meshy-node 0.0.9 → 0.1.2

package/main.cjs

@@ -1460,8 +1460,8 @@ var require_node = __commonJS({
           }
           break;
         case "FILE":
-          var fs17 = require("fs");
-          stream2 = new fs17.SyncWriteStream(fd2, { autoClose: false });
+          var fs16 = require("fs");
+          stream2 = new fs16.SyncWriteStream(fd2, { autoClose: false });
           stream2._type = "fs";
           break;
         case "PIPE":
@@ -14251,11 +14251,11 @@ var require_mime_types = __commonJS({
       }
       return exts[0];
     }
-    function lookup(path17) {
-      if (!path17 || typeof path17 !== "string") {
+    function lookup(path16) {
+      if (!path16 || typeof path16 !== "string") {
         return false;
       }
-      var extension2 = extname3("x." + path17).toLowerCase().substr(1);
+      var extension2 = extname3("x." + path16).toLowerCase().substr(1);
       if (!extension2) {
         return false;
       }
@@ -17773,7 +17773,7 @@ var require_path_to_regexp = __commonJS({
     "use strict";
     module2.exports = pathToRegexp;
     var MATCHING_GROUP_REGEXP = /\\.|\((?:\?<(.*?)>)?(?!\?)/g;
-    function pathToRegexp(path17, keys, options) {
+    function pathToRegexp(path16, keys, options) {
       options = options || {};
       keys = keys || [];
       var strict = options.strict;
@@ -17787,8 +17787,8 @@ var require_path_to_regexp = __commonJS({
       var pos = 0;
       var backtrack = "";
       var m;
-      if (path17 instanceof RegExp) {
-        while (m = MATCHING_GROUP_REGEXP.exec(path17.source)) {
+      if (path16 instanceof RegExp) {
+        while (m = MATCHING_GROUP_REGEXP.exec(path16.source)) {
           if (m[0][0] === "\\") continue;
           keys.push({
             name: m[1] || name++,
@@ -17796,18 +17796,18 @@ var require_path_to_regexp = __commonJS({
             offset: m.index
           });
         }
-        return path17;
+        return path16;
       }
-      if (Array.isArray(path17)) {
-        path17 = path17.map(function(value) {
+      if (Array.isArray(path16)) {
+        path16 = path16.map(function(value) {
           return pathToRegexp(value, keys, options).source;
         });
-        return new RegExp(path17.join("|"), flags);
+        return new RegExp(path16.join("|"), flags);
       }
-      if (typeof path17 !== "string") {
+      if (typeof path16 !== "string") {
         throw new TypeError("path must be a string, array of strings, or regular expression");
       }
-      path17 = path17.replace(
+      path16 = path16.replace(
         /\\.|(\/)?(\.)?:(\w+)(\(.*?\))?(\*)?(\?)?|[.*]|\/\(/g,
         function(match, slash, format, key, capture, star, optional, offset) {
           if (match[0] === "\\") {
@@ -17824,7 +17824,7 @@ var require_path_to_regexp = __commonJS({
           if (slash || format) {
             backtrack = "";
           } else {
-            backtrack += path17.slice(pos, offset);
+            backtrack += path16.slice(pos, offset);
           }
           pos = offset + match.length;
           if (match === "*") {
@@ -17854,7 +17854,7 @@ var require_path_to_regexp = __commonJS({
           return result;
         }
       );
-      while (m = MATCHING_GROUP_REGEXP.exec(path17)) {
+      while (m = MATCHING_GROUP_REGEXP.exec(path16)) {
         if (m[0][0] === "\\") continue;
         if (keysOffset + i === keys.length || keys[keysOffset + i].offset > m.index) {
           keys.splice(keysOffset + i, 0, {
@@ -17866,13 +17866,13 @@ var require_path_to_regexp = __commonJS({
         }
         i++;
       }
-      path17 += strict ? "" : path17[path17.length - 1] === "/" ? "?" : "/?";
+      path16 += strict ? "" : path16[path16.length - 1] === "/" ? "?" : "/?";
       if (end) {
-        path17 += "$";
-      } else if (path17[path17.length - 1] !== "/") {
-        path17 += lookahead ? "(?=/|$)" : "(?:/|$)";
+        path16 += "$";
+      } else if (path16[path16.length - 1] !== "/") {
+        path16 += lookahead ? "(?=/|$)" : "(?:/|$)";
       }
-      return new RegExp("^" + path17, flags);
+      return new RegExp("^" + path16, flags);
     }
   }
 });
@@ -17885,19 +17885,19 @@ var require_layer = __commonJS({
     var debug = require_src()("express:router:layer");
     var hasOwnProperty = Object.prototype.hasOwnProperty;
     module2.exports = Layer;
-    function Layer(path17, options, fn) {
+    function Layer(path16, options, fn) {
       if (!(this instanceof Layer)) {
-        return new Layer(path17, options, fn);
+        return new Layer(path16, options, fn);
       }
-      debug("new %o", path17);
+      debug("new %o", path16);
       var opts = options || {};
       this.handle = fn;
       this.name = fn.name || "<anonymous>";
       this.params = void 0;
       this.path = void 0;
-      this.regexp = pathRegexp(path17, this.keys = [], opts);
-      this.regexp.fast_star = path17 === "*";
-      this.regexp.fast_slash = path17 === "/" && opts.end === false;
+      this.regexp = pathRegexp(path16, this.keys = [], opts);
+      this.regexp.fast_star = path16 === "*";
+      this.regexp.fast_slash = path16 === "/" && opts.end === false;
     }
     Layer.prototype.handle_error = function handle_error(error, req, res, next) {
       var fn = this.handle;
@@ -17921,20 +17921,20 @@ var require_layer = __commonJS({
         next(err);
       }
     };
-    Layer.prototype.match = function match(path17) {
+    Layer.prototype.match = function match(path16) {
       var match2;
-      if (path17 != null) {
+      if (path16 != null) {
         if (this.regexp.fast_slash) {
           this.params = {};
           this.path = "";
           return true;
         }
         if (this.regexp.fast_star) {
-          this.params = { "0": decode_param(path17) };
-          this.path = path17;
+          this.params = { "0": decode_param(path16) };
+          this.path = path16;
           return true;
         }
-        match2 = this.regexp.exec(path17);
+        match2 = this.regexp.exec(path16);
       }
       if (!match2) {
         this.params = void 0;
@@ -17976,10 +17976,10 @@ var require_layer = __commonJS({
 var require_methods = __commonJS({
   "../../node_modules/.pnpm/methods@1.1.2/node_modules/methods/index.js"(exports2, module2) {
     "use strict";
-    var http2 = require("http");
+    var http3 = require("http");
     module2.exports = getCurrentNodeMethods() || getBasicNodeMethods();
     function getCurrentNodeMethods() {
-      return http2.METHODS && http2.METHODS.map(function lowerCaseMethod(method) {
+      return http3.METHODS && http3.METHODS.map(function lowerCaseMethod(method) {
         return method.toLowerCase();
       });
     }
@@ -18027,10 +18027,10 @@ var require_route = __commonJS({
     var slice = Array.prototype.slice;
     var toString = Object.prototype.toString;
     module2.exports = Route;
-    function Route(path17) {
-      this.path = path17;
+    function Route(path16) {
+      this.path = path16;
       this.stack = [];
-      debug("new %o", path17);
+      debug("new %o", path16);
       this.methods = {};
     }
     Route.prototype._handles_method = function _handles_method(method) {
@@ -18243,8 +18243,8 @@ var require_router = __commonJS({
         if (++sync > 100) {
           return setImmediate(next, err);
         }
-        var path17 = getPathname(req);
-        if (path17 == null) {
+        var path16 = getPathname(req);
+        if (path16 == null) {
           return done(layerError);
         }
         var layer;
@@ -18252,7 +18252,7 @@ var require_router = __commonJS({
         var route;
         while (match !== true && idx < stack.length) {
           layer = stack[idx++];
-          match = matchLayer(layer, path17);
+          match = matchLayer(layer, path16);
           route = layer.route;
           if (typeof match !== "boolean") {
             layerError = layerError || match;
@@ -18290,18 +18290,18 @@ var require_router = __commonJS({
           } else if (route) {
             layer.handle_request(req, res, next);
           } else {
-            trim_prefix(layer, layerError, layerPath, path17);
+            trim_prefix(layer, layerError, layerPath, path16);
           }
           sync = 0;
         });
       }
-      function trim_prefix(layer, layerError, layerPath, path17) {
+      function trim_prefix(layer, layerError, layerPath, path16) {
         if (layerPath.length !== 0) {
-          if (layerPath !== path17.slice(0, layerPath.length)) {
+          if (layerPath !== path16.slice(0, layerPath.length)) {
             next(layerError);
             return;
           }
-          var c = path17[layerPath.length];
+          var c = path16[layerPath.length];
           if (c && c !== "/" && c !== ".") return next(layerError);
           debug("trim prefix (%s) from url %s", layerPath, req.url);
           removed = layerPath;
@@ -18379,7 +18379,7 @@ var require_router = __commonJS({
     };
     proto.use = function use(fn) {
       var offset = 0;
-      var path17 = "/";
+      var path16 = "/";
       if (typeof fn !== "function") {
         var arg = fn;
         while (Array.isArray(arg) && arg.length !== 0) {
@@ -18387,7 +18387,7 @@ var require_router = __commonJS({
         }
         if (typeof arg !== "function") {
           offset = 1;
-          path17 = fn;
+          path16 = fn;
         }
       }
       var callbacks = flatten(slice.call(arguments, offset));
@@ -18399,8 +18399,8 @@ var require_router = __commonJS({
         if (typeof fn !== "function") {
           throw new TypeError("Router.use() requires a middleware function but got a " + gettype(fn));
         }
-        debug("use %o %s", path17, fn.name || "<anonymous>");
-        var layer = new Layer(path17, {
+        debug("use %o %s", path16, fn.name || "<anonymous>");
+        var layer = new Layer(path16, {
           sensitive: this.caseSensitive,
           strict: false,
           end: false
@@ -18410,9 +18410,9 @@ var require_router = __commonJS({
       }
       return this;
     };
-    proto.route = function route(path17) {
-      var route2 = new Route(path17);
-      var layer = new Layer(path17, {
+    proto.route = function route(path16) {
+      var route2 = new Route(path16);
+      var layer = new Layer(path16, {
         sensitive: this.caseSensitive,
         strict: this.strict,
         end: true
@@ -18422,8 +18422,8 @@ var require_router = __commonJS({
       return route2;
     };
     methods.concat("all").forEach(function(method) {
-      proto[method] = function(path17) {
-        var route = this.route(path17);
+      proto[method] = function(path16) {
+        var route = this.route(path16);
         route[method].apply(route, slice.call(arguments, 1));
         return this;
       };
@@ -18459,9 +18459,9 @@ var require_router = __commonJS({
       }
       return toString.call(obj).replace(objectRegExp, "$1");
     }
-    function matchLayer(layer, path17) {
+    function matchLayer(layer, path16) {
       try {
-        return layer.match(path17);
+        return layer.match(path16);
       } catch (err) {
         return err;
       }
@@ -18579,13 +18579,13 @@ var require_view = __commonJS({
   "../../node_modules/.pnpm/express@4.22.1/node_modules/express/lib/view.js"(exports2, module2) {
     "use strict";
     var debug = require_src()("express:view");
-    var path17 = require("path");
-    var fs17 = require("fs");
-    var dirname3 = path17.dirname;
-    var basename4 = path17.basename;
-    var extname3 = path17.extname;
-    var join13 = path17.join;
-    var resolve10 = path17.resolve;
+    var path16 = require("path");
+    var fs16 = require("fs");
+    var dirname3 = path16.dirname;
+    var basename3 = path16.basename;
+    var extname3 = path16.extname;
+    var join13 = path16.join;
+    var resolve10 = path16.resolve;
     module2.exports = View;
     function View(name, options) {
       var opts = options || {};
@@ -18614,17 +18614,17 @@ var require_view = __commonJS({
       this.path = this.lookup(fileName);
     }
     View.prototype.lookup = function lookup(name) {
-      var path18;
+      var path17;
       var roots = [].concat(this.root);
       debug('lookup "%s"', name);
-      for (var i = 0; i < roots.length && !path18; i++) {
+      for (var i = 0; i < roots.length && !path17; i++) {
         var root = roots[i];
         var loc = resolve10(root, name);
         var dir = dirname3(loc);
-        var file = basename4(loc);
-        path18 = this.resolve(dir, file);
+        var file = basename3(loc);
+        path17 = this.resolve(dir, file);
       }
-      return path18;
+      return path17;
     };
     View.prototype.render = function render(options, callback) {
       debug('render "%s"', this.path);
@@ -18632,21 +18632,21 @@ var require_view = __commonJS({
     };
     View.prototype.resolve = function resolve11(dir, file) {
       var ext = this.ext;
-      var path18 = join13(dir, file);
-      var stat = tryStat(path18);
+      var path17 = join13(dir, file);
+      var stat = tryStat(path17);
       if (stat && stat.isFile()) {
-        return path18;
+        return path17;
       }
-      path18 = join13(dir, basename4(file, ext), "index" + ext);
-      stat = tryStat(path18);
+      path17 = join13(dir, basename3(file, ext), "index" + ext);
+      stat = tryStat(path17);
       if (stat && stat.isFile()) {
-        return path18;
+        return path17;
       }
     };
-    function tryStat(path18) {
