local-operator-ui 0.30.35 → 0.31.0

package/out/main/index.js

@@ -17,7 +17,7 @@ const promises = require("node:fs/promises");
 const node_net = require("node:net");
 const headless = require("@xterm/headless");
 const node_module = require("node:module");
-const node_http = require("node:http");
+const http = require("node:http");
 const https = require("node:https");
 const electronUpdater = require("electron-updater");
 function _interopNamespaceDefault(e) {
@@ -37,6 +37,7 @@ function _interopNamespaceDefault(e) {
   return Object.freeze(n);
 }
 const path__namespace = /* @__PURE__ */ _interopNamespaceDefault(path$1);
+const http__namespace = /* @__PURE__ */ _interopNamespaceDefault(http);
 const https__namespace = /* @__PURE__ */ _interopNamespaceDefault(https);
 const icon = path.join(__dirname, "../../resources/icon.png");
 const BACKEND_STATUS_CHANNEL = "backend-status";
@@ -389,7 +390,18 @@ const desktopRequestSchema = zod.z.discriminatedUnion("op", [
      * actionable is strictly additive, and a `null` here would be a
      * different request for every caller that never asked.
      */
-    model: modelSelection.optional()
+    model: modelSelection.optional(),
+    /*
+     * The id a `sessions.draft` mint handed the pane, when it has one: the
+     * create then adopts that id (and the runtime already engaged for it)
+     * instead of minting a fresh session id. OMITTED when the pane never
+     * minted — an older backend, a draft the user sent before the first
+     * keystroke's mint answered, or a set of fields that changed since the
+     * mint (see the store's drop rule) — so the body is byte-for-byte the
+     * request this op sent before the draft could be warmed, and a backend
+     * that cannot resolve the id mints fresh rather than failing the send.
+     */
+    draftId: sessionId.optional()
   }).strict(),
   /*
    * What a NEW conversation's readings would be, without creating anything.
@@ -423,6 +435,49 @@ const desktopRequestSchema = zod.z.discriminatedUnion("op", [
        first turn will actually get. */
     model: modelSelection.optional()
   }).strict(),
+  /*
+   * Mint the id a NEW chat's runtime is warmed and then born on, from the
+   * pane's first keystroke.
+   *
+   * WHY THE OP EXISTS. A draft pane has no session to address, so there is
+   * nothing to warm: `sessions.warm` needs an id, and the multi-second engage
+   * the first send pays is exactly what the draft cannot pre-empt without one.
+   * The mint allocates that id and registers it with the daemon (fast, no
+   * engage), and the id then unlocks the same three doors a session pane uses
+   * — `events`, `watch` (the lease) and `warm` — through a deliberately narrow
+   * allow-list on the backend. `sessions.create` adopts the id on send, so the
+   * conversation the user lands in IS the one that was warmed; a daemon that
+   * has never seen the id (restart, expiry, eviction) mints fresh and the send
+   * works exactly as it did before this op existed.
+   *
+   * THE MINT ENGAGES NOTHING, and that is the lifetime design rather than an
+   * omission: the pane's own subscription and watch lease hold the bridge that
+   * keeps a warm alive, exactly as they do for a session, so abandoning the
+   * pane cancels an in-flight warm through the same `_detach` and a runtime
+   * nobody holds is reaped by the residency drain. There is no second, warmer-
+   * owned lifetime to get wrong.
+   *
+   * `requestId` IS A RECEIPT KEY, unlike `sessions.preview`'s token: a mint is
+   * fired once per pane, and a retry — a fast second keystroke, a lost
+   * response — must replay the SAME id, because two ids for one pane would
+   * warm two runtimes and leave a registry entry nobody can ever consume.
+   *
+   * The body is `sessions.create`'s first half, deliberately: same `cwd` bounds,
+   * same optional `target`, same optional `model` and the same 422 for an
+   * unresolvable profile. The pane is asking the question it will ask for real
+   * on the first send, so both derive from one selection and cannot disagree.
+   *
+   * Deliberately NOT a `MESSAGE_OPS` member (see `desktopRequestByteBudget`):
+   * a path and two optional short ids are not prose, so the mint costs the
+   * control budget — which is what lets a KEYSTROKE issue it.
+   */
+  zod.z.object({
+    op: zod.z.literal("sessions.draft"),
+    requestId,
+    cwd: zod.z.string().min(1).max(4096),
+    target: target.optional(),
+    model: modelSelection.optional()
+  }).strict(),
   zod.z.object({ op: zod.z.literal("sessions.get"), sessionId }).strict(),
   zod.z.object({
     op: zod.z.literal("sessions.history"),
@@ -859,6 +914,29 @@ const desktopRequestSchema = zod.z.discriminatedUnion("op", [
     untilMs: zod.z.number().int().nonnegative().optional(),
     days: zod.z.number().int().min(1).max(366).optional()
   }).strict(),
+  /*
+   * The per-model rate table's own read, and a SEPARATE op on purpose.
+   *
+   * Its rows come from a grouped scan of the RAW LEDGER rather than from the
+   * rollup `analytics.get` reads, which is what makes it cover the operator's
+   * whole existing history rather than only the days since the rollup shipped
+   * — and is also what makes it cost seconds on a large ledger. Riding
+   * `analytics.get` would add that scan to every analytics panel load,
+   * including the ones that never scroll to the table, so it is fetched on its
+   * own and its wait is bounded and stated on its own section.
