };
+}
 function parseArgs(argv) {
+  const [command] = argv;
+  if (command !== void 0 && !command.startsWith("-") && argv.slice(1).some((argument) => argument === "--help" || argument === "-h")) {
+    return { kind: "help" };
+  }
   if (argv[0] === "new") return parseNew(argv.slice(1));
   if (argv[0] === "watch") return parseWatch(argv.slice(1));
   if (argv[0] === "add") return parseAdd(argv.slice(1));
@@ -347,8 +419,8 @@ function parseArgs(argv) {
         }
         if (flag === "--port") {
           const parsed = parsePort(flag, raw);
-          if (typeof parsed !== "number") return { kind: "error", message: parsed.error };
-          port = parsed;
+          if ("error" in parsed) return { kind: "error", message: parsed.error };
+          port = parsed.port;
           continue;
         }
         if (!/^\d+$/.test(raw)) {
@@ -388,6 +460,7 @@ function parseArgs(argv) {
     }
     return { kind: "show", title, json, screenshot, width, port };
   }
+  if (argv[0] === "share") return parseShare(argv.slice(1));
   const options = {
     port: void 0,
     userPort: void 0,
@@ -427,9 +500,9 @@ function parseArgs(argv) {
       continue;
     }
     const port = parsePort(flag, value);
-    if (typeof port !== "number") return { kind: "error", message: port.error };
-    if (flag === "--port") options.port = port;
-    else options.userPort = port;
+    if ("error" in port) return { kind: "error", message: port.error };
+    if (flag === "--port") options.port = port.port;
+    else options.userPort = port.port;
   }
   return { kind: "run", options };
 }
@@ -525,8 +598,10 @@ type SearchParams = Record<string, string | string[] | undefined>;
 /**
  * Production always renders the fallback, whatever the URL says, so a branch
  * point that reaches a deployed build cannot expose an unreleased direction.
+ * It is not exported because a file whose exports are all components hot-swaps
+ * in place, while an extra export makes every edit reload the page.
  */
-export function resolve${titleCase(slug).replace(/\s/g, "")}(searchParams: SearchParams): Direction {
+function resolve${titleCase(slug).replace(/\s/g, "")}(searchParams: SearchParams): Direction {
   if (process.env.NODE_ENV === "production") return FALLBACK;
   const raw = searchParams["v-${slug}"];
   const value = Array.isArray(raw) ? raw[0] : raw;
@@ -572,8 +647,10 @@ function isProduction(): boolean {
 /**
  * Production always renders the fallback, whatever the URL says, so a branch
  * point that reaches a deployed build cannot expose an unreleased direction.
+ * It is not exported because a file whose exports are all components hot-swaps
+ * in place, while an extra export makes every edit reload the page.
  */
-export function resolve${name}(): Direction {
+function resolve${name}(): Direction {
   if (isProduction()) return FALLBACK;
   const value = new URLSearchParams(window.location.search).get("v-${slug}");
   return value !== null && value in DIRECTIONS ? (value as Direction) : FALLBACK;
@@ -855,7 +932,7 @@ function frameFor(title, requests) {
   return found;
 }
 function askedOf(title, requests) {
-  return requests.filter((request) => request.title === title && request.status !== "failed" && request.intent.trim() !== "").map((request) => request.intent.trim());
+  return requests.flatMap((request) => request.title === title && request.status !== "failed" && request.intent.trim() !== "" ? [request.intent.trim()] : []);
 }
 function composeEntry(input) {
   const slug = `${input.date}-${slugify(input.surface)}`;
@@ -915,13 +992,27 @@ function composeEntry(input) {
 `, pictures };
 }
 
+// ../server/dist/json.js
+function parseJson(text2) {
+  return JSON.parse(text2);
+}
+function isJsonRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isString(value) {
+  return typeof value === "string";
+}
+function isNumber(value) {
+  return typeof value === "number";
+}
+function isBoolean(value) {
+  return typeof value === "boolean";
+}
+
 // ../server/dist/config/config.js
 var DEFAULT_DEV_SERVER = "http://localhost:3000";
 var DEFAULT_INSTALL_COMMAND = "npm install";
 var IMPLICIT_PREVIEW = { title: "App", url: "/" };
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function isValidOrigin(value) {
   try {
     const url = new URL(value);
@@ -951,11 +1042,11 @@ function normalizeConfig(raw, options = {}) {
   const requireDevCommand = options.requireDevCommand ?? true;
   const errors = [];
   const source = raw === void 0 || raw === null ? {} : raw;
-  if (!isRecord(source)) {
+  if (!isJsonRecord(source)) {
     return { config: null, errors: ["Config must export an object."] };
   }
   const devServer = source["devServer"] ?? DEFAULT_DEV_SERVER;
-  if (typeof devServer !== "string" || !isValidOrigin(devServer)) {
+  if (!isString(devServer) || !isValidOrigin(devServer)) {
     errors.push(`devServer must be an http(s) URL, received ${JSON.stringify(devServer)}.`);
   }
   const rawPreviews = source["previews"] ?? [IMPLICIT_PREVIEW];
@@ -967,14 +1058,14 @@ function normalizeConfig(raw, options = {}) {
   const seenTitles = /* @__PURE__ */ new Set();
   rawPreviews.forEach((entry, index) => {
     const at = `previews[${index}]`;
-    if (!isRecord(entry)) {
+    if (!isJsonRecord(entry)) {
       errors.push(`${at} must be an object.`);
       return;
     }
     const title = entry["title"];
     const url = entry["url"];
     const file = entry["file"];
-    if (typeof title !== "string" || title.trim() === "") {
+    if (!isString(title) || title.trim() === "") {
       errors.push(`${at} needs a title; the rail has nothing to show without one.`);
     } else if (seenTitles.has(title)) {
       errors.push(`${at} repeats the title ${JSON.stringify(title)}; titles must be unique.`);
@@ -982,22 +1073,22 @@ function normalizeConfig(raw, options = {}) {
       seenTitles.add(title);
     }
     if (file !== void 0) {
-      if (typeof file !== "string" || !isSafePreviewFile(file)) {
+      if (!isString(file) || !isSafePreviewFile(file)) {
         errors.push(`${at} has an unusable file ${JSON.stringify(file)}; use a path inside the project, like "directions/hero.html".`);
       }
       if (url !== void 0) {
         errors.push(`${at} names a file and a url; a file preview's url is assigned by Leglas.`);
       }
-    } else if (typeof url !== "string" || url.trim() === "") {
+    } else if (!isString(url) || url.trim() === "") {
       errors.push(`${at} needs a url.`);
     } else if (!isValidPreviewUrl(url)) {
       errors.push(`${at} has url ${JSON.stringify(url)}; use a root-relative path ("/pricing") or a full URL.`);
     }
     const branch = entry["branch"];
     if (branch !== void 0) {
-      if (typeof branch !== "string" || !isSafeBranch(branch)) {
+      if (!isString(branch) || !isSafeBranch(branch)) {
         errors.push(`${at} has an unusable branch ${JSON.stringify(branch)}; use a plain git branch name.`);
-      } else if (typeof url === "string" && !url.startsWith("/")) {
+      } else if (isString(url) && !url.startsWith("/")) {
         errors.push(`${at} names a branch and an absolute url; a branch preview is served by Leglas, so its url must be a path.`);
       }
       if (file !== void 0) {
@@ -1005,54 +1096,59 @@ function normalizeConfig(raw, options = {}) {
       }
     }
     const basedOn = entry["basedOn"];
-    if (basedOn !== void 0 && (typeof basedOn !== "string" || basedOn.trim() === "")) {
+    if (basedOn !== void 0 && (!isString(basedOn) || basedOn.trim() === "")) {
       errors.push(`${at} has a basedOn that is not a direction title.`);
     }
     const askedFor = entry["askedFor"];
-    if (askedFor !== void 0 && (typeof askedFor !== "string" || askedFor.trim() === "")) {
+    if (askedFor !== void 0 && (!isString(askedFor) || askedFor.trim() === "")) {
       errors.push(`${at} has an askedFor that is not a change request.`);
     }
     const tags = entry["tags"];
-    previews.push({
-      title: typeof title === "string" ? title : "",
-      url: typeof url === "string" ? url : "",
-      note: typeof entry["note"] === "string" ? entry["note"] : void 0,
-      tags: Array.isArray(tags) ? tags.filter((tag) => typeof tag === "string") : [],
-      ...typeof branch === "string" ? { branch } : {},
-      ...typeof file === "string" ? { file } : {},
-      ...typeof basedOn === "string" && basedOn.trim() !== "" ? { basedOn } : {},
-      ...typeof askedFor === "string" && askedFor.trim() !== "" ? { askedFor } : {}
-    });
+    const preview = {
+      title: isString(title) ? title : "",
+      url: isString(url) ? url : "",
+      note: isString(entry["note"]) ? entry["note"] : void 0,
+      tags: Array.isArray(tags) ? tags.filter((tag) => isString(tag)) : []
+    };
+    if (isString(branch))
+      preview.branch = branch;
+    if (isString(file))
+      preview.file = file;
+    if (isString(basedOn) && basedOn.trim() !== "")
+      preview.basedOn = basedOn;
+    if (isString(askedFor) && askedFor.trim() !== "")
+      preview.askedFor = askedFor;
+    previews.push(preview);
   });
   const devCommand = source["devCommand"];
-  if (devCommand !== void 0 && typeof devCommand !== "string") {
+  if (devCommand !== void 0 && !isString(devCommand)) {
     errors.push("devCommand must be a string.");
-  } else if (typeof devCommand === "string" && !devCommand.includes("{port}")) {
+  } else if (isString(devCommand) && !devCommand.includes("{port}")) {
     errors.push(`devCommand must include {port}, so Leglas can start each checkout on a free port. Received ${JSON.stringify(devCommand)}.`);
   }
   if (requireDevCommand && previews.some((preview) => preview.branch !== void 0) && devCommand === void 0) {
     errors.push("A preview names a branch, so devCommand is required: Leglas has to start that checkout itself.");
   }
   const logDir = source["logDir"] ?? DEFAULT_LOG_DIR;
-  if (typeof logDir !== "string" || logDir.trim() === "") {
+  if (!isString(logDir) || logDir.trim() === "") {
     errors.push("logDir must be a non-empty string.");
   }
   const installCommand = source["installCommand"] ?? DEFAULT_INSTALL_COMMAND;
-  if (typeof installCommand !== "string" || installCommand.trim() === "") {
+  if (!isString(installCommand) || installCommand.trim() === "") {
     errors.push("installCommand must be a non-empty string.");
   }
   const scanPreviews = source["scanPreviews"] ?? true;
-  if (typeof scanPreviews !== "boolean") {
+  if (!isBoolean(scanPreviews)) {
     errors.push("scanPreviews must be a boolean.");
   }
-  if (errors.length > 0)
+  if (errors.length > 0 || !isString(devServer) || !isBoolean(scanPreviews) || !isString(installCommand) || !isString(logDir))
     return { config: null, errors };
   return {
     config: {
       devServer,
       previews,
       scanPreviews,
-      devCommand: typeof devCommand === "string" ? devCommand : void 0,
+      devCommand: isString(devCommand) ? devCommand : void 0,
       installCommand,
       logDir
     },
@@ -1068,17 +1164,17 @@ function tokenize(template) {
   const tokens = [];
   let current = "";
   let started = false;
-  let quote = null;
+  let quote2 = null;
   for (const character of template) {
-    if (quote !== null) {
-      if (character === quote)
-        quote = null;
+    if (quote2 !== null) {
+      if (character === quote2)
+        quote2 = null;
       else
         current += character;
       continue;
     }
     if (character === '"' || character === "'") {
-      quote = character;
+      quote2 = character;
       started = true;
       continue;
     }
@@ -1092,8 +1188,8 @@ function tokenize(template) {
     current += character;
     started = true;
   }
-  if (quote !== null) {
-    return { ok: false, error: `The agent command has an unclosed ${quote} quote.` };
+  if (quote2 !== null) {
+    return { ok: false, error: `The agent command has an unclosed ${quote2} quote.` };
   }
   if (started)
     tokens.push(current);
@@ -1190,7 +1286,7 @@ var KNOWN_AGENTS = {
     ],
     activityVerified: true,
     // Every stream-json event names its session.
-    sessionFrom: (event) => typeof event.session_id === "string" && event.session_id !== "" ? event.session_id : null,
+    sessionFrom: (event) => isString(event.session_id) && event.session_id !== "" ? event.session_id : null,
     authArgs: ["auth", "status"],
     // `claude auth status` prints JSON with a loggedIn boolean. Only that
     // field decides; any other shape stays unknown.
@@ -1253,7 +1349,7 @@ var KNOWN_AGENTS = {
       ...images.flatMap((image) => ["-i", image]),
       prompt
     ],
-    sessionFrom: (event) => event.type === "thread.started" && typeof event.thread_id === "string" ? event.thread_id : null,
+    sessionFrom: (event) => event.type === "thread.started" && isString(event.thread_id) ? event.thread_id : null,
     activityVerified: true,
     authArgs: ["login", "status"],
     // `codex login status` exits 0 when logged in and nonzero when not.
@@ -1291,7 +1387,7 @@ var KNOWN_AGENTS = {
       "stream-json",
       "--trust"
     ],
-    sessionFrom: (event) => typeof event.session_id === "string" && event.session_id !== "" ? event.session_id : null,
+    sessionFrom: (event) => isString(event.session_id) && event.session_id !== "" ? event.session_id : null,
     // Read against cursor-agent 2026.09.02: every event carries the id, a
     // resume in this argument order answers under the same id and remembers
     // the earlier turn.