-      debug('stat "%s"', path18);
+    function tryStat(path17) {
+      debug('stat "%s"', path17);
       try {
-        return fs17.statSync(path18);
+        return fs16.statSync(path17);
       } catch (e) {
         return void 0;
       }
@@ -18719,7 +18719,7 @@ var require_content_disposition = __commonJS({
     "use strict";
     module2.exports = contentDisposition;
     module2.exports.parse = parse;
-    var basename4 = require("path").basename;
+    var basename3 = require("path").basename;
     var Buffer2 = require_safe_buffer().Buffer;
     var ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g;
     var HEX_ESCAPE_REGEXP = /%[0-9A-Fa-f]{2}/;
@@ -18755,9 +18755,9 @@ var require_content_disposition = __commonJS({
       if (typeof fallback === "string" && NON_LATIN1_REGEXP.test(fallback)) {
         throw new TypeError("fallback must be ISO-8859-1 string");
       }
-      var name = basename4(filename);
+      var name = basename3(filename);
       var isQuotedString = TEXT_REGEXP.test(name);
-      var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name) : basename4(fallback);
+      var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name) : basename3(fallback);
       var hasFallback = typeof fallbackName === "string" && fallbackName !== name;
       if (hasFallback || !isQuotedString || HEX_ESCAPE_REGEXP.test(name)) {
         params["filename*"] = name;
@@ -19002,8 +19002,8 @@ var require_types = __commonJS({
 var require_mime = __commonJS({
   "../../node_modules/.pnpm/mime@1.6.0/node_modules/mime/mime.js"(exports2, module2) {
     "use strict";
-    var path17 = require("path");
-    var fs17 = require("fs");
+    var path16 = require("path");
+    var fs16 = require("fs");
     function Mime() {
       this.types = /* @__PURE__ */ Object.create(null);
       this.extensions = /* @__PURE__ */ Object.create(null);
@@ -19024,7 +19024,7 @@ var require_mime = __commonJS({
     };
     Mime.prototype.load = function(file) {
       this._loading = file;
-      var map = {}, content = fs17.readFileSync(file, "ascii"), lines = content.split(/[\r\n]+/);
+      var map = {}, content = fs16.readFileSync(file, "ascii"), lines = content.split(/[\r\n]+/);
       lines.forEach(function(line) {
         var fields = line.replace(/\s*#.*|^\s*|\s*$/g, "").split(/\s+/);
         map[fields.shift()] = fields;
@@ -19032,8 +19032,8 @@ var require_mime = __commonJS({
       this.define(map);
       this._loading = null;
     };
-    Mime.prototype.lookup = function(path18, fallback) {
-      var ext = path18.replace(/^.*[\.\/\\]/, "").toLowerCase();
+    Mime.prototype.lookup = function(path17, fallback) {
+      var ext = path17.replace(/^.*[\.\/\\]/, "").toLowerCase();
       return this.types[ext] || fallback || this.default_type;
     };
     Mime.prototype.extension = function(mimeType) {
@@ -19263,33 +19263,33 @@ var require_send = __commonJS({
     var escapeHtml = require_escape_html();
     var etag = require_etag();
     var fresh = require_fresh();
-    var fs17 = require("fs");
+    var fs16 = require("fs");
     var mime = require_mime();
     var ms = require_ms2();
     var onFinished = require_on_finished();
     var parseRange = require_range_parser();
-    var path17 = require("path");
+    var path16 = require("path");
     var statuses = require_statuses();
     var Stream = require("stream");
     var util2 = require("util");
-    var extname3 = path17.extname;
-    var join13 = path17.join;
-    var normalize = path17.normalize;
-    var resolve10 = path17.resolve;
-    var sep3 = path17.sep;
+    var extname3 = path16.extname;
+    var join13 = path16.join;
+    var normalize = path16.normalize;
+    var resolve10 = path16.resolve;
+    var sep3 = path16.sep;
     var BYTES_RANGE_REGEXP = /^ *bytes=/;
     var MAX_MAXAGE = 60 * 60 * 24 * 365 * 1e3;
     var UP_PATH_REGEXP = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
     module2.exports = send;
     module2.exports.mime = mime;
-    function send(req, path18, options) {
-      return new SendStream(req, path18, options);
+    function send(req, path17, options) {
+      return new SendStream(req, path17, options);
     }
-    function SendStream(req, path18, options) {
+    function SendStream(req, path17, options) {
       Stream.call(this);
       var opts = options || {};
       this.options = opts;
-      this.path = path18;
+      this.path = path17;
       this.req = req;
       this._acceptRanges = opts.acceptRanges !== void 0 ? Boolean(opts.acceptRanges) : true;
       this._cacheControl = opts.cacheControl !== void 0 ? Boolean(opts.cacheControl) : true;
@@ -19335,8 +19335,8 @@ var require_send = __commonJS({
       this._index = index2;
       return this;
     }, "send.index: pass index as option");
-    SendStream.prototype.root = function root(path18) {
-      this._root = resolve10(String(path18));
+    SendStream.prototype.root = function root(path17) {
+      this._root = resolve10(String(path17));
       debug("root %s", this._root);
       return this;
     };
@@ -19449,10 +19449,10 @@ var require_send = __commonJS({
       var lastModified = this.res.getHeader("Last-Modified");
       return parseHttpDate(lastModified) <= parseHttpDate(ifRange);
     };
-    SendStream.prototype.redirect = function redirect(path18) {
+    SendStream.prototype.redirect = function redirect(path17) {
       var res = this.res;
       if (hasListeners(this, "directory")) {
-        this.emit("directory", res, path18);
+        this.emit("directory", res, path17);
         return;
       }
       if (this.hasTrailingSlash()) {
@@ -19472,42 +19472,42 @@ var require_send = __commonJS({
     SendStream.prototype.pipe = function pipe(res) {
       var root = this._root;
       this.res = res;
-      var path18 = decode(this.path);
-      if (path18 === -1) {
+      var path17 = decode(this.path);
+      if (path17 === -1) {
         this.error(400);
         return res;
       }
-      if (~path18.indexOf("\0")) {
+      if (~path17.indexOf("\0")) {
         this.error(400);
         return res;
       }
       var parts;
       if (root !== null) {
-        if (path18) {
-          path18 = normalize("." + sep3 + path18);
+        if (path17) {
+          path17 = normalize("." + sep3 + path17);
         }
-        if (UP_PATH_REGEXP.test(path18)) {
-          debug('malicious path "%s"', path18);
+        if (UP_PATH_REGEXP.test(path17)) {
+          debug('malicious path "%s"', path17);
           this.error(403);
           return res;
         }
-        parts = path18.split(sep3);
-        path18 = normalize(join13(root, path18));
+        parts = path17.split(sep3);
+        path17 = normalize(join13(root, path17));
       } else {
-        if (UP_PATH_REGEXP.test(path18)) {
-          debug('malicious path "%s"', path18);
+        if (UP_PATH_REGEXP.test(path17)) {
+          debug('malicious path "%s"', path17);
           this.error(403);
           return res;
         }
-        parts = normalize(path18).split(sep3);
-        path18 = resolve10(path18);
+        parts = normalize(path17).split(sep3);
+        path17 = resolve10(path17);
       }
       if (containsDotFile(parts)) {
         var access = this._dotfiles;
         if (access === void 0) {
           access = parts[parts.length - 1][0] === "." ? this._hidden ? "allow" : "ignore" : "allow";
         }
-        debug('%s dotfile "%s"', access, path18);
+        debug('%s dotfile "%s"', access, path17);
         switch (access) {
           case "allow":
             break;
@@ -19521,13 +19521,13 @@ var require_send = __commonJS({
         }
       }
       if (this._index.length && this.hasTrailingSlash()) {
-        this.sendIndex(path18);
+        this.sendIndex(path17);
         return res;
       }
-      this.sendFile(path18);
+      this.sendFile(path17);
       return res;
     };
-    SendStream.prototype.send = function send2(path18, stat) {
+    SendStream.prototype.send = function send2(path17, stat) {
       var len = stat.size;
       var options = this.options;
       var opts = {};
@@ -19539,9 +19539,9 @@ var require_send = __commonJS({
         this.headersAlreadySent();
         return;
       }
-      debug('pipe "%s"', path18);
-      this.setHeader(path18, stat);
-      this.type(path18);
+      debug('pipe "%s"', path17);
+      this.setHeader(path17, stat);
+      this.type(path17);
       if (this.isConditionalGET()) {
         if (this.isPreconditionFailure()) {
           this.error(412);
@@ -19590,28 +19590,28 @@ var require_send = __commonJS({
         res.end();
         return;
       }
-      this.stream(path18, opts);
+      this.stream(path17, opts);
     };
-    SendStream.prototype.sendFile = function sendFile(path18) {
+    SendStream.prototype.sendFile = function sendFile(path17) {
       var i = 0;
       var self = this;
-      debug('stat "%s"', path18);
-      fs17.stat(path18, function onstat(err, stat) {
-        if (err && err.code === "ENOENT" && !extname3(path18) && path18[path18.length - 1] !== sep3) {
+      debug('stat "%s"', path17);
+      fs16.stat(path17, function onstat(err, stat) {
+        if (err && err.code === "ENOENT" && !extname3(path17) && path17[path17.length - 1] !== sep3) {
           return next(err);
         }
         if (err) return self.onStatError(err);
-        if (stat.isDirectory()) return self.redirect(path18);
-        self.emit("file", path18, stat);
-        self.send(path18, stat);
+        if (stat.isDirectory()) return self.redirect(path17);
+        self.emit("file", path17, stat);
+        self.send(path17, stat);
       });
       function next(err) {
         if (self._extensions.length <= i) {
           return err ? self.onStatError(err) : self.error(404);
         }
-        var p = path18 + "." + self._extensions[i++];
+        var p = path17 + "." + self._extensions[i++];
         debug('stat "%s"', p);
-        fs17.stat(p, function(err2, stat) {
+        fs16.stat(p, function(err2, stat) {
           if (err2) return next(err2);
           if (stat.isDirectory()) return next();
           self.emit("file", p, stat);
@@ -19619,7 +19619,7 @@ var require_send = __commonJS({
         });
       }
     };
-    SendStream.prototype.sendIndex = function sendIndex(path18) {
+    SendStream.prototype.sendIndex = function sendIndex(path17) {
       var i = -1;
       var self = this;
       function next(err) {
@@ -19627,9 +19627,9 @@ var require_send = __commonJS({
           if (err) return self.onStatError(err);
           return self.error(404);
         }
-        var p = join13(path18, self._index[i]);
+        var p = join13(path17, self._index[i]);
         debug('stat "%s"', p);
-        fs17.stat(p, function(err2, stat) {
+        fs16.stat(p, function(err2, stat) {
           if (err2) return next(err2);
           if (stat.isDirectory()) return next();
           self.emit("file", p, stat);
@@ -19638,10 +19638,10 @@ var require_send = __commonJS({
       }
       next();
     };
-    SendStream.prototype.stream = function stream(path18, options) {
+    SendStream.prototype.stream = function stream(path17, options) {
       var self = this;
       var res = this.res;
-      var stream2 = fs17.createReadStream(path18, options);
+      var stream2 = fs16.createReadStream(path17, options);
       this.emit("stream", stream2);
       stream2.pipe(res);
       function cleanup() {
@@ -19656,10 +19656,10 @@ var require_send = __commonJS({
         self.emit("end");
       });
     };
-    SendStream.prototype.type = function type(path18) {
+    SendStream.prototype.type = function type(path17) {
       var res = this.res;
       if (res.getHeader("Content-Type")) return;
-      var type2 = mime.lookup(path18);
+      var type2 = mime.lookup(path17);
       if (!type2) {
         debug("no content-type");
         return;
@@ -19668,9 +19668,9 @@ var require_send = __commonJS({
       debug("content-type %s", type2);
       res.setHeader("Content-Type", type2 + (charset ? "; charset=" + charset : ""));
     };
-    SendStream.prototype.setHeader = function setHeader(path18, stat) {
+    SendStream.prototype.setHeader = function setHeader(path17, stat) {
       var res = this.res;
-      this.emit("headers", res, path18, stat);
+      this.emit("headers", res, path17, stat);
       if (this._acceptRanges && !res.getHeader("Accept-Ranges")) {
         debug("accept ranges");
         res.setHeader("Accept-Ranges", "bytes");
@@ -19729,9 +19729,9 @@ var require_send = __commonJS({
       }
       return err instanceof Error ? createError(status, err, { expose: false }) : createError(status, err);
     }
-    function decode(path18) {
+    function decode(path17) {
       try {
-        return decodeURIComponent(path18);
+        return decodeURIComponent(path17);
       } catch (err) {
         return -1;
       }
@@ -20641,10 +20641,10 @@ var require_utils2 = __commonJS({
     var querystring = require("querystring");
     exports2.etag = createETagGenerator({ weak: false });
     exports2.wetag = createETagGenerator({ weak: true });
-    exports2.isAbsolute = function(path17) {
-      if ("/" === path17[0]) return true;
-      if (":" === path17[1] && ("\\" === path17[2] || "/" === path17[2])) return true;
-      if ("\\\\" === path17.substring(0, 2)) return true;
+    exports2.isAbsolute = function(path16) {
+      if ("/" === path16[0]) return true;
+      if (":" === path16[1] && ("\\" === path16[2] || "/" === path16[2])) return true;
