local-operator-ui 0.26.10 → 0.27.0

package/out/main/index.js

@@ -1555,6 +1555,7 @@ function desktopEndpoint(request) {
   }
 }
 const MAX_PROBE_PATHS = 64;
+const DIRECTORY_ENTRY_LIMIT = 200;
 const MAX_FILE_READ_BYTES = 64 * 1024 * 1024;
 const OPEN_SESSION_FLAG = "--open-session";
 const OPEN_CATALOGUE_FLAG = "--open-catalogue";
@@ -4577,7 +4578,7 @@ function compareVersions(a, b) {
   }
   return 0;
 }
-function compareCandidates(a, b, preferredPrefix) {
+function compareCandidates$1(a, b, preferredPrefix) {
   const sameInstall = (candidate) => preferredPrefix !== null && preferredPrefix !== "" && candidate.record.prefix === preferredPrefix;
   if (sameInstall(a) !== sameInstall(b)) return sameInstall(a) ? -1 : 1;
   if (a.source !== b.source) return a.source === "record" ? -1 : 1;
@@ -4590,7 +4591,7 @@ function compareCandidates(a, b, preferredPrefix) {
 }
 function rankCandidates(candidates, preferredPrefix) {
   return [...candidates].sort(
-    (a, b) => compareCandidates(a, b, preferredPrefix)
+    (a, b) => compareCandidates$1(a, b, preferredPrefix)
   );
 }
 async function discoverDaemons(options = {}) {
@@ -10851,6 +10852,10 @@ class TabRegistry {
       // silently reclaim the tab it owned in a previous app run.
       owner: restored ? "user" : options.owner,
       sessionId: restored ? null : options.sessionId ?? null,
+      // The same value `sessionId` gets at creation, kept because a hand-over
+      // overwrites `sessionId` and a revocation has to put the conversation back
+      // (see the field's own note).
+      homeSessionId: restored ? null : options.sessionId ?? null,
       nonce: restored || options.owner === "user" ? null : mintNonce(),
       handedTo: null,
       restored,
@@ -10974,13 +10979,23 @@ class TabRegistry {
     this.onChanged();
   }
   /** Revoke a hand-over: nulls the nonce, so the session's next action on that
-   * handle gets the ordinary `tab_closed` refusal. */
+   * handle gets the ordinary `tab_closed` refusal, and puts the tab back in the
+   * conversation the user opened it in.
+   *
+   * THE ATTRIBUTION COMES BACK, NOT JUST THE OWNERSHIP (review round 1, Q2): the
+   * revocation used to null `sessionId` outright, which took the tab out of the
+   * conversation it was opened in (`tabsInScope` reads that field, and so does the
+   * conversation's own tab count) — so revoking a hand-over silently lost the
+   * conversation, and the design's §5.1 row 6 says a revoke is a true inverse. The
+   * ownership and the capability still go, and `mayDrive` still refuses without the
+   * nonce. A tab with no home (the route, a draft, a restored tab) still lands on
+   * `null`, which is the behaviour it always had. */
   revokeHandOver(tabId) {
     const record = this.tabs.get(tabId);
     if (!record) return;
     record.nonce = null;
     record.owner = "user";
-    record.sessionId = null;
+    record.sessionId = record.homeSessionId;
     record.handedTo = null;
     record.allocationId = "";
     this.bumpEpoch(record.tabId);
@@ -11082,24 +11097,89 @@ class TabRegistry {
   }
   // ---- removal -------------------------------------------------------------
   /**
-   * Drop a tab and hand its webContents id to `onRemove`, which is where the
-   * debugger session, the log buffer and the child view are released.
-   *
-   * `forget` is the registry-local half, used by the fail-closed handle check
-   * where the caller has no cleanup work to do (the webContents is already
-   * destroyed) and by `destroy` below.
+   * Drop one tab's record WITHOUT notifying: the registry-local half of every removal.
+   *
+   * EXTRACTED FROM `forget` FOR `destroyMany` (design R5), and the split is what makes a
+   * batch one change rather than N: `destroyMany` drops every record first, then runs
+   * ONE `applyLayout()` and ONE `onChanged()`, and the notify-free half is the only way
+   * to do that without N full state builds, N IPC broadcasts and N `session.json`
+   * writes — which is what N sequential closes cost today (`host.closeTab` →
+   * `registry.destroy` → `onChanged` per tab).
    */
-  forget(tabId) {
+  drop(tabId) {
     const record = this.tabs.get(tabId);
     if (!record) return void 0;
     this.tabs.delete(tabId);
     if (this.activeTabId === tabId) {
       this.activeTabId = this.list().filter((candidate) => candidate.owner === "user").at(-1)?.tabId ?? null;
     }
+    return record;
+  }
+  /**
+   * Drop a tab and hand its webContents id to `onRemove`, which is where the
+   * debugger session, the log buffer and the child view are released.
+   *
+   * `forget` is the registry-local half PLUS the notification: `drop` above removes the
+   * record, and this runs the one `applyLayout()`/`onChanged()` pair every single-tab
+   * removal has always run. It is what `destroy` below and the fail-closed handle check
+   * use (where the caller has no cleanup work to do — the webContents is already
+   * destroyed), while `destroyMany` uses `drop` for the same reason one level down: it
+   * wants N removals under ONE notification rather than N of each.