@@ -1383,7 +1479,7 @@ function agentSearchPath(env = process.env, platform = process.platform) {
     platform === "darwin" ? "/usr/local/bin" : void 0,
     platform === "darwin" ? "/Applications/Codex.app/Contents/Resources" : void 0,
     platform === "darwin" ? "/Applications/Codex++.app/Contents/Resources" : void 0
-  ].filter((entry) => typeof entry === "string" && entry !== "");
+  ].filter((entry) => isString(entry) && entry !== "");
   return [...new Set(candidates)].join(delimiter);
 }
 function agentEnvironment(env = process.env) {
@@ -1427,23 +1523,23 @@ async function detectAgents(lookup2 = pathLookup, probe2 = execProbe) {
   }));
 }
 function record(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  return isJsonRecord(value) ? value : null;
 }
 function shownPath(value, cwd) {
-  if (typeof value !== "string" || value === "")
+  if (!isString(value) || value === "")
     return null;
   if (!isAbsolute(value))
     return value;
   return relative(cwd, value) || ".";
 }
 function shownCommand(value) {
-  let command = Array.isArray(value) ? value.filter((part) => typeof part === "string").join(" ") : typeof value === "string" ? value : "";
+  let command = Array.isArray(value) ? value.filter((part) => isString(part)).join(" ") : isString(value) ? value : "";
   command = command.trim();
   const wrapped = /^(?:\S*\/)?(?:bash|sh|zsh)\s+-l?c\s+([\s\S]*)$/.exec(command);
   if (wrapped?.[1] !== void 0) {
     command = wrapped[1].trim();
-    const quote = command[0];
-    if ((quote === "'" || quote === '"') && command.endsWith(quote) && command.length > 1) {
+    const quote2 = command[0];
+    if ((quote2 === "'" || quote2 === '"') && command.endsWith(quote2) && command.length > 1) {
       command = command.slice(1, -1);
     }
   }
@@ -1460,7 +1556,7 @@ function claudeActivity(event, cwd) {
     return null;
   for (const rawBlock of message2.content) {
     const block = record(rawBlock);
-    if (block?.type !== "tool_use" || typeof block.name !== "string")
+    if (block?.type !== "tool_use" || !isString(block.name))
       continue;
     const input = record(block.input);
     if (["Edit", "Write", "MultiEdit", "NotebookEdit"].includes(block.name)) {
@@ -1526,7 +1622,7 @@ function cursorActivity(event, cwd) {
 function activityFrom(agent, line, cwd = process.cwd()) {
   let event;
   try {
-    event = record(JSON.parse(line));
+    event = record(parseJson(line));
   } catch {
     return null;
   }
@@ -1545,7 +1641,7 @@ function sessionFrom(agent, line) {
     return null;
   let event;
   try {
-    event = record(JSON.parse(line));
+    event = record(parseJson(line));
   } catch {
     return null;
   }
@@ -1558,29 +1654,29 @@ function retryFrom(agent, line) {
     return null;
   let event;
   try {
-    event = record(JSON.parse(line));
+    event = record(parseJson(line));
   } catch {
     return null;
   }
   if (event === null || event.type !== "system" || event.subtype !== "api_retry")
     return null;
-  const attempt = typeof event.attempt === "number" ? event.attempt : 1;
+  const attempt = isNumber(event.attempt) ? event.attempt : 1;
   return {
     attempt,
-    max: typeof event.max_retries === "number" ? event.max_retries : null,
-    status: typeof event.error_status === "number" ? event.error_status : null,
-    reason: typeof event.error === "string" && event.error !== "" ? event.error.toLowerCase() : null
+    max: isNumber(event.max_retries) ? event.max_retries : null,
+    status: isNumber(event.error_status) ? event.error_status : null,
+    reason: isString(event.error) && event.error !== "" ? event.error.toLowerCase() : null
   };
 }
 function isAgentChoice(value) {
-  return value === "custom" || typeof value === "string" && Object.hasOwn(KNOWN_AGENTS, value);
+  return value === "custom" || isString(value) && Object.hasOwn(KNOWN_AGENTS, value);
 }
 function isAgentEffort(value) {
-  return typeof value === "string" && AGENT_EFFORTS.includes(value);
+  return isString(value) && AGENT_EFFORTS.some((effort) => effort === value);
 }
 async function readWatchConfig(cwd) {
   try {
-    const parsed = JSON.parse(await readFile(join(cwd, WATCH_PATH), "utf8"));
+    const parsed = parseJson(await readFile(join(cwd, WATCH_PATH), "utf8"));
     return record(parsed) ?? {};
   } catch {
     return {};
@@ -1593,7 +1689,7 @@ async function readAgentChoice(cwd) {
   return {
     agent,
     effort: agent !== null && agent !== "custom" && isAgentEffort(efforts?.[agent]) ? efforts[agent] : null,
-    run: typeof config.run === "string" && config.run !== "" ? config.run : null
+    run: isString(config.run) && config.run !== "" ? config.run : null
   };
 }
 async function saveAgentChoice(cwd, choice) {
@@ -1739,7 +1835,7 @@ async function loadConfig(cwd) {
     const message2 = error instanceof Error ? error.message : String(error);
     return { config: null, errors: [`${label} could not be loaded: ${message2}`], path };
   }
-  const result = normalizeConfig(exported);
+  const result = isJsonRecord(exported) || exported === void 0 || exported === null ? normalizeConfig(exported ?? void 0) : { config: null, errors: ["Config must export an object."] };
   return {
     config: result.config,
     errors: result.errors.map((error) => `${label}: ${error}`),
@@ -1757,7 +1853,7 @@ async function readLocalPreviews(cwd) {
   try {
     raw = await readFile3(path, "utf8");
   } catch (error) {
-    const code = error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : null;
+    const code = error instanceof Error && "code" in error && isString(error.code) ? error.code : null;
     if (code === "ENOENT") {
       return { previews: [], errors: [] };
     }
@@ -1770,7 +1866,7 @@ async function readLocalPreviews(cwd) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(raw);
+    parsed = parseJson(raw);
   } catch (error) {
     return {
       previews: [],
@@ -1803,16 +1899,21 @@ async function addLocalPreview(cwd, input, shared) {
       error: `A preview called ${JSON.stringify(input.title)} already exists. Titles identify previews, so they have to be unique.`
     };
   }
-  const candidate = {
-    title: input.title,
-    ...input.url === void 0 ? {} : { url: input.url },
-    ...input.note === void 0 ? {} : { note: input.note },
-    ...input.tags === void 0 ? {} : { tags: input.tags },
-    ...input.branch === void 0 ? {} : { branch: input.branch },
-    ...input.file === void 0 ? {} : { file: input.file },
-    ...input.basedOn === void 0 ? {} : { basedOn: input.basedOn },
-    ...input.askedFor === void 0 ? {} : { askedFor: input.askedFor }
-  };
+  const candidate = { title: input.title };
+  if (input.url !== void 0)
+    candidate.url = input.url;
+  if (input.note !== void 0)
+    candidate.note = input.note;
+  if (input.tags !== void 0)
+    candidate.tags = [...input.tags];
+  if (input.branch !== void 0)
+    candidate.branch = input.branch;
+  if (input.file !== void 0)
+    candidate.file = input.file;
+  if (input.basedOn !== void 0)
+    candidate.basedOn = input.basedOn;
+  if (input.askedFor !== void 0)
+    candidate.askedFor = input.askedFor;
   const check = normalizeConfig({ previews: [candidate] }, { requireDevCommand: false });
   if (check.config === null) {
     return { ok: false, error: check.errors.join(" ") };
@@ -1892,7 +1993,7 @@ function createProxyHandler(options) {
       res.once("close", close);
       const upstream = http.request({ host: dialHost, port, method: req.method, path: req.url, headers: upstreamHeaders(req) }, (upstreamRes) => {
         const headers = { ...upstreamRes.headers };
-        const location = rewriteLocation(typeof headers.location === "string" ? headers.location : void 0, publicOrigin2);
+        const location = rewriteLocation(isString(headers.location) ? headers.location : void 0, publicOrigin2);
         if (location !== void 0)
           headers.location = location;
         res.writeHead(upstreamRes.statusCode ?? 502, headers);
@@ -1961,7 +2062,7 @@ function startProxyServer(options) {
     });
     const server = http.createServer((req, res) => {
       const address = server.address();
-      const port = typeof address === "object" && address !== null ? address.port : 0;
+      const port = address !== null && !isString(address) ? address.port : 0;
       handler.request(req, res, `http://127.0.0.1:${port}`);
     });
     const sockets = /* @__PURE__ */ new Set();
@@ -1977,7 +2078,7 @@ function startProxyServer(options) {
     const onListening = () => {
       server.removeListener("error", onError);
       const address = server.address();
-      const port = typeof address === "object" && address !== null ? address.port : 0;
+      const port = address !== null && !isString(address) ? address.port : 0;
       let closed = null;
       resolve5({
         active: () => open > 0,
@@ -2109,7 +2210,7 @@ function findBrowser(search = {}) {
   const readdir4 = search.readdir ?? readableDirectories;
   const firstExisting = (paths) => paths.find((path) => exists(path)) ?? null;
   for (const candidate of [env.LEGLAS_BROWSER, env.CHROME_PATH, env.PUPPETEER_EXECUTABLE_PATH]) {
-    if (typeof candidate === "string" && candidate !== "" && exists(candidate))
+    if (isString(candidate) && candidate !== "" && exists(candidate))
       return candidate;
   }
   const caches = cacheRoots(platform, home, readdir4);
@@ -2135,7 +2236,7 @@ function findBrowser(search = {}) {
       return installed;
   }
   if (platform === "win32") {
-    const roots = [env.PROGRAMFILES, env["PROGRAMFILES(X86)"], env.LOCALAPPDATA].filter((entry) => typeof entry === "string" && entry !== "");
+    const roots = [env.PROGRAMFILES, env["PROGRAMFILES(X86)"], env.LOCALAPPDATA].filter((entry) => isString(entry) && entry !== "");
     const installed = firstExisting(roots.flatMap((root) => WINDOWS_BROWSERS.map((browser) => join4(root, browser))));
     if (installed !== null)
       return installed;
@@ -2218,7 +2319,7 @@ function endpoint(process2, timeoutMs) {
         return;
       settled = true;
       clearTimeout(timer);
-      if (typeof value === "string")
+      if (isString(value))
         resolve5(value);
       else
         reject(value);
@@ -2247,12 +2348,15 @@ var OWNER_FILE = "leglas-owner.json";
 var PROFILE_PREFIX = "leglas-browser-";
 var RECORD_GRACE_MS = 6e4;
 var REAP_CLOSE_MS = 2e3;
+function permissionDenied(cause) {
+  return typeof cause === "object" && cause !== null && "code" in cause && cause.code === "EPERM";
+}
 function livePid(pid) {
   try {
     nodeProcess.kill(pid, 0);
     return true;
   } catch (error) {
-    return typeof error === "object" && error !== null && error.code === "EPERM";
+    return permissionDenied(error);
   }
 }
 async function closeOrphan(url, connect) {
@@ -2282,7 +2386,7 @@ async function closeOrphan(url, connect) {
 }
 async function reapOrphanedBrowsers(deps = {}) {
   const root = deps.tmpdir ?? osTmpdir();
-  const clock = deps.now ?? (() => Date.now());
+  const clock2 = deps.now ?? (() => Date.now());
   const list = deps.list ?? (async (path) => (await readdir(path, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name));
   const read = deps.read ?? ((path) => readFile4(path, "utf8"));
   const alive = deps.alive ?? livePid;
@@ -2315,15 +2419,16 @@ async function reapOrphanedBrowsers(deps = {}) {
     let record3 = null;
     try {
       const raw = await read(join4(directory, OWNER_FILE));
-      record3 = raw === null ? null : JSON.parse(raw);
+      const parsed = raw === null ? null : parseJson(raw);
+      record3 = isJsonRecord(parsed) ? parsed : null;
     } catch {
     }
-    const owner = typeof record3?.owner === "number" ? record3.owner : null;
+    const owner = isNumber(record3?.owner) ? record3.owner : null;
     if (owner !== null && alive(owner))
       continue;
-    if (owner === null && clock() - details.createdAt < RECORD_GRACE_MS)
+    if (owner === null && clock2() - details.createdAt < RECORD_GRACE_MS)
       continue;
-    const endpoint2 = typeof record3?.ws === "string" && record3.ws !== "" ? record3.ws : null;
+    const endpoint2 = isString(record3?.ws) && record3.ws !== "" ? record3.ws : null;
     if (endpoint2 !== null && await closeOrphan(endpoint2, connect))
       reaped += 1;
     await remove(directory).catch(() => {
@@ -2332,7 +2437,7 @@ async function reapOrphanedBrowsers(deps = {}) {
   return reaped;
 }
 async function launchBrowser(executable, options = {}) {
-  const spawn4 = options.spawn ?? nodeSpawn;
+  const spawn5 = options.spawn ?? nodeSpawn;
   const connect = options.connect ?? connectWebSocket;
   const commandTimeoutMs = options.commandTimeoutMs ?? 3e4;
   const userDataDir = join4(options.tmpdir ?? osTmpdir(), `leglas-browser-${randomBytes(8).toString("hex")}`);
@@ -2345,7 +2450,7 @@ async function launchBrowser(executable, options = {}) {
     }
   };
   owned({});
-  const process2 = spawn4(executable, [
+  const process2 = spawn5(executable, [
     "--headless=new",
     "--remote-debugging-port=0",
     `--user-data-dir=${userDataDir}`,
@@ -2423,11 +2528,14 @@ async function launchBrowser(executable, options = {}) {
   socket.onMessage((text2) => {
     let message2;
     try {
-      message2 = JSON.parse(text2);
+      const parsed = parseJson(text2);
+      if (!isJsonRecord(parsed))
+        return;
+      message2 = parsed;
     } catch {
       return;
     }
-    if (typeof message2.id === "number") {
+    if (isNumber(message2.id)) {
       const command = pending.get(message2.id);
       if (command === void 0)
         return;
@@ -2435,15 +2543,15 @@ async function launchBrowser(executable, options = {}) {
       clearTimeout(command.timer);
       const error = message2.error;
       if (error !== void 0) {
-        command.reject(new Error(typeof error.message === "string" ? error.message : "CDP command failed."));
+        command.reject(new Error(isJsonRecord(error) && isString(error.message) ? error.message : "CDP command failed."));
       } else {
         command.resolve(message2.result);
       }
       return;
     }
-    if (typeof message2.method !== "string")
+    if (!isString(message2.method))
       return;
-    const sessionId = typeof message2.sessionId === "string" ? message2.sessionId : "";
+    const sessionId = isString(message2.sessionId) ? message2.sessionId : "";
     const key = `${sessionId}\0${message2.method}`;
     for (const listener of listeners.get(key) ?? [])
       listener(message2.params ?? {});
@@ -2466,17 +2574,16 @@ async function launchBrowser(executable, options = {}) {
       }, commandTimeoutMs);
       timer.unref?.();
       pending.set(id, {
+        // SAFETY: The pending command id pairs this CDP result with the method and result type requested by its caller.
         resolve: (value) => resolve5(value),
         reject,
         timer
       });
       try {
-        socket.send(JSON.stringify({
-          id,
-          method,
-          params,
-          ...sessionId === void 0 ? {} : { sessionId }
-        }));
+        const message2 = { id, method, params };
+        if (sessionId !== void 0)
+          message2.sessionId = sessionId;
+        socket.send(JSON.stringify(message2));
       } catch {
         clearTimeout(timer);
         pending.delete(id);
@@ -2561,36 +2668,37 @@ function createBrowserPool(options = {}) {
   const launch = options.launch ?? launchBrowser;
   const idleMs = options.idleMs ?? 6e4;
   const setLater = options.setTimeout ?? ((callback, milliseconds) => {
-    const timer2 = setTimeout(callback, milliseconds);
-    timer2.unref?.();
-    return timer2;
+    const timer = setTimeout(callback, milliseconds);
+    timer.unref?.();
+    return timer;
   });
   const clearLater = options.clearTimeout ?? ((handle) => clearTimeout(handle));
   let browser = null;
   let exposed = null;
   let working = 0;
   let launching = null;
-  let timer = null;
+  let cancelTimer = null;
   let lastReason = null;
   let closed = false;
   const clearIdle = () => {
-    if (timer === null)
+    if (cancelTimer === null)
       return;
-    clearLater(timer);
-    timer = null;
+    cancelTimer();
+    cancelTimer = null;
   };
   const scheduleIdle = () => {
     clearIdle();
     if (browser === null || closed || working > 0)
       return;
-    timer = setLater(() => {
-      timer = null;
+    const handle = setLater(() => {
+      cancelTimer = null;
       const retiring = browser;
       browser = null;
       exposed = null;
       void retiring?.close().catch(() => {
       });
     }, idleMs);
+    cancelTimer = () => clearLater(handle);
   };
   const wrap = (launched) => ({
     withPage: async (work) => {
@@ -2640,8 +2748,8 @@ function createBrowserPool(options = {}) {
       lastReason = null;
       scheduleIdle();
       return exposed;
-    }).catch((error) => {
-      lastReason = error instanceof Error ? error.message : String(error);
+    }).catch((cause) => {
+      lastReason = cause instanceof Error ? cause.message : String(cause);
       return null;
     }).finally(() => {
       if (launching === attempt)
@@ -2715,6 +2823,12 @@ var LOCATOR = `(function (selector, text, tag) {
   if (r.width === 0 && r.height === 0) return null;
   return { x: r.left + window.scrollX, y: r.top + window.scrollY, width: r.width, height: r.height };