+      if ("\\\\" === path16.substring(0, 2)) return true;
     };
     exports2.flatten = deprecate.function(
       flatten,
@@ -20767,13 +20767,13 @@ var require_application = __commonJS({
   "../../node_modules/.pnpm/express@4.22.1/node_modules/express/lib/application.js"(exports2, module2) {
     "use strict";
     var finalhandler = require_finalhandler();
-    var Router7 = require_router();
+    var Router8 = require_router();
     var methods = require_methods();
     var middleware = require_init();
     var query = require_query();
     var debug = require_src()("express:application");
     var View = require_view();
-    var http2 = require("http");
+    var http3 = require("http");
     var compileETag = require_utils2().compileETag;
     var compileQueryParser = require_utils2().compileQueryParser;
     var compileTrust = require_utils2().compileTrust;
@@ -20832,7 +20832,7 @@ var require_application = __commonJS({
     };
     app.lazyrouter = function lazyrouter() {
       if (!this._router) {
-        this._router = new Router7({
+        this._router = new Router8({
           caseSensitive: this.enabled("case sensitive routing"),
           strict: this.enabled("strict routing")
         });
@@ -20855,7 +20855,7 @@ var require_application = __commonJS({
     };
     app.use = function use(fn) {
       var offset = 0;
-      var path17 = "/";
+      var path16 = "/";
       if (typeof fn !== "function") {
         var arg = fn;
         while (Array.isArray(arg) && arg.length !== 0) {
@@ -20863,7 +20863,7 @@ var require_application = __commonJS({
         }
         if (typeof arg !== "function") {
           offset = 1;
-          path17 = fn;
+          path16 = fn;
         }
       }
       var fns = flatten(slice.call(arguments, offset));
@@ -20874,12 +20874,12 @@ var require_application = __commonJS({
       var router = this._router;
       fns.forEach(function(fn2) {
         if (!fn2 || !fn2.handle || !fn2.set) {
-          return router.use(path17, fn2);
+          return router.use(path16, fn2);
         }
-        debug(".use app under %s", path17);
-        fn2.mountpath = path17;
+        debug(".use app under %s", path16);
+        fn2.mountpath = path16;
         fn2.parent = this;
-        router.use(path17, function mounted_app(req, res, next) {
+        router.use(path16, function mounted_app(req, res, next) {
           var orig = req.app;
           fn2.handle(req, res, function(err) {
             setPrototypeOf(req, orig.request);
@@ -20891,9 +20891,9 @@ var require_application = __commonJS({
       }, this);
       return this;
     };
-    app.route = function route(path17) {
+    app.route = function route(path16) {
       this.lazyrouter();
-      return this._router.route(path17);
+      return this._router.route(path16);
     };
     app.engine = function engine(ext, fn) {
       if (typeof fn !== "function") {
@@ -20944,7 +20944,7 @@ var require_application = __commonJS({
       }
       return this;
     };
-    app.path = function path17() {
+    app.path = function path16() {
       return this.parent ? this.parent.path() + this.mountpath : "";
     };
     app.enabled = function enabled(setting) {
@@ -20960,19 +20960,19 @@ var require_application = __commonJS({
       return this.set(setting, false);
     };
     methods.forEach(function(method) {
-      app[method] = function(path17) {
+      app[method] = function(path16) {
         if (method === "get" && arguments.length === 1) {
-          return this.set(path17);
+          return this.set(path16);
         }
         this.lazyrouter();
-        var route = this._router.route(path17);
+        var route = this._router.route(path16);
         route[method].apply(route, slice.call(arguments, 1));
         return this;
       };
     });
-    app.all = function all(path17) {
+    app.all = function all(path16) {
       this.lazyrouter();
-      var route = this._router.route(path17);
+      var route = this._router.route(path16);
       var args = slice.call(arguments, 1);
       for (var i = 0; i < methods.length; i++) {
         route[methods[i]].apply(route, args);
@@ -21022,7 +21022,7 @@ var require_application = __commonJS({
       tryRender(view, renderOptions, done);
     };
     app.listen = function listen() {
-      var server = http2.createServer(this);
+      var server = http3.createServer(this);
       return server.listen.apply(server, arguments);
     };
     function logerror(err) {
@@ -21624,12 +21624,12 @@ var require_request = __commonJS({
     var deprecate = require_depd()("express");
     var isIP = require("net").isIP;
     var typeis = require_type_is();
-    var http2 = require("http");
+    var http3 = require("http");
     var fresh = require_fresh();
     var parseRange = require_range_parser();
     var parse = require_parseurl();
     var proxyaddr = require_proxy_addr();
-    var req = Object.create(http2.IncomingMessage.prototype);
+    var req = Object.create(http3.IncomingMessage.prototype);
     module2.exports = req;
     req.get = req.header = function header(name) {
       if (!name) {
@@ -21731,7 +21731,7 @@ var require_request = __commonJS({
       var subdomains2 = !isIP(hostname2) ? hostname2.split(".").reverse() : [hostname2];
       return subdomains2.slice(offset);
     });
-    defineGetter(req, "path", function path17() {
+    defineGetter(req, "path", function path16() {
       return parse(this).pathname;
     });
     defineGetter(req, "hostname", function hostname2() {
@@ -22051,10 +22051,10 @@ var require_response = __commonJS({
     var deprecate = require_depd()("express");
     var encodeUrl = require_encodeurl();
     var escapeHtml = require_escape_html();
-    var http2 = require("http");
+    var http3 = require("http");
     var isAbsolute2 = require_utils2().isAbsolute;
     var onFinished = require_on_finished();
-    var path17 = require("path");
+    var path16 = require("path");
     var statuses = require_statuses();
     var merge = require_utils_merge();
     var sign = require_cookie_signature().sign;
@@ -22063,11 +22063,11 @@ var require_response = __commonJS({
     var setCharset = require_utils2().setCharset;
     var cookie = require_cookie();
     var send = require_send();
-    var extname3 = path17.extname;
+    var extname3 = path16.extname;
     var mime = send.mime;
-    var resolve10 = path17.resolve;
+    var resolve10 = path16.resolve;
     var vary = require_vary();
-    var res = Object.create(http2.ServerResponse.prototype);
+    var res = Object.create(http3.ServerResponse.prototype);
     module2.exports = res;
     var charsetRegExp = /;\s*charset\s*=/;
     res.status = function status(code) {
@@ -22242,26 +22242,26 @@ var require_response = __commonJS({
       this.type("txt");
       return this.send(body);
     };
-    res.sendFile = function sendFile(path18, options, callback) {
+    res.sendFile = function sendFile(path17, options, callback) {
       var done = callback;
       var req = this.req;
       var res2 = this;
       var next = req.next;
       var opts = options || {};
-      if (!path18) {
+      if (!path17) {
         throw new TypeError("path argument is required to res.sendFile");
       }
-      if (typeof path18 !== "string") {
+      if (typeof path17 !== "string") {
         throw new TypeError("path must be a string to res.sendFile");
       }
       if (typeof options === "function") {
         done = options;
         opts = {};
       }
-      if (!opts.root && !isAbsolute2(path18)) {
+      if (!opts.root && !isAbsolute2(path17)) {
         throw new TypeError("path must be absolute or specify root to res.sendFile");
       }
-      var pathname = encodeURI(path18);
+      var pathname = encodeURI(path17);
       var file = send(req, pathname, opts);
       sendfile(res2, file, opts, function(err) {
         if (done) return done(err);
@@ -22271,7 +22271,7 @@ var require_response = __commonJS({
         }
       });
     };
-    res.sendfile = function(path18, options, callback) {
+    res.sendfile = function(path17, options, callback) {
       var done = callback;
       var req = this.req;
       var res2 = this;
@@ -22281,7 +22281,7 @@ var require_response = __commonJS({
         done = options;
         opts = {};
       }
-      var file = send(req, path18, opts);
+      var file = send(req, path17, opts);
       sendfile(res2, file, opts, function(err) {
         if (done) return done(err);
         if (err && err.code === "EISDIR") return next();
@@ -22294,7 +22294,7 @@ var require_response = __commonJS({
       res.sendfile,
       "res.sendfile: Use res.sendFile instead"
     );
-    res.download = function download(path18, filename, options, callback) {
+    res.download = function download(path17, filename, options, callback) {
       var done = callback;
       var name = filename;
       var opts = options || null;
@@ -22311,7 +22311,7 @@ var require_response = __commonJS({
         opts = filename;
       }
       var headers = {
-        "Content-Disposition": contentDisposition(name || path18)
+        "Content-Disposition": contentDisposition(name || path17)
       };
       if (opts && opts.headers) {
         var keys = Object.keys(opts.headers);
@@ -22324,7 +22324,7 @@ var require_response = __commonJS({
       }
       opts = Object.create(opts);
       opts.headers = headers;
-      var fullPath = !opts.root ? resolve10(path18) : path18;
+      var fullPath = !opts.root ? resolve10(path17) : path17;
       return this.sendFile(fullPath, opts, done);
     };
     res.contentType = res.type = function contentType(type) {
@@ -22625,11 +22625,11 @@ var require_serve_static = __commonJS({
         }
         var forwardError = !fallthrough;
         var originalUrl = parseUrl.original(req);
-        var path17 = parseUrl(req).pathname;
-        if (path17 === "/" && originalUrl.pathname.substr(-1) !== "/") {
-          path17 = "";
+        var path16 = parseUrl(req).pathname;
+        if (path16 === "/" && originalUrl.pathname.substr(-1) !== "/") {
+          path16 = "";
         }
-        var stream = send(req, path17, opts);
+        var stream = send(req, path16, opts);
         stream.on("directory", onDirectory);
         if (setHeaders) {
           stream.on("headers", setHeaders);
@@ -22697,7 +22697,7 @@ var require_express = __commonJS({
     var mixin = require_merge_descriptors();
     var proto = require_application();
     var Route = require_route();
-    var Router7 = require_router();
+    var Router8 = require_router();
     var req = require_request();
     var res = require_response();
     exports2 = module2.exports = createApplication;
@@ -22720,7 +22720,7 @@ var require_express = __commonJS({
     exports2.request = req;
     exports2.response = res;
     exports2.Route = Route;
-    exports2.Router = Router7;
+    exports2.Router = Router8;
     exports2.json = bodyParser.json;
     exports2.query = require_query();
     exports2.raw = bodyParser.raw;
@@ -22791,6 +22791,7 @@ __export(main_exports, {
   shouldSkipStartupRequirementsCheck: () => shouldSkipStartupRequirementsCheck
 });
 module.exports = __toCommonJS(main_exports);
+var http2 = __toESM(require("http"), 1);
 var nodePath = __toESM(require("path"), 1);
 
 // ../../packages/core/src/logger.ts
@@ -23149,6 +23150,13 @@ function persistNodeStartupTransport(storagePath, transport) {
     transport
   });
 }
+function persistNodeStartupJoin(storagePath, join13) {
+  const startup = resolveNodeStartupMetadata(storagePath);
+  persistNodeStartupMetadata(storagePath, {
+    ...startup,
+    join: join13
+  });
+}
 function resolvePersistedDevTunnelId(storagePath, kind) {
   return readNodeMetadata(storagePath).devTunnelIds?.[kind]?.trim() || void 0;
 }
@@ -24013,19 +24021,19 @@ async function fetchWithTimeout(url, init, timeoutMs = DEFAULT_NODE_REQUEST_TIME
     cleanup();
   }
 }
-async function fetchNodeWithFallback(node, path17, init, timeoutMs = DEFAULT_NODE_REQUEST_TIMEOUT_MS, trace) {
+async function fetchNodeWithFallback(node, path16, init, timeoutMs = DEFAULT_NODE_REQUEST_TIMEOUT_MS, trace) {
   let lastError;
   const endpoints = getNodeRequestEndpoints(node);
   for (const [index, endpoint] of endpoints.entries()) {
     const attempt = index + 1;
-    trace?.onAttempt?.({ attempt, endpoint, path: path17, timeoutMs, totalEndpoints: endpoints.length });
+    trace?.onAttempt?.({ attempt, endpoint, path: path16, timeoutMs, totalEndpoints: endpoints.length });
     try {
-      const response = await fetchWithTimeout(`${endpoint}${path17}`, init, timeoutMs);
-      trace?.onResponse?.({ attempt, endpoint, path: path17, response, timeoutMs, totalEndpoints: endpoints.length });
+      const response = await fetchWithTimeout(`${endpoint}${path16}`, init, timeoutMs);
+      trace?.onResponse?.({ attempt, endpoint, path: path16, response, timeoutMs, totalEndpoints: endpoints.length });
       return { endpoint, response };
     } catch (error) {
       lastError = error;
-      trace?.onError?.({ attempt, endpoint, error, path: path17, timeoutMs, totalEndpoints: endpoints.length });
+      trace?.onError?.({ attempt, endpoint, error, path: path16, timeoutMs, totalEndpoints: endpoints.length });
     }
   }
   throw lastError instanceof Error ? lastError : new Error("No reachable node endpoint");
@@ -25817,9 +25825,9 @@ var DataRouter = class {
   /**
    * Returns true if the request should be proxied to the leader.