+   *
+   * Same arguments as `analytics.get`, same `.strict()` door, same window
+   * bounds: the two ops are windowed by the same `since_ms`/`until_ms`, which
+   * is the one property that lets a reader hold a row here against the
+   * headline Total above it.
+   */
+  zod.z.object({
+    op: zod.z.literal("analytics.models"),
+    sessionId: sessionId.optional(),
+    sinceMs: zod.z.number().int().nonnegative().optional(),
+    untilMs: zod.z.number().int().nonnegative().optional(),
+    days: zod.z.number().int().min(1).max(366).optional()
+  }).strict(),
   /*
    * The two diagnostics reads. They ride their own capability key
    * (`diagnostics`) rather than the catalogue one, because `/analytics` and
@@ -1291,6 +1369,15 @@ const DESKTOP_CONTROL_DEADLINE_MS = 2e4;
 const DESKTOP_LONG_READ_DEADLINE_MS = 9e4;
 const LEDGER_READ_OPS = /* @__PURE__ */ new Set([
   "analytics.get",
+  /*
+   * The worst case of the same shape, and the reason the set is spelled by
+   * shape rather than by measured cost: `/analytics/models` is a grouped scan
+   * of the raw ledger with no covering index, measured in SECONDS on a 1.95 M
+   * row ledger where `analytics.get` measures 12-40 s cold. On the control
+   * budget it would be abandoned mid-read on nearly every open, so it is here
+   * beside the op it is a slower sibling of.
+   */
+  "analytics.models",
   "sessions.report"
 ]);
 const PROVIDER_READ_OPS = /* @__PURE__ */ new Set(["usage.get"]);
@@ -1307,6 +1394,7 @@ const READ_ONLY_OPS = /* @__PURE__ */ new Set([
   "capabilities",
   "accounts.list",
   "analytics.get",
+  "analytics.models",
   "commands.entities",
   "commands.list",
   "config.get",
@@ -1346,6 +1434,7 @@ const READ_ONLY_OPS = /* @__PURE__ */ new Set([
 ]);
 const PANEL_READ_OPS = /* @__PURE__ */ new Set([
   "analytics.get",
+  "analytics.models",
   "usage.get",
   "sessions.report",
   "info.get",
@@ -1493,7 +1582,10 @@ function desktopEndpoint(request) {
           request_id: request.requestId,
           cwd: request.cwd,
           ...request.target ? { target: request.target } : {},
-          ...request.model ? { model: request.model } : {}
+          ...request.model ? { model: request.model } : {},
+          // Omitted, not nulled, when the pane has no minted id: see the field's
+          // own note for the byte-identity promise this keeps.
+          ...request.draftId ? { draft_id: request.draftId } : {}
         }
       };
     case "sessions.preview":
@@ -1507,6 +1599,17 @@ function desktopEndpoint(request) {
           ...request.model ? { model: request.model } : {}
         }
       };
+    case "sessions.draft":
+      return {
+        path: "/v1/desktop/sessions/draft",
+        method: "POST",
+        body: {
+          request_id: request.requestId,
+          cwd: request.cwd,
+          ...request.target ? { target: request.target } : {},
+          ...request.model ? { model: request.model } : {}
+        }
+      };
     case "sessions.get":
       return {
         path: `/v1/desktop/sessions/${request.sessionId}`,
@@ -1902,6 +2005,25 @@ function desktopEndpoint(request) {
         query.set("until_ms", String(request.untilMs));
       return { path: `/v1/desktop/analytics?${query}`, method: "GET" };
     }
+    /*
+     * `/analytics/models`, NOT `/analytics?models=1`.
+     *
+     * The path segment is what keeps the two reads separable at the
+     * transport: `desktopRequestDeadlineMs` sizes a wait from the op, and an
+     * op that sometimes means "the cheap rollup" and sometimes "a 1.95 M-row
+     * ledger scan" cannot have one honest budget. The two spellings of the
+     * query string below are deliberately identical to `analytics.get`'s, so
+     * the server resolves one window from either.