 })`;
+var DRAWN_WITH = /* @__PURE__ */ new Set(["Script", "Stylesheet", "Font", "Image"]);
+var LAID_OUT = `(async () => {
+  await new Promise((next) => requestAnimationFrame(() => requestAnimationFrame(next)));
+  if (document.fonts) await document.fonts.ready;
+  return true;
+})()`;
 function clamp(value, low, high) {
   return Math.min(high, Math.max(low, value));
 }
@@ -2747,9 +2861,9 @@ function bounded(work, milliseconds, fallback) {
     void work.then((value) => {
       clearTimeout(timer);
       resolve5(value);
-    }, (error) => {
+    }, (cause) => {
       clearTimeout(timer);
-      reject(error);
+      reject(cause);
     });
   });
 }
@@ -2764,9 +2878,9 @@ function abortable(work, signal) {
     void work.then((value) => {
       signal.removeEventListener("abort", abort);
       resolve5(value);
-    }, (error) => {
+    }, (cause) => {
       signal.removeEventListener("abort", abort);
-      reject(error);
+      reject(cause);
     });
   });
 }
@@ -2775,10 +2889,9 @@ function resultValue(response) {
   return result !== void 0 && "value" in result ? result.value : null;
 }
 function validBox(value) {
-  if (typeof value !== "object" || value === null)
+  if (!isJsonRecord(value))
     return false;
-  const box = value;
-  return [box.x, box.y, box.width, box.height].every((entry) => typeof entry === "number" && Number.isFinite(entry));
+  return [value.x, value.y, value.width, value.height].every((entry) => isNumber(entry) && Number.isFinite(entry));
 }
 function locatorExpression(focus) {
   return `${LOCATOR}(${JSON.stringify(focus.selector)}, ${JSON.stringify(focus.text)}, ${JSON.stringify(focus.tag)})`;
@@ -2797,14 +2910,49 @@ async function render(page, input) {
     errors.push(message2);
   };
   let documentStatus = null;
+  const pending = /* @__PURE__ */ new Set();
+  const afterLoadScripts = /* @__PURE__ */ new Set();
+  let loadFired = false;
+  let scriptLanded = null;
+  let asked = 0;
+  let emptied = () => {
+  };
+  const received = (id) => {
+    if (afterLoadScripts.delete(id))
+      scriptLanded = Date.now();
+    if (pending.delete(id) && pending.size === 0)
+      emptied();
+  };
+  const landed = () => pending.size === 0 ? Promise.resolve() : new Promise((resolve5) => {
+    emptied = resolve5;
+  });
   const unlisten = [
     page.on("Network.responseReceived", (params) => {
       if (documentStatus !== null || params?.type !== "Document")
         return;
       const status = params?.response?.status;
-      if (typeof status === "number")
+      if (isNumber(status))
         documentStatus = status;
     }),
+    page.on("Network.requestWillBeSent", (params) => {
+      const id = params?.requestId;
+      if (!DRAWN_WITH.has(params?.type) || !isString(id))
+        return;
+      if (!pending.has(id)) {
+        asked += 1;
+        if (loadFired && params?.type === "Script")
+          afterLoadScripts.add(id);
+      }
+      pending.add(id);
+    }),
+    page.on("Network.loadingFinished", (params) => {
+      if (isString(params?.requestId))
+        received(params.requestId);
+    }),
+    page.on("Network.loadingFailed", (params) => {
+      if (isString(params?.requestId))
+        received(params.requestId);
+    }),
     page.on("Runtime.exceptionThrown", (params) => remember(params?.exceptionDetails?.exception?.description ?? params?.exceptionDetails?.text)),
     page.on("Runtime.consoleAPICalled", (params) => {
       if (params?.type !== "error")
@@ -2831,10 +2979,13 @@ async function render(page, input) {
     const load = new Promise((resolve5) => {
       loaded = resolve5;
     });
-    const stopLoad = page.on("Page.loadEventFired", () => loaded());
+    const stopLoad = page.on("Page.loadEventFired", () => {
+      loadFired = true;
+      loaded();
+    });
     unlisten.push(stopLoad);
     const navigation = await page.send("Page.navigate", { url: input.url });
-    if (typeof navigation.errorText === "string" && navigation.errorText !== "") {
+    if (isString(navigation.errorText) && navigation.errorText !== "") {
       throw new Error(`The page did not load: ${navigation.errorText}`);
     }
     await bounded(load, input.timeoutMs ?? 15e3, void 0);
@@ -2842,12 +2993,28 @@ async function render(page, input) {
     if (documentStatus !== null && documentStatus >= 500) {
       throw new Error(`The page did not load: the app answered HTTP ${documentStatus}.`);
     }
-    await bounded(page.send("Runtime.evaluate", {
-      expression: "document.fonts ? document.fonts.ready.then(() => true) : true",
-      awaitPromise: true,
-      returnByValue: true
-    }), 2e3, void 0).catch(() => {
-    });
+    const until = Date.now() + 2e3;
+    let waitedForScript = null;
+    while (Date.now() < until) {
+      await bounded(landed(), until - Date.now(), void 0);
+      const before = asked;
+      const answered = await bounded(page.send("Runtime.evaluate", {
+        expression: LAID_OUT,
+        awaitPromise: true,
+        returnByValue: true
+      }), Math.max(0, until - Date.now()), void 0).then(() => true, () => false);
+      if (!answered)
+        break;
+      if (pending.size !== 0 || asked !== before)
+        continue;
+      const latestScript = scriptLanded;
+      if (latestScript === null || latestScript === waitedForScript)
+        break;
+      const remaining = Math.min(latestScript + 300, until) - Date.now();
+      if (remaining > 0)
+        await new Promise((resolve5) => setTimeout(resolve5, remaining));
+      waitedForScript = latestScript;
+    }
     await bounded(page.send("Runtime.evaluate", {
       expression: `(async () => {
           // The page stops itself before the caller's deadline can. Without
@@ -3071,13 +3238,15 @@ async function moveReference(cwd, id, destinationDir, index) {
   };
 }
 function focusOf(note) {
-  return {
+  const focus = {
     selector: note.anchor.selector,
     text: note.anchor.text,
     tag: note.anchor.tag,
-    ...note.anchor.region === void 0 ? {} : { region: note.anchor.region },
     rect: note.anchor.rect
   };
+  if (note.anchor.region !== void 0)
+    focus.region = note.anchor.region;
+  return focus;
 }
 async function attachRequest(cwd, requestId, input, deps) {
   const capture = deps.capture ?? capturePage;
@@ -3104,8 +3273,8 @@ async function attachRequest(cwd, requestId, input, deps) {
     finishDeadline();
   }, deadlineMs);
   timer.unref?.();
-  for (let index = 0; index < input.references.length; index += 1) {
-    const reference = await moveReference(cwd, input.references[index], destination, index + 1).catch(() => null);
+  for (const [index, referenceId] of input.references.entries()) {
+    const reference = await moveReference(cwd, referenceId, destination, index + 1).catch(() => null);
     if (reference !== null)
       references.push(reference);
   }
@@ -3286,7 +3455,7 @@ async function freePort() {
     probe2.once("error", reject);
     probe2.listen(0, "127.0.0.1", () => {
       const address = probe2.address();
-      const port = typeof address === "object" && address !== null ? address.port : 0;
+      const port = address !== null && !isString(address) ? address.port : 0;
       probe2.close(() => resolve5(port));
     });
   });
@@ -3519,9 +3688,9 @@ function createBranchRegistry(options) {
         });
         throw error;
       }
-    }).catch((error) => transition(title, {
+    }).catch((cause) => transition(title, {
       status: "failed",
-      reason: error instanceof Error ? error.message : String(error)
+      reason: cause instanceof Error ? cause.message : String(cause)
     })).finally(() => {
       inflight.delete(title);
     });
@@ -3537,8 +3706,8 @@ function createBranchRegistry(options) {
         return stopPromise;
       closed = true;
       clearInterval(sweepTimer);
-      stopPromise = Promise.allSettled([...inflight.values()]).then(async () => {
-        await Promise.allSettled([...stopping.values()]);
+      stopPromise = Promise.allSettled(inflight.values()).then(async () => {
+        await Promise.allSettled(stopping.values());
         const ready = [...states.entries()].filter((entry) => entry[1].status === "ready" && proxies.has(entry[0]));
         await Promise.all(ready.map(([title, state]) => stopReady(title, state, false)));
       });
@@ -3547,6 +3716,10 @@ function createBranchRegistry(options) {
   };
 }
 
+// ../server/dist/agents/silence.js
+var QUIET_NOTICE_MS = 3 * 6e4;
+var SILENCE_CEILING_MS = 30 * 6e4;
+
 // ../server/dist/agents/failure.js
 var NEEDS_TRUST = /not inside a trusted directory|--skip-git-repo-check/i;
 var MISSING_BINARY = /\b(ENOENT|EACCES|ENOTDIR)\b/;
@@ -3600,6 +3773,8 @@ function message(code, input) {
       return `Codex refused this project: it is not a git repository and Codex has no trust on record for it.`;
     case "not-registered":
       return `${agent} finished without registering the new direction, so nothing reached the rail. Its last output is in the Leglas terminal.`;
+    case "agent-silent":
+      return `${agent} sent nothing for ${SILENCE_CEILING_MS / 6e4} minutes, so Leglas stopped it. It may have been waiting on a question nothing here can answer. Its last output is in the Leglas terminal.`;
     case "agent-error":
       return input.exitCode === null || input.exitCode === void 0 ? `${agent} stopped without finishing. Its last output is in the Leglas terminal.` : `${agent} exited with code ${input.exitCode}. Its last output is in the Leglas terminal.`;
   }
@@ -3607,10 +3782,10 @@ function message(code, input) {
 function classifyFailure(input) {
   const lines2 = input.lines ?? [];
   const error = input.error ?? null;
-  const code = error === "cancelled" ? "cancelled" : error === "not-registered" ? "not-registered" : error !== null && /^stopped by /.test(error) ? "stopped" : error !== null && MISSING_BINARY.test(error) ? "missing-agent" : (error !== null ? fromLines([error]) : null) ?? fromStatus(input.retry?.status ?? null, input.retry?.reason ?? null) ?? fromLines(lines2) ?? "agent-error";
+  const code = error === "cancelled" ? "cancelled" : error === "not-registered" ? "not-registered" : error === "silent" ? "agent-silent" : error !== null && error.startsWith("stopped by ") ? "stopped" : error !== null && MISSING_BINARY.test(error) ? "missing-agent" : (error !== null ? fromLines([error]) : null) ?? fromStatus(input.retry?.status ?? null, input.retry?.reason ?? null) ?? fromLines(lines2) ?? "agent-error";
   return { code, message: message(code, input) };
 }
-function sessionShaped(code) {
+function conversationFailure(code) {
   return code === "agent-error";
 }
 
@@ -3626,43 +3801,38 @@ var TAG_CAP = 40;
 var CLASS_CAP = 8;
 var CLASS_LENGTH_CAP = 60;
 var COVERS_CAP = 8;
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function text(value, cap) {
-  return typeof value === "string" ? value.trim().slice(0, cap) : "";
+  return isString(value) ? value.trim().slice(0, cap) : "";
 }
 function fraction(value) {
-  if (typeof value !== "number" || !Number.isFinite(value))
+  if (!isNumber(value) || !Number.isFinite(value))
     return 0.5;
   return Math.min(1, Math.max(0, value));
 }
 function size(value) {
-  return typeof value === "number" && Number.isFinite(value) ? Math.round(value) : 0;
+  return isNumber(value) && Number.isFinite(value) ? Math.round(value) : 0;
 }
 function anchorFrom(value) {
-  if (!isRecord2(value))
+  if (!isJsonRecord(value))
     return null;
   const selector = text(value["selector"], SELECTOR_CAP);
   if (selector === "")
     return null;
-  const rect = isRecord2(value["rect"]) ? value["rect"] : {};
-  const classes = Array.isArray(value["classes"]) ? value["classes"].filter((entry) => typeof entry === "string").slice(0, CLASS_CAP).map((entry) => entry.slice(0, CLASS_LENGTH_CAP)) : [];
-  const rawRegion = isRecord2(value["region"]) ? value["region"] : null;
+  const rect = isJsonRecord(value["rect"]) ? value["rect"] : {};
+  const classes = Array.isArray(value["classes"]) ? value["classes"].filter((entry) => isString(entry)).slice(0, CLASS_CAP).map((entry) => entry.slice(0, CLASS_LENGTH_CAP)) : [];
+  const rawRegion = isJsonRecord(value["region"]) ? value["region"] : null;
   const region = rawRegion === null ? null : {
     height: fraction(rawRegion["height"]),
     width: fraction(rawRegion["width"]),
     x: fraction(rawRegion["x"]),
     y: fraction(rawRegion["y"])
   };
-  const covers = Array.isArray(value["covers"]) ? value["covers"].filter(isRecord2).slice(0, COVERS_CAP).map((entry) => ({
+  const covers = Array.isArray(value["covers"]) ? value["covers"].filter(isJsonRecord).slice(0, COVERS_CAP).map((entry) => ({
     tag: text(entry["tag"], TAG_CAP) || "element",
     text: text(entry["text"], TEXT_CAP)
   })) : [];
-  return {
+  const anchor = {
     classes,
-    ...covers.length === 0 ? {} : { covers },
-    ...region === null ? {} : { region },
     rect: {
       height: size(rect["height"]),
       width: size(rect["width"]),
@@ -3671,22 +3841,27 @@ function anchorFrom(value) {
     },
     selector,
     spot: {
-      x: fraction(isRecord2(value["spot"]) ? value["spot"]["x"] : void 0),
-      y: fraction(isRecord2(value["spot"]) ? value["spot"]["y"] : void 0)
+      x: fraction(isJsonRecord(value["spot"]) ? value["spot"]["x"] : void 0),
+      y: fraction(isJsonRecord(value["spot"]) ? value["spot"]["y"] : void 0)
     },
     tag: text(value["tag"], TAG_CAP) || "element",
     text: text(value["text"], TEXT_CAP),
     viewport: size(value["viewport"])
   };
+  if (covers.length > 0)
+    anchor.covers = covers;
+  if (region !== null)
+    anchor.region = region;
+  return anchor;
 }
 async function readAnnotations(cwd) {
   try {
     const raw = await readFile6(join7(cwd, ANNOTATIONS_PATH), "utf8");
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed.annotations))
+    const parsed = parseJson(raw);
+    if (!isJsonRecord(parsed) || !Array.isArray(parsed.annotations))
       return [];
     return parsed.annotations.flatMap((entry, index) => {
-      if (!isRecord2(entry))
+      if (!isJsonRecord(entry))
         return [];
       const anchor = anchorFrom(entry["anchor"]);
       const title = text(entry["title"], TAG_CAP * 4);
@@ -3695,7 +3870,7 @@ async function readAnnotations(cwd) {
       return [
         {
           anchor,
-          id: typeof entry["id"] === "string" ? entry["id"] : String(index),
+          id: isString(entry["id"]) ? entry["id"] : String(index),
           note: text(entry["note"], NOTE_CAP),
           title
         }
@@ -3811,7 +3986,7 @@ function composeRequest(preview, intent, mode, notes = [], leglasCommand = "npx
   const target = preview.file ?? targetFor(preview.url);
   const cleaned = intent.trim();
   const asked = changeBlock(cleaned, notes);
-  const recorded = cleaned === "" ? notes.map((entry) => entry.note).filter((entry) => entry !== "").join("; ") : cleaned;
+  const recorded = cleaned === "" ? notes.flatMap((entry) => entry.note !== "" ? [entry.note] : []).join("; ") : cleaned;
   const prompt = mode === "variant" ? variantPrompt(preview, recorded, asked, target, leglasCommand, captured) : replacePrompt(preview, asked, target, leglasCommand, captured);
   return { prompt, target, mode };
 }
@@ -3934,52 +4109,62 @@ var TERMINAL = ["failed", "cancelled"];
 function isTerminal(status) {
   return TERMINAL.includes(status);
 }
-var FAILURE_CODES = [
-  "cancelled",
-  "stopped",
-  "missing-agent",
-  "not-signed-in",
-  "provider-overloaded",
-  "provider-limit",
-  "needs-trust",
-  "not-registered",
-  "agent-error"
-];
-function failureOf(value) {
-  if (typeof value !== "object" || value === null)
+var FAILURE_CODES = {
+  cancelled: true,
+  stopped: true,
+  "missing-agent": true,
+  "not-signed-in": true,
+  "provider-overloaded": true,
+  "provider-limit": true,
+  "needs-trust": true,
+  "not-registered": true,
+  "agent-error": true,
+  "agent-silent": true
+};
+function isFailureCode(value) {
+  return isString(value) && Object.hasOwn(FAILURE_CODES, value);
+}
+function failureOf(entry) {
+  if (!isJsonRecord(entry))
     return null;
-  const entry = value;
-  if (typeof entry.message !== "string" || entry.message === "")
+  if (!isString(entry.message) || entry.message === "")
     return null;
-  if (entry.code === void 0 || !FAILURE_CODES.includes(entry.code))
+  if (!isFailureCode(entry.code))
     return null;
   return { code: entry.code, message: entry.message };
 }
 async function readRequests(cwd) {
   try {
     const raw = await readFile7(join8(cwd, REQUESTS_PATH), "utf8");
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed.requests))
+    const parsed = parseJson(raw);
+    if (!isJsonRecord(parsed) || !Array.isArray(parsed.requests))
       return [];
     return parsed.requests.map((request, index) => {
-      const source = typeof request === "object" && request !== null ? request : {};
+      const source = isJsonRecord(request) ? request : Array.isArray(request) ? Object.fromEntries(Object.entries(request)) : {};
       const { failure: rawFailure, attachments: rawAttachments, captureNote: rawCaptureNote, compare: rawCompare, references: rawReferences, ...entry } = source;
       const status = entry.status === "picked-up" || entry.status === "failed" || entry.status === "cancelled" ? entry.status : "queued";