+   *
+   * WHAT IT IS NOT, because this file is where a reader learns which removal path
+   * notifies and it used to say the opposite of `drop`'s note (review round 1, A8):
+   * `forget` is NOT the registry-local half — `drop` above is — and a caller that wants
+   * the removal without the notification wants `drop`.
+   */
+  forget(tabId) {
+    const record = this.drop(tabId);
+    if (!record) return void 0;
     this.applyLayout();
     this.onChanged();
     return record;
   }
+  /**
+   * Close SEVERAL tabs as one change: the registry half of the renderer's bulk closes
+   * (design R5).
+   *
+   * WHY ONE INTENT RATHER THAN N `destroy` CALLS, in the order the design weighs it:
+   *
+   * 1. "Close all tabs in this conversation" cannot be expressed as a list without
+   *    racing. A list computed from a projection the renderer read up to seconds ago
+   *    misses a tab an agent opened in that conversation in the meantime, and the user
+   *    pressed something that said ALL. (The renderer resolves that mode HERE, at
+   *    execution time, for exactly this reason.)
+   * 2. N round trips are N full `chromeState()` builds, N IPC broadcasts and N
+   *    `session.json` writes, each of which re-renders the strip. A batch is one of
+   *    each.
+   * 3. `destroy` is synchronous and the chrome's closes do not take the per-tab lane
+   *    (`registry.lane` is the dispatcher's), so there is no interleaving to reason
+   *    about within one intent — and N separate intents are N separate windows in which
+   *    an agent can create a tab. One intent, one window, one decision.
+   *
+   * IDS THAT ARE ALREADY GONE ARE SKIPPED RATHER THAN REFUSED: the user's intent was
+   * that they be closed, and they are. Refusing the batch because one tab was closed
+   * twice — by a second press, or by an agent's own `close` — would leave the other
+   * tabs open, which is the one outcome nobody asked for.
+   *
+   * `onRemove` STILL RUNS PER RECORD and after the single notification, so the
+   * webContents/debugger/log release path stays the single one it has always been
+   * (design 11.1: with `WebContentsView`, nothing destroys the webContents for you).
+   */
+  destroyMany(tabIds) {
+    const removed = [];
+    for (const tabId of tabIds) {
+      const record = this.drop(tabId);
+      if (record) removed.push(record);
+    }
+    if (removed.length === 0) return 0;
+    this.applyLayout();
+    this.onChanged();
+    for (const record of removed) {
+      this.onRemove(record.tabId, record.view.webContents.id);
+    }
+    return removed.length;
+  }
   /** Destroy a tab: forget it, then release its resources. `onRemove` is
    * called for every removal path so a tab can never be forgotten while its
    * webContents, debugger session or log buffer leak (design 11.1: with
@@ -11716,10 +11796,15 @@ class BrowserHost {
         owner: entry.owner,
         // WHICH CONVERSATION THIS TAB BELONGS TO, and the ONLY new field this
         // change adds to the wire. `null` is a real and common value — a restored
-        // tab is nobody's (`registry.ts:231`), a user tab that was never handed
-        // over is nobody's, and a tab handed back goes back to `null` (`:386`) —
-        // and it means "not any conversation's", which is why a conversation's
-        // scope shows it under no scope but `"all"` (spec 7.2).
+        // tab is nobody's (`registry.ts:231`), a user tab never handed over and
+        // opened from the route or a draft is nobody's — and it means "not any
+        // conversation's", which is why a conversation's scope shows it under no
+        // scope but `"all"` (spec 7.2).
+        //
+        // A TAB HANDED BACK KEEPS ITS CONVERSATION (review round 1, Q2):
+        // revocation restores `homeSessionId` rather than writing `null`, so the
+        // field is "which conversation this belongs to", not "which session is
+        // driving it" — the second question is `handedOver` and `owner`.
         sessionId: entry.sessionId,
         active: entry.active,
         restored: entry.restored,
@@ -11791,10 +11876,32 @@ class BrowserHost {
       }))
     };
   }
-  /** A user tab: created active, at about:blank, owned by the user and with no
-   * capability until the user hands it over (design 6.1, 6.3). */
-  async newTab() {
-    const record = this.registry.create({ owner: "user" });
+  /**
+   * A user tab: created active, at about:blank, owned by the user and with no
+   * capability until the user hands it over (design 6.1, 6.3).
+   *
+   * ATTRIBUTED TO THE CONVERSATION IT WAS OPENED FROM when it has one (design R1).
+   * That is the whole of the main-process half and it takes no new mechanism:
+   * `registry.create` already stores a non-restored tab's `sessionId`
+   * (`registry.ts:231`) and already leaves every user tab's `nonce` null (`:232`).
+   *
+   * WHY THIS CHANGES NO CAPABILITY, and the test that pins it
+   * (`scripts/browser-host.test.mjs`): `mayDrive` requires the session id AND a
+   * nonce (`registry.ts:395-397`), and this tab has the first and not the second, so
+   * an agent in that conversation still cannot drive a tab the user opened. The
+   * `tabs` listing redacts its handle, `agentTabCount()` filters on `owner` and is
+   * unmoved, the agent cap is unmoved, and hand-over stays the only authority
+   * transfer.