    */
-  shouldProxy(method, path17) {
+  shouldProxy(method, path16) {
     if (this.election.isLeader()) return false;
-    if (this.isExcludedPath(path17)) return false;
+    if (this.isExcludedPath(path16)) return false;
     if (method.toUpperCase() === "GET") return false;
     return WRITE_METHODS.has(method.toUpperCase());
   }
@@ -25920,8 +25928,8 @@ var DataRouter = class {
     };
   }
   // ── Helpers ───────────────────────────────────────────────────────────
-  isExcludedPath(path17) {
-    return EXCLUDED_PATH_PREFIXES.some((prefix) => path17.startsWith(prefix)) || EXCLUDED_PATH_SUFFIXES.some((suffix) => path17.endsWith(suffix));
+  isExcludedPath(path16) {
+    return EXCLUDED_PATH_PREFIXES.some((prefix) => path16.startsWith(prefix)) || EXCLUDED_PATH_SUFFIXES.some((suffix) => path16.endsWith(suffix));
   }
 };
 
@@ -26935,22 +26943,34 @@ ${joinErrors.map((e) => `  - ${e}`).join("\n")}`
   async joinCluster(seedUrl) {
     const log = this.logger.child("node/join-cluster");
     const tasks = this.taskEngine.listTasks().tasks;
+    const self = this.nodeRegistry.getSelf();
     const joinBody = {
-      id: this.selfInfo.id,
-      endpoint: this.selfInfo.endpoint,
-      name: this.config.node.name,
+      id: self.id,
+      endpoint: self.endpoint,
+      name: self.name,
       capabilities: [],
+      transportType: self.transportType,
+      workDir: self.workDir,
+      workDirFolders: listWorkDirFolders(this.getWorkDir()),
       tasks
     };
-    if (this.selfInfo.devtunnelEndpoint) {
-      joinBody.devtunnelEndpoint = this.selfInfo.devtunnelEndpoint;
+    if (self.devtunnelEndpoint) {
+      joinBody.devtunnelEndpoint = self.devtunnelEndpoint;
+    }
+    if (self.dashboardOrigin) {
+      joinBody.dashboardOrigin = self.dashboardOrigin;
+    }
+    if (self.previewOrigin) {
+      joinBody.previewOrigin = self.previewOrigin;
     }
     log.info("sending cluster join request", {
       seedUrl,
-      nodeId: this.selfInfo.id,
-      endpoint: this.selfInfo.endpoint,
+      nodeId: self.id,
+      endpoint: self.endpoint,
       taskCount: tasks.length,
-      hasDevTunnel: !!this.selfInfo.devtunnelEndpoint
+      hasDevTunnel: !!self.devtunnelEndpoint,
+      hasDashboardOrigin: !!self.dashboardOrigin,
+      hasPreviewOrigin: !!self.previewOrigin
     });
     let response;
     try {
@@ -26996,6 +27016,7 @@ ${joinErrors.map((e) => `  - ${e}`).join("\n")}`
       nodeCount: data.nodes.length
     });
     this.applyClusterState(data.nodes, data.leaderId, data.term);
+    persistNodeStartupJoin(this.config.storage.path, seedUrl);
   }
   async leaveCluster() {
     const log = this.logger.child("node/leave-cluster");
@@ -27048,6 +27069,7 @@ ${joinErrors.map((e) => `  - ${e}`).join("\n")}`
     this.nodeRegistry.clearLeader();
     this.election.assumeLeadership();
     this.syncSelfInfoFromRegistry();
+    persistNodeStartupJoin(this.config.storage.path, void 0);
     log.info("detached from leader and assumed solo leadership", {
       previousLeaderId: leader.id,
       nodeId: refreshedSelf.id,
@@ -27229,15 +27251,17 @@ ${joinErrors.map((e) => `  - ${e}`).join("\n")}`
     this.selfInfo.status = current.status;
   }
   applyClusterState(nodes, leaderId, term) {
-    const remoteSelf = nodes.find((node) => node.id === this.selfInfo.id);
+    const currentSelf = this.nodeRegistry.getSelf();
+    const remoteSelf = nodes.find((node) => node.id === currentSelf.id);
     const nextSelf = {
-      ...this.selfInfo,
+      ...currentSelf,
       ...remoteSelf ?? {},
       transportType: this.config.transport.type,
-      workDir: this.selfInfo.workDir,
+      workDir: currentSelf.workDir,
       workDirFolders: listWorkDirFolders(this.getWorkDir()),
-      ...this.selfInfo.devtunnelEndpoint ? { devtunnelEndpoint: this.selfInfo.devtunnelEndpoint } : {},
-      ...this.selfInfo.previewOrigin ? { previewOrigin: this.selfInfo.previewOrigin } : {}
+      ...currentSelf.devtunnelEndpoint ? { devtunnelEndpoint: currentSelf.devtunnelEndpoint } : {},
+      ...currentSelf.dashboardOrigin ? { dashboardOrigin: currentSelf.dashboardOrigin } : {},
+      ...currentSelf.previewOrigin ? { previewOrigin: currentSelf.previewOrigin } : {}
     };
     this.selfInfo = nextSelf;
     this.nodeRegistry.setSelf(nextSelf);
@@ -27881,8 +27905,8 @@ function getErrorMap() {
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path17, errorMaps, issueData } = params;
-  const fullPath = [...path17, ...issueData.path || []];
+  const { data, path: path16, errorMaps, issueData } = params;
+  const fullPath = [...path16, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -27998,11 +28022,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path17, key) {
+  constructor(parent, value, path16, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path17;
+    this._path = path16;
     this._key = key;
   }
   get path() {
@@ -31500,7 +31524,12 @@ var JoinClusterBody = external_exports.object({
   endpoint: external_exports.string().url(),
   name: external_exports.string().min(1),
   capabilities: external_exports.array(external_exports.string()).default([]),
+  transportType: external_exports.string().optional(),
+  workDir: external_exports.string().optional(),
+  workDirFolders: external_exports.array(external_exports.string()).optional(),
   devtunnelEndpoint: external_exports.string().url().optional(),
+  dashboardOrigin: external_exports.string().url().optional(),
+  previewOrigin: external_exports.string().url().optional(),
   tasks: external_exports.array(JoinTaskSchema).default([])
 });
 var JoinClusterResponse = external_exports.object({
@@ -31663,9 +31692,9 @@ var BatchTaskIdsBody = external_exports.object({
 });
 
 // ../../packages/api/src/server.ts
-var path15 = __toESM(require("path"), 1);
-var fs15 = __toESM(require("fs"), 1);
-var import_express7 = __toESM(require_express2(), 1);
+var path14 = __toESM(require("path"), 1);
+var fs14 = __toESM(require("fs"), 1);
+var import_express8 = __toESM(require_express2(), 1);
 
 // ../../packages/api/src/middleware/auth.ts
 var SKIP_AUTH_PATHS = ["/api/system/health"];
@@ -31745,7 +31774,7 @@ function createAuthMiddleware(config) {
       return;
     }
     if (config.validateBearerToken) {
-      if (isTrustedDashboardRequest(req, config)) {
+      if (config.allowTrustedHostBypass !== false && isTrustedDashboardRequest(req, config)) {
         log.debug("skipping bearer auth for trusted dashboard request", {
           path: req.path,
           method: req.method,
@@ -31933,7 +31962,9 @@ function createClusterRoutes() {
       name: body.name,
       endpoint: body.endpoint,
       taskCount: body.tasks?.length ?? 0,
-      hasDevTunnel: !!body.devtunnelEndpoint
+      hasDevTunnel: !!body.devtunnelEndpoint,
+      hasDashboardOrigin: !!body.dashboardOrigin,
+      hasPreviewOrigin: !!body.previewOrigin
     });
     const existingNodes = nodeRegistry.getAllNodes();
     let removedCount = 0;
@@ -31952,7 +31983,12 @@ function createClusterRoutes() {
       capabilities: body.capabilities ?? [],
       joinedAt: Date.now(),
       lastHeartbeat: Date.now(),
-      ...body.devtunnelEndpoint && { devtunnelEndpoint: body.devtunnelEndpoint }
+      ...body.transportType && { transportType: body.transportType },
+      ...body.workDir && { workDir: body.workDir },
+      ...body.workDirFolders && { workDirFolders: body.workDirFolders },
+      ...body.devtunnelEndpoint && { devtunnelEndpoint: body.devtunnelEndpoint },
+      ...body.dashboardOrigin && { dashboardOrigin: body.dashboardOrigin },
+      ...body.previewOrigin && { previewOrigin: body.previewOrigin }
     };
     nodeRegistry.addNode(node);
     taskEngine.importTasks(body.tasks ?? []);
@@ -32080,174 +32116,72 @@ function assertCanChangeNodeDevTunnel(taskEngine, nodeId) {
   );
 }
 
-// ../../packages/api/src/worker-control.ts
-var fs12 = __toESM(require("fs"), 1);
-var path13 = __toESM(require("path"), 1);
-
-// ../../packages/api/src/preview/preview-server.ts
-var crypto2 = __toESM(require("crypto"), 1);
-var fs10 = __toESM(require("fs"), 1);
-var path11 = __toESM(require("path"), 1);
-var http = __toESM(require("http"), 1);
-function resolvePreviewPath(rootPath, relativePath) {
-  const sanitizedPath = relativePath.replace(/\\/g, "/");
-  const resolvedPath = path11.resolve(rootPath, sanitizedPath);
-  const normalizedRoot = path11.resolve(rootPath);
-  if (!resolvedPath.startsWith(normalizedRoot + path11.sep) && resolvedPath !== normalizedRoot) {
-    throw new Error("Invalid preview path");
-  }
-  return {
-    absolutePath: resolvedPath,
-    normalizedPath: path11.relative(normalizedRoot, resolvedPath).split(path11.sep).join("/")
-  };
-}
-function resolvePreviewEntryPath(rootPath, entryPath) {
-  const { absolutePath, normalizedPath } = resolvePreviewPath(rootPath, entryPath ?? "index.html");
-  if (!fs10.existsSync(absolutePath) || !fs10.statSync(absolutePath).isFile()) {
-    throw new Error("Preview entry not found");
-  }
-  return normalizedPath;
-}
-function buildPreviewUrl(origin, session) {
-  const encodedEntryPath = session.entryPath.split("/").filter(Boolean).map((segment) => encodeURIComponent(segment)).join("/");
-  return `${origin.replace(/\/+$/, "")}/preview/${session.token}/${encodedEntryPath}`;