       const failure = isTerminal(status) ? failureOf(rawFailure) : null;
-      const id = typeof entry.id === "string" && REQUEST_ID.test(entry.id) ? entry.id : String(index);
+      const id = isString(entry.id) && REQUEST_ID.test(entry.id) ? entry.id : String(index);
       const ownFile = new RegExp(`^\\.leglas/captures/${id}/[A-Za-z0-9][A-Za-z0-9_.-]*$`);
-      const attachments = Array.isArray(rawAttachments) ? rawAttachments.filter((attachment) => typeof attachment === "object" && attachment !== null && !Array.isArray(attachment) && typeof attachment.file === "string" && ownFile.test(attachment.file) && !attachment.file.includes("..") && ["frame", "note", "compare", "reference"].includes(String(attachment.kind))) : null;
-      return {
+      const attachments = Array.isArray(rawAttachments) ? rawAttachments.filter((attachment) => isJsonRecord(attachment) && isString(attachment.file) && ownFile.test(attachment.file) && !attachment.file.includes("..") && ["frame", "note", "compare", "reference"].includes(String(attachment.kind))) : null;
+      const loaded = {
         ...entry,
         id,
         status,
-        mode: entry.mode === "variant" ? "variant" : "replace",
-        ...failure === null ? {} : { failure },
-        ...attachments === null || attachments.length === 0 ? {} : { attachments },
-        ...typeof rawCaptureNote === "string" ? { captureNote: rawCaptureNote } : {},
-        ...typeof rawCompare === "string" ? { compare: rawCompare } : {},
-        ...Array.isArray(rawReferences) && rawReferences.every((id2) => typeof id2 === "string") ? { references: rawReferences } : {}
+        mode: entry.mode === "variant" ? "variant" : "replace"
       };
+      const optional = {};
+      if (failure !== null)
+        optional.failure = failure;
+      if (attachments !== null && attachments.length > 0)
+        optional.attachments = attachments;
+      if (isString(rawCaptureNote))
+        optional.captureNote = rawCaptureNote;
+      if (isString(rawCompare))
+        optional.compare = rawCompare;
+      if (Array.isArray(rawReferences) && rawReferences.every(isString))
+        optional.references = rawReferences;
+      return { ...loaded, ...optional };
     });
   } catch {
     return [];
@@ -4047,7 +4232,7 @@ async function clearRequests(cwd) {
 // ../server/dist/agents/runner.js
 import { spawn as nodeSpawn3 } from "child_process";
 import { readFile as readFile9 } from "fs/promises";
-import { join as join9, resolve as resolve2, sep as sep2 } from "path";
+import { join as join9, resolve as resolve2 } from "path";
 
 // ../server/dist/agents/claude-agent-session.js
 import { EventEmitter } from "events";
@@ -4071,7 +4256,9 @@ function imageMediaType(path) {
 async function claudeContent(prompt, images) {
   if (images.length === 0)
     return prompt;
-  const blocks = [{ type: "text", text: prompt }];
+  const blocks = [
+    { type: "text", text: prompt }
+  ];
   for (const path of images) {
     const mediaType = imageMediaType(path);
     if (mediaType === null)
@@ -4103,9 +4290,9 @@ function waitForAbort(work, signal) {
     void work.then((value) => {
       signal.removeEventListener("abort", onAbort);
       resolve5(value);
-    }, (error) => {
+    }, (cause) => {
       signal.removeEventListener("abort", onAbort);
-      reject(error);
+      reject(cause);
     });
   });
 }
@@ -4238,27 +4425,28 @@ var PersistentClaudeSession = class {
     this.warmedFor = sessionId;
     const controller = new AbortController();
     this.processAbort = controller;
-    const warming = this.startup({
-      options: {
-        abortController: controller,
-        cwd: this.cwd,
-        env: agentEnvironment(),
-        permissionMode: "acceptEdits",
-        settingSources: ["user", "project", "local"],
-        persistSession: true,
-        ...this.allowedCommands.length === 0 ? {} : { allowedTools: this.allowedCommands.map((command) => `Bash(${command} *)`) },
-        ...sessionId === null ? {} : { resume: sessionId }
-      },
-      initializeTimeoutMs: INITIALIZE_TIMEOUT_MS
-    }).then((warmQuery) => {
+    const options = {
+      abortController: controller,
+      cwd: this.cwd,
+      env: agentEnvironment(),
+      permissionMode: "acceptEdits",
+      settingSources: ["user", "project", "local"],
+      persistSession: true
+    };
+    if (this.allowedCommands.length > 0) {
+      options.allowedTools = this.allowedCommands.map((command) => `Bash(${command} *)`);
+    }
+    if (sessionId !== null)
+      options.resume = sessionId;
+    const warming = this.startup({ options, initializeTimeoutMs: INITIALIZE_TIMEOUT_MS }).then((warmQuery) => {
       if (this.closed || controller.signal.aborted || this.processAbort !== controller)
         warmQuery.close();
       else
         this.warmQuery = warmQuery;
-    }).catch((error) => {
+    }).catch((cause) => {
       if (this.processAbort === controller)
         this.processAbort = null;
-      throw error;
+      throw cause;
     }).finally(() => {
       if (this.warming === warming)
         this.warming = null;
@@ -4365,7 +4553,7 @@ var PersistentClaudeSession = class {
     let endedNormally = false;
     try {
       for await (const message2 of query) {
-        if (typeof message2.session_id === "string" && message2.session_id !== "") {
+        if (isString(message2.session_id) && message2.session_id !== "") {
           this.loadedSessionId = message2.session_id;
         }
         const child = this.active;
@@ -4466,10 +4654,10 @@ import { EventEmitter as EventEmitter2 } from "events";
 import { PassThrough as PassThrough2 } from "stream";
 var REQUEST_TIMEOUT_MS = 3e4;
 function record2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  return isJsonRecord(value) ? value : null;
 }
 function string(value) {
-  return typeof value === "string" && value !== "" ? value : null;
+  return isString(value) && value !== "" ? value : null;
 }
 var CodexTurnChild = class {
   interrupt;
@@ -4529,9 +4717,9 @@ var PersistentCodexAppServer = class {
   stderr = [];
   closed = false;
   resetting = null;
-  constructor(cwd, spawn4, requestTimeoutMs) {
+  constructor(cwd, spawn5, requestTimeoutMs) {
     this.cwd = cwd;
-    this.spawn = spawn4;
+    this.spawn = spawn5;
     this.requestTimeoutMs = requestTimeoutMs;
   }
   /**
@@ -4585,9 +4773,9 @@ var PersistentCodexAppServer = class {
       capabilities: null
     }).then(() => {
       this.notify("initialized", {});
-    }).catch(async (error) => {
-      await this.resetProcess(process2, error instanceof Error ? error : new Error(String(error)));
-      throw error;
+    }).catch(async (cause) => {
+      await this.resetProcess(process2, cause instanceof Error ? cause : new Error(String(cause)));
+      throw cause;
     });
     return this.ready;
   }
@@ -4619,7 +4807,7 @@ var PersistentCodexAppServer = class {
       this.active = { child, threadId, turnId: null };
       child.line({ type: "thread.started", thread_id: threadId });
       turnSubmitted = true;
-      const response = record2(await this.requestRaw("turn/start", {
+      const params = {
         threadId,
         input: [
           { type: "text", text: input.prompt },
@@ -4633,9 +4821,11 @@ var PersistentCodexAppServer = class {
           networkAccess: true,
           excludeTmpdirEnvVar: false,
           excludeSlashTmp: false
-        },
-        ...input.effort === null ? {} : { effort: input.effort }
-      }));
+        }
+      };
+      if (input.effort !== null)
+        params.effort = input.effort;
+      const response = record2(await this.requestRaw("turn/start", params));
       const turn = record2(response?.turn);
       const turnId = string(turn?.id);
       if (turnId === null)
@@ -4730,13 +4920,13 @@ var PersistentCodexAppServer = class {
       return;
     let message2;
     try {
-      message2 = record2(JSON.parse(line));
+      message2 = record2(parseJson(line));
     } catch {
       message2 = null;
     }
     if (message2 === null)
       return;
-    const id = typeof message2.id === "number" ? message2.id : null;
+    const id = isNumber(message2.id) ? message2.id : null;
     const method = string(message2.method);
     if (id !== null && method === null) {
       const pending = this.pending.get(id);
@@ -4805,7 +4995,7 @@ var PersistentCodexAppServer = class {
     }
     if (item.type === "reasoning")
       return { type: "reasoning" };
-    return { type: typeof item.type === "string" ? item.type : "unknown" };
+    return { type: isString(item.type) ? item.type : "unknown" };
   }
   answerServerRequest(id, method) {
     if (method === "item/commandExecution/requestApproval") {
@@ -4928,8 +5118,39 @@ var defaultSpawn = (command, args, options) => nodeSpawn2(command, args, {
   ...options,
   env: agentEnvironment()
 });
-function createCodexAppServer(cwd, spawn4 = defaultSpawn, requestTimeoutMs = REQUEST_TIMEOUT_MS) {
-  return new PersistentCodexAppServer(cwd, spawn4, requestTimeoutMs);
+function createCodexAppServer(cwd, spawn5 = defaultSpawn, requestTimeoutMs = REQUEST_TIMEOUT_MS) {
+  return new PersistentCodexAppServer(cwd, spawn5, requestTimeoutMs);
+}
+
+// ../server/dist/agents/process-tree.js
+import { spawn as spawn3 } from "child_process";
+function ownGroup(platform = process.platform) {
+  return { detached: platform !== "win32" };
+}
+var system = {
+  platform: process.platform,
+  kill: (pid, signal) => process.kill(pid, signal),
+  taskkill: (pid) => spawn3("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore", shell: false })
+};
+function signalTree(child, signal, deps = system) {
+  const { pid } = child;
+  if (pid === void 0) {
+    child.kill(signal);
+    return;
+  }
+  if (deps.platform === "win32") {
+    try {
+      deps.taskkill(pid).once("error", () => child.kill(signal));
+    } catch {
+      child.kill(signal);
+    }
+    return;
+  }
+  try {
+    deps.kill(-pid, signal);
+  } catch {
+    child.kill(signal);
+  }
 }
 
 // ../server/dist/agents/runner.js
@@ -4937,6 +5158,9 @@ var POLL_MS = 2e3;
 var OUTPUT_LINES = 20;
 var IDLE_RELEASE_MS = 5 * 6e4;
 var CANCEL_GRACE_MS = 5e3;
+function isStateUpdater(value) {
+  return typeof value === "function";
+}
 var SESSION_TURNS_CAP = 8;
 function resolveCommand(choice, prompt, sessionId = null, allowedCommands = [], images = []) {
   if (choice.agent === null)
@@ -5007,7 +5231,7 @@ function defaultSpawn2(command, args, options) {
   return nodeSpawn3(command, args, { ...options, env: agentEnvironment() });
 }
 function startRunner(options) {
-  const spawn4 = options.spawn ?? defaultSpawn2;
+  const spawn5 = options.spawn ?? defaultSpawn2;
   const codexAppServer = options.codexAppServer === void 0 ? options.spawn === void 0 ? createCodexAppServer(options.cwd) : null : options.codexAppServer;
   const claudeAgentSession = options.claudeAgentSession === void 0 ? options.spawn === void 0 ? createClaudeAgentSession(options.cwd, options.leglasCommand === void 0 ? [] : [`${options.leglasCommand} show`, registrationCommand(options.leglasCommand)]) : null : options.claudeAgentSession;
   const setEvery = options.setInterval ?? ((callback, milliseconds) => setInterval(callback, milliseconds));
@@ -5016,6 +5240,7 @@ function startRunner(options) {
   const setLater = options.setTimeout ?? ((callback, milliseconds) => {
     setTimeout(callback, milliseconds).unref?.();
   });
+  const now = options.now ?? (() => Date.now());
   let state = {
     running: false,
     requestId: null,
@@ -5023,10 +5248,11 @@ function startRunner(options) {
     activity: null,
     startedAt: null,
     stopping: false,
-    waiting: null
+    waiting: null,
+    quietSince: null
   };
   const setState = (next) => {
-    state = typeof next === "function" ? next(state) : next;
+    state = isStateUpdater(next) ? next(state) : next;
     options.onChange?.();
   };
   let stopped = false;
@@ -5087,7 +5313,8 @@ function startRunner(options) {
       activity: null,
       startedAt: null,
       stopping: false,
-      waiting: null
+      waiting: null,
+      quietSince: null
     });
   };
   const rememberLine = (lines2, line) => {
@@ -5116,11 +5343,21 @@ function startRunner(options) {
       cancelled: false,
       controller,
       abandon: () => {
-      }
+      },
+      heardAt: now(),
+      silenced: false,
+      spawned: false
     };
     active = current;
     activeAgent = resolved.agent;
     const cancelled = () => ({ ok: false, error: "cancelled" });
+    const silent = () => ({ ok: false, error: "silent" });
+    const heard = () => {
+      current.heardAt = now();
+      if (active === current && state.quietSince !== null) {
+        setState((value) => ({ ...value, quietSince: null }));
+      }
+    };
     const startPersistent = async () => {
       if (persistent === null)
         throw new Error("No persistent transport.");
@@ -5145,27 +5382,31 @@ function startRunner(options) {
             return;
           }
           resolve5(child);
-        }, (error) => reject(error));
+        }, (cause) => reject(cause));
       });
     };
+    const spawnAgent2 = () => {
+      const child = spawn5(resolved.command, resolved.args, {
+        cwd: options.cwd,
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"],
+        ...ownGroup()
+      });
+      current.spawned = true;
+      return child;
+    };
     try {
       let child;
       try {
-        child = persistent !== null ? await startPersistent() : spawn4(resolved.command, resolved.args, {
-          cwd: options.cwd,
-          shell: false,
-          stdio: ["ignore", "pipe", "pipe"]
-        });
+        child = persistent !== null ? await startPersistent() : spawnAgent2();
       } catch (error) {
+        if (current.silenced)
+          return silent();
         if (current.cancelled || stopped || controller.signal.aborted)
           return cancelled();
         if (persistent !== null) {
           try {
-            child = spawn4(resolved.command, resolved.args, {
-              cwd: options.cwd,
-              shell: false,
-              stdio: ["ignore", "pipe", "pipe"]
-            });
+            child = spawnAgent2();
           } catch (fallbackError) {
             return {
               ok: false,
@@ -5182,12 +5423,13 @@ function startRunner(options) {
       current.child = child;
       if (current.cancelled || stopped || controller.signal.aborted) {
         try {
-          child.kill("SIGTERM");
+          signalChild(current, "SIGTERM");
         } catch {
         }
-        return cancelled();
+        return current.silenced ? silent() : cancelled();
       }
       const stdoutFlush = lineReader(child.stdout, (line) => {
+        heard();
         rememberLine(lines2, line);
         const sessionId = sessionFrom(resolved.agent, line);
         if (sessionId !== null)
@@ -5207,7 +5449,10 @@ function startRunner(options) {
           }
         }
       });
-      const stderrFlush = lineReader(child.stderr, (line) => rememberLine(lines2, line));
+      const stderrFlush = lineReader(child.stderr, (line) => {
+        heard();
+        rememberLine(lines2, line);
+      });
       return await new Promise((resolve5) => {
         let settled = false;
         const settle = (outcome) => {
@@ -5218,11 +5463,19 @@ function startRunner(options) {
           stderrFlush();
           resolve5(outcome);
         };
-        current.abandon = () => settle(cancelled());
-        child.once("error", (error) => settle({ ok: false, error: error.message }));
+        current.abandon = () => settle(current.silenced ? silent() : cancelled());
+        child.once("error", (error) => {
+          if (current.cancelled)
+            return settle(cancelled());
+          if (current.silenced)
+            return settle(silent());
+          settle({ ok: false, error: error.message });
+        });
         child.once("close", (code, signal) => {
           if (current.cancelled)
             return settle(cancelled());
+          if (current.silenced)
+            return settle(silent());
           if (signal !== null)
             return settle({ ok: false, error: `stopped by ${signal}` });
           settle({ ok: true, code: code ?? 0 });
@@ -5258,7 +5511,8 @@ function startRunner(options) {
         activity: null,
         startedAt: Date.now(),
         stopping: false,
-        waiting: null
+        waiting: null,
+        quietSince: null
       });
       const observed = {
         sessionId: null,
@@ -5280,7 +5534,7 @@ function startRunner(options) {
       // real output. Where it has not, "did not edit" means "was not seen
       // to edit", and rerunning on that is how a half-applied change gets
       // applied twice. Such a vendor keeps the failure card and its Retry.
-      activityVerified(resolved.agent) && sessionShaped(failure.code) && // Not redundant with the verdict: a stop that lands between the first
+      activityVerified(resolved.agent) && conversationFailure(failure.code) && // Not redundant with the verdict: a stop that lands between the first
       // child settling and the retry starting finds no child to cancel, so
       // nothing says "cancelled". Stopped still means stopped.