+   *
+   * Before this, all three ways a user could open a tab produced one the pane's
+   * "This conversation" scope would never show, because the scope filter reads this
+   * one field.
+   */
+  async newTab(sessionId2) {
+    const record = this.registry.create({
+      owner: "user",
+      sessionId: sessionId2 ?? null
+    });
     await record.view.webContents.loadURL("about:blank");
     await this.cdp.attach(record.view.webContents);
     this.onChanged();
@@ -11807,6 +11914,32 @@ class BrowserHost {
     this.onChanged();
     return this.chromeState();
   }
+  /**
+   * Close several tabs as ONE intent (design R5): resolve it, close them, notify once.
+   *
+   * TWO MODES RATHER THAN ONE LIST, and the difference is the race the design names:
+   *
+   * - `ids` is positional — "these tabs, the ones I could see" — and main closes
+   *   exactly those, skipping any that are already gone. A tab an agent opened after the
+   *   press is not in the list and survives, which the strip then shows honestly.
+   * - `conversation` is resolved HERE, at execution time, against the live registry. A
+   *   list computed from a projection the renderer read seconds ago (the band stays open
+   *   while the user reads it) would miss a tab an agent opened in that conversation in
+   *   the meantime — and the user pressed something that said ALL.
+   *
+   * ONE `onChanged()` EITHER WAY, which is the whole point of `registry.destroyMany`: N
+   * closes are N full `chromeState()` builds, N IPC broadcasts, N renderer re-reads and
+   * N `session.json` writes.
+   */
+  closeTabs(intent) {
+    const tabIds = intent.mode === "ids" ? intent.tabIds : this.registry.list().filter((record) => record.sessionId === intent.sessionId).map((record) => record.tabId);
+    for (const tabId of tabIds) {
+      this.dropReceipt(tabId);
+      this.loadFailures.delete(tabId);
+    }
+    this.registry.destroyMany(tabIds);
+    return this.chromeState();
+  }
   /**
    * Re-create the tabs a previous run recorded (design 7).
    *
@@ -12094,6 +12227,7 @@ const BROWSER_IPC_CHANNELS = [
   "browser-state",
   "browser-new-tab",
   "browser-close-tab",
+  "browser-close-tabs",
   "browser-activate-tab",
   "browser-navigate",
   "browser-reload",
@@ -12120,11 +12254,18 @@ function registerBrowserIpc(options) {
     return host;
   }
   electron.ipcMain.handle("browser-state", (event) => authorize(event).chromeState());
-  electron.ipcMain.handle("browser-new-tab", async (event) => authorize(event).newTab());
+  electron.ipcMain.handle("browser-new-tab", async (event, sessionId2) => {
+    const host = authorize(event);
+    return host.newTab(optionalConversationOrThrow(sessionId2));
+  });
   electron.ipcMain.handle("browser-close-tab", (event, tabId) => {
     const host = authorize(event);
     return host.closeTab(numberOrThrow(tabId, "tabId"));
   });
+  electron.ipcMain.handle("browser-close-tabs", (event, intent) => {
+    const host = authorize(event);
+    return host.closeTabs(closeTabsIntentOrThrow(intent));
+  });
   electron.ipcMain.handle("browser-activate-tab", (event, tabId) => {
     const host = authorize(event);
     return host.activateTab(numberOrThrow(tabId, "tabId"));
@@ -12220,6 +12361,38 @@ function numberOrThrow(value, name) {
   }
   return value;
 }
+function closeTabsIntentOrThrow(value) {
+  if (!value || typeof value !== "object") {
+    throw new Error("A close request is required.");
+  }
+  const intent = value;
+  if (intent.mode === "ids") {
+    if (!Array.isArray(intent.tabIds) || intent.tabIds.length === 0) {
+      throw new Error("Closing tabs by id needs at least one tab id.");
+    }
+    const tabIds = intent.tabIds.map(
+      (tabId) => numberOrThrow(tabId, "each tab id")
+    );
+    return { mode: "ids", tabIds };
+  }
+  if (intent.mode === "conversation") {
+    const sessionId2 = optionalConversationOrThrow(intent.sessionId);
+    if (sessionId2 === null) {
+      throw new Error("Closing a conversation's tabs needs a conversation id.");
+    }
+    return { mode: "conversation", sessionId: sessionId2 };
+  }
+  throw new Error("Unsupported close request.");
+}
+function optionalConversationOrThrow(value) {
+  if (value === null || value === void 0) return null;
+  if (typeof value !== "string") {
+    throw new Error("A conversation id must be a string.");
+  }
+  const sessionId2 = value.trim();
+  if (!sessionId2) throw new Error("A conversation id cannot be empty.");
+  return sessionId2;
+}
 function contentRectOrNull(value) {
   if (value === null || value === void 0) return null;
   if (typeof value !== "object")
@@ -15604,6 +15777,122 @@ function registerDevDriverIPC(options) {
     };
   });
 }
+const PRUNE_NAMES = [
+  "__pycache__",
+  "node_modules",
+  "dist",
+  "build",
+  ".git",
+  ".venv"
+];
+function excluded(name) {
+  if (name.startsWith(".")) return true;
+  return PRUNE_NAMES.includes(name);
+}
+function resolveUserPath$1(filePath, cwd, home) {
+  if (filePath === "~") return home;