-}
-var DEFAULT_TTL_MS = 15 * 60 * 1e3;
-var PreviewSessionManager = class {
-  sessions = /* @__PURE__ */ new Map();
-  create(options) {
-    const token = crypto2.randomBytes(32).toString("hex");
-    const entryPath = resolvePreviewEntryPath(options.rootPath, options.entryPath);
-    const session = {
-      token,
-      taskId: options.taskId,
-      rootPath: options.rootPath,
-      entryPath,
-      expiresAt: Date.now() + (options.ttlMs ?? DEFAULT_TTL_MS)
-    };
-    this.sessions.set(token, session);
-    return session;
-  }
-  get(token) {
-    const session = this.sessions.get(token);
-    if (!session) return null;
-    if (Date.now() > session.expiresAt) {
-      this.sessions.delete(token);
-      return null;
+// ../../packages/api/src/task-cancellation.ts
+var TERMINAL_STATUSES2 = /* @__PURE__ */ new Set(["completed", "failed", "cancelled", "archived"]);
+function cancelTaskOnCurrentNode(deps, taskId, options = {}) {
+  const task = deps.taskEngine.getTask(taskId);
+  if (!task) {
+    if (options.missingOk) {
+      return {
+        task: null,
+        cancelled: false,
+        engineCancelRequested: false,
+        missing: true,
+        terminal: false
+      };
     }
-    return session;
+    throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
   }
-  cleanup() {
-    const now = Date.now();
-    for (const [token, session] of this.sessions) {
-      if (now > session.expiresAt) {
-        this.sessions.delete(token);
-      }
+  if (TERMINAL_STATUSES2.has(task.status)) {
+    if (options.terminalOk) {
+      return {
+        task,
+        cancelled: false,
+        engineCancelRequested: false,
+        missing: false,
+        terminal: true
+      };
     }
+    throw new MeshyError("VALIDATION_ERROR", `Task ${taskId} cannot be cancelled (status: ${task.status})`, 400);
   }
-};
-var MIME_MAP = {
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".css": "text/css",
-  ".js": "text/javascript",
-  ".mjs": "text/javascript",
-  ".json": "application/json",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".svg": "image/svg+xml",
-  ".webp": "image/webp",
-  ".ico": "image/x-icon",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2",
-  ".ttf": "font/ttf",
-  ".eot": "application/vnd.ms-fontobject",
-  ".pdf": "application/pdf"
-};
-function getMime(filePath) {
-  return MIME_MAP[path11.extname(filePath).toLowerCase()] ?? "application/octet-stream";
-}
-var PreviewServer = class {
-  server = null;
-  sessionManager;
-  constructor(sessionManager) {
-    this.sessionManager = sessionManager;
-  }
-  async start(port) {
-    return new Promise((resolve10, reject) => {
-      this.server = http.createServer((req, res) => this.handleRequest(req, res));
-      this.server.listen(port, () => {
-        const addr = this.server.address();
-        const actualPort = typeof addr === "object" && addr ? addr.port : port;
-        resolve10(actualPort);
+  let engineCancelRequested = false;
+  if (task.status === "running") {
+    const engine = deps.engineRegistry.get(task.agent);
+    if (!engine || typeof engine.cancelTask !== "function") {
+      deps.logger.warn("engine not registered while cancelling running task", {
+        taskId,
+        agent: task.agent
       });
-      this.server.on("error", reject);
-    });
-  }
-  async stop() {
-    return new Promise((resolve10) => {
-      if (!this.server) {
-        resolve10();
-        return;
+    } else {
+      engineCancelRequested = engine.cancelTask(taskId);
+      if (!engineCancelRequested) {
+        deps.logger.warn("running task had no active engine process to cancel", {
+          taskId,
+          agent: task.agent
+        });
       }
-      this.server.close(() => resolve10());
-    });
-  }
-  getPort() {
-    if (!this.server) return null;
-    const addr = this.server.address();
-    return typeof addr === "object" && addr ? addr.port : null;
-  }
-  handleRequest(req, res) {
-    if (req.method !== "GET") {
-      res.writeHead(405, { "Content-Type": "text/plain" });
-      res.end("Method not allowed");
-      return;
     }
-    const url = new URL(req.url ?? "/", `http://localhost`);
-    const match = url.pathname.match(/^\/preview\/([a-f0-9]+)(?:\/(.*))?$/i);
-    const token = match?.[1];
-    if (!token) {
-      res.writeHead(404, { "Content-Type": "text/plain" });
-      res.end("Preview not found");
-      return;
-    }
-    const session = this.sessionManager.get(token);
-    if (!session) {
-      res.writeHead(403, { "Content-Type": "text/plain" });
-      res.end("Invalid or expired preview token");
-      return;
-    }
-    const requestedPath = decodeURIComponent(match?.[2] ?? session.entryPath);
-    let resolved;
-    try {
-      resolved = resolvePreviewPath(session.rootPath, requestedPath).absolutePath;
-    } catch {
-      res.writeHead(400, { "Content-Type": "text/plain" });
-      res.end("Invalid path");
-      return;
-    }
-    if (!fs10.existsSync(resolved) || !fs10.statSync(resolved).isFile()) {
-      res.writeHead(404, { "Content-Type": "text/plain" });
-      res.end("File not found");
-      return;
-    }
-    const mime = getMime(resolved);
-    const content = fs10.readFileSync(resolved);
-    res.writeHead(200, {
-      "Content-Type": mime,
-      "Content-Length": content.length,
-      "Cache-Control": "no-cache"
-    });
-    res.end(content);
   }
-};
+  const cancelled = deps.taskEngine.cancelTask(taskId);
+  if (!cancelled) {
+    throw new MeshyError("VALIDATION_ERROR", `Task ${taskId} cannot be cancelled`, 400);
+  }
+  return {
+    task,
+    cancelled: true,
+    engineCancelRequested,
+    missing: false,
+    terminal: false
+  };
+}
+
+// ../../packages/api/src/task-output-service.ts
+var fs12 = __toESM(require("fs"), 1);
+var path13 = __toESM(require("path"), 1);
 
 // ../../packages/api/src/output/helpers.ts
-var fs11 = __toESM(require("fs"), 1);
-var path12 = __toESM(require("path"), 1);
+var fs10 = __toESM(require("fs"), 1);
+var path11 = __toESM(require("path"), 1);
 var MAX_INLINE_SIZE = 512 * 1024;
 var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".txt",
@@ -32324,7 +32258,7 @@ var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".ico",
   ".avif"
 ]);
-var MIME_MAP2 = {
+var MIME_MAP = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
   ".jpeg": "image/jpeg",
@@ -32357,18 +32291,18 @@ var MIME_MAP2 = {
   ".sh": "text/x-shellscript"
 };
 function mimeForExt(ext) {
-  return MIME_MAP2[ext] ?? "application/octet-stream";
+  return MIME_MAP[ext] ?? "application/octet-stream";
 }
 function resolveOutputPath(root, relativePath) {
-  const resolved = path12.resolve(root, relativePath);
-  const normalizedRoot = path12.resolve(root);
-  if (!resolved.startsWith(normalizedRoot + path12.sep) && resolved !== normalizedRoot) {
+  const resolved = path11.resolve(root, relativePath);
+  const normalizedRoot = path11.resolve(root);
+  if (!resolved.startsWith(normalizedRoot + path11.sep) && resolved !== normalizedRoot) {
     throw new Error("Path traversal detected");
   }
   return resolved;
 }
 function classifyFile(filePath) {
-  const ext = path12.extname(filePath).toLowerCase();
+  const ext = path11.extname(filePath).toLowerCase();
   if (ext === ".json" || ext === ".jsonl" || ext === ".ndjson") {
     return { kind: "json", mimeType: "application/json" };
   }
@@ -32395,14 +32329,14 @@ function classifyFile(filePath) {
 }
 function listDirectory(root, relativePath) {
   const absPath = resolveOutputPath(root, relativePath);
-  if (!fs11.existsSync(absPath) || !fs11.statSync(absPath).isDirectory()) {
+  if (!fs10.existsSync(absPath) || !fs10.statSync(absPath).isDirectory()) {
     return [];
   }
-  const entries = fs11.readdirSync(absPath, { withFileTypes: true });
+  const entries = fs10.readdirSync(absPath, { withFileTypes: true });
   const result = [];
   for (const entry of entries) {
     if (entry.name.startsWith(".")) continue;
-    const entryRelPath = path12.join(relativePath || ".", entry.name).split(path12.sep).join("/");
+    const entryRelPath = path11.join(relativePath || ".", entry.name).split(path11.sep).join("/");
     if (entry.isDirectory()) {
       result.push({
         path: entryRelPath,
@@ -32410,8 +32344,8 @@ function listDirectory(root, relativePath) {
         type: "directory"
       });
     } else if (entry.isFile()) {
-      const fullPath = path12.join(absPath, entry.name);
-      const stat = fs11.statSync(fullPath);
+      const fullPath = path11.join(absPath, entry.name);
+      const stat = fs10.statSync(fullPath);
       const { kind, mimeType } = classifyFile(entry.name);
       result.push({
         path: entryRelPath,
@@ -32431,11 +32365,11 @@ function listDirectory(root, relativePath) {
 }
 function detectHtmlEntries(root) {
   const entries = [];
-  if (fs11.existsSync(path12.join(root, "index.html"))) {
+  if (fs10.existsSync(path11.join(root, "index.html"))) {
     entries.push({ path: "index.html", label: "index.html" });
   }
   try {
-    const topLevel = fs11.readdirSync(root, { withFileTypes: true });
+    const topLevel = fs10.readdirSync(root, { withFileTypes: true });
     const htmlFiles = topLevel.filter(
       (e) => e.isFile() && e.name.endsWith(".html") && !e.name.startsWith(".")