+     */
+    case "analytics.models": {
+      const query = new URLSearchParams({ days: String(request.days ?? 30) });
+      if (request.sessionId) query.set("session_id", request.sessionId);
+      if (request.sinceMs !== void 0)
+        query.set("since_ms", String(request.sinceMs));
+      if (request.untilMs !== void 0)
+        query.set("until_ms", String(request.untilMs));
+      return { path: `/v1/desktop/analytics/models?${query}`, method: "GET" };
+    }
     case "info.get":
       return { path: "/v1/desktop/info", method: "GET" };
     case "sessions.report": {
@@ -2136,6 +2258,115 @@ function readLaunchTarget(argv) {
   if (argv.includes(OPEN_CATALOGUE_FLAG)) return { kind: "catalogue" };
   return { kind: "restore" };
 }
+const WINDOW_CHROME_MODES = ["integrated", "native"];
+const WINDOW_CHROME_FLAG = "--window-chrome";
+const WINDOW_CHROME_ENV = "LOCAL_OPERATOR_UI_WINDOW_CHROME";
+const WINDOW_CHROME_ARG = "--lo-window-chrome";
+const WINDOW_CHROME_HEIGHT = 40;
+const WINDOW_CHROME_TRANSPARENT = "#00000000";
+const DEFAULT_WINDOW_CHROME_COLORS = {
+  ground: "#22201c",
+  symbol: "#c2bcaf",
+  symbolInactive: "#a6a091"
+};
+function chromePlatformFor(platform) {
+  if (platform === "darwin") return "mac";
+  if (platform === "win32") return "win";
+  return "linux";
+}
+function parseWindowChromeMode(value) {
+  if (value === void 0) return null;
+  const normalized = value.trim().toLowerCase();
+  return WINDOW_CHROME_MODES.includes(normalized) ? normalized : null;
+}
+function readWindowChromeFlag(argv, name = WINDOW_CHROME_FLAG) {
+  let found = false;
+  let valueless = false;
+  let value;
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === name) {
+      const next = argv[index + 1];
+      found = true;
+      if (next === void 0 || next.startsWith("--")) {
+        valueless = true;
+        continue;
+      }
+      value = next;
+      continue;
+    }
+    if (argument.startsWith(`${name}=`)) {
+      found = true;
+      value = argument.slice(name.length + 1);
+    }
+  }
+  return { found, value, valueless };
+}
+function resolveWindowChrome(input) {
+  const problems = [];
+  const argv = input.argv ?? [];
+  const env = input.env ?? {};
+  const persisted = input.persisted ?? null;
+  const flag = readWindowChromeFlag(argv);
+  if (flag.found) {
+    const parsed = parseWindowChromeMode(flag.value);
+    if (parsed !== null) return { mode: parsed, source: "argument", problems };
+    if (flag.valueless) {
+      problems.push(
+        `${WINDOW_CHROME_FLAG} was given with no value and names nothing`
+      );
+    } else {
+      problems.push(
+        `${WINDOW_CHROME_FLAG}=${flag.value} is not one of ${WINDOW_CHROME_MODES.join(", ")}`
+      );
+    }
+  }
+  const fromEnv = env[WINDOW_CHROME_ENV];
+  if (fromEnv !== void 0 && fromEnv.trim() !== "") {
+    const parsed = parseWindowChromeMode(fromEnv);
+    if (parsed !== null)
+      return { mode: parsed, source: "environment", problems };
+    problems.push(
+      `${WINDOW_CHROME_ENV}=${fromEnv} is not one of ${WINDOW_CHROME_MODES.join(", ")}`
+    );
+  }
+  if (persisted !== null)
+    return { mode: persisted, source: "persisted", problems };
+  return { mode: "integrated", source: "default", problems };
+}
+function windowChromeArgument(facts) {
+  return `${WINDOW_CHROME_ARG}=${facts.platform}:${facts.mode}`;
+}
+const WINDOW_CHROME_REPORT_CHANNEL = "window-chrome:report";
+const WINDOW_CHROME_STATE_CHANNEL = "window-chrome:state";
+const WINDOW_CHROME_MENU_CHANNEL = "window-chrome:popup-app-menu";
+const WINDOW_CHROME_FILE = "window-chrome.json";
+function windowChromeFactsFor(platform, mode) {
+  return { platform: chromePlatformFor(platform), mode };
+}
+function windowChromeArgumentFor(platform, mode) {
+  return windowChromeArgument(windowChromeFactsFor(platform, mode));
+}
+function resolveWindowChromeForLaunch(input) {
+  const resolved = resolveWindowChrome({
+    argv: input.argv,
+    env: input.env,
+    persisted: input.persisted?.mode ?? null
+  });
+  const problems = [...resolved.problems];
+  const macRequestedNative = input.platform === "darwin" && resolved.mode === "native";
+  if (macRequestedNative) {
+    problems.push(
+      "macOS has no native-frame fallback (the frame options are #462's shipped design and the renderer's 32px lane depends on them), so --window-chrome=native is ignored here: the app runs integrated"
+    );
+  }
+  return {
+    mode: macRequestedNative ? "integrated" : resolved.mode,
+    colors: input.persisted?.colors ?? DEFAULT_WINDOW_CHROME_COLORS,
+    source: input.persisted?.colors ? `${resolved.source}+persisted-colors` : resolved.source,
+    problems
+  };
+}
 const SERVE_RUN_DIRNAME = "run/serve";
 const REAPED_DIRNAME = "reaped";
 const REAPED_MAX_FILES = 200;
@@ -5376,9 +5607,9 @@ const SILENCE_TIMEOUT_MS = 45e3;
 const WATCHDOG_TICK_MS = 1e3;
 const MAX_FRAME_BYTES$1 = 8 * 1024 * 1024;
 const LINE_ENDING = /\r\n|\n|\r/;
-const BLANK_LINE = /(?:\r\n|\n|\r)(?:\r\n|\n|\r)/;
+const BLANK_LINE$1 = /(?:\r\n|\n|\r)(?:\r\n|\n|\r)/;
 function nextRecord(buffer) {
-  const blank = BLANK_LINE.exec(buffer);
+  const blank = BLANK_LINE$1.exec(buffer);
   if (blank === null) return null;
   const data = [];
   for (const line of buffer.slice(0, blank.index).split(LINE_ENDING)) {
@@ -7350,8 +7581,9 @@ function runBounded(command, args, env, bounds) {
     );
   });
 }
+const NEWLINES = /\r?\n/;