+  if (filePath.startsWith("~/")) return path$1.join(home, filePath.slice(2));
+  if (cwd && !filePath.startsWith("/")) {
+    const base = cwd === "~" || cwd.startsWith("~/") ? resolveUserPath$1(cwd, void 0, home) : cwd;
+    return path$1.join(base, filePath);
+  }
+  return filePath;
+}
+const DIRECTORY_SCAN_LIMIT = 2e3;
+const collator = new Intl.Collator();
+function compareCandidates(a, b) {
+  const display = collator.compare(a.name, b.name);
+  if (display !== 0) return display;
+  return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+}
+function offerCandidate(heap, candidate) {
+  if (heap.length < DIRECTORY_SCAN_LIMIT) {
+    heap.push(candidate);
+    siftUp(heap, heap.length - 1);
+    return true;
+  }
+  if (compareCandidates(candidate, heap[0]) >= 0) return false;
+  heap[0] = candidate;
+  siftDown(heap, 0);
+  return true;
+}
+function siftUp(heap, from) {
+  let index = from;
+  while (index > 0) {
+    const parent = index - 1 >> 1;
+    if (compareCandidates(heap[index], heap[parent]) <= 0) return;
+    [heap[parent], heap[index]] = [heap[index], heap[parent]];
+    index = parent;
+  }
+}
+function siftDown(heap, from) {
+  let index = from;
+  for (; ; ) {
+    const left = index * 2 + 1;
+    const right = left + 1;
+    let largest = index;
+    if (left < heap.length && compareCandidates(heap[left], heap[largest]) > 0)
+      largest = left;
+    if (right < heap.length && compareCandidates(heap[right], heap[largest]) > 0)
+      largest = right;
+    if (largest === index) return;
+    [heap[largest], heap[index]] = [heap[index], heap[largest]];
+    index = largest;
+  }
+}
+async function listDirectory(dir) {
+  try {
+    const candidates = [];
+    let overflow = false;
+    const stream = await promises.opendir(dir);
+    for await (const entry of stream) {
+      if (excluded(entry.name)) continue;
+      if (!offerCandidate(candidates, {
+        name: entry.name,
+        directory: entry.isDirectory(),
+        link: entry.isSymbolicLink()
+      }))
+        overflow = true;
+    }
+    candidates.sort(compareCandidates);
+    const kept = candidates.slice(0, DIRECTORY_ENTRY_LIMIT);
+    const entries = kept.map((candidate) => ({
+      name: candidate.name,
+      directory: candidate.link ? fs.statSync(path$1.join(dir, candidate.name), {
+        throwIfNoEntry: false
+      })?.isDirectory() ?? false : candidate.directory
+    }));
+    return {
+      dir,
+      entries,
+      // Either bound withheld something. `overflow` is the scan cap, which
+      // means the kept set is the smallest ALPHABETICAL
+      // `DIRECTORY_SCAN_LIMIT` names of a directory nobody finished reading —
+      // the same rows a full sort-then-truncate would have answered with — and
+      // the second term is the answer's own `DIRECTORY_ENTRY_LIMIT`-row limit.
+      truncated: overflow || candidates.length > DIRECTORY_ENTRY_LIMIT
+    };
+  } catch (error) {
+    return {
+      dir,
+      entries: [],
+      truncated: false,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+function realPathOrNull(path2) {
+  try {
+    return fs.realpathSync(path2);
+  } catch {
+    return null;
+  }
+}
+function outsideWorkspace(realTarget, realRoot) {
+  if (realRoot === null) return void 0;
+  if (realTarget === null) return true;
+  return realTarget !== realRoot && !realTarget.startsWith(`${realRoot}${path$1.sep}`);
+}
 const LAUNCHER_MISSES_BEFORE_GONE = 2;
 function createLauncherWatch(input) {
   const threshold = input.missesBeforeGone ?? LAUNCHER_MISSES_BEFORE_GONE;
@@ -15790,6 +16079,25 @@ const READABLE_VERSION_PATTERN = /^v?\d+(\.\d+){0,3}([.-]?(?:a|b|c|rc|alpha|beta
 const isReadableVersion = (value) => typeof value === "string" && READABLE_VERSION_PATTERN.test(value.trim());
 const UP_TO_DATE_AFFIRMATION = "The application and server are up to date";
 const updateCheckAffirmation = (channels) => channels.app === "current" && channels.server === "current" ? UP_TO_DATE_AFFIRMATION : null;
+const readable = (value) => isReadableVersion(value) ? value.trim() : null;
+const serverChannelVerdict = ({
+  installVersion,
+  runningVersion,
+  publishedVersion,
+  isNewer
+}) => {
+  const published = readable(publishedVersion);
+  const running = readable(runningVersion);
+  if (!published || !running)
+    return { status: "unavailable", state: "unreadable" };
+  const install = readable(installVersion);
+  const subject = install ?? running;
+  if (isNewer(published, subject))
+    return { status: "available", state: "install-behind" };
+  if (install && install !== running && isNewer(install, running))
+    return { status: "restart-required", state: "restart-required" };
+  return { status: "current", state: "current" };
+};
 const updateCheckVerdict = (channels) => ({
   app: channels.app,
   server: channels.server,
@@ -15859,6 +16167,37 @@ function stderrTail(stderr, maxLines = 4) {
   const lines = stderr.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
   return lines.slice(-maxLines).join("\n").slice(-600);
 }