       !stopped) {
@@ -5354,31 +5608,61 @@ function startRunner(options) {
       }
     });
   };
-  const timer = setEvery(() => schedule(), POLL_MS);
-  schedule();
-  const cancel = (id) => {
-    if (active === null || active.cancelled)
-      return false;
-    if (id !== void 0 && active.requestId !== id)
-      return false;
-    const current = active;
-    current.cancelled = true;
-    failed.add(current.requestId);
-    setState((value) => ({ ...value, stopping: true, waiting: null }));
+  const signalChild = (current, value) => {
+    const { child } = current;
+    if (child === null)
+      return;
+    if (current.spawned)
+      signalTree(child, value);
+    else
+      child.kill(value);
+  };
+  const end = (current) => {
     current.controller.abort();
     try {
-      current.child?.kill("SIGTERM");
+      signalChild(current, "SIGTERM");
     } catch {
     }
     setLater(() => {
       if (active !== current)
         return;
       try {
-        current.child?.kill("SIGKILL");
+        signalChild(current, "SIGKILL");
       } catch {
       }
       current.abandon();
     }, CANCEL_GRACE_MS);
+  };
+  const listen2 = () => {
+    const current = active;
+    if (current === null || current.cancelled || current.silenced)
+      return;
+    const quiet = now() - current.heardAt;
+    if (quiet >= SILENCE_CEILING_MS) {
+      current.silenced = true;
+      setState((value) => ({ ...value, stopping: true, waiting: null, quietSince: null }));
+      end(current);
+      return;
+    }
+    if (quiet >= QUIET_NOTICE_MS && state.quietSince === null) {
+      setState((value) => ({ ...value, quietSince: current.heardAt }));
+    }
+  };
+  const timer = setEvery(() => {
+    listen2();
+    schedule();
+  }, POLL_MS);
+  schedule();
+  const cancel = (id) => {
+    if (active === null || active.cancelled || active.silenced)
+      return false;
+    if (id !== void 0 && active.requestId !== id)
+      return false;
+    const current = active;
+    current.cancelled = true;
+    failed.add(current.requestId);
+    setState((value) => ({ ...value, stopping: true, waiting: null, quietSince: null }));
+    end(current);
     return true;
   };
   const stop = () => {
@@ -5409,7 +5693,7 @@ import { createHash } from "crypto";
 var LIVE_PATH = "/leglas/api/live";
 var WEBSOCKET_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
 function encodeFrame(opcode, payload) {
-  const body = typeof payload === "string" ? Buffer.from(payload) : payload;
+  const body = isString(payload) ? Buffer.from(payload) : payload;
   let header;
   if (body.length < 126) {
     header = Buffer.allocUnsafe(2);
@@ -5443,17 +5727,18 @@ function createCoalescer(emit, options = {}) {
         return;
       const waiting = pending.get(change);
       if (waiting !== void 0)
-        clearLater(waiting);
-      pending.set(change, setLater(() => {
+        waiting();
+      const handle = setLater(() => {
         pending.delete(change);
         if (!closed)
           emit(change);
-      }, windowMs));
+      }, windowMs);
+      pending.set(change, () => clearLater(handle));
     },
     close() {
       closed = true;
-      for (const handle of pending.values())
-        clearLater(handle);
+      for (const cancel of pending.values())
+        cancel();
       pending.clear();
     }
   };
@@ -5537,7 +5822,7 @@ function createLiveHub(options = {}) {
       if (listeners.size === 0)
         return;
       const frame = encodeFrame(1, JSON.stringify({ changed: change }));
-      for (const listener of [...listeners]) {
+      for (const listener of Array.from(listeners)) {
         if (listener.socket.destroyed || !listener.socket.writable) {
           drop(listener);
           continue;
@@ -5556,7 +5841,7 @@ function createLiveHub(options = {}) {
         return false;
       const upgrade = req.headers.upgrade;
       const key = req.headers["sec-websocket-key"];
-      if (typeof upgrade !== "string" || upgrade.toLowerCase() !== "websocket" || typeof key !== "string" || key.trim() === "") {
+      if (!isString(upgrade) || upgrade.toLowerCase() !== "websocket" || !isString(key) || key.trim() === "") {
         socket.destroy();
         return false;
       }
@@ -5591,7 +5876,7 @@ Sec-WebSocket-Accept: ${accept}\r
       return true;
     },
     close: async () => {
-      for (const listener of [...listeners]) {
+      for (const listener of Array.from(listeners)) {
         write2(listener, 8, Buffer.alloc(0));
         drop(listener);
         listener.socket.destroy();
@@ -5645,15 +5930,17 @@ async function askLink(resolver, url, entryPath) {
     return false;
   const secure = target.protocol === "https:";
   return new Promise((resolve5) => {
-    const request = (secure ? https : http2).request({
+    const requestOptions = {
       host: address,
       port: Number(target.port || (secure ? 443 : 80)),
       path: entryPath,
       method: "GET",
       headers: { host: target.host },
-      ...secure ? { servername: target.hostname } : {},
       timeout: PROBE_TIMEOUT_MS2
-    }, (response) => {
+    };
+    if (secure)
+      requestOptions.servername = target.hostname;
+    const request = (secure ? https : http2).request(requestOptions, (response) => {
       response.resume();
       const status = response.statusCode ?? 0;
       resolve5(status >= 200 && status < 400);
@@ -5678,12 +5965,14 @@ function withOutput(sentence, output) {
   return `${stem} (${output.slice(0, 160)}).`;
 }
 function startTunnel(options, deps = {}) {
-  const spawn4 = deps.spawn ?? spawnChild;
+  const spawn5 = deps.spawn ?? spawnChild;
   const now = deps.now ?? Date.now;
   const urlDeadlineMs = deps.urlDeadlineMs ?? URL_DEADLINE_MS;
   const probeDeadlineMs = deps.probeDeadlineMs ?? PROBE_DEADLINE_MS;
   const resolver = deps.probe === void 0 ? new Resolver() : null;
-  const probe2 = deps.probe ?? ((url2) => askLink(resolver, url2, options.entryPath));
+  const probe2 = deps.probe ?? ((url2) => {
+    return askLink(resolver, url2, options.entryPath);
+  });
   const timers = /* @__PURE__ */ new Set();
   const later = (callback, ms) => {
     const timer = setTimeout(() => {
@@ -5724,18 +6013,16 @@ function startTunnel(options, deps = {}) {
       return;
     terminal = true;
     clearTimers();
-    report({
-      status: "failed",
-      provider: options.provider,
-      reason,
-      ...url === null ? {} : { url }
-    });
+    const failure = { status: "failed", provider: options.provider, reason };
+    if (url !== null)
+      failure.url = url;
+    report(failure);
   };
   report(state);
   const args = options.provider === "cloudflared" ? ["tunnel", "--url", `http://127.0.0.1:${options.port}`, "--no-autoupdate"] : ["http", String(options.port), "--log", "stdout", "--log-format", "json"];
   let child;
   try {
-    child = spawn4(options.provider, args, {
+    child = spawn5(options.provider, args, {
       env: agentEnvironment(),
       shell: false,
       stdio: ["ignore", "pipe", "pipe"]
@@ -5805,8 +6092,8 @@ function startTunnel(options, deps = {}) {
     if (stream !== "stdout")
       return;
     try {
-      const event = JSON.parse(trimmed);
-      const candidate = typeof event.url === "string" && event.url.startsWith("https://") ? event.url : null;
+      const event = parseJson(trimmed);
+      const candidate = isJsonRecord(event) && isString(event.url) && event.url.startsWith("https://") ? event.url : null;
       if (candidate !== null)
         beginProbe(candidate);
     } catch {
@@ -6027,19 +6314,16 @@ function isHiddenPath(path) {
 }
 var FILES_PREFIX_PATH = "/leglas/files/";
 var DETECT_TTL_MS = 1e4;
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function stringArray(value) {
-  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+  return Array.isArray(value) && value.every((entry) => isString(entry));
 }
 function stringRecord(value) {
-  return isRecord3(value) && Object.values(value).every((entry) => typeof entry === "string");
+  return isJsonRecord(value) && Object.values(value).every((entry) => isString(entry));
 }
 function layoutFrom(value) {
-  if (!isRecord3(value))
+  if (!isJsonRecord(value))
     return null;
-  if (!stringArray(value.order) || !stringRecord(value.renames) || !stringArray(value.collapsedFamilies) || value.compare !== null && typeof value.compare !== "string" || value.viewport !== null && (typeof value.viewport !== "number" || !Number.isFinite(value.viewport))) {
+  if (!stringArray(value.order) || !stringRecord(value.renames) || !stringArray(value.collapsedFamilies) || value.compare !== null && !isString(value.compare) || value.viewport !== null && (!isNumber(value.viewport) || !Number.isFinite(value.viewport))) {
     return null;
   }
   return {
@@ -6051,7 +6335,7 @@ function layoutFrom(value) {
   };
 }
 function manifestFrom(value, previews) {
-  if (!isRecord3(value)) {
+  if (!isJsonRecord(value)) {
     return { ok: false, error: "Share details must be a JSON object." };
   }
   const scope2 = value.scope;
@@ -6216,7 +6500,7 @@ function bind(server) {
     const onListening = () => {
       server.removeListener("error", onError);
       const address = server.address();
-      resolve5(typeof address === "object" && address !== null ? address.port : 0);
+      resolve5(address !== null && !isString(address) ? address.port : 0);
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -6256,10 +6540,7 @@ function createShareManager(options) {
     }
     return detected;
   };
-  const status = () => {
-    const share = active;
-    if (share === null)
-      return null;
+  const snapshot = (share) => {
     const tunnelUrl = "url" in share.tunnel ? share.tunnel.url : void 0;
     const origin = tunnelUrl === void 0 ? null : tunnelUrl.replace(/\/$/, "");
     return {
@@ -6268,7 +6549,7 @@ function createShareManager(options) {
       titles: [...share.titles],
       layout: cloneLayout(share.layout),
       sharePort: share.port,
-      grants: [...share.grants.values()].toSorted((a, b) => a.createdAt - b.createdAt).map((grant) => {
+      grants: Array.from(share.grants.values()).toSorted((a, b) => a.createdAt - b.createdAt).map((grant) => {
         const entryPath = `${ENTRY_PREFIX}${grant.token}`;
         return {
           id: grant.id,
@@ -6287,6 +6568,7 @@ function createShareManager(options) {
       startedAt: share.startedAt
     };
   };
+  const status = () => active === null ? null : snapshot(active);
   const endGrant = (share, grant, why) => {
     if (!share.grants.delete(grant.id))
       return;
@@ -6304,7 +6586,7 @@ function createShareManager(options) {
       held.req.destroy();
     }
     share.grantRequests.delete(grant.id);
-    for (const held of [...share.waiting.get(grant.id) ?? []]) {
+    for (const held of Array.from(share.waiting.get(grant.id) ?? [])) {
       if (held.drop())
         refuse(held.req, held.res, why);
     }
@@ -6324,13 +6606,13 @@ function createShareManager(options) {
     const at = now();
     const mono = nowMono();
     let ended = false;
-    for (const grant of [...share.grants.values()]) {
+    for (const grant of Array.from(share.grants.values())) {
       if (!expired(grant, at, mono))
         continue;
       endGrant(share, grant, "expiry");
       ended = true;
     }
-    const next = [...share.grants.values()].reduce((soonest, grant) => soonest === null ? grant.expiresAt : Math.min(soonest, grant.expiresAt), null);
+    const next = Array.from(share.grants.values()).reduce((soonest, grant) => soonest === null ? grant.expiresAt : Math.min(soonest, grant.expiresAt), null);
     if (next !== null) {
       share.expiryTimer = setTimeout(sweepExpiry, Math.max(1, next - at));
       share.expiryTimer.unref?.();
@@ -6619,7 +6901,7 @@ function createShareManager(options) {
       if (!parsed.ok)
         return { ok: false, status: 400, error: parsed.error };
       const providers = await tunnels();
-      const requested = isRecord3(input) ? input.tunnel : void 0;
+      const requested = isJsonRecord(input) ? input.tunnel : void 0;
       if (requested !== void 0 && requested !== "none" && requested !== "cloudflared" && requested !== "ngrok") {
         return { ok: false, status: 400, error: "That tunnel provider is not supported." };
       }
@@ -6693,7 +6975,7 @@ function createShareManager(options) {
             port,
             // Whichever link exists when the tunnel starts: the probe only
             // needs a path the listener answers, and a share always has one.
-            entryPath: `${ENTRY_PREFIX}${[...share.grants.values()][0]?.token ?? ""}`,
+            entryPath: `${ENTRY_PREFIX}${Array.from(share.grants.values())[0]?.token ?? ""}`,
             onState: (next) => {
               if (active !== share || JSON.stringify(share.tunnel) === JSON.stringify(next))
                 return;
@@ -6704,7 +6986,7 @@ function createShareManager(options) {
         });
         share.launch.unref?.();
       }
-      return { ok: true, share: status() };
+      return { ok: true, share: snapshot(share) };
     } finally {
       creating = false;
     }
@@ -6713,7 +6995,7 @@ function createShareManager(options) {
     const share = active;
     if (share === null)
       return { ok: false, status: 404, error: "Nothing is being shared." };
-    const name = isRecord3(input) && typeof input.name === "string" ? input.name.trim() : "";
+    const name = isJsonRecord(input) && isString(input.name) ? input.name.trim() : "";
     if (name.length > 60) {
       return { ok: false, status: 400, error: "That name is too long for a link." };
     }
@@ -6728,26 +7010,26 @@ function createShareManager(options) {
     mintGrant(share, name);
     sweepExpiry();
     options.live.nudge("share");
-    return { ok: true, share: status() };
+    return { ok: true, share: snapshot(share) };
   };
   const revokeGrant = (input) => {
     const share = active;
     if (share === null)
       return { ok: false, status: 404, error: "Nothing is being shared." };
-    const id = isRecord3(input) && typeof input.id === "string" ? input.id : "";
+    const id = isJsonRecord(input) && isString(input.id) ? input.id : "";
     const grant = share.grants.get(id);
     if (grant === void 0)
       return { ok: false, status: 404, error: "No such link." };
     endGrant(share, grant, "revoke");
     sweepExpiry();
     options.live.nudge("share");
-    return { ok: true, share: status() };
+    return { ok: true, share: snapshot(share) };
   };
   const extendGrant = (input) => {
     const share = active;
     if (share === null)
       return { ok: false, status: 404, error: "Nothing is being shared." };
-    const id = isRecord3(input) && typeof input.id === "string" ? input.id : "";
+    const id = isJsonRecord(input) && isString(input.id) ? input.id : "";
     sweepExpiry();
     const grant = share.grants.get(id);
     if (grant === void 0) {
@@ -6758,13 +7040,13 @@ function createShareManager(options) {
     grant.expiresAtMono = nowMono() + BigInt(DEFAULT_TTL_MS) * 1000000n;
     sweepExpiry();
     options.live.nudge("share");
-    return { ok: true, share: status() };
+    return { ok: true, share: snapshot(share) };
   };
   const rotate = async () => {
     const share = active;
     if (share === null)
       return { ok: false, status: 404, error: "Nothing is being shared." };
-    for (const grant of [...share.grants.values()])
+    for (const grant of Array.from(share.grants.values()))
       endGrant(share, grant, "revoke");
     const provider = "provider" in share.tunnel ? share.tunnel.provider : null;
     await share.runningTunnel?.stop().catch(() => {
@@ -6781,7 +7063,7 @@ function createShareManager(options) {
       share.runningTunnel = runTunnel({
         provider,
         port: share.port,
-        entryPath: `${ENTRY_PREFIX}${[...share.grants.values()][0]?.token ?? ""}`,
+        entryPath: `${ENTRY_PREFIX}${Array.from(share.grants.values())[0]?.token ?? ""}`,
         onState: (next) => {
           if (active !== share || share.tunnelGeneration !== generation)
             return;
@@ -6793,17 +7075,17 @@ function createShareManager(options) {
       });
     }
     options.live.nudge("share");
-    return { ok: true, share: status() };
+    return { ok: true, share: snapshot(share) };
   };
   const allowRoute = (input) => {
     const share = active;
     if (share === null)
       return { ok: false, status: 404, error: "Nothing is being shared." };
-    const given = isRecord3(input) && typeof input.path === "string" ? input.path.trim() : "";
+    const given = isJsonRecord(input) && isString(input.path) ? input.path.trim() : "";
     if (!given.startsWith("/")) {
       return { ok: false, status: 400, error: "A route is a path beginning with a slash." };
     }
-    const subtree = isRecord3(input) && input.subtree === true;
+    const subtree = isJsonRecord(input) && input.subtree === true;
     if (subtree && given.replace(/\/+$/, "") === "") {
       return { ok: false, status: 400, error: "The root is a page, not a folder." };
     }
@@ -6815,7 +7097,7 @@ function createShareManager(options) {
       share.routes.push(asked);
     share.refused = share.refused.filter((path) => !routeAllowed([asked], path));
     options.live.nudge("share");
-    return { ok: true, share: status() };
+    return { ok: true, share: snapshot(share) };
   };
   const update = async (input) => {
     const share = active;
@@ -6833,7 +7115,7 @@ function createShareManager(options) {
     share.layout = parsed.manifest.layout;
     options.live.nudge("share");
     options.live.nudge("config");
-    return { ok: true, share: status() };
+    return { ok: true, share: snapshot(share) };
   };
   const viewerConfig = async (grantId) => {
     const share = active;
@@ -6923,8 +7205,8 @@ var RENAMES_PATH = ".leglas/renames.json";
 async function readRenames(cwd) {
   try {
     const raw = await readFile10(join10(cwd, RENAMES_PATH), "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed.renames === null || typeof parsed.renames !== "object")
+    const parsed = parseJson(raw);
+    if (!isJsonRecord(parsed) || !isJsonRecord(parsed.renames) && !Array.isArray(parsed.renames))
       return {};
     return Object.fromEntries(Object.entries(parsed.renames).filter((entry) => typeof entry[1] === "string" && entry[1] !== ""));
   } catch {
@@ -6956,6 +7238,115 @@ import http4 from "http";
 import net3 from "net";
 import { basename as basename3, dirname as dirname8, extname as extname3, join as join12, normalize, relative as relative3 } from "path";
 
+// ../server/dist/frame-policy.js
+var FRAMING_TIMEOUT_MS = 4e3;
+var FRAME_ANCESTORS = "frame-ancestors";
+var QUOTE_CAP = 160;
+function quote(value) {
+  return value.length <= QUOTE_CAP ? value : `${value.slice(0, QUOTE_CAP - 1)}\u2026`;
+}
+function defaultPort(protocol) {
+  return protocol === "https:" || protocol === "wss:" ? "443" : "80";
+}
+function portOf(url) {
+  return url.port === "" ? defaultPort(url.protocol) : url.port;
+}
+function schemeAdmits(scheme, url) {
+  return url.protocol === scheme || scheme === "http:" && url.protocol === "https:";
+}
+var HOST_SOURCE = /^(?:([a-z][a-z0-9+.-]*):\/\/)?(\*|\*\.[^:/]+|\[[0-9a-f:.]+\]|[^:/*[\]]+)(?::(\*|\d+))?(\/.*)?$/i;
+function sourceAdmits(source, embedder, target) {
+  const lower = source.toLowerCase();
+  if (lower === "'self'")
+    return embedder.origin === target.origin;
+  if (lower === "*")
+    return embedder.protocol === "http:" || embedder.protocol === "https:";
+  if (/^[a-z][a-z0-9+.-]*:$/.test(lower))
+    return schemeAdmits(lower, embedder);
+  if (lower.startsWith("'"))
+    return false;
+  const match = HOST_SOURCE.exec(lower);
+  if (match === null)
+    return false;
+  const [, scheme, host = "", port, path] = match;
+  const schemeOk = scheme === void 0 ? (
+    // No scheme borrows the protected page's own, with the upgrade allowed.