     );
@@ -32446,8 +32380,8 @@ function detectHtmlEntries(root) {
     }
     const subdirs = topLevel.filter((e) => e.isDirectory() && !e.name.startsWith("."));
     for (const dir of subdirs) {
-      const subIndex = path12.join(root, dir.name, "index.html");
-      if (fs11.existsSync(subIndex)) {
+      const subIndex = path11.join(root, dir.name, "index.html");
+      if (fs10.existsSync(subIndex)) {
         entries.push({
           path: `${dir.name}/index.html`,
           label: `${dir.name}/index.html`
@@ -32459,11 +32393,11 @@ function detectHtmlEntries(root) {
   return entries;
 }
 function getOutputSummary(root) {
-  const rootName = path12.basename(root);
+  const rootName = path11.basename(root);
   const htmlEntries = detectHtmlEntries(root);
   let fileCount;
   try {
-    const entries = fs11.readdirSync(root, { withFileTypes: true });
+    const entries = fs10.readdirSync(root, { withFileTypes: true });
     fileCount = entries.filter((e) => !e.name.startsWith(".")).length;
   } catch {
     fileCount = void 0;
@@ -32479,14 +32413,14 @@ function getOutputSummary(root) {
 }
 function readFileContent(root, relativePath) {
   const absPath = resolveOutputPath(root, relativePath);
-  if (!fs11.existsSync(absPath) || !fs11.statSync(absPath).isFile()) {
+  if (!fs10.existsSync(absPath) || !fs10.statSync(absPath).isFile()) {
     throw new Error("File not found");
   }
-  const stat = fs11.statSync(absPath);
+  const stat = fs10.statSync(absPath);
   const { kind, mimeType } = classifyFile(absPath);
   if (kind === "image" || kind === "pdf" || kind === "binary") {
     const truncated2 = stat.size > MAX_INLINE_SIZE;
-    const buffer = truncated2 ? Buffer.alloc(0) : fs11.readFileSync(absPath);
+    const buffer = truncated2 ? Buffer.alloc(0) : fs10.readFileSync(absPath);
     return {
       path: relativePath,
       kind,
@@ -32497,7 +32431,7 @@ function readFileContent(root, relativePath) {
     };
   }
   const truncated = stat.size > MAX_INLINE_SIZE;
-  const content = truncated ? fs11.readFileSync(absPath, "utf-8").slice(0, MAX_INLINE_SIZE) : fs11.readFileSync(absPath, "utf-8");
+  const content = truncated ? fs10.readFileSync(absPath, "utf-8").slice(0, MAX_INLINE_SIZE) : fs10.readFileSync(absPath, "utf-8");
   return {
     path: relativePath,
     kind,
@@ -32557,62 +32491,264 @@ function getGitDiff(dirPath) {
   };
 }
 
-// ../../packages/api/src/task-cancellation.ts
-var TERMINAL_STATUSES2 = /* @__PURE__ */ new Set(["completed", "failed", "cancelled", "archived"]);
-function cancelTaskOnCurrentNode(deps, taskId, options = {}) {
-  const task = deps.taskEngine.getTask(taskId);
-  if (!task) {
-    if (options.missingOk) {
-      return {
-        task: null,
-        cancelled: false,
-        engineCancelRequested: false,
-        missing: true,
-        terminal: false
-      };
+// ../../packages/api/src/preview/preview-server.ts
+var crypto2 = __toESM(require("crypto"), 1);
+var fs11 = __toESM(require("fs"), 1);
+var path12 = __toESM(require("path"), 1);
+var http = __toESM(require("http"), 1);
+function resolvePreviewPath(rootPath, relativePath) {
+  const sanitizedPath = relativePath.replace(/\\/g, "/");
+  const resolvedPath = path12.resolve(rootPath, sanitizedPath);
+  const normalizedRoot = path12.resolve(rootPath);
+  if (!resolvedPath.startsWith(normalizedRoot + path12.sep) && resolvedPath !== normalizedRoot) {
+    throw new Error("Invalid preview path");
+  }
+  return {
+    absolutePath: resolvedPath,
+    normalizedPath: path12.relative(normalizedRoot, resolvedPath).split(path12.sep).join("/")
+  };
+}
+function resolvePreviewEntryPath(rootPath, entryPath) {
+  const { absolutePath, normalizedPath } = resolvePreviewPath(rootPath, entryPath ?? "index.html");
+  if (!fs11.existsSync(absolutePath) || !fs11.statSync(absolutePath).isFile()) {
+    throw new Error("Preview entry not found");
+  }
+  return normalizedPath;
+}
+function buildPreviewUrl(origin, session) {
+  const encodedEntryPath = session.entryPath.split("/").filter(Boolean).map((segment) => encodeURIComponent(segment)).join("/");
+  return `${origin.replace(/\/+$/, "")}/preview/${session.token}/${encodedEntryPath}`;
+}
+var DEFAULT_TTL_MS = 15 * 60 * 1e3;
+var PreviewSessionManager = class {
+  sessions = /* @__PURE__ */ new Map();
+  create(options) {
+    const token = crypto2.randomBytes(32).toString("hex");
+    const entryPath = resolvePreviewEntryPath(options.rootPath, options.entryPath);
+    const session = {
+      token,
+      taskId: options.taskId,
+      rootPath: options.rootPath,
+      entryPath,
+      expiresAt: Date.now() + (options.ttlMs ?? DEFAULT_TTL_MS)
+    };
+    this.sessions.set(token, session);
+    return session;
+  }
+  get(token) {
+    const session = this.sessions.get(token);
+    if (!session) return null;
+    if (Date.now() > session.expiresAt) {
+      this.sessions.delete(token);
+      return null;
     }
+    return session;
+  }
+  cleanup() {
+    const now = Date.now();
+    for (const [token, session] of this.sessions) {
+      if (now > session.expiresAt) {
+        this.sessions.delete(token);
+      }
+    }
+  }
+};
+var MIME_MAP2 = {
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".css": "text/css",
+  ".js": "text/javascript",
+  ".mjs": "text/javascript",
+  ".json": "application/json",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".webp": "image/webp",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".eot": "application/vnd.ms-fontobject",
+  ".pdf": "application/pdf"
+};
+function getMime(filePath) {
+  return MIME_MAP2[path12.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}
+function handlePreviewRequest(sessionManager, req, res) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  if (!url.pathname.startsWith("/preview/")) {
+    return false;
+  }
+  if (req.method !== "GET") {
+    res.writeHead(405, { "Content-Type": "text/plain" });
+    res.end("Method not allowed");
+    return true;
+  }
+  const match = url.pathname.match(/^\/preview\/([a-f0-9]+)(?:\/(.*))?$/i);
+  const token = match?.[1];
+  if (!token) {
+    res.writeHead(404, { "Content-Type": "text/plain" });
+    res.end("Preview not found");
+    return true;
+  }
+  const session = sessionManager.get(token);
+  if (!session) {
+    res.writeHead(403, { "Content-Type": "text/plain" });
+    res.end("Invalid or expired preview token");
+    return true;
+  }
+  const requestedPath = decodeURIComponent(match?.[2] ?? session.entryPath);
+  let resolved;
+  try {
+    resolved = resolvePreviewPath(session.rootPath, requestedPath).absolutePath;
+  } catch {
+    res.writeHead(400, { "Content-Type": "text/plain" });
+    res.end("Invalid path");
+    return true;
+  }
+  if (!fs11.existsSync(resolved) || !fs11.statSync(resolved).isFile()) {
+    res.writeHead(404, { "Content-Type": "text/plain" });
+    res.end("File not found");
+    return true;
+  }
+  const mime = getMime(resolved);
+  const content = fs11.readFileSync(resolved);
+  res.writeHead(200, {
+    "Content-Type": mime,
+    "Content-Length": content.length,
+    "Cache-Control": "no-cache"
+  });
+  res.end(content);
+  return true;
+}
+
+// ../../packages/api/src/task-output-service.ts
+var TASK_OUTPUT_ROUTE_PREFIX = "/api/tasks";
+function getTask(taskEngine, taskId) {
+  const task = taskEngine.getTask(taskId);
+  if (!task) {
     throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
   }
-  if (TERMINAL_STATUSES2.has(task.status)) {
-    if (options.terminalOk) {
-      return {
-        task,
-        cancelled: false,
-        engineCancelRequested: false,
-        missing: false,
-        terminal: true
-      };
+  return task;
+}
+function getTaskOutputRoot(taskEngine, taskId) {
+  const task = getTask(taskEngine, taskId);
+  if (!task.effectiveProjectPath) {
+    throw new MeshyError("VALIDATION_ERROR", "Task output not available", 400);
+  }
+  return task.effectiveProjectPath;
+}
+function buildTaskOutputDownloadUrl(taskId, filePath) {
+  return `${TASK_OUTPUT_ROUTE_PREFIX}/${taskId}/output/download?path=${encodeURIComponent(filePath)}`;
+}
+function getLocalTaskOutputSummary(taskEngine, taskId) {
+  const task = getTask(taskEngine, taskId);
+  if (!task.effectiveProjectPath) {
+    return {
+      taskId: task.id,
+      requestedProject: task.project,
+      effectiveProjectPath: null,
+      assignedTo: task.assignedTo,
+      available: false,
+      summary: null
+    };
+  }
+  return {
+    taskId: task.id,
+    requestedProject: task.project,
+    effectiveProjectPath: task.effectiveProjectPath,
+    assignedTo: task.assignedTo,
+    available: true,
+    summary: getOutputSummary(task.effectiveProjectPath)
+  };
+}
+function getLocalTaskOutputTree(taskEngine, taskId, currentPath) {
+  const rootPath = getTaskOutputRoot(taskEngine, taskId);
+  try {
+    return {
+      rootPath,
+      currentPath,
+      entries: listDirectory(rootPath, currentPath)
+    };
+  } catch (err) {
+    if (err instanceof Error && err.message === "Path traversal detected") {
+      throw new MeshyError("VALIDATION_ERROR", "Invalid directory path", 400);
     }
-    throw new MeshyError("VALIDATION_ERROR", `Task ${taskId} cannot be cancelled (status: ${task.status})`, 400);
+    throw err;
   }
-  let engineCancelRequested = false;
-  if (task.status === "running") {
-    const engine = deps.engineRegistry.get(task.agent);
-    if (!engine || typeof engine.cancelTask !== "function") {
-      deps.logger.warn("engine not registered while cancelling running task", {
-        taskId,
-        agent: task.agent
-      });
-    } else {
-      engineCancelRequested = engine.cancelTask(taskId);
-      if (!engineCancelRequested) {
-        deps.logger.warn("running task had no active engine process to cancel", {
-          taskId,
-          agent: task.agent
-        });
+}
+function getLocalTaskOutputContent(taskEngine, taskId, filePath) {
+  const rootPath = getTaskOutputRoot(taskEngine, taskId);
+  try {
+    return {
+      ...readFileContent(rootPath, filePath),
+      downloadUrl: buildTaskOutputDownloadUrl(taskId, filePath)
+    };
+  } catch (err) {
+    if (err instanceof Error && err.message === "Path traversal detected") {
+      throw new MeshyError("VALIDATION_ERROR", "Invalid file path", 400);
+    }
+    if (err instanceof Error && err.message === "File not found") {
+      throw new MeshyError("TASK_NOT_FOUND", `File not found: ${filePath}`, 404);
+    }
+    throw err;
+  }
+}
+function getLocalTaskOutputDownload(taskEngine, taskId, filePath) {
+  const rootPath = getTaskOutputRoot(taskEngine, taskId);
+  try {
+    const absolutePath = resolveOutputPath(rootPath, filePath);
+    if (!fs12.existsSync(absolutePath) || !fs12.statSync(absolutePath).isFile()) {
+      throw new MeshyError("TASK_NOT_FOUND", `File not found: ${filePath}`, 404);
+    }
+    const { mimeType } = classifyFile(absolutePath);
+    const fileName = path13.basename(absolutePath).replace(/"/g, "");
+    return {
+      content: fs12.readFileSync(absolutePath),
+      headers: {
+        "Content-Type": mimeType,
+        "Content-Disposition": `inline; filename="${fileName}"`,
+        "Cache-Control": "no-cache"
       }
+    };
+  } catch (err) {
+    if (err instanceof MeshyError) {
+      throw err;
+    }
+    if (err instanceof Error && err.message === "Path traversal detected") {
+      throw new MeshyError("VALIDATION_ERROR", "Invalid file path", 400);
     }
+    throw err;
   }
-  const cancelled = deps.taskEngine.cancelTask(taskId);
-  if (!cancelled) {
-    throw new MeshyError("VALIDATION_ERROR", `Task ${taskId} cannot be cancelled`, 400);
+}
+function getLocalTaskOutputDiff(taskEngine, taskId) {
+  const rootPath = getTaskOutputRoot(taskEngine, taskId);
+  return getGitDiff(rootPath);
+}
+async function createPreviewSessionPayload(deps, taskId, entryPath) {