 const errorTail = (text, lines = 3) => {
-  const kept = text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  const kept = text.split(NEWLINES).map((line) => line.trim()).filter(Boolean);
   if (kept.length === 0) return "";
   const tail = kept.slice(-lines).join(" | ");
   return kept.length > lines ? `… ${tail}` : tail;
@@ -21025,7 +21257,7 @@ function validateRequest(raw) {
   };
 }
 async function startRpcServer(options) {
-  const server = node_http.createServer((req, res) => {
+  const server = http.createServer((req, res) => {
     void handle(req, res, options);
   });
   const bound = await new Promise(
@@ -23868,6 +24100,41 @@ function describeTelemetryLaunch(decision) {
   const detail = [decision.offReason, ...decision.problems].filter((part) => part !== null && part !== void 0).join("; ");
   return `[telemetry] off: ${detail}`;
 }
+function titlebarOptions(platform, chrome) {
+  if (platform === "darwin") {
+    return { titleBarStyle: "hidden" };
+  }
+  if (platform !== "win32" && platform !== "linux") {
+    return {};
+  }
+  if (chrome.mode === "native") return {};
+  const chromePlatform = chromePlatformFor(platform);
+  return {
+    titleBarStyle: "hidden",
+    titleBarOverlay: {
+      color: chromePlatform === "win" ? (
+        /* Transparent: the app's own ground shows through. See the docblock. */
+        WINDOW_CHROME_TRANSPARENT
+      ) : (
+        /* Opaque reported ground: Linux forces alpha to ff, so a transparent
+        value would paint the glyphs on black. The renderer reports the
+        resolved ground of the element owning the controls' corner and main
+        re-applies it with `setTitleBarOverlay`; this is the value for the
+        first frame, before any report has arrived, which is why it is the
+        palette's `canvas` rather than a guessed pane ground. */
+        chrome.colors.ground
+      ),
+      symbolColor: chrome.colors.symbol,
+      /*
+       * 40 is the app's own toolbar step, so the caption buttons are exactly as
+       * tall as the row they end: the chat header, every pane toolbar and the
+       * sidebar's brand row are all `h-10`. It sits inside Microsoft's 32-48
+       * range. `height` is an integer; a fractional one is rejected.
+       */
+      height: WINDOW_CHROME_HEIGHT
+    }
+  };
+}
 const CHROMIUM_TRANSPORT_CODES = [
   "ERR_INTERNET_DISCONNECTED",
   "ERR_NETWORK_CHANGED",
@@ -24365,6 +24632,273 @@ function dropStream(stream) {
   const destroy = stream?.destroy;
   if (typeof destroy === "function") destroy.call(stream);
 }
+const SERVER_RELEASE_REPO = "damianvtran/local-operator";
+const GITHUB_API_ORIGIN = "https://api.github.com";
+const RELEASE_NOTES_CACHE_FILE = "server-release-notes.json";
+const SUMMARY_LIMIT = 400;
+const RELEASE_NOTES_TIMEOUT_MS = 4e3;
+const CACHE_LIMIT = 12;
+const MAX_RESPONSE_BYTES = 512 * 1024;
+const TAG_PREFIX = /^v/i;
+function releaseTag(version) {
+  const trimmed = String(version ?? "").trim();
+  if (!trimmed) return "";
+  return TAG_PREFIX.test(trimmed) ? trimmed : `v${trimmed}`;
+}
+function releasePageUrl(version) {
+  return `https://github.com/${SERVER_RELEASE_REPO}/releases/tag/${releaseTag(version)}`;
+}
+function releaseNotesCachePath(userDataDir) {
+  return path$1.join(userDataDir, RELEASE_NOTES_CACHE_FILE);
+}
+function normaliseCache(parsed) {
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+  const cache = {};
+  for (const [version, entry] of Object.entries(
+    parsed
+  )) {
+    if (!entry || typeof entry !== "object") continue;
+    const { version: named, summary, url } = entry;
+    if (typeof summary !== "string" || !summary.trim()) continue;
+    if (typeof url !== "string" || !url.trim()) continue;
+    cache[version] = {
+      version: typeof named === "string" && named ? named : version,
+      summary,
+      url
+    };
+  }
+  return cache;
+}
+function readReleaseNotesCache(userDataDir) {
+  try {
+    return normaliseCache(
+      JSON.parse(fs.readFileSync(releaseNotesCachePath(userDataDir), "utf8"))
+    );
+  } catch {
+    return {};
+  }
+}
+function writeReleaseNotesCache(userDataDir, cache) {
+  try {
+    fs.mkdirSync(userDataDir, { recursive: true });
+    fs.writeFileSync(
+      releaseNotesCachePath(userDataDir),
+      `${JSON.stringify(cache, null, 2)}
+`,
+      "utf8"
+    );
+  } catch {
+  }
+}
+function rememberReleaseNotes(cache, notes) {
+  const next = { ...cache, [notes.version]: notes };
+  const versions = Object.keys(next);
+  if (versions.length <= CACHE_LIMIT) return next;
+  const trimmed = {};
+  for (const version of versions.slice(versions.length - CACHE_LIMIT)) {
+    trimmed[version] = next[version];
+  }
+  return trimmed;
+}
+function cachedReleaseNotes(cache, version) {
+  return cache[String(version ?? "").trim()] ?? null;
+}
+function summariseReleaseBody(body, limit = SUMMARY_LIMIT) {
+  if (typeof body !== "string") return null;
+  const blocks = body.replace(CRLF, "\n").split(BLANK_LINE);
+  for (const block of blocks) {
+    const text = flattenBlock(block);
+    if (text && !isMachineRow(text)) return truncateSummary(text, limit);
+  }
+  return null;
+}
+function isMachineRow(text) {
+  return PR_HEADLINE.test(text) || MERGE_CITATION.test(text);
+}
+const CRLF = /\r\n?/g;
+const BLANK_LINE = /\n{2,}/;
+const HEADING_LINE = /^#{1,6}\s/;
+const RULE_LINE = /^(?:[-*_]\s*){3,}$/;
+const COMMENT_OPEN = /^<!--/;