+    schemeAdmits(target.protocol, embedder)
+  ) : schemeAdmits(`${scheme}:`, embedder);
+  const hostname = embedder.hostname.toLowerCase();
+  const hostOk = host === "*" ? true : host.startsWith("*.") ? hostname.endsWith(host.slice(1)) : hostname === host;
+  const portOk = port === "*" ? true : port === void 0 ? portOf(embedder) === defaultPort(embedder.protocol) : portOf(embedder) === port;
+  const pathOk = path === void 0 || path === "/" ? true : path.endsWith("/") ? embedder.pathname.startsWith(path) : embedder.pathname === path;
+  return schemeOk && hostOk && portOk && pathOk;
+}
+function listAdmits(list, embedder, target) {
+  const sources = list.split(/\s+/).filter((source) => source !== "");
+  return sources.some((source) => sourceAdmits(source, embedder, target));
+}
+function ancestorLists(csp) {
+  if (csp === null)
+    return [];
+  const lists = [];
+  for (const policy of csp.split(",")) {
+    for (const directive of policy.split(";")) {
+      const trimmed = directive.trim();
+      const name = trimmed.split(/\s+/, 1)[0]?.toLowerCase();
+      if (name === FRAME_ANCESTORS)
+        lists.push(trimmed.slice(FRAME_ANCESTORS.length).trim());
+    }
+  }
+  return lists;
+}
+function framingFor(headers, target, embedder) {
+  const targetUrl = new URL(target);
+  const embedderUrl = new URL(embedder);
+  const lists = ancestorLists(headers.get("content-security-policy"));
+  if (lists.length > 0) {
+    const refusing = lists.find((list) => !listAdmits(list, embedderUrl, targetUrl));
+    return refusing === void 0 ? { framable: true } : {
+      framable: false,
+      refusal: {
+        header: "content-security-policy",
+        value: quote(`${FRAME_ANCESTORS} ${refusing}`.trim())
+      }
+    };
+  }
+  const raw = headers.get("x-frame-options");
+  if (raw === null)
+    return { framable: true };
+  const values = new Set(raw.split(",").flatMap((value) => {
+    const normal = value.trim().toLowerCase();
+    return normal === "" ? [] : [normal];
+  }));
+  const refused = {
+    framable: false,
+    refusal: { header: "x-frame-options", value: quote(raw.trim()) }
+  };
+  if (values.size > 1) {
+    return values.has("deny") || values.has("sameorigin") || values.has("allowall") ? refused : { framable: true };
+  }
+  if (values.has("deny"))
+    return refused;
+  if (values.has("sameorigin")) {
+    return embedderUrl.origin === targetUrl.origin ? { framable: true } : refused;
+  }
+  return { framable: true };
+}
+async function checkFraming(target, embedder, fetcher = fetch) {
+  try {
+    const response = await fetcher(target, {
+      headers: { accept: "text/html" },
+      redirect: "follow",
+      signal: AbortSignal.timeout(FRAMING_TIMEOUT_MS)
+    });
+    void response.body?.cancel().catch(() => {
+    });
+    return framingFor(response.headers, response.url === "" ? target : response.url, embedder);
+  } catch {
+    return { framable: null };
+  }
+}
+
 // ../server/dist/server-info.js
 import { lstat as lstat2, mkdir as mkdir7, readFile as readFile11, rename as rename2, rm as rm4, writeFile as writeFile7 } from "fs/promises";
 import { dirname as dirname7, join as join11 } from "path";
@@ -6972,16 +7363,16 @@ async function writeServerInfo(cwd, info) {
   const temporary = `${path}.${process.pid}.tmp`;
   await writeFile7(temporary, `${JSON.stringify({ ...info, startedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `, "utf8");
-  await rename2(temporary, path).catch(async (error) => {
+  await rename2(temporary, path).catch(async (cause) => {
     await rm4(temporary, { force: true }).catch(() => {
     });
-    throw error;
+    throw cause;
   });
 }
 async function readServerInfo(cwd) {
   try {
-    const value = JSON.parse(await readFile11(join11(cwd, SERVER_INFO_PATH), "utf8"));
-    if (typeof value.port !== "number" || !Number.isInteger(value.port) || value.port < 1 || value.port > 65535 || typeof value.url !== "string" || value.url === "" || typeof value.pid !== "number" || !Number.isInteger(value.pid))
+    const value = parseJson(await readFile11(join11(cwd, SERVER_INFO_PATH), "utf8"));
+    if (!isJsonRecord(value) || !isNumber(value.port) || !Number.isInteger(value.port) || value.port < 1 || value.port > 65535 || !isString(value.url) || value.url === "" || !isNumber(value.pid) || !Number.isInteger(value.pid))
       return null;
     return { port: value.port, url: value.url, pid: value.pid };
   } catch {
@@ -7020,6 +7411,9 @@ var CONTENT_TYPES = {
   ".woff": "font/woff",
   ".woff2": "font/woff2"
 };
+function isContentExtension(extension) {
+  return Object.hasOwn(CONTENT_TYPES, extension);
+}
 var FILES_PREFIX = `${LEGLAS_PREFIX}/files`;
 function sendJson2(res, status, body) {
   const payload = JSON.stringify(body);
@@ -7066,8 +7460,11 @@ function referenceName(value) {
   }).join("").trim().slice(0, 80);
   return safe || "image";
 }
+function isAddressInUse(cause) {
+  return typeof cause === "object" && cause !== null && "code" in cause && cause.code === "EADDRINUSE";
+}
 function isKnownAgent(value) {
-  return typeof value === "string" && Object.hasOwn(KNOWN_AGENTS, value);
+  return isString(value) && Object.hasOwn(KNOWN_AGENTS, value);
 }
 function isAllowedMutationHost(hostname) {
   const bare = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
@@ -7088,7 +7485,7 @@ function isLoopbackAddress(address) {
 function isTrustedMutation(req) {
   if (!isLoopbackAddress(req.socket.remoteAddress))
     return false;
-  if (typeof req.headers.host !== "string")
+  if (!isString(req.headers.host))
     return false;
   let host;
   try {
@@ -7112,17 +7509,21 @@ function isEnded(request, failedIds) {
   return isTerminal(request.status) || failedIds.includes(request.id);
 }
 function jsonBody(body) {
-  let parsed;
   try {
-    parsed = JSON.parse(body || "{}");
+    const parsed = parseJson(body || "{}");
+    return isJsonRecord(parsed) ? parsed : null;
   } catch {
     return null;
   }
-  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : null;
+}
+function requestIntent(value) {
+  if (value === null || value === void 0)
+    return "";
+  return isString(value) ? value.trim() : null;
 }
 function hasJsonBody(req) {
   const contentType = req.headers["content-type"];
-  return typeof contentType === "string" && contentType.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
+  return isString(contentType) && contentType.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
 }
 function probe(target, timeoutMs = 1e3) {
   return new Promise((resolve5) => {
@@ -7151,8 +7552,9 @@ function serveFrom(res, dir, relativePath) {
     return false;
   if (!existsSync3(candidate) || !statSync(candidate).isFile())
     return false;
+  const extension = extname3(candidate);
   res.writeHead(200, {
-    "content-type": CONTENT_TYPES[extname3(candidate)] ?? "application/octet-stream",
+    "content-type": isContentExtension(extension) ? CONTENT_TYPES[extension] : "application/octet-stream",
     "cache-control": "no-store"
   });
   createReadStream(candidate).pipe(res);
@@ -7409,7 +7811,7 @@ function listen(server, port) {
     const onListening = () => {
       server.removeListener("error", onError);
       const address = server.address();
-      resolve5(typeof address === "object" && address !== null ? address.port : port);
+      resolve5(address !== null && !isString(address) ? address.port : port);
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -7423,7 +7825,7 @@ async function bind2(server, requested) {
     try {
       return await listen(server, requested + attempt);
     } catch (error) {
-      if (error.code !== "EADDRINUSE")
+      if (!isAddressInUse(error))
         throw error;
     }
   }
@@ -7435,14 +7837,16 @@ async function startServer(options) {
   let shares = null;
   let liveHealth = null;
   const live = options.live ?? createLiveHub();
-  const branches = createBranchRegistry({
+  const branchOptions = {
     cwd,
     previews: (config?.previews ?? []).flatMap((preview) => preview.branch === void 0 ? [] : [{ title: preview.title, branch: preview.branch }]),
     installCommand: config?.installCommand ?? DEFAULT_INSTALL_COMMAND,
     devCommand: config?.devCommand,
-    onChange: () => live.nudge("config"),
-    ...options.startWorktree === void 0 ? {} : { startWorktree: options.startWorktree }
-  });
+    onChange: () => live.nudge("config")
+  };
+  if (options.startWorktree !== void 0)
+    branchOptions.startWorktree = options.startWorktree;
+  const branches = createBranchRegistry(branchOptions);
   const previewForConfig = (preview) => {
     if (preview.branch === void 0)
       return preview;
@@ -7556,9 +7960,9 @@ async function startServer(options) {
         return void updates.check({ force: true }).then((status) => sendJson2(res, 200, status));
       }
       if (path.endsWith("/install")) {
-        return void updates.update().then((status) => sendJson2(res, 200, status), (error) => sendJson2(res, 409, {
+        return void updates.update().then((status) => sendJson2(res, 200, status), (cause) => sendJson2(res, 409, {
           ok: false,
-          error: error instanceof Error ? error.message : String(error)
+          error: cause instanceof Error ? cause.message : String(cause)
         }));
       }
       if (!hasJsonBody(req))
@@ -7569,12 +7973,12 @@ async function startServer(options) {
         const parsed = jsonBody(body);
         if (parsed === null)
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
-        if (typeof parsed.version !== "string" || parsed.version.trim() === "") {
+        if (!isString(parsed.version) || parsed.version.trim() === "") {
           return sendJson2(res, 400, { ok: false, error: "Body needs a version." });
         }
-        void updates.skip(parsed.version).then((status) => sendJson2(res, 200, status), (error) => sendJson2(res, 400, {
+        void updates.skip(parsed.version).then((status) => sendJson2(res, 200, status), (cause) => sendJson2(res, 400, {
           ok: false,
-          error: error instanceof Error ? error.message : String(error)
+          error: cause instanceof Error ? cause.message : String(cause)
         }));
       });
     }
@@ -7592,10 +7996,10 @@ async function startServer(options) {
         if (parsed === null) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
-        const result = await shares?.create(parsed).catch((error) => ({
+        const result = await shares?.create(parsed).catch((cause) => ({
           ok: false,
           status: 500,
-          error: `Leglas could not start the share (${error instanceof Error ? error.message : String(error)}).`
+          error: `Leglas could not start the share (${cause instanceof Error ? cause.message : String(cause)}).`
         }));
         if (result === void 0) {
           return sendJson2(res, 500, { ok: false, error: "Sharing is not available." });
@@ -7677,6 +8081,24 @@ async function startServer(options) {
         warnings: configWarnings
       }));
     }
+    if (path === `${LEGLAS_PREFIX}/api/previews/framing` && req.method === "GET") {
+      const site = req.headers["sec-fetch-site"];
+      if (site !== void 0 && site !== "same-origin" && site !== "none") {
+        return sendJson2(res, 403, { ok: false, error: "Only the interface can ask this." });
+      }
+      const title = query.get("title");
+      return void livePreviewDefinitions().then(async (previews) => {
+        const preview = previews.find((entry) => entry.title === title);
+        if (preview === void 0) {
+          return sendJson2(res, 404, { ok: false, error: "There is no direction by that name." });
+        }
+        if (preview.file !== void 0 || preview.branch !== void 0 || !/^https?:\/\//i.test(preview.url)) {
+          return sendJson2(res, 200, { framable: true });
+        }
+        const embedder = `http://${req.headers.host ?? "localhost"}${LEGLAS_PREFIX}/`;
+        sendJson2(res, 200, await checkFraming(preview.url, embedder));
+      });
+    }
     if (path === `${LEGLAS_PREFIX}/api/previews/start` && req.method === "POST") {
       let body = "";
       req.on("data", (chunk) => body += chunk);
@@ -7685,7 +8107,7 @@ async function startServer(options) {
         if (parsed === null) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
-        if (typeof parsed.title !== "string" || parsed.title.trim() === "") {
+        if (!isString(parsed.title) || parsed.title.trim() === "") {
           return sendJson2(res, 400, { ok: false, error: "Body needs a direction title." });
         }
         const preview = (await livePreviewDefinitions()).find((entry) => entry.title === parsed.title);
@@ -7721,7 +8143,7 @@ async function startServer(options) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
         const titles = parsed.titles;
-        if (!Array.isArray(titles) || titles.length === 0 || titles.some((title) => typeof title !== "string" || title.trim() === "")) {
+        if (!Array.isArray(titles) || titles.length === 0 || !titles.every((title) => isString(title) && title.trim() !== "")) {
           return sendJson2(res, 400, {
             ok: false,
             error: "Body needs a non-empty array of direction titles."
@@ -7753,7 +8175,7 @@ async function startServer(options) {
     }
     if (path === `${LEGLAS_PREFIX}/api/references` && req.method === "POST") {
       const declaredLength = req.headers["content-length"];
-      if (typeof declaredLength === "string" && Number(declaredLength) > REFERENCE_MAX_BYTES) {
+      if (isString(declaredLength) && Number(declaredLength) > REFERENCE_MAX_BYTES) {
         return sendJson2(res, 413, { ok: false, error: "That image is over 10MB." });
       }
       const chunks = [];
@@ -7828,7 +8250,7 @@ async function startServer(options) {
           });
         }
         const mode = parsed.mode === "replace" ? "replace" : "variant";
-        if (parsed.references !== void 0 && (!Array.isArray(parsed.references) || parsed.references.some((reference) => typeof reference !== "string" || !/^[A-Za-z0-9_-]{1,32}$/.test(reference)))) {
+        if (parsed.references !== void 0 && (!Array.isArray(parsed.references) || !parsed.references.every((reference) => isString(reference) && /^[A-Za-z0-9_-]{1,32}$/.test(reference)))) {
           return sendJson2(res, 400, { ok: false, error: "references must be uploaded image ids." });
         }
         const references = parsed.references ?? [];
@@ -7842,23 +8264,26 @@ async function startServer(options) {
             });
           }
         }
-        const width = typeof parsed.width === "number" && Number.isFinite(parsed.width) ? Math.min(MAX_WIDTH, Math.max(MIN_WIDTH, Math.round(parsed.width))) : 1440;
+        const width = isNumber(parsed.width) && Number.isFinite(parsed.width) ? Math.min(MAX_WIDTH, Math.max(MIN_WIDTH, Math.round(parsed.width))) : 1440;
         const previews = await livePreviews();
         const preview = previews.find((entry) => entry.title === parsed.title);
         if (!preview) {
           return sendJson2(res, 400, { ok: false, error: "Unknown preview, or empty request." });
         }
         const notes = annotationsFor(await readAnnotations(cwd).catch(() => []), preview.title);
-        if (!parsed.intent?.trim() && notes.length === 0) {
+        const intent = requestIntent(parsed.intent);
+        if (intent === null) {
+          return sendJson2(res, 400, { ok: false, error: "A request's words must be text." });
+        }
+        if (!intent && notes.length === 0) {
           return sendJson2(res, 400, { ok: false, error: "Unknown preview, or empty request." });
         }
-        const intent = (parsed.intent ?? "").trim();
         const live2 = (await readRequests(cwd).catch(() => [])).filter((entry) => entry.status === "queued" || entry.status === "picked-up");
         const sameNotes = (entry) => {
           const before = [...entry.notes ?? []].sort().join(",");
           return before === notes.map((note) => note.id).sort().join(",");
         };
-        const compare = typeof parsed.compare === "string" && parsed.compare !== preview.title ? previews.find((entry) => entry.title === parsed.compare) ?? null : null;
+        const compare = isString(parsed.compare) && parsed.compare !== preview.title ? previews.find((entry) => entry.title === parsed.compare) ?? null : null;
         const sameContext = (entry) => (entry.compare ?? null) === (compare?.title ?? null) && [...entry.references ?? []].sort().join(",") === [...references].sort().join(",");
         if (live2.some((entry) => entry.title === preview.title && entry.intent === intent && // The same words in the other mode are not the same request:
         // one forks the direction and the other rewrites it. Only a
@@ -7871,7 +8296,7 @@ async function startServer(options) {
           });
         }
         const address = server.address();
-        const requestPort = typeof address === "object" && address !== null ? address.port : options.port ?? DEFAULT_PORT;
+        const requestPort = address !== null && !isString(address) ? address.port : options.port ?? DEFAULT_PORT;
         const id = newRequestId();
         const captured = await attachRequest(cwd, id, {
           origin: `http://127.0.0.1:${requestPort}`,
@@ -7883,20 +8308,26 @@ async function startServer(options) {
         }, { pool: browserPool });
         const composed = composeRequest(preview, intent, mode, notes, leglasCommand, captured);
         try {
-          await appendRequest(cwd, {
+          const queued = {
             title: preview.title,
             url: preview.url,
             intent,
             // The ids travel with the request so a change made in place can
             // forget the notes it answered. A fork leaves them where they are:
             // the direction they point at was not touched.