+  const previewManager = deps.previewSessionManager;
+  if (!previewManager) {
+    throw new MeshyError("VALIDATION_ERROR", "Preview not available on this node", 400);
+  }
+  if (!deps.previewPort) {
+    throw new MeshyError("VALIDATION_ERROR", "Preview server not running", 400);
+  }
+  const rootPath = getTaskOutputRoot(deps.taskEngine, taskId);
+  const session = previewManager.create({
+    taskId,
+    rootPath,
+    entryPath
+  });
+  const origin = deps.ensurePreviewOrigin ? await deps.ensurePreviewOrigin() ?? deps.previewOrigin : deps.previewOrigin;
+  if (!origin) {
+    throw new MeshyError("VALIDATION_ERROR", "Preview origin not available", 502);
   }
   return {
-    task,
-    cancelled: true,
-    engineCancelRequested,
-    missing: false,
-    terminal: false
+    previewUrl: buildPreviewUrl(origin, session),
+    expiresAt: session.expiresAt,
+    entryPath: session.entryPath
   };
 }
 
@@ -32654,44 +32790,6 @@ function errorResponse(requestId, err) {
     }
   });
 }
-function getTask(taskEngine, taskId) {
-  const task = taskEngine.getTask(taskId);
-  if (!task) {
-    throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
-  }
-  return task;
-}
-function getTaskOutputRoot(taskEngine, taskId) {
-  const task = getTask(taskEngine, taskId);
-  if (!task.effectiveProjectPath) {
-    throw new MeshyError("VALIDATION_ERROR", "Task output not available", 400);
-  }
-  return task.effectiveProjectPath;
-}
-async function createPreviewSessionPayload(deps, taskId, entryPath) {
-  const previewManager = deps.previewSessionManager;
-  if (!previewManager) {
-    throw new MeshyError("VALIDATION_ERROR", "Preview not available on this node", 400);
-  }
-  if (!deps.previewPort) {
-    throw new MeshyError("VALIDATION_ERROR", "Preview server not running", 400);
-  }
-  const rootPath = getTaskOutputRoot(deps.taskEngine, taskId);
-  const session = previewManager.create({
-    taskId,
-    rootPath,
-    entryPath
-  });
-  const origin = deps.ensurePreviewOrigin ? await deps.ensurePreviewOrigin() ?? deps.previewOrigin : deps.previewOrigin;
-  if (!origin) {
-    throw new MeshyError("VALIDATION_ERROR", "Preview origin not available", 502);
-  }
-  return {
-    previewUrl: buildPreviewUrl(origin, session),
-    expiresAt: session.expiresAt,
-    entryPath: session.entryPath
-  };
-}
 async function executeWorkerControlRequest(deps, request) {
   const log = deps.logger.child("worker-control");
   log.info("received worker control request", {
@@ -32751,89 +32849,40 @@ async function executeWorkerControlRequest(deps, request) {
         break;
       }
       case "task-output-summary": {
-        const task = getTask(deps.taskEngine, request.taskId ?? "");
-        if (!task.effectiveProjectPath) {
-          response = jsonResponse(request.requestId, 200, {
-            taskId: task.id,
-            requestedProject: task.project,
-            effectiveProjectPath: null,
-            assignedTo: task.assignedTo,
-            available: false,
-            summary: null
-          });
-          break;
-        }
-        response = jsonResponse(request.requestId, 200, {
-          taskId: task.id,
-          requestedProject: task.project,
-          effectiveProjectPath: task.effectiveProjectPath,
-          assignedTo: task.assignedTo,
-          available: true,
-          summary: getOutputSummary(task.effectiveProjectPath)
-        });
+        response = jsonResponse(
+          request.requestId,
+          200,
+          getLocalTaskOutputSummary(deps.taskEngine, request.taskId ?? "")
+        );
         break;
       }
       case "task-output-tree": {
-        const rootPath = getTaskOutputRoot(deps.taskEngine, request.taskId ?? "");
-        try {
-          response = jsonResponse(request.requestId, 200, {
-            rootPath,
-            currentPath: request.path ?? ".",
-            entries: listDirectory(rootPath, request.path ?? ".")
-          });
-          break;
-        } catch (err) {
-          if (err instanceof Error && err.message === "Path traversal detected") {
-            throw new MeshyError("VALIDATION_ERROR", "Invalid directory path", 400);
-          }
-          throw err;
-        }
+        response = jsonResponse(
+          request.requestId,
+          200,
+          getLocalTaskOutputTree(deps.taskEngine, request.taskId ?? "", request.path ?? ".")
+        );
+        break;
       }
       case "task-output-content": {
-        const rootPath = getTaskOutputRoot(deps.taskEngine, request.taskId ?? "");
-        try {
-          const filePath = request.path ?? "";
-          response = jsonResponse(request.requestId, 200, {
-            ...readFileContent(rootPath, filePath),
-            downloadUrl: `/api/tasks/${request.taskId}/output/download?path=${encodeURIComponent(filePath)}`
-          });
-          break;
-        } catch (err) {
-          if (err instanceof Error && err.message === "Path traversal detected") {
-            throw new MeshyError("VALIDATION_ERROR", "Invalid file path", 400);
-          }
-          if (err instanceof Error && err.message === "File not found") {
-            throw new MeshyError("TASK_NOT_FOUND", `File not found: ${request.path}`, 404);
-          }
-          throw err;
-        }
+        response = jsonResponse(
+          request.requestId,
+          200,
+          getLocalTaskOutputContent(deps.taskEngine, request.taskId ?? "", request.path ?? "")
+        );
+        break;
       }
       case "task-output-download": {
-        const rootPath = getTaskOutputRoot(deps.taskEngine, request.taskId ?? "");
-        try {
-          const absolutePath = resolveOutputPath(rootPath, request.path ?? "");
-          if (!fs12.existsSync(absolutePath) || !fs12.statSync(absolutePath).isFile()) {
-            throw new MeshyError("TASK_NOT_FOUND", `File not found: ${request.path}`, 404);
-          }
-          const { mimeType } = classifyFile(absolutePath);
-          const fileName = path13.basename(absolutePath).replace(/"/g, "");
-          response = binaryResponse(request.requestId, 200, fs12.readFileSync(absolutePath), {
-            "Content-Type": mimeType,
-            "Content-Disposition": `inline; filename="${fileName}"`,
-            "Cache-Control": "no-cache"
-          });
-          break;
-        } catch (err) {
-          if (err instanceof MeshyError) throw err;
-          if (err instanceof Error && err.message === "Path traversal detected") {
-            throw new MeshyError("VALIDATION_ERROR", "Invalid file path", 400);
-          }
-          throw err;
-        }
+        const download = getLocalTaskOutputDownload(deps.taskEngine, request.taskId ?? "", request.path ?? "");
+        response = binaryResponse(request.requestId, 200, download.content, download.headers);
+        break;
       }
       case "task-output-diff": {
-        const rootPath = getTaskOutputRoot(deps.taskEngine, request.taskId ?? "");
-        response = jsonResponse(request.requestId, 200, getGitDiff(rootPath));
+        response = jsonResponse(
+          request.requestId,
+          200,
+          getLocalTaskOutputDiff(deps.taskEngine, request.taskId ?? "")
+        );
         break;
       }
       case "task-preview-session": {
@@ -33066,9 +33115,7 @@ function createNodeRoutes() {
 }
 
 // ../../packages/api/src/routes/tasks.ts
-var fs14 = __toESM(require("fs"), 1);
-var path14 = __toESM(require("path"), 1);
-var import_express3 = __toESM(require_express2(), 1);
+var import_express4 = __toESM(require_express2(), 1);
 
 // ../../packages/api/src/task-route-utils.ts
 var fs13 = __toESM(require("fs"), 1);
@@ -33177,11 +33224,190 @@ function startLocalTaskFollowUp(deps, task, content, assignedTo, metadata) {
   }
 }
 
+// ../../packages/api/src/routes/task-output.ts
+var import_express3 = __toESM(require_express2(), 1);
+function asyncHandler3(fn) {
+  return (req, res, next) => fn(req, res, next).catch(next);
+}
+async function maybeHandleRemoteTaskOutputRequest(req, res, taskId, subPath, init, fallbackRequest) {
+  const { taskEngine, nodeRegistry, heartbeat, logger: rootLogger } = req.app.locals.deps;
+  const log = rootLogger.child("tasks/output");
+  const task = taskEngine.getTask(taskId);
+  if (!task) {
+    throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
+  }
+  const selfId = nodeRegistry.getSelf()?.id;
+  const needsProxy = !!(task.assignedTo && task.assignedTo !== selfId);
+  if (!needsProxy) {
+    return false;
+  }
+  const assignedNodeId = task.assignedTo;
+  if (!assignedNodeId) {
+    return false;
+  }
+  const node = nodeRegistry.getNode(assignedNodeId);
+  if (!node) {
+    throw new MeshyError("NODE_NOT_FOUND", `Assigned node ${assignedNodeId} not found`, 404);
+  }
+  if (!node.previewOrigin) {
+    if (fallbackRequest && heartbeat?.requestWorkerControl) {
+      log.warn("task output server origin missing, falling back to keepalive control", {
+        taskId,
+        assignedTo: assignedNodeId,
+        kind: fallbackRequest.kind
+      });
+      const controlResponse = await heartbeat.requestWorkerControl(assignedNodeId, fallbackRequest);
+      sendWorkerControlResponse(res, controlResponse);
+      return true;
+    }
+    throw new MeshyError("NODE_OFFLINE", "Task output API is not available on the assigned worker", 502);
+  }
+  const qs = new URL(req.originalUrl ?? req.url, "http://localhost").search;
+  const proxyPath = `/api/tasks/${taskId}/output${subPath}${qs}`;
+  try {
+    const { endpoint, response: proxyRes } = await fetchNodeWithFallback(
+      { endpoint: node.previewOrigin },
+      proxyPath,
+      init
+    );
+    log.debug("proxying task output request to worker output server", {
+      taskId,
+      assignedTo: assignedNodeId,
+      proxyPath,
+      outputOrigin: endpoint
+    });
+    await sendProxyResponse(res, proxyRes);
+    return true;
+  } catch (err) {
+    if (fallbackRequest && heartbeat?.requestWorkerControl) {
+      log.warn("output server proxy failed, falling back to keepalive control", {
+        taskId,
+        assignedTo: assignedNodeId,
+        kind: fallbackRequest.kind,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      const controlResponse = await heartbeat.requestWorkerControl(assignedNodeId, fallbackRequest);
+      sendWorkerControlResponse(res, controlResponse);
+      return true;
+    }
+    log.warn("output server proxy error", {
+      taskId,
+      assignedTo: assignedNodeId,
+      error: err instanceof Error ? err.message : String(err)
+    });
+    throw new MeshyError("NODE_OFFLINE", "Cannot reach worker for task output", 502);
+  }
+}
+function createTaskOutputRoutes(options = {}) {
+  const router = (0, import_express3.Router)();
+  const allowRemoteProxy = options.allowRemoteProxy ?? true;
+  router.get("/:id/output", asyncHandler3(async (req, res) => {
+    const taskId = req.params.id;
+    if (allowRemoteProxy) {
+      const handled = await maybeHandleRemoteTaskOutputRequest(req, res, taskId, "", void 0, {
+        kind: "task-output-summary",
+        taskId
+      });
+      if (handled) {
+        return;
+      }
+    }
+    const { taskEngine } = req.app.locals.deps;
+    res.json(getLocalTaskOutputSummary(taskEngine, taskId));
+  }));
+  router.get("/:id/output/tree", asyncHandler3(async (req, res) => {
+    const taskId = req.params.id;
+    const query = TaskOutputTreeQuery.parse(req.query);
+    if (allowRemoteProxy) {
+      const handled = await maybeHandleRemoteTaskOutputRequest(req, res, taskId, "/tree", void 0, {
+        kind: "task-output-tree",
+        taskId,
+        path: query.path
+      });
+      if (handled) {
+        return;
+      }
+    }
+    const { taskEngine } = req.app.locals.deps;
+    res.json(getLocalTaskOutputTree(taskEngine, taskId, query.path));
+  }));