+const COMMENT_CLOSE = /-->$/;
+const BLOCKQUOTE_MARKER = /^>\s?/;
+const LIST_MARKER = /^(?:[-*+]|\d+[.)])\s+/;
+const IMAGE = /!\[([^\]]*)\]\([^)]*\)/g;
+const LINK = /\[([^\]]*)\]\([^)]*\)/g;
+const CODE_SPAN = /`([^`]*)`/g;
+const CODE_PLACEHOLDER = /\uE000(\d+)\uE001/g;
+const MASK_ALPHABET = /[\uE000\uE001]/g;
+const EMPHASIS = /(?<!\*)\*{3}([\s\S]+?)(?<!\*)\*{3}(?!\*)|(?<!\*)\*{2}([\s\S]+?)(?<!\*)\*{2}(?!\*)|(?<!\*)\*(?!\*)([\s\S]+?)(?<!\*)\*(?!\*)/g;
+const WHITESPACE_RUN = /\s+/g;
+const PR_HEADLINE = /^#\d+\s+[—–-]\s/;
+const MERGE_CITATION = /\(merge [0-9a-f]{7,40}\)$/i;
+function flattenBlock(block) {
+  const lines = block.split("\n").flatMap((line) => {
+    const trimmed = line.trim();
+    if (!trimmed) return [];
+    if (HEADING_LINE.test(trimmed)) return [];
+    if (RULE_LINE.test(trimmed)) return [];
+    if (COMMENT_OPEN.test(trimmed) || COMMENT_CLOSE.test(trimmed)) return [];
+    return [trimmed.replace(BLOCKQUOTE_MARKER, "").replace(LIST_MARKER, "")];
+  });
+  if (lines.length === 0) return "";
+  return collapseWhitespace(flattenInline(lines.join(" ")));
+}
+function flattenInline(text) {
+  const code = [];
+  const masked = text.replace(MASK_ALPHABET, " ").replace(IMAGE, "$1").replace(LINK, "$1").replace(CODE_SPAN, (_span, inner) => {
+    code.push(inner);
+    return `${code.length - 1}`;
+  });
+  const unwrapped = masked.replace(EMPHASIS, unwrapEmphasis).replace(EMPHASIS, unwrapEmphasis);
+  return unwrapped.replace(CODE_PLACEHOLDER, (placeholder, index) => {
+    return code[Number(index)] ?? placeholder;
+  });
+}
+function unwrapEmphasis(_match, triple, strong, italic) {
+  return triple ?? strong ?? italic ?? "";
+}
+function collapseWhitespace(text) {
+  return text.replace(WHITESPACE_RUN, " ").trim();
+}
+function truncateSummary(text, limit) {
+  if (text.length <= limit) return text;
+  const cut = text.slice(0, Math.max(0, limit - 3));
+  const lastSpace = cut.lastIndexOf(" ");
+  const words = lastSpace > limit / 2 ? cut.slice(0, lastSpace) : cut;
+  const trimmed = words.trimEnd();
+  const dropped = DanglingWord.test(trimmed) ? trimmed.slice(0, trimmed.lastIndexOf(" ")).trimEnd() : trimmed;
+  const balanced = stripUnpairedEmphasis(dropped);
+  const sentence = balanced.replace(TRAILING_STOP, "");
+  return `${sentence}...`;
+}
+const DanglingWord = /(?:^|\s)(?:a|an|as|at|by|in|of|on|or|to)$/i;
+const TRAILING_STOP = /[.!?]$/;
+function stripUnpairedEmphasis(text) {
+  const leading = text.match(/^\*{1,3}/);
+  if (leading && !text.slice(leading[0].length).includes("*")) {
+    return text.slice(leading[0].length).trimStart();
+  }
+  const trailing = text.match(/\*{1,3}$/);
+  if (trailing && !text.slice(0, -trailing[0].length).includes("*")) {
+    return text.slice(0, -trailing[0].length).trimEnd();
+  }
+  return text;
+}
+function parseReleaseResponse(payload, version) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return null;
+  }
+  const release = payload;
+  const summary = summariseReleaseBody(release.body);
+  if (!summary) return null;
+  const url = typeof release.html_url === "string" && release.html_url.trim() ? release.html_url.trim() : releasePageUrl(version);
+  return { version: String(version).trim(), summary, url };
+}
+async function fetchServerReleaseNotes(version, options) {
+  const named = String(version ?? "").trim();
+  const tag = releaseTag(named);
+  if (!tag) return { status: "absent", reason: "the offer named no version" };
+  const cache = readReleaseNotesCache(options.userDataDir);
+  const hit = cachedReleaseNotes(cache, named);
+  if (hit) return { status: "found", notes: hit, cached: true };
+  const origin = options.apiOrigin ?? GITHUB_API_ORIGIN;
+  const url = `${origin}/repos/${SERVER_RELEASE_REPO}/releases/tags/${tag}`;
+  let answer;
+  try {
+    answer = await getJson(url, options.timeoutMs ?? RELEASE_NOTES_TIMEOUT_MS);
+  } catch (error) {
+    return {
+      status: "absent",
+      reason: `the lookup for ${tag} failed: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  if (answer.status !== 200) {
+    return {
+      status: "absent",
+      reason: `GitHub answered ${answer.status} for ${tag}`
+    };
+  }
+  let payload;
+  try {
+    payload = JSON.parse(answer.body);
+  } catch {
+    return {
+      status: "absent",
+      reason: `GitHub's answer for ${tag} was not JSON`
+    };
+  }
+  const notes = parseReleaseResponse(payload, named);
+  if (!notes) {
+    return { status: "absent", reason: `the ${tag} release carries no notes` };
+  }
+  writeReleaseNotesCache(
+    options.userDataDir,
+    rememberReleaseNotes(cache, notes)
+  );
+  return { status: "found", notes, cached: false };
+}
+function getJson(url, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const settle2 = (finish) => {
+      if (settled) return;
+      settled = true;
+      finish();
+    };
+    const fail = (error) => settle2(
+      () => reject(error instanceof Error ? error : new Error(String(error)))
+    );
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch (error) {
+      fail(error);
+      return;
+    }
+    const transport = parsed.protocol === "http:" ? http__namespace : https__namespace;
+    const request = transport.get(
+      parsed,
+      {
+        timeout: timeoutMs,
+        headers: {
+          // GitHub refuses a request with no user agent, and the versioned
+          // media type is what pins the payload shape this module parses.