-            ...notes.length === 0 ? {} : { notes: notes.map((entry) => entry.id) },
-            ...captured.attachments.length === 0 ? {} : { attachments: captured.attachments },
-            ...captured.skipped === null ? {} : { captureNote: captured.skipped },
-            ...compare === null ? {} : { compare: compare.title },
-            ...references.length === 0 ? {} : { references },
             ...composed
-          }, id);
+          };
+          if (notes.length > 0)
+            queued.notes = notes.map((entry) => entry.id);
+          if (captured.attachments.length > 0)
+            queued.attachments = captured.attachments;
+          if (captured.skipped !== null)
+            queued.captureNote = captured.skipped;
+          if (compare !== null)
+            queued.compare = compare.title;
+          if (references.length > 0)
+            queued.references = references;
+          await appendRequest(cwd, queued, id);
           runner?.nudge();
           return sendJson2(res, 200, {
             ok: true,
@@ -7924,17 +8355,17 @@ async function startServer(options) {
         if (parsed === null) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
-        if (typeof parsed.title !== "string" || parsed.title === "") {
+        if (!isString(parsed.title) || parsed.title === "") {
           return sendJson2(res, 400, { ok: false, error: "Capture needs a direction title." });
         }
-        if (parsed.note !== void 0 && typeof parsed.note !== "string") {
+        if (parsed.note !== void 0 && !isString(parsed.note)) {
           return sendJson2(res, 400, { ok: false, error: "The note id must be a string." });
         }
         const preview = (await livePreviews()).find((entry) => entry.title === parsed.title);
         if (preview === void 0) {
           return sendJson2(res, 404, { ok: false, error: "No such direction." });
         }
-        const width = typeof parsed.width === "number" && Number.isFinite(parsed.width) ? Math.min(MAX_WIDTH, Math.max(MIN_WIDTH, Math.round(parsed.width))) : 1440;
+        const width = isNumber(parsed.width) && Number.isFinite(parsed.width) ? Math.min(MAX_WIDTH, Math.max(MIN_WIDTH, Math.round(parsed.width))) : 1440;
         const browser = await browserPool.acquire();
         if (browser === null) {
           return sendJson2(res, 503, {
@@ -7942,9 +8373,9 @@ async function startServer(options) {
             error: browserPool.reason() ?? NO_BROWSER
           });
         }
-        const annotations = typeof parsed.note === "string" ? (await readAnnotations(cwd).catch(() => [])).filter((entry) => entry.id === parsed.note && entry.title === preview.title) : [];
+        const annotations = isString(parsed.note) ? (await readAnnotations(cwd).catch(() => [])).filter((entry) => entry.id === parsed.note && entry.title === preview.title) : [];
         const address = server.address();
-        const capturePort = typeof address === "object" && address !== null ? address.port : options.port ?? DEFAULT_PORT;
+        const capturePort = address !== null && !isString(address) ? address.port : options.port ?? DEFAULT_PORT;
         const controller = new AbortController();
         const timeoutMarker = /* @__PURE__ */ Symbol("capture timeout");
         let timedOut;
@@ -7957,21 +8388,26 @@ async function startServer(options) {
         }, CAPTURE_DEADLINE_MS);
         timer.unref?.();
         try {
-          const work = capturePage(browser, {
+          const captureInput = {
             url: previewUrl(`http://127.0.0.1:${capturePort}`, preview),
             width,
-            ...annotations.length === 0 ? {} : {
-              focuses: annotations.map((entry) => ({
+            timeoutMs: CAPTURE_LOAD_MS,
+            signal: controller.signal
+          };
+          if (annotations.length > 0) {
+            captureInput.focuses = annotations.map((entry) => {
+              const focus = {
                 selector: entry.anchor.selector,
                 text: entry.anchor.text,
                 tag: entry.anchor.tag,
-                ...entry.anchor.region === void 0 ? {} : { region: entry.anchor.region },
                 rect: entry.anchor.rect
-              }))
-            },
-            timeoutMs: CAPTURE_LOAD_MS,
-            signal: controller.signal
-          });
+              };
+              if (entry.anchor.region !== void 0)
+                focus.region = entry.anchor.region;
+              return focus;
+            });
+          }
+          const work = capturePage(browser, captureInput);
           const result = await Promise.race([work, timeout]);
           if (result === timeoutMarker) {
             return sendJson2(res, 504, { ok: false, error: "The page did not load in time." });
@@ -7979,7 +8415,7 @@ async function startServer(options) {
           clearTimeout(timer);
           const crop = annotations.length > 0 ? result.crops[0] : null;
           const shot = crop?.shot ?? result.frame;
-          const noteSuffix = typeof parsed.note === "string" ? `-${parsed.note.replace(/[^A-Za-z0-9_-]+/g, "-")}` : "";
+          const noteSuffix = isString(parsed.note) ? `-${parsed.note.replace(/[^A-Za-z0-9_-]+/g, "-")}` : "";
           const name = `${captureSlug(preview.title)}-${result.frame.width}${noteSuffix}.png`;
           const relativeFile = `${CAPTURES_DIR}/show/${name}`;
           await mkdir8(join12(cwd, CAPTURES_DIR, "show"), { recursive: true });
@@ -8041,7 +8477,7 @@ async function startServer(options) {
         if (!isKnownAgent(parsed.agent) && parsed.agent !== "custom") {
           return sendJson2(res, 400, { ok: false, error: "Body needs a known agent." });
         }
-        if (parsed.run !== void 0 && typeof parsed.run !== "string") {
+        if (parsed.run !== void 0 && !isString(parsed.run)) {
           return sendJson2(res, 400, {
             ok: false,
             error: "The custom run command must be a string."
@@ -8061,7 +8497,7 @@ async function startServer(options) {
               error: "Custom agents manage effort in their own command."
             });
           }
-          if (typeof parsed.run !== "string") {
+          if (!isString(parsed.run)) {
             return sendJson2(res, 400, { ok: false, error: "A custom agent needs a run command." });
           }
           const template = parseTemplate(parsed.run);
@@ -8069,17 +8505,18 @@ async function startServer(options) {
             return sendJson2(res, 400, { ok: false, error: template.error });
           return void saveAgentChoice(cwd, { agent: "custom", run: parsed.run }).then(() => sendJson2(res, 200, { ok: true }), () => sendJson2(res, 500, { ok: false, error: "Agent choice could not be saved." }));
         }
-        if (effort !== void 0 && effort !== null && !KNOWN_AGENTS[parsed.agent].efforts.includes(effort)) {
+        if (effort !== void 0 && effort !== null && !KNOWN_AGENTS[parsed.agent].efforts.some((supported) => supported === effort)) {
           return sendJson2(res, 400, {
             ok: false,
             error: `${KNOWN_AGENTS[parsed.agent].name} does not expose an effort override.`
           });
         }
-        return void saveAgentChoice(cwd, {
-          agent: parsed.agent,
-          ...effort === void 0 ? {} : { effort }
-        }).then(() => {
-          runner?.prepare(parsed.agent);
+        const agent = parsed.agent;
+        const choice = { agent };
+        if (effort !== void 0)
+          choice.effort = effort;
+        return void saveAgentChoice(cwd, choice).then(() => {
+          runner?.prepare(agent);
           sendJson2(res, 200, { ok: true });
         }, () => sendJson2(res, 500, { ok: false, error: "Agent choice could not be saved." }));
       });
@@ -8092,7 +8529,7 @@ async function startServer(options) {
         if (parsed === null) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
-        if (typeof parsed.watching !== "boolean") {
+        if (!isBoolean(parsed.watching)) {
           return sendJson2(res, 400, { ok: false, error: "Body needs a watching boolean." });
         }
         lastSeen = parsed.watching ? Date.now() : null;
@@ -8108,6 +8545,7 @@ async function startServer(options) {
         startedAt: null,
         stopping: false,
         waiting: null,
+        quietSince: null,
         failedIds: []
       };
       return void readRequests(cwd).then((requests) => sendConditionalJson(req, res, {
@@ -8139,7 +8577,10 @@ async function startServer(options) {
           // says so rather than going on describing a live run.
           stopping: snapshot.running && snapshot.stopping,
           // Why a run that looks stalled is stalled, while it is stalled.
-          waiting: snapshot.running ? snapshot.waiting : null
+          waiting: snapshot.running ? snapshot.waiting : null,
+          // When a run that has gone quiet last said anything. A run on its
+          // way out is not quiet, it is stopping.
+          quietSince: snapshot.running && !snapshot.stopping ? snapshot.quietSince : null
         }
       }));
     }
@@ -8154,7 +8595,7 @@ async function startServer(options) {
         if (parsed === null) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
-        if (parsed.id !== void 0 && typeof parsed.id !== "string") {
+        if (parsed.id !== void 0 && !isString(parsed.id)) {
           return sendJson2(res, 400, { ok: false, error: "The request id must be a string." });
         }
         return sendJson2(res, 200, { ok: true, cancelled: runner?.cancel(parsed.id) ?? false });
@@ -8171,7 +8612,7 @@ async function startServer(options) {
         if (parsed === null) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
-        if (typeof parsed.id !== "string") {
+        if (!isString(parsed.id)) {
           return sendJson2(res, 400, { ok: false, error: "Body needs a request id." });
         }
         const request = (await readRequests(cwd)).find((entry) => entry.id === parsed.id);
@@ -8190,7 +8631,7 @@ async function startServer(options) {
           if (!await removeRequest(cwd, request.id)) {
             return sendJson2(res, 404, { ok: false, error: "No such request." });
           }
-          await appendRequest(cwd, {
+          const retry = {
             title: request.title,
             url: request.url,
             intent: request.intent,
@@ -8198,16 +8639,23 @@ async function startServer(options) {
             // The prompt names the captures by path, and the embedded pipes
             // are not its only readers: watch, a custom command and
             // `requests --json` all hand the text over as it stands.
-            prompt: attachments.length === 0 ? request.prompt : rehomeText(request.prompt, request.id, retryId),
+            prompt: attachments.length === 0 ? request.prompt : rehomeText(request.prompt, request.id, retryId)
             // The stored prompt already carries the mode's instructions;
             // its notes and visual context travel with the retry too.
-            ...request.mode === void 0 ? {} : { mode: request.mode },
-            ...request.notes === void 0 ? {} : { notes: request.notes },
-            ...attachments.length === 0 ? {} : { attachments },
-            ...request.captureNote === void 0 ? {} : { captureNote: request.captureNote },
-            ...request.compare === void 0 ? {} : { compare: request.compare },
-            ...request.references === void 0 ? {} : { references: request.references }
-          }, retryId);
+          };
+          if (request.mode !== void 0)
+            retry.mode = request.mode;
+          if (request.notes !== void 0)
+            retry.notes = request.notes;
+          if (attachments.length > 0)
+            retry.attachments = attachments;
+          if (request.captureNote !== void 0)
+            retry.captureNote = request.captureNote;
+          if (request.compare !== void 0)
+            retry.compare = request.compare;
+          if (request.references !== void 0)
+            retry.references = request.references;
+          await appendRequest(cwd, retry, retryId);
           runner?.nudge();
           return sendJson2(res, 200, { ok: true });
         } catch {
@@ -8229,7 +8677,7 @@ async function startServer(options) {
         if (parsed === null) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
-        if (typeof parsed.title !== "string" || parsed.title.trim() === "") {
+        if (!isString(parsed.title) || parsed.title.trim() === "") {
           return sendJson2(res, 400, { ok: false, error: "A note needs a direction." });
         }
         const anchor = anchorFrom(parsed.anchor);
@@ -8239,7 +8687,7 @@ async function startServer(options) {
         try {
           const annotation = await addAnnotation(cwd, {
             anchor,
-            note: typeof parsed.note === "string" ? parsed.note.trim() : "",
+            note: isString(parsed.note) ? parsed.note.trim() : "",
             title: parsed.title
           });
           return sendJson2(res, 200, { ok: true, annotation });
@@ -8259,10 +8707,10 @@ async function startServer(options) {
         if (parsed === null) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
-        if (typeof parsed.id !== "string" || parsed.id === "") {
+        if (!isString(parsed.id) || parsed.id === "") {
           return sendJson2(res, 400, { ok: false, error: "Body needs the note to reword." });
         }
-        if (typeof parsed.note !== "string") {
+        if (!isString(parsed.note)) {
           return sendJson2(res, 400, { ok: false, error: "A reworded note needs its words." });
         }
         try {
@@ -8287,7 +8735,7 @@ async function startServer(options) {
         if (parsed === null) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
-        const ids = Array.isArray(parsed.ids) ? parsed.ids.filter((entry) => typeof entry === "string") : [];
+        const ids = Array.isArray(parsed.ids) ? parsed.ids.filter((entry) => isString(entry)) : [];
         if (ids.length === 0) {
           return sendJson2(res, 400, { ok: false, error: "Body needs the notes to forget." });
         }
@@ -8309,7 +8757,7 @@ async function startServer(options) {
         if (parsed === null) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
-        if (typeof parsed.id !== "string") {
+        if (!isString(parsed.id)) {
           return sendJson2(res, 400, { ok: false, error: "Body needs a request id." });
         }
         const target2 = (await readRequests(cwd)).find((entry) => entry.id === parsed.id);
@@ -8337,7 +8785,7 @@ async function startServer(options) {
         if (parsed === null) {
           return sendJson2(res, 400, { ok: false, error: "Body must be JSON." });
         }
-        if (parsed.renames === null || typeof parsed.renames !== "object") {
+        if (!isJsonRecord(parsed.renames) && !Array.isArray(parsed.renames)) {
           return sendJson2(res, 400, { ok: false, error: "Body needs a renames object." });
         }
         const renames = Object.fromEntries(Object.entries(parsed.renames).filter((entry) => typeof entry[1] === "string" && entry[1] !== ""));
@@ -8426,7 +8874,7 @@ async function startServer(options) {
   server.on("upgrade", (req, socket, head) => {
     handleUpgrade(req, socket, head, { remote: false });
   });
-  shares = createShareManager({
+  const shareOptions = {
     live,
     previews: livePreviewDefinitions,
     previewsForConfig,
@@ -8440,10 +8888,13 @@ async function startServer(options) {
       publicOrigin: context.publicOrigin,
       grantId: context.grantId
     }),
-    upgrade: (req, socket, head) => handleUpgrade(req, socket, head, { remote: true }),
-    ...options.detectTunnels === void 0 ? {} : { detectTunnels: options.detectTunnels },
-    ...options.startTunnel === void 0 ? {} : { startTunnel: options.startTunnel }
-  });
+    upgrade: (req, socket, head) => handleUpgrade(req, socket, head, { remote: true })
+  };
+  if (options.detectTunnels !== void 0)
+    shareOptions.detectTunnels = options.detectTunnels;
+  if (options.startTunnel !== void 0)
+    shareOptions.startTunnel = options.startTunnel;
+  shares = createShareManager(shareOptions);
   port = await bind2(server, options.port ?? DEFAULT_PORT);
   options.updates?.setPort(port);
   const liveFiles = watchLiveFiles(cwd, bootConfigPath, live);
@@ -8456,14 +8907,17 @@ async function startServer(options) {
     pid: process.pid
   }).catch(() => {
   });
-  runner = startRunner({
+  const runnerOptions = {
     cwd,
     externallyAttached,
     onChange: () => live.nudge("requests"),
-    leglasCommand,
-    ...options.codexAppServer === void 0 ? {} : { codexAppServer: options.codexAppServer },
-    ...options.claudeAgentSession === void 0 ? {} : { claudeAgentSession: options.claudeAgentSession }
-  });
+    leglasCommand
+  };
+  if (options.codexAppServer !== void 0)
+    runnerOptions.codexAppServer = options.codexAppServer;
+  if (options.claudeAgentSession !== void 0)
+    runnerOptions.claudeAgentSession = options.claudeAgentSession;
+  runner = startRunner(runnerOptions);
   options.updates?.onBusy(() => runner?.snapshot().running ?? false);
   options.updates?.onChange(() => live.nudge("update"));
   let closePromise = null;
@@ -8882,17 +9336,16 @@ async function runAdd(options, deps) {
   await ensureIgnored(options.cwd);
   const needsDevCommand = options.preview.branch !== void 0 && loaded.config?.devCommand === void 0;
   if (options.json) {
-    envelope(deps, true, {
-      added: options.preview.title,
-      ...options.preview.url === void 0 ? {} : { url: options.preview.url },
-      local: true,
-      ...options.preview.branch === void 0 ? {} : { branch: options.preview.branch },
-      ...options.preview.file === void 0 ? {} : { file: options.preview.file },
-      note: options.preview.branch === void 0 && options.preview.file === void 0 ? "A running interface picks this up within seconds." : "Restart Leglas to see this preview: branch checkouts and file mounts are built when Leglas starts.",
-      ...needsDevCommand ? {
-        warning: "The config sets no devCommand, so Leglas cannot start this branch yet. Add devCommand (with {port}) to the config."
-      } : {}
-    });
+    const added = { added: options.preview.title };
+    if (options.preview.url !== void 0) added.url = options.preview.url;
+    added.local = true;
+    if (options.preview.branch !== void 0) added.branch = options.preview.branch;
+    if (options.preview.file !== void 0) added.file = options.preview.file;
+    added.note = options.preview.branch === void 0 && options.preview.file === void 0 ? "A running interface picks this up within seconds." : "Restart Leglas to see this preview: branch checkouts and file mounts are built when Leglas starts.";
+    if (needsDevCommand) {
+      added.warning = "The config sets no devCommand, so Leglas cannot start this branch yet. Add devCommand (with {port}) to the config.";
+    }
+    envelope(deps, true, added);
   } else {
     deps.log(
       `  added  ${options.preview.title}  ${options.preview.url ?? options.preview.file ?? ""}`
@@ -9031,10 +9484,29 @@ function planShow({ title, previews, requests }) {
   };
 }
 
-// src/run-show.ts
+// src/running.ts
 import { realpath as realpath2 } from "fs/promises";
+
+// src/json.ts
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isString2(value) {
+  return typeof value === "string";
+}
+function isNumber2(value) {
+  return typeof value === "number";
+}
+async function bodyOf(response) {
+  try {
+    return JSON.parse(await response.text());
+  } catch {
+    return null;
+  }
+}
+
+// src/running.ts
 var NOT_RUNNING = "Leglas is not running here. Start it with npx leglas, then try again.";
-var CAPTURE_WAIT_MS = 3e4;
 async function sameDirectory(left, right) {
   const [a, b] = await Promise.all([
     realpath2(left).catch(() => left),
@@ -9042,6 +9514,42 @@ async function sameDirectory(left, right) {
   ]);
   return a === b;
 }
+async function findLeglas(cwd, port, request) {
+  const server = port === null ? await readServerInfo(cwd) : null;
+  const chosen = port ?? server?.port ?? DEFAULT_PORT;
+  try {
+    const health = await request(`http://127.0.0.1:${chosen}/leglas/api/health`, {
+      signal: AbortSignal.timeout(2e3)
+    });
+    if (health.status !== 200) return { ok: false, error: NOT_RUNNING };
+    const answered = await health.text().then((text2) => JSON.parse(text2)).catch(() => ({}));
+    if (answered === null) return { ok: false, error: NOT_RUNNING };
+    if (isJsonObject(answered) && isString2(answered.cwd) && !await sameDirectory(answered.cwd, cwd)) {
+      return {
+        ok: false,
+        error: `The Leglas on port ${chosen} serves another project. Start one here with npx leglas, or name the right one with --port.`
+      };
+    }
+    return { ok: true, port: chosen, base: `http://127.0.0.1:${chosen}` };
+  } catch {
+    return { ok: false, error: NOT_RUNNING };
+  }
+}
+
+// src/run-show.ts
+function isString3(value) {
+  return typeof value === "string";
+}
+function hasCaptureError(value) {
+  return typeof value === "object" && value !== null && "error" in value && typeof value.error === "string";
+}
+function hasCaptureSize(value) {
+  return typeof value === "object" && value !== null && "file" in value && typeof value.file === "string" && "width" in value && typeof value.width === "number" && "height" in value && typeof value.height === "number" && "viewport" in value && typeof value.viewport === "number";
+}
+function isHydration(value) {
+  return typeof value === "object" && value !== null && "framework" in value && typeof value.framework === "string" && "message" in value && typeof value.message === "string";
+}
+var CAPTURE_WAIT_MS = 3e4;
 async function runShow(options, deps) {
   const loaded = await loadConfig(options.cwd);
   const local = await readLocalPreviews(options.cwd);
@@ -9074,28 +9582,15 @@ async function runShow(options, deps) {
     requests: plan.requests
   };
   if (options.screenshot) {
-    const server = options.port === null ? await readServerInfo(options.cwd) : null;
-    const port = options.port ?? server?.port ?? DEFAULT_PORT;
     const fail = (error) => {
       if (options.json) deps.log(JSON.stringify({ ok: false, error }));
       else deps.error(error);
       return { exitCode: 1 };
     };
     const request = deps.fetch ?? fetch;
-    try {
-      const health = await request(`http://127.0.0.1:${port}/leglas/api/health`, {
-        signal: AbortSignal.timeout(2e3)
-      });
-      if (health.status !== 200) return fail(NOT_RUNNING);
-      const answered = await health.json().catch(() => ({}));
-      if (typeof answered.cwd === "string" && !await sameDirectory(answered.cwd, options.cwd)) {
-        return fail(
-          `The Leglas on port ${port} serves another project. Start one here with npx leglas, or name the right one with --port.`
-        );
-      }
-    } catch {
-      return fail(NOT_RUNNING);
-    }
+    const found = await findLeglas(options.cwd, options.port, request);
+    if (!found.ok) return fail(found.error);
+    const port = found.port;
     let response;
     try {
       response = await request(`http://127.0.0.1:${port}/leglas/api/capture`, {
@@ -9112,18 +9607,17 @@ async function runShow(options, deps) {
     const captured = await response.json().catch(() => ({}));
     if (!response.ok) {
       return fail(
-        typeof captured.error === "string" ? captured.error : "The direction could not be captured."