+function readingOfHealth(health) {
+  const result = health.result;
+  return {
+    version: result?.version ?? null,
+    prefix: result?.prefix ? result.prefix : null,
+    installKind: result?.install_kind ? result.install_kind : null
+  };
+}
+function appOwnedInstallRoots(input) {
+  const support = managedSupportRoot(input.home);
+  return [
+    path$1.join(support, "managed-python"),
+    ...legacyVenvPaths(support),
+    managedVenvPath(input),
+    managedVenvPath({ ...input, packaged: !input.packaged })
+  ];
+}
+function appOwnsInstallRoot(input, prefix) {
+  return isWithinAnyRoot(appOwnedInstallRoots(input), prefix);
+}
+function newerReading(left, right, isNewer) {
+  if (typeof left !== "string" || !isReadableVersion(left)) return right;
+  if (typeof right !== "string" || !isReadableVersion(right)) return left;
+  return isNewer(left, right) ? left : right;
+}
+function isWithinAnyRoot(roots, candidate) {
+  return roots.some((root) => {
+    const relative = path__namespace.relative(root, candidate);
+    return !relative.startsWith("..") && !path__namespace.isAbsolute(relative);
+  });
+}
 class UpdateService {
   mainWindow = null;
   isDevMode;
@@ -17724,10 +18063,24 @@ ${heal.removed.join("\n")}`,
     return this.backendService?.getBackendUrl() ?? this.backendUrl;
   }
   /**
-   * Get the installed backend version using the health API
-   * @returns Promise resolving to the installed version or null if not found
+   * Read the server serving this app: its version, and the install it runs from.
+   *
+   * The install root travels with the version because the update check is a
+   * statement about an INSTALL, and `/health` is the only thing that knows which
+   * one is answering. The app used to classify the install it could name from the
+   * `local-operator` shim on `PATH` and compare THAT against PyPI while reading
+   * this version separately - so a machine serving the app from a three-release-old
+   * environment was told "The application and server are up to date" beside a
+   * Settings row naming the older build.
+   *
+   * @returns the reading, with a null version when nothing answered
    */
-  async getInstalledBackendVersion() {
+  async readRunningBackend() {
+    const notAnswered = {
+      version: null,
+      prefix: null,
+      installKind: null
+    };
     try {
       const backendUrl = this.liveBackendUrl();
       logger.info(
@@ -17747,21 +18100,22 @@ ${heal.removed.join("\n")}`,
           `Health API returned status ${response.status}`,
           LogFileType.UPDATE_SERVICE
         );
-        return null;
+        return notAnswered;
       }
       const healthData = await response.json();
-      if (healthData.result?.version) {
+      const reading = readingOfHealth(healthData);
+      if (reading.version) {
         logger.info(
-          `Backend version from health API: ${healthData.result.version}`,
+          `Backend version from health API: ${reading.version} (install root ${reading.prefix ?? "not reported"}, install kind ${reading.installKind ?? "not reported"})`,
           LogFileType.UPDATE_SERVICE
         );
-        return healthData.result.version;
+        return reading;
       }
       logger.info(
         "Backend version not available in health response",
         LogFileType.UPDATE_SERVICE
       );
-      return "Unknown";
+      return { ...reading, version: "Unknown" };
     } catch (error) {
       logger.error(
         "Error getting backend version from health API:",
@@ -17789,15 +18143,16 @@ ${heal.removed.join("\n")}`,
               `Alternative health API returned status ${response.status}`,
               LogFileType.UPDATE_SERVICE
             );
-            return null;
+            return notAnswered;
           }
           const healthData = await response.json();
-          if (healthData.result?.version) {
+          const reading = readingOfHealth(healthData);
+          if (reading.version) {
             logger.info(
-              `Backend version from alternative health API: ${healthData.result.version}`,
+              `Backend version from alternative health API: ${reading.version} (install root ${reading.prefix ?? "not reported"}, install kind ${reading.installKind ?? "not reported"})`,
               LogFileType.UPDATE_SERVICE
             );
-            return healthData.result.version;
+            return reading;
           }
         } catch (altError) {
           logger.error(
@@ -17822,7 +18177,7 @@ ${heal.removed.join("\n")}`,
               `Backend version from pip: ${version}`,
               LogFileType.UPDATE_SERVICE
             );
-            return version;
+            return { version, prefix: null, installKind: null };
           }
         } catch (pipError) {
           logger.error(
@@ -17832,9 +18187,19 @@ ${heal.removed.join("\n")}`,
           );
         }
       }
-      return null;
+      return notAnswered;
     }
   }
+  /**
+   * The version the server serving this app reports, or null when it did not.