+          "user-agent": "local-operator-ui",
+          accept: "application/vnd.github+json"
+        }
+      },
+      (response) => {
+        const chunks = [];
+        let length = 0;
+        response.on("data", (chunk) => {
+          length += chunk.length;
+          if (length > MAX_RESPONSE_BYTES) {
+            request.destroy();
+            fail(new Error("the answer was larger than this lookup accepts"));
+            return;
+          }
+          chunks.push(chunk);
+        });
+        response.on(
+          "end",
+          () => settle2(
+            () => resolve({
+              status: response.statusCode ?? 0,
+              body: Buffer.concat(chunks).toString("utf8")
+            })
+          )
+        );
+        response.on("error", fail);
+      }
+    );
+    request.setTimeout(timeoutMs, () => {
+      request.destroy();
+      fail(new Error(`no answer within ${timeoutMs}ms`));
+    });
+    request.on("error", fail);
+  });
+}
 function serverUpdateFailureRemedy(input) {
   if (input.rebuildRoute && /REFUSING to release a stale ref/i.test(input.diagnosis)) {
     return "This checkout is behind its remote, which is what `lop-update` refused to build from: bring the checkout up to date, and the next press here will build it.";
@@ -27473,6 +28007,51 @@ ${heal.removed.join("\n")}`,
       });
     });
   }
+  /**
+   * What changed in the server version this offer names, or null.
+   *
+   * The read is off the CRITICAL PATH in the sense that matters: it cannot fail
+   * the offer. Every way it can come back empty - no release for the tag, an
+   * unreachable host, an answer that is not JSON, a body with no prose in it -
+   * is a `null` here and a line in this log, and the panel renders without the
+   * paragraph rather than not at all. That is the shape the app's own channel
+   * has always had (`updateInfo.releaseNotes` is optional and the card is drawn
+   * either way), and it is the one a panel asking a reader to move has to keep:
+   * the notes are the reason to move, never the condition for being told.
+   *
+   * AWAITED RATHER THAN SENT LATER, deliberately. The alternative is a second
+   * renderer event carrying the notes after the offer is already on screen,
+   * which buys a panel that grows under the reader's eyes and a state machine to
+   * review in exchange for saving the one bounded round trip this makes per
+   * version (every later check reads the cache). The bound is
+   * `RELEASE_NOTES_TIMEOUT_MS`, and it is smaller than the wait the version read
+   * above it can already impose with no bound at all.
+   */
+  async readServerReleaseNotes(version) {
+    try {
+      const lookup = await fetchServerReleaseNotes(version, {
+        userDataDir: electron.app.getPath("userData")
+      });
+      if (lookup.status === "found") {
+        logger.info(
+          `Release notes for ${version} read from ${lookup.cached ? "the cache" : "GitHub"} (${lookup.notes.summary.length} chars)`,
+          LogFileType.UPDATE_SERVICE
+        );
+        return lookup.notes;
+      }
+      logger.info(
+        `No release notes for ${version}: ${lookup.reason}`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return null;
+    } catch (error) {
+      logger.warn(
+        `Could not read release notes for ${version}: ${error}`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return null;
+    }
+  }
   /**
    * Check for backend updates using health API and PyPI
    * @param silent - Whether to suppress notifications on no update
@@ -27924,9 +28503,11 @@ ${heal.removed.join("\n")}`,
           `New backend version available: ${latestVersion} (installed: ${installedVersion})`,
           LogFileType.UPDATE_SERVICE
         );
+        const releaseNotes = await this.readServerReleaseNotes(latestVersion);
         const updateInfo = {
           currentVersion: installedVersion,
           latestVersion,
+          releaseNotes,
           /*
            * THE PROCESS'S OWN READING, not `/health`'s (review round 2, T1): the
            * panel's sentence is "the server you are using is running X until it
@@ -30162,6 +30743,193 @@ class ViewerRecordPublisher {
     }
   }
 }
+function windowChromeFilePath(userDataDir) {
+  return path$1.join(userDataDir, WINDOW_CHROME_FILE);
+}
+function readPersistedWindowChrome(userDataDir) {
+  const raw = readJson(
+    windowChromeFilePath(userDataDir)
+  );
+  if (raw === null || typeof raw !== "object") return null;
+  const mode = raw.mode === "native" || raw.mode === "integrated" ? raw.mode : null;
+  if (mode === null) return null;
+  const colors = parseChromeColors(raw.colors);
+  return {
+    mode,
+    ...colors ? { colors } : {},
+    ...typeof raw.themeId === "string" ? { themeId: raw.themeId } : {}
+  };
+}
+function writePersistedWindowChrome(userDataDir, value) {
+  return writeJsonAtomic(windowChromeFilePath(userDataDir), value);
+}