+        hasCaptureError(captured) ? captured.error : "The direction could not be captured."
       );
     }
-    if (typeof captured.file !== "string" || typeof captured.width !== "number" || typeof captured.height !== "number" || typeof captured.viewport !== "number")
-      return fail("The direction could not be captured.");
+    if (!hasCaptureSize(captured)) return fail("The direction could not be captured.");
     envelope2.screenshot = {
       file: captured.file,
       width: captured.width,
       height: captured.height,
       viewport: captured.viewport,
-      errors: Array.isArray(captured.errors) ? captured.errors.filter((error) => typeof error === "string") : [],
-      hydration: typeof captured.hydration === "object" && captured.hydration !== null && typeof captured.hydration.framework === "string" && typeof captured.hydration.message === "string" ? {
+      errors: Array.isArray(captured.errors) ? captured.errors.filter(isString3) : [],
+      hydration: isHydration(captured.hydration) ? {
         framework: captured.hydration.framework,
         message: captured.hydration.message
       } : null,
@@ -9176,8 +9670,290 @@ async function runShow(options, deps) {
   return { exitCode: 0 };
 }
 
+// src/run-share.ts
+var TUNNEL_WAIT_MS = 6e4;
+var TUNNEL_POLL_MS = 500;
+function stringsOf(value) {
+  return Array.isArray(value) && value.every(isString2) ? value : null;
+}
+function tunnelFrom(value) {
+  if (value === void 0 || !isJsonObject(value)) return null;
+  const provider = isString2(value.provider) ? value.provider : "The tunnel";
+  switch (value.status) {
+    case "none":
+      return { status: "none" };
+    case "starting":
+      return { status: "starting", provider };
+    case "ready":
+      return isString2(value.url) ? { status: "ready", provider, url: value.url } : null;
+    case "failed":
+      return {
+        status: "failed",
+        provider,
+        reason: isString2(value.reason) ? value.reason : "it stopped"
+      };
+    default:
+      return null;
+  }
+}
+function linkFrom(value) {
+  if (!isJsonObject(value) || !isString2(value.localUrl) || !isNumber2(value.expiresAt)) return null;
+  return {
+    name: isString2(value.name) ? value.name : "",
+    url: isString2(value.url) ? value.url : null,
+    localUrl: value.localUrl,
+    expiresAt: value.expiresAt
+  };
+}
+function shareFrom(value) {
+  if (value === void 0 || !isJsonObject(value)) return null;
+  const titles = stringsOf(value.titles);
+  const tunnel = tunnelFrom(value.tunnel);
+  if (!isString2(value.scope) || titles === null || tunnel === null || !Array.isArray(value.grants)) {
+    return null;
+  }
+  return {
+    scope: value.scope,
+    titles,
+    reach: isString2(value.reach) ? value.reach : "open",
+    tunnel,
+    links: value.grants.flatMap((grant) => {
+      const link = linkFrom(grant);
+      return link === null ? [] : [link];
+    })
+  };
+}
+async function readShare(base, request) {
+  try {
+    const response = await request(`${base}/leglas/api/share`);
+    if (!response.ok) {
+      return {
+        ok: false,
+        error: `Leglas answered ${response.status} when asked what it is sharing.`,
+        answered: true
+      };
+    }
+    const payload = await bodyOf(response);
+    if (!isJsonObject(payload)) {
+      return { ok: false, error: "Leglas did not say what it is sharing.", answered: true };
+    }
+    const installed = stringsOf(payload.tunnels) ?? [];
+    if (payload.share === null) return { ok: true, value: { share: null, installed } };
+    const share = shareFrom(payload.share);
+    return share === null ? {
+      ok: false,
+      error: "Leglas is sharing something this version of the command cannot read.",
+      answered: true
+    } : { ok: true, value: { share, installed } };
+  } catch {
+    return { ok: false, error: NOT_RUNNING, answered: false };
+  }
+}
+async function post(base, path, body, request, fallback) {
+  try {
+    const response = await request(`${base}${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    const payload = await bodyOf(response);
+    if (!response.ok) {
+      return {
+        ok: false,
+        error: isJsonObject(payload) && isString2(payload.error) ? payload.error : fallback,
+        answered: true
+      };
+    }
+    return { ok: true, value: payload };
+  } catch {
+    return { ok: false, error: NOT_RUNNING, answered: false };
+  }
+}
+function describe2(share) {
+  const [first, second] = share.titles;
+  if (share.scope === "compare" && first !== void 0 && second !== void 0) {
+    return `${first} and ${second}, side by side`;
+  }
+  if (share.scope === "direction" && first !== void 0) return first;
+  const count = share.titles.length;
+  return `the rail, ${count} ${count === 1 ? "direction" : "directions"}`;
+}
+function clock(at) {
+  return new Date(at).toLocaleString([], { weekday: "short", hour: "numeric", minute: "2-digit" });
+}
+function tunnelLine(tunnel, installed) {
+  switch (tunnel.status) {
+    case "ready":
+      return null;
+    case "none":
+      return installed.length > 0 ? "none, as asked; the link works on this machine, or through a tunnel you run yourself" : "no cloudflared or ngrok on this machine; the link works here, or through a tunnel you run yourself";
+    case "starting":
+      return `${tunnel.provider} is still starting; run npx leglas share again for the public link`;
+    case "failed":
+      return `${tunnel.provider} failed: ${tunnel.reason}`;
+  }
+}
+async function runShare(options, deps) {
+  const request = deps.fetch ?? fetch;
+  const sleep = deps.sleep ?? ((milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds)));
+  const fail = (error) => {
+    if (options.json) deps.log(JSON.stringify({ ok: false, error }));
+    else deps.error(error);
+    return { exitCode: 1 };
+  };
+  const found = await findLeglas(options.cwd, options.port, request);
+  if (!found.ok) return fail(found.error);
+  if (options.stop) {
+    const stopped = await post(
+      found.base,
+      "/leglas/api/share/stop",
+      {},
+      request,
+      "Leglas could not stop sharing."
+    );
+    if (!stopped.ok) return fail(stopped.error);
+    if (options.json) deps.log(JSON.stringify({ ok: true, stopped: true }));
+    else deps.log("  stopped  nothing is shared any more");
+    return { exitCode: 0 };
+  }
+  const running = await readShare(found.base, request);
+  if (!running.ok) return fail(running.error);
+  const { installed } = running.value;
+  const report = (share2, already, leftOut2) => {
+    if (options.json) {
+      deps.log(
+        JSON.stringify({
+          ok: true,
+          alreadySharing: already,
+          share: {
+            scope: share2.scope,
+            titles: share2.titles,
+            reach: share2.reach,
+            tunnel: share2.tunnel,
+            links: share2.links
+          },
+          leftOut: leftOut2
+        })
+      );
+      return { exitCode: 0 };
+    }
+    deps.log(`  sharing  ${describe2(share2)}${already ? " (already running)" : ""}`);
+    if (share2.reach === "listed") {
+      deps.log("  reach    only the paths the share lists; allow more from the share panel");
+    }
+    for (const link of share2.links) {
+      const label = link.name === "" ? "" : `${link.name}  `;
+      if (link.url !== null) deps.log(`  link     ${label}${link.url}`);
+      else deps.log(`  local    ${label}${link.localUrl}`);
+    }
+    const tunnel = tunnelLine(share2.tunnel, installed);
+    if (tunnel !== null) deps.log(`  tunnel   ${tunnel}`);
+    const ends = share2.links.map((link) => link.expiresAt);
+    if (ends.length > 0) deps.log(`  until    ${clock(Math.min(...ends))}`);
+    for (const title of leftOut2) {
+      deps.log(`  left out ${title}: branch directions can't be shared yet`);
+    }
+    deps.log("  stop     npx leglas share --stop");
+    return { exitCode: 0 };
+  };
+  const loaded = await loadConfig(options.cwd);
+  const local = await readLocalPreviews(options.cwd);
+  const renames = await readRenames(options.cwd);
+  const previews = [...loaded.config?.previews ?? [], ...local.previews];
+  const known = [...new Set(previews.map((preview) => preview.title))];
+  const titles = [];
+  for (const asked of options.titles) {
+    const resolved = resolveOrExplain(asked, known, renames);
+    if (!resolved.ok) return fail(resolved.error);
+    titles.push(resolved.title);
+  }
+  const [first, second] = titles;
+  if (first !== void 0 && first === second) {
+    return fail(`Both names are ${first}. Name two different directions to compare them.`);
+  }
+  const scope2 = titles.length === 0 ? "rail" : titles.length === 1 ? "direction" : "compare";
+  const current = running.value.share;
+  if (current !== null) {
+    const same = titles.length === 0 || current.scope === scope2 && titles.length === current.titles.length && titles.every((title, index) => current.titles[index] === title);
+    if (!same) {
+      return fail(
+        `Leglas is already sharing ${describe2(current)}. Stop it with npx leglas share --stop, then share again.`
+      );
+    }
+    return report(current, true, []);
+  }
+  const branches = new Set(
+    previews.flatMap((preview) => preview.branch === void 0 ? [] : [preview.title])
+  );
+  const shared = titles.length > 0 ? titles : known.filter((title) => !branches.has(title));
+  const leftOut = titles.length > 0 ? [] : known.filter((title) => branches.has(title));
+  if (shared.length === 0) {
+    return fail("Nothing on the rail can be shared: branch directions can't be shared yet.");
+  }
+  const [, right] = shared;
+  const body = {
+    scope: scope2,
+    titles: shared,
+    layout: {
+      order: shared,
+      renames: Object.fromEntries(
+        Object.entries(renames).filter(([title]) => shared.includes(title))
+      ),
+      collapsedFamilies: [],
+      compare: scope2 === "compare" && right !== void 0 ? right : null,
+      viewport: null
+    },
+    reach: options.reach,
+    routes: []
+  };
+  if (options.tunnel !== null) body.tunnel = options.tunnel;
+  const giveUp = async (error, known2 = true) => {
+    const stopped = await post(found.base, "/leglas/api/share/stop", {}, request, "");
+    const what = known2 ? "The share it started" : "A share";
+    return fail(
+      stopped.ok ? `${error} ${known2 ? "The share it started is stopped." : "Anything it started is stopped."}` : `${error} ${what} may still be running; stop it with npx leglas share --stop.`
+    );
+  };
+  const created = await post(
+    found.base,
+    "/leglas/api/share",
+    body,
+    request,
+    "Leglas could not start sharing."
+  );
+  if (!created.ok) {
+    return created.answered ? fail(created.error) : giveUp("Leglas stopped answering while the share was starting.", false);
+  }
+  let share = isJsonObject(created.value) ? shareFrom(created.value.share) : null;
+  if (share === null) {
+    return giveUp("Leglas started a share this version of the command cannot read.");
+  }
+  for (let waited = 0; share.tunnel.status === "starting" && waited < TUNNEL_WAIT_MS; waited += TUNNEL_POLL_MS) {
+    await sleep(TUNNEL_POLL_MS);
+    const read = await readShare(found.base, request);
+    if (!read.ok) return giveUp(read.error);
+    if (read.value.share === null) {
+      return fail("The share was stopped while its tunnel was starting.");
+    }
+    share = read.value.share;
+  }
+  return report(share, false, leftOut);
+}
+
+// src/shutdown.ts
+var SHUTDOWN_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+function installShutdown(stop, target = process) {
+  let stopping = null;
+  const shutdown = () => {
+    stopping ??= stop();
+    return stopping;
+  };
+  for (const signal of SHUTDOWN_SIGNALS) target.on(signal, () => void shutdown());
+  return shutdown;
+}
+
 // src/run-watch.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { mkdir as mkdir12, readFile as readFile16, writeFile as writeFile14 } from "fs/promises";
 import { dirname as dirname12, join as join18 } from "path";
 var POLL_MS2 = 2e3;
@@ -9187,9 +9963,7 @@ async function saveTemplate(cwd, run4) {
   let config = {};
   try {
     const parsed = JSON.parse(await readFile16(path, "utf8"));
-    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-      config = parsed;
-    }
+    if (isJsonObject(parsed)) config = parsed;
   } catch {
   }
   config.run = run4;
@@ -9205,7 +9979,7 @@ function spawnAgent(command, args, cwd) {
       settled = true;
       resolve5(outcome);
     };
-    const child = spawn3(command, args, { cwd, stdio: "inherit" });
+    const child = spawn4(command, args, { cwd, stdio: "inherit" });
     child.on("error", (error) => settle({ ok: false, error: error.message }));
     child.on(
       "close",
@@ -9480,8 +10254,11 @@ function skipStartupCheck(env) {
   return env.CI !== void 0 && env.CI !== "" && env.CI !== "false" || !off(env.LEGLAS_NO_UPDATE_CHECK);
 }
 async function run3(options, deps) {
-  const loaded = await loadConfig(options.cwd);
-  const local = await readLocalPreviews(options.cwd);
+  return runWithServices(options, deps);
+}
+async function runWithServices(options, deps, services = {}) {
+  const loaded = await (services.loadConfig ?? loadConfig)(options.cwd);
+  const local = await (services.readLocalPreviews ?? readLocalPreviews)(options.cwd);
   let devServer = options.userPort === void 0 ? loaded.config?.devServer ?? "http://localhost:3000" : `http://localhost:${options.userPort}`;
   const merged = loaded.config === null ? null : { ...loaded.config, devServer, previews: [...loaded.config.previews, ...local.previews] };
   const previewErrors = [];
@@ -9532,8 +10309,8 @@ async function run3(options, deps) {
   const projectRoot = await realpath4(
     loaded.path === null ? options.cwd : dirname13(loaded.path)
   ).catch(() => resolve4(loaded.path === null ? options.cwd : dirname13(loaded.path)));
-  const ownerWarning = needsApp && app === null ? inspectLocalDevServer(devServer).then((owners) => devServerOwnerWarning(devServer, projectRoot, owners)).catch(() => null) : Promise.resolve(null);
-  const serverPromise = startServer({
+  const ownerWarning = needsApp && app === null ? (services.inspectLocalDevServer ?? inspectLocalDevServer)(devServer).then((owners) => devServerOwnerWarning(devServer, projectRoot, owners)).catch(() => null) : Promise.resolve(null);
+  const serverOptions = {
     config,
     configErrors: [...loaded.errors, ...local.errors, ...previewErrors],
     configWarnings,
@@ -9543,10 +10320,11 @@ async function run3(options, deps) {
     // directory does. Either way saved layout survives a port change.
     project: loaded.path ?? options.cwd,
     cwd: options.cwd,
-    leglasCommand: embeddedLeglasCommand(),
-    ...deps.updates === void 0 ? {} : { updates: deps.updates },
-    ...options.port === void 0 ? {} : { port: options.port }
-  });
+    leglasCommand: embeddedLeglasCommand()
+  };
+  if (deps.updates !== void 0) serverOptions.updates = deps.updates;
+  if (options.port !== void 0) serverOptions.port = options.port;
+  const serverPromise = (services.startServer ?? startServer)(serverOptions);
   const [server, warning] = await Promise.all([serverPromise, ownerWarning]);
   if (warning !== null) configWarnings.push(warning);
   const url = `${server.url}${LEGLAS_PREFIX}`;
@@ -9635,6 +10413,7 @@ export {
   commandFor,
   detectFramework,
   findBrowser,
+  installShutdown,
   isOwnCapture,
   nextRequest,
   parseArgs,
@@ -9655,6 +10434,7 @@ export {
   runList,
   runNew,
   runRequests,
+  runShare,
   runShow,
   runWatch,
   surfaceSlug