+   *
+   * Kept beside `readRunningBackend` rather than replaced by it: four callers ask
+   * only this question (the skew notices, the by-hand panel), and none of them may
+   * start judging an install because a second reading became available.
+   */
+  async getInstalledBackendVersion() {
+    return (await this.readRunningBackend()).version;
+  }
   /**
    * Get the latest version from PyPI
    * @returns Promise resolving to the latest version string or null if unable to fetch
@@ -17876,6 +18241,76 @@ ${heal.removed.join("\n")}`,
    * @param silent - Whether to suppress notifications on no update
    * @returns Promise resolving to update info or null if no update is available
    */
+  /**
+   * Read the install that is serving this app, from the root `/health` named.
+   *
+   * The version comes from the dist-info at that root
+   * (`resolveDistributionMarkers`, the same read the global classification uses),
+   * which is shell-free and needs no interpreter: `pip show` inside that
+   * environment would spawn the very server's python, and a second process is not
+   * worth a number that is already on disk beside the code.
+   *
+   * A root the server did not name answers with nulls, and the check treats that
+   * as "the serving install could not be identified" rather than falling back to
+   * an install the app can name - which is the reported defect.
+   */
+  readServingInstall(reading) {
+    const prefix = reading.prefix;
+    if (!prefix) {
+      return {
+        prefix: null,
+        version: null,
+        installKind: reading.installKind,
+        appOwned: false
+      };
+    }
+    let version = null;
+    try {
+      const markers = resolveDistributionMarkers(prefix);
+      version = (markers.editable || markers.sourceRef) && isReadableVersion(reading.version) ? reading.version : markers.version;
+    } catch (error) {
+      logger.warn(
+        `Could not read the install at ${prefix}: ${error.message}`,
+        LogFileType.UPDATE_SERVICE
+      );
+    }
+    return {
+      prefix,
+      version,
+      installKind: reading.installKind,
+      appOwned: appOwnsInstallRoot(this.ownedInstallInput(), prefix)
+    };
+  }
+  /**
+   * This instance's own ownership triple.
+   *
+   * `packaged` is the build this process IS, not the environment it is asking
+   * about: a packaged build pointed at a dev server still owns the environment
+   * its bundle carries, and the sibling name is in the root list for the
+   * question the other way round.
+   */
+  ownedInstallInput() {
+    return {
+      platform: process.platform,
+      home: electron.app.getPath("home"),
+      appDataPath: electron.app.getPath("appData"),
+      packaged: electron.app.isPackaged
+    };
+  }
+  /**
+   * The identity of the install serving this app, for the classification the plan
+   * needs when that install is not one the app owns.
+   *
+   * Read from the console script INSIDE the reported prefix, so
+   * `classifyGlobalInstall` sees the install that answered rather than whichever
+   * one the shim on `PATH` happens to point at - the two differ exactly on the
+   * machines this check exists for. Null when the prefix carries no console
+   * script, which is "we could not classify it" rather than a guess.
+   */
+  servingInstallIdentity(prefix) {
+    const script = process.platform === "win32" ? path$1.join(prefix, "Scripts", "local-operator.exe") : path$1.join(prefix, "bin", "local-operator");
+    return fs.existsSync(script) ? readInstallIdentity(script) : null;
+  }
   /**
    * Decide what the backend update prompt may offer for a startup mode.
    *
@@ -17889,13 +18324,34 @@ ${heal.removed.join("\n")}`,
    * is the same question: a server the app attaches to but does not own was
    * still being told to run pip, three lines below the code that had already
    * learned better (reviews U4, D4).
+   *
+   * Both of those modes resolve the plan for ONE install: the install that is
+   * actually serving this app, as `/health` reports it. Classifying a global
+   * install by name while a different one serves the user is how the check came to
+   * affirm a version the panel's own row contradicted.