+const HEX_COLOR = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
+const FUNCTIONAL_COLOR = /^rgba?\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\d{1,3}\s*(?:,\s*(?:0|1|0?\.\d+)\s*)?\)$/;
+function isValidChromeColor(value) {
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  return HEX_COLOR.test(trimmed) || FUNCTIONAL_COLOR.test(trimmed);
+}
+function mergeChromeColors(current, reported) {
+  if (reported === void 0 || reported === null) return current;
+  if (typeof reported !== "object") return null;
+  const record = reported;
+  const next = { ...current };
+  let sawOne = false;
+  for (const key of [
+    "ground",
+    "symbol",
+    "symbolInactive"
+  ]) {
+    if (!(key in record)) continue;
+    const value = record[key];
+    if (!isValidChromeColor(value)) return null;
+    sawOne = true;
+    next[key] = value.trim();
+  }
+  return sawOne ? next : null;
+}
+function parseChromeColors(value) {
+  if (value === null || typeof value !== "object") return null;
+  const record = value;
+  const ground = record.ground;
+  const symbol = record.symbol;
+  const symbolInactive = record.symbolInactive;
+  if (!isValidChromeColor(ground) || !isValidChromeColor(symbol) || !isValidChromeColor(symbolInactive)) {
+    return null;
+  }
+  return { ground, symbol, symbolInactive };
+}
+function resolveLaunchWindowChrome(input) {
+  let persisted = null;
+  try {
+    persisted = readPersistedWindowChrome(input.userDataDir);
+  } catch {
+    persisted = null;
+  }
+  return resolveWindowChromeForLaunch({
+    argv: input.argv,
+    env: input.env,
+    persisted,
+    platform: input.platform
+  });
+}
+function attachWindowChrome(options) {
+  const { window, mode, userDataDir, headless: headless2, log } = options;
+  let colors = options.colors;
+  let cornerGround;
+  let themeId;
+  const platform = chromePlatformFor(process.platform);
+  const hasOverlay = platform !== "mac" && mode === "integrated";
+  const applyOverlay = (focused) => {
+    if (!hasOverlay) return;
+    const focusedNow = focused && !window.isDestroyed();
+    try {
+      window.setTitleBarOverlay({
+        ...platform === "linux" ? { color: cornerGround ?? colors.ground } : {},
+        symbolColor: focusedNow ? colors.symbol : colors.symbolInactive
+      });
+    } catch (error) {
+      log(
+        `[window-chrome] setTitleBarOverlay refused (${String(error)}) — the window keeps its previous caption colours`
+      );
+    }
+  };
+  const currentState = () => ({
+    fullScreen: window.isDestroyed() ? false : window.isFullScreen(),
+    maximized: window.isDestroyed() ? false : window.isMaximized(),
+    focused: window.isDestroyed() ? false : window.isFocused()
+  });
+  const pushState = () => {
+    if (window.isDestroyed()) return;
+    window.webContents.send(WINDOW_CHROME_STATE_CHANNEL, currentState());
+  };
+  const persist = () => {
+    writePersistedWindowChrome(userDataDir, {
+      mode,
+      colors,
+      ...themeId ? { themeId } : {}
+    });
+  };
+  const onReport = (event, report) => {
+    if (event.sender !== window.webContents) return false;
+    const next = mergeChromeColors(colors, report?.colors);
+    if (next === null) {
+      log(
+        "[window-chrome] refused a report whose colours did not parse — the caption colours are unchanged"
+      );
+      return false;
+    }
+    colors = next;
+    const nextCorner = isValidChromeColor(report?.cornerGround) ? report.cornerGround.trim() : void 0;
+    cornerGround = nextCorner;
+    if (typeof report?.themeId === "string") themeId = report.themeId;
+    window.setBackgroundColor(colors.ground);
+    applyOverlay(!window.isDestroyed() && window.isFocused());
+    persist();
+    log(
+      `[window-chrome] applied themeId=${themeId ?? "(none)"} ground=${colors.ground} symbol=${colors.symbol}${cornerGround ? ` cornerGround=${cornerGround}` : ""}`
+    );
+    return true;
+  };
+  const onPopupAppMenu = (event) => {
+    if (event.sender !== window.webContents) return false;
+    if (headless2) {
+      log(
+        "[window-chrome] app menu popup refused: this launch is headless, so there is no window to hang it from"
+      );
+      return false;
+    }
+    if (window.isDestroyed()) return false;
+    const menu = electron.Menu.getApplicationMenu();
+    if (menu === null) {
+      log("[window-chrome] app menu popup refused: no application menu is set");
+      return false;
+    }
+    const [x, y] = window.getPosition();
+    menu.popup({ window, x, y: y + WINDOW_CHROME_HEIGHT });
+    return true;
+  };
+  electron.ipcMain.handle(WINDOW_CHROME_REPORT_CHANNEL, onReport);
+  electron.ipcMain.handle(WINDOW_CHROME_MENU_CHANNEL, onPopupAppMenu);
+  const onFullScreen = () => {
+    pushState();
+  };
+  const onFocus = () => {
+    applyOverlay(true);
+    pushState();
+  };
+  const onBlur = () => {
+    applyOverlay(false);
+    pushState();
+  };
+  const onResizeState = () => {
+    pushState();
+  };
+  window.on("enter-full-screen", onFullScreen);
+  window.on("leave-full-screen", onFullScreen);
+  window.on("maximize", onResizeState);
+  window.on("unmaximize", onResizeState);
+  window.on("focus", onFocus);
+  window.on("blur", onBlur);
+  window.setBackgroundColor(colors.ground);
+  const sync = () => {
+    applyOverlay(!window.isDestroyed() && window.isFocused());
+    window.setBackgroundColor(colors.ground);
+    pushState();
+  };
+  const dispose = () => {
+    electron.ipcMain.removeHandler(WINDOW_CHROME_REPORT_CHANNEL);
+    electron.ipcMain.removeHandler(WINDOW_CHROME_MENU_CHANNEL);
+    window.removeListener("enter-full-screen", onFullScreen);
+    window.removeListener("leave-full-screen", onFullScreen);
+    window.removeListener("maximize", onResizeState);
+    window.removeListener("unmaximize", onResizeState);
+    window.removeListener("focus", onFocus);
+    window.removeListener("blur", onBlur);
+  };
+  return { sync, dispose };
+}
 const BASE64_FILE_EXTENSIONS = ["csv", "tsv", "xls", "xlsx", "ods"];
 const resolveUserPath = (filePath, cwd) => resolveUserPath$1(filePath, cwd, electron.app.getPath("home"));
 const windowLaunch = resolveWindowLaunchPlan({
@@ -30430,7 +31198,36 @@ const ownLaunchRequest = () => ({
   trigger: "initial-present"
 });
 function createWindow(initialSession = null, openCatalogue = false, request = ownLaunchRequest()) {
+  const chrome = resolveLaunchWindowChrome({
+    argv: process.argv,
+    env: launchEnv,
+    userDataDir: electron.app.getPath("userData"),
+    platform: process.platform
+  });
+  for (const problem of chrome.problems) {
+    logger.warn(`[window-chrome] ${problem}`, LogFileType.BACKEND);
+    console.log(`[window-chrome] ${problem}`);
+  }
   const mainWindow2 = new electron.BrowserWindow({
+    /*
+     * The frame, per platform, from a pure function so the matrix is exercised on
+     * any host (`scripts/titlebar-options.test.mjs`). macOS hides its title bar
+     * and keeps the native traffic lights, which is why the renderer reserves their
+     * 32px lane at the top of the shell (`chat-layout.tsx`) - the lane exists
+     * because this line does, and shipping one without the other is either 32px of
+     * blank space under a native title bar or lights drawn over the app's own row.
+     */
+    ...titlebarOptions(process.platform, {
+      mode: chrome.mode,
+      colors: chrome.colors
+    }),
+    /*
+     * The ground the OS paints before the renderer's first frame. Without it
+     * Electron's default is `#FFF`, so every launch on a dark palette opened with a
+     * white flash - the same defect `INSTALL_WINDOW_CANVAS` fixed for the installer
+     * window, and a hard-coded palette value that a test keeps honest.
+     */
+    backgroundColor: chrome.colors.ground,
     width: windowLaunch.width,
     height: windowLaunch.height,
     // The layout is verified down to 800x600 and not below: the app rail,
@@ -30501,9 +31298,18 @@ function createWindow(initialSession = null, openCatalogue = false, request = ow
        * silent. `rendererArgumentFlags` below concatenates them, and is `{}` when
        * neither applies, so "adds no option at all" stays literally true.
        */
-      ...rendererArgumentFlags(initialSession, openCatalogue)
+      ...rendererArgumentFlags(initialSession, openCatalogue, chrome.mode)
     }
   });
+  const chromeController = attachWindowChrome({
+    window: mainWindow2,
+    mode: chrome.mode,
+    colors: chrome.colors,
+    userDataDir: electron.app.getPath("userData"),
+    headless: windowLaunch.mode === "headless",
+    log: (line) => logger.info(line, LogFileType.BACKEND)
+  });
+  mainWindow2.on("closed", () => chromeController.dispose());
   if (initialSession)
     holdPresentUntilConversation(mainWindow2, initialSession, request);
   mainWindow2.webContents.on("console-message", (_event, level, message) => {
@@ -30651,8 +31457,16 @@ function launchArgumentFlags(initialSession, openCatalogue) {
   if (openCatalogue) return { additionalArguments: [OPEN_CATALOGUE_FLAG] };
   return {};
 }
-function rendererArgumentFlags(initialSession, openCatalogue) {
+function rendererArgumentFlags(initialSession, openCatalogue, chromeMode) {
   const flags = [
+    /*
+     * The chrome facts, and they are ALWAYS written - unlike the conversation or
+     * the dev driver's arming entry, which appear only when they apply. The
+     * renderer chooses between two incompatible layouts on this value, so a reader
+     * that had to infer it from an absent entry would be guessing; see
+     * `readWindowChromeArgument` for why the guess fails towards `native`.
+     */
+    windowChromeArgumentFor(process.platform, chromeMode),
     ...launchArgumentFlags(initialSession, openCatalogue).additionalArguments ?? [],
     ...devDriverWebPreferences.additionalArguments ?? [],
     ...telemetryWebPreferences.additionalArguments ?? []