    */
-  async resolveBackendUpdatePlan(startupMode) {
+  async resolveBackendUpdatePlan(startupMode, serving) {
     if (startupMode === LocalOperatorStartupMode.EXISTING_SERVER || startupMode === LocalOperatorStartupMode.GLOBAL_INSTALL) {
-      const identity = await this.resolveInstallIdentity();
+      if (serving.appOwned) {
+        const detail = `The server serving this app runs from Local Operator's own managed environment at ${serving.prefix}, which the app owns rather than a package manager (the backend reports it as install kind "${serving.installKind || "not reported"}")${serving.version ? `, at version ${serving.version}` : " and its installed version could not be read"}.`;
+        logger.info(
+          `External backend install (${startupMode}) runs from the app's own managed environment at ${serving.prefix}; no installer owns it, so the app names no command`,
+          LogFileType.UPDATE_SERVICE
+        );
+        return {
+          canManageUpdate: false,
+          updateCommand: "",
+          remedy: "This server is running from Local Operator's own managed environment, which no package manager owns - so there is no terminal command that can update it correctly. The app can only update a server it started itself: stop this one, then start Local Operator again and let it start its own.",
+          detail,
+          sourceBuild: false,
+          appOwned: true,
+          installedInstallVersion: serving.version
+        };
+      }
+      const identity = (serving.prefix ? this.servingInstallIdentity(serving.prefix) : null) ?? await this.resolveInstallIdentity();
       const plan = resolveGlobalInstallPlan({ identity });
       logger.info(
-        `External backend install (${startupMode}): ${plan.detail}; remedy is \`${plan.updateCommand || "nothing the app can name"}\`; install version ${identity.version ?? "unreadable"}`,
+        `External backend install (${startupMode}): ${plan.detail}; remedy is \`${plan.updateCommand || "nothing the app can name"}\`; install version ${serving.version ?? identity.version ?? "unreadable"}`,
         LogFileType.UPDATE_SERVICE
       );
       return {
@@ -17904,7 +18360,8 @@ ${heal.removed.join("\n")}`,
         remedy: plan.remedy,
         detail: plan.detail,
         sourceBuild: plan.sourceBuild,
-        installedInstallVersion: identity.version ?? null
+        appOwned: false,
+        installedInstallVersion: serving.version ?? identity.version ?? null
       };
     }
     return {
@@ -17913,7 +18370,20 @@ ${heal.removed.join("\n")}`,
       remedy: "Updating the server will improve AI functionality.",
       detail: `The app started this server itself (${startupMode}).`,
       sourceBuild: false,
-      installedInstallVersion: null
+      /*
+       * `false` although this IS the app's own environment: the flag answers
+       * "may the manual panel tell the reader nothing here can move it", and on
+       * this arm the app moves it itself with the button above. It is the
+       * app-owned MANUAL arm that owns the sentence (review round 1, UX U1).
+       */
+      appOwned: false,
+      /*
+       * The app-managed environment's own on-disk version when the server named
+       * it, which is what an update moves: the check compares against the same
+       * install it would rewrite, so a landed update with a daemon still on the
+       * old build is visible as exactly that rather than as "nothing newer".
+       */
+      installedInstallVersion: serving.version
     };
   }
   /**
@@ -18026,11 +18496,17 @@ ${heal.removed.join("\n")}`,
         );
         return { status: "unavailable", info: null };
       }
-      const plan = await this.resolveBackendUpdatePlan(startupMode);
-      const runningVersion = await this.getInstalledBackendVersion();
+      const running = await this.readRunningBackend();
+      const runningVersion = running.version;
+      const serving = this.readServingInstall(running);
+      const plan = await this.resolveBackendUpdatePlan(startupMode, serving);
       const latestVersion = await this.getLatestPypiVersion();
       if (latestVersion) this.lastPublishedBackendVersion = latestVersion;
-      const installVersion = plan.installedInstallVersion;
+      const installVersion = serving.prefix ? plan.installedInstallVersion : newerReading(
+        plan.installedInstallVersion,
+        runningVersion,
+        (candidate, subject) => this.isNewerVersion(candidate, subject)
+      );
       const installedVersion = installVersion && isReadableVersion(installVersion) ? installVersion : runningVersion;
       if (!installedVersion || !latestVersion) {
         logger.error(
@@ -18080,15 +18556,27 @@ ${heal.removed.join("\n")}`,
         }
         return { status: "unavailable", info: null };
       }
-      const shouldUpdate = this.isNewerVersion(latestVersion, installedVersion);
+      const channel = serverChannelVerdict({
+        installVersion,
+        runningVersion,
+        publishedVersion: latestVersion,
+        isNewer: (candidate, subject) => this.isNewerVersion(candidate, subject)
+      });
+      const shouldUpdate = channel.status === "available";
       logger.info(
-        `Install on disk reports: ${installVersion ?? "no reading"}, running backend reports: ${runningVersion ?? "no reading"}, Latest: ${latestVersion}, Update needed: ${shouldUpdate}, Startup mode: ${startupMode}`,
+        `Install on disk reports: ${installVersion ?? "no reading"} (at ${serving.prefix ?? "an install the server did not name"}), running backend reports: ${runningVersion ?? "no reading"}, Latest: ${latestVersion}, Update needed: ${shouldUpdate}, Server channel: ${channel.status} (${channel.state}), Startup mode: ${startupMode}`,
         LogFileType.UPDATE_SERVICE
       );
       logger.info(
         `Installed backend version: ${installedVersion}, Latest: ${latestVersion}, Update needed: ${shouldUpdate}, Startup mode: ${startupMode}`,
         LogFileType.UPDATE_SERVICE
       );
+      if (channel.state === "restart-required") {
+        logger.info(
+          `The install is current (${installedVersion}) and the server serving this app runs ${runningVersion}; a restart of that server picks the installed build up.`,
+          LogFileType.UPDATE_SERVICE
+        );
+      }
       if (shouldUpdate) {
         logger.info(
           `New backend version available: ${latestVersion} (installed: ${installedVersion})`,
@@ -18100,6 +18588,7 @@ ${heal.removed.join("\n")}`,
           runningVersion,
           updateCommand: plan.updateCommand,
           canManageUpdate: plan.canManageUpdate,
+          appOwned: plan.appOwned,
           startupMode,
           remedy: plan.remedy,
           detail: plan.detail,
@@ -18155,7 +18644,7 @@ ${heal.removed.join("\n")}`,
           restartable: this.backendIsAppOwned()
         });
       }
-      return { status: "current", info: null };
+      return { status: channel.status, info: null };
     } catch (error) {
       logger.error(
         "Error checking for backend updates:",
@@ -18549,6 +19038,8 @@ ${tail}` : ""}`,
         return false;
       }
       const startupMode = this.backendService.getStartupMode();
+      const running = await this.readRunningBackend();
+      const serving = this.readServingInstall(running);
       switch (startupMode) {
         case LocalOperatorStartupMode.NOT_STARTED:
           logger.info(
@@ -18565,7 +19056,10 @@ ${tail}` : ""}`,
           return false;
         case LocalOperatorStartupMode.EXISTING_SERVER:
         case LocalOperatorStartupMode.GLOBAL_INSTALL: {
-          const plan = await this.resolveBackendUpdatePlan(startupMode);
+          const plan = await this.resolveBackendUpdatePlan(
+            startupMode,
+            serving
+          );
           const target2 = targetVersion ?? this.lastPublishedBackendVersion ?? null;
           if (plan.canManageUpdate) {
             return await this.updateGlobalInstall(
@@ -18578,7 +19072,7 @@ ${tail}` : ""}`,
             `Cannot manage the update for ${startupMode}: ${plan.detail}`,
             LogFileType.UPDATE_SERVICE
           );
-          const installed = await this.getInstalledBackendVersion();
+          const installed = running.version;
           this.sendToRenderer("backend-update-manual-required", {
             message: plan.remedy,
             command: plan.updateCommand,
@@ -18587,7 +19081,14 @@ ${tail}` : ""}`,
             currentVersion: installed && installed !== "Unknown" ? installed : null,
             installVersion: plan.installedInstallVersion,
             runningVersion: installed,
-            sourceBuild: plan.sourceBuild
+            sourceBuild: plan.sourceBuild,
+            /*
+             * The second door into the same state, and it needs the same reading: this
+             * panel renders `ManualRemedyNote` too, and on an app-owned install the
+             * closing line it would otherwise append asks for a press that cannot move
+             * the environment (review round 1, UX U1).
+             */
+            appOwned: plan.appOwned
           });
           return false;
         }
@@ -19227,14 +19728,7 @@ class ViewerRecordPublisher {
   }
 }
 const BASE64_FILE_EXTENSIONS = ["csv", "tsv", "xls", "xlsx", "ods"];
-const resolveUserPath = (filePath, cwd) => {
-  if (filePath === "~") return electron.app.getPath("home");
-  if (filePath.startsWith("~/"))
-    return path$1.join(electron.app.getPath("home"), filePath.slice(2));
-  if (cwd && !filePath.startsWith("/"))
-    return path$1.join(cwd.startsWith("~/") ? resolveUserPath(cwd) : cwd, filePath);
-  return filePath;
-};
+const resolveUserPath = (filePath, cwd) => resolveUserPath$1(filePath, cwd, electron.app.getPath("home"));
 const windowLaunch = resolveWindowLaunchPlan({
   env: launchEnv,
   argv: process.argv,
@@ -20051,18 +20545,28 @@ electron.app.whenReady().then(async () => {
     "probe-files",
     async (_, paths, cwd) => {
       const asked = Array.isArray(paths) ? paths.filter((path2) => typeof path2 === "string") : [];
+      const realRoot = cwd ? realPathOrNull(resolveUserPath(cwd)) : null;
       return asked.slice(0, MAX_PROBE_PATHS).map((input) => {
         let resolved = input;
         try {
           resolved = resolveUserPath(input, cwd);
           const stat = fs.statSync(resolved, { throwIfNoEntry: false });
+          const exists = stat !== void 0;
           return {
             input,
             resolved,
-            exists: stat !== void 0,
+            exists,
             isFile: stat?.isFile() ?? false,
             sizeBytes: stat?.isFile() ? stat.size : null,
-            mtimeMs: stat?.isFile() ? stat.mtimeMs : null
+            mtimeMs: stat?.isFile() ? stat.mtimeMs : null,
+            /*
+             * The containment verdict, and the reason it is asked ONLY of a path
+             * that exists: the one caller that reads it (the composer's `@` chip)
+             * asks the question about a candidate reference, so a path that is not
+             * there costs no second syscall — and a miss is the common case on the
+             * keystroke path this runs on.
+             */
+            outsideWorkspace: exists ? outsideWorkspace(realPathOrNull(resolved), realRoot) : void 0
           };
         } catch (error) {
           return {
@@ -20078,6 +20582,13 @@ electron.app.whenReady().then(async () => {
       });
     }
   );
+  electron.ipcMain.handle(
+    "list-directory",
+    async (_, dir, cwd) => {
+      const target2 = typeof dir === "string" && dir.length > 0 ? dir : ".";
+      return await listDirectory(resolveUserPath(target2, cwd));
+    }
+  );
   electron.ipcMain.handle(
     "read-file-bytes",
     async (_, filePath, maxBytes = MAX_FILE_READ_BYTES) => {