+  router.get("/:id/output/content", asyncHandler3(async (req, res) => {
+    const taskId = req.params.id;
+    const query = TaskOutputContentQuery.parse(req.query);
+    if (allowRemoteProxy) {
+      const handled = await maybeHandleRemoteTaskOutputRequest(req, res, taskId, "/content", void 0, {
+        kind: "task-output-content",
+        taskId,
+        path: query.path
+      });
+      if (handled) {
+        return;
+      }
+    }
+    const { taskEngine } = req.app.locals.deps;
+    res.json(getLocalTaskOutputContent(taskEngine, taskId, query.path));
+  }));
+  router.get("/:id/output/download", asyncHandler3(async (req, res) => {
+    const taskId = req.params.id;
+    const query = TaskOutputDownloadQuery.parse(req.query);
+    if (allowRemoteProxy) {
+      const handled = await maybeHandleRemoteTaskOutputRequest(req, res, taskId, "/download", void 0, {
+        kind: "task-output-download",
+        taskId,
+        path: query.path
+      });
+      if (handled) {
+        return;
+      }
+    }
+    const { taskEngine } = req.app.locals.deps;
+    const download = getLocalTaskOutputDownload(taskEngine, taskId, query.path);
+    for (const [key, value] of Object.entries(download.headers)) {
+      res.setHeader(key, value);
+    }
+    res.send(download.content);
+  }));
+  router.get("/:id/output/diff", asyncHandler3(async (req, res) => {
+    const taskId = req.params.id;
+    if (allowRemoteProxy) {
+      const handled = await maybeHandleRemoteTaskOutputRequest(req, res, taskId, "/diff", void 0, {
+        kind: "task-output-diff",
+        taskId
+      });
+      if (handled) {
+        return;
+      }
+    }
+    const { taskEngine } = req.app.locals.deps;
+    res.json(getLocalTaskOutputDiff(taskEngine, taskId));
+  }));
+  router.post("/:id/output/preview-sessions", asyncHandler3(async (req, res) => {
+    const taskId = req.params.id;
+    const body = TaskPreviewSessionBody.parse(req.body ?? {});
+    if (allowRemoteProxy) {
+      const handled = await maybeHandleRemoteTaskOutputRequest(req, res, taskId, "/preview-sessions", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      }, {
+        kind: "task-preview-session",
+        taskId,
+        path: body.path
+      });
+      if (handled) {
+        return;
+      }
+    }
+    res.json(await createPreviewSessionPayload(req.app.locals.deps, taskId, body.path));
+  }));
+  return router;
+}
+
 // ../../packages/api/src/routes/tasks.ts
 var TERMINAL_STATUSES3 = /* @__PURE__ */ new Set(["completed", "failed", "cancelled", "archived"]);
 var ARCHIVABLE_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled", "archived"]);
 var ACTIVE_STATUSES = /* @__PURE__ */ new Set(["pending", "assigned", "running"]);
-function asyncHandler3(fn) {
+function asyncHandler4(fn) {
   return (req, res, next) => fn(req, res, next).catch(next);
 }
 function withAssignedNodeMetadata(task, nodeRegistry) {
@@ -33196,8 +33422,8 @@ function withAssignedNodeMetadata(task, nodeRegistry) {
   };
 }
 function createTaskRoutes() {
-  const router = (0, import_express3.Router)();
-  router.post("/", asyncHandler3(async (req, res) => {
+  const router = (0, import_express4.Router)();
+  router.post("/", asyncHandler4(async (req, res) => {
     const { taskEngine, nodeRegistry } = req.app.locals.deps;
     const body = CreateTaskBody.parse(req.body);
     const task = taskEngine.createTask({
@@ -33216,7 +33442,7 @@ function createTaskRoutes() {
     }
     res.status(201).json(withAssignedNodeMetadata(task, nodeRegistry));
   }));
-  router.get("/", asyncHandler3(async (req, res) => {
+  router.get("/", asyncHandler4(async (req, res) => {
     const { taskEngine, nodeRegistry } = req.app.locals.deps;
     const query = TaskListQuery.parse(req.query);
     const filter = {};
@@ -33231,7 +33457,7 @@ function createTaskRoutes() {
       total: result.total
     });
   }));
-  router.post("/batch/delete", asyncHandler3(async (req, res) => {
+  router.post("/batch/delete", asyncHandler4(async (req, res) => {
     const { taskEngine } = req.app.locals.deps;
     const { ids } = BatchTaskIdsBody.parse(req.body);
     const results = ids.map((id) => {
@@ -33244,7 +33470,7 @@ function createTaskRoutes() {
     });
     res.json({ results });
   }));
-  router.post("/batch/archive", asyncHandler3(async (req, res) => {
+  router.post("/batch/archive", asyncHandler4(async (req, res) => {
     const { taskEngine } = req.app.locals.deps;
     const { ids } = BatchTaskIdsBody.parse(req.body);
     const results = ids.map((id) => {
@@ -33262,7 +33488,7 @@ function createTaskRoutes() {
     });
     res.json({ results });
   }));
-  router.get("/:id", asyncHandler3(async (req, res) => {
+  router.get("/:id", asyncHandler4(async (req, res) => {
     const { taskEngine, nodeRegistry } = req.app.locals.deps;
     const task = taskEngine.getTask(req.params.id);
     if (!task) {
@@ -33270,7 +33496,7 @@ function createTaskRoutes() {
     }
     res.json(withAssignedNodeMetadata(task, nodeRegistry));
   }));
-  router.patch("/:id", asyncHandler3(async (req, res) => {
+  router.patch("/:id", asyncHandler4(async (req, res) => {
     const { taskEngine, nodeRegistry, logger: rootLogger } = req.app.locals.deps;
     const log = rootLogger.child("tasks/patch");
     const updates = UpdateTaskBody.parse(req.body);
@@ -33309,7 +33535,7 @@ function createTaskRoutes() {
     }
     res.json(withAssignedNodeMetadata(task, nodeRegistry));
   }));
-  router.delete("/:id", asyncHandler3(async (req, res) => {
+  router.delete("/:id", asyncHandler4(async (req, res) => {
     const { taskEngine } = req.app.locals.deps;
     const result = taskEngine.deleteTask(req.params.id);
     if (!result) {
@@ -33317,7 +33543,7 @@ function createTaskRoutes() {
     }
     res.json({ ok: true });
   }));
-  router.post("/:id/cancel", asyncHandler3(async (req, res) => {
+  router.post("/:id/cancel", asyncHandler4(async (req, res) => {
     const { taskEngine, nodeRegistry, engineRegistry, heartbeat, logger: rootLogger } = req.app.locals.deps;
     const log = rootLogger.child("tasks/cancel");
     const task = taskEngine.getTask(req.params.id);
@@ -33354,18 +33580,18 @@ function createTaskRoutes() {
     }, task.id);
     res.json({ ok: true });
   }));
-  router.post("/:id/assign", asyncHandler3(async (req, res) => {
+  router.post("/:id/assign", asyncHandler4(async (req, res) => {
     const { taskEngine, nodeRegistry } = req.app.locals.deps;
     const body = AssignTaskBody.parse(req.body);
     const task = taskEngine.assignTask(req.params.id, body.nodeId);
     res.json(withAssignedNodeMetadata(task, nodeRegistry));
   }));
-  router.post("/:id/retry", asyncHandler3(async (req, res) => {
+  router.post("/:id/retry", asyncHandler4(async (req, res) => {
     const { taskEngine, nodeRegistry } = req.app.locals.deps;
     const task = taskEngine.retryTask(req.params.id);
     res.json(withAssignedNodeMetadata(task, nodeRegistry));
   }));
-  router.get("/:id/logs", asyncHandler3(async (req, res) => {
+  router.get("/:id/logs", asyncHandler4(async (req, res) => {
     const { engineRegistry, taskEngine, nodeRegistry, logger: rootLogger } = req.app.locals.deps;
     const log = rootLogger.child("tasks/logs");
     const query = TaskLogsQuery.parse(req.query);
@@ -33432,7 +33658,7 @@ function createTaskRoutes() {
     });
     res.json(local);
   }));
-  router.post("/:id/message", asyncHandler3(async (req, res) => {
+  router.post("/:id/message", asyncHandler4(async (req, res) => {
     const { taskEngine, engineRegistry, nodeRegistry, heartbeat, logger: rootLogger } = req.app.locals.deps;
     const log = rootLogger.child("tasks/message");
     const body = SendMessageBody.parse(req.body);
@@ -33516,281 +33742,24 @@ function createTaskRoutes() {
     }, task, body.content, task.assignedTo);
     res.json({ ok: true });
   }));
-  async function resolveTaskOutputOrProxy(req, res, taskId, subPath, init, fallbackRequest) {
-    const { taskEngine, nodeRegistry, heartbeat, logger: rootLogger } = req.app.locals.deps;
-    const log = rootLogger.child("tasks/output");
-    const task = taskEngine.getTask(taskId);
-    if (!task) {
-      throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
-    }
-    const effectivePath = task.effectiveProjectPath;
-    if (!effectivePath) {
-      throw new MeshyError("VALIDATION_ERROR", "Task output not available", 400);
-    }
-    const selfId = nodeRegistry.getSelf()?.id;
-    const needsProxy = !!(task.assignedTo && task.assignedTo !== selfId);
-    if (needsProxy) {
-      const node = nodeRegistry.getNode(task.assignedTo);
-      if (!node) {
-        throw new MeshyError("NODE_NOT_FOUND", `Assigned node ${task.assignedTo} not found`, 404);
-      }
-      const canPushToNode = heartbeat?.canPushToNode?.(task.assignedTo) ?? true;
-      if (!canPushToNode && fallbackRequest && heartbeat?.requestWorkerControl) {
-        log.debug("skipping direct output proxy because worker is keepalive-only", {
-          taskId,
-          assignedTo: task.assignedTo,
-          kind: fallbackRequest.kind
-        });
-        const controlResponse = await heartbeat.requestWorkerControl(task.assignedTo, fallbackRequest);
-        sendWorkerControlResponse(res, controlResponse);
-        return null;
-      }
-      const qs = new URL(req.url, "http://localhost").search;
-      const proxyPath = `/api/tasks/${taskId}/output${subPath}${qs}`;
-      try {
-        const { endpoint, response: proxyRes } = await fetchNodeWithFallback(node, proxyPath, init);
-        const proxyUrl = `${endpoint}${proxyPath}`;
-        log.debug("proxying output request to worker", { taskId, proxyUrl });
-        await sendProxyResponse(res, proxyRes);
-        return null;
-      } catch (err) {
-        if (fallbackRequest && heartbeat?.requestWorkerControl) {
-          log.warn("direct output proxy failed, falling back to keepalive control", {
-            taskId,
-            assignedTo: task.assignedTo,
-            kind: fallbackRequest.kind,
-            error: err instanceof Error ? err.message : String(err)
-          });
-          try {
-            const controlResponse = await heartbeat.requestWorkerControl(task.assignedTo, fallbackRequest);
-            sendWorkerControlResponse(res, controlResponse);
-            return null;
-          } catch (fallbackErr) {
-            log.warn("keepalive output fallback failed", {
-              taskId,
-              assignedTo: task.assignedTo,
-              kind: fallbackRequest.kind,
-              error: fallbackErr instanceof Error ? fallbackErr.message : String(fallbackErr)
-            });
-          }
-        }
-        log.warn("output proxy error", { error: err instanceof Error ? err.message : String(err) });
-        throw new MeshyError("NODE_OFFLINE", "Cannot reach worker for task output", 502);
-      }
-    }
-    return effectivePath;
-  }
-  router.get("/:id/output", asyncHandler3(async (req, res) => {
-    const { taskEngine } = req.app.locals.deps;
-    const taskId = req.params.id;
-    const task = taskEngine.getTask(taskId);
-    if (!task) {
-      throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
-    }
-    const effectivePath = task.effectiveProjectPath;
-    if (!effectivePath) {
-      res.json({
-        taskId,
-        requestedProject: task.project,
-        effectiveProjectPath: null,
-        assignedTo: task.assignedTo,
-        available: false,
-        summary: null
-      });
-      return;
-    }
-    const root = await resolveTaskOutputOrProxy(req, res, taskId, "", void 0, {
-      kind: "task-output-summary",
-      taskId
-    });
-    if (root === null) return;
-    const summary = getOutputSummary(root);
-    res.json({
-      taskId,
-      requestedProject: task.project,
-      effectiveProjectPath: effectivePath,
-      assignedTo: task.assignedTo,
-      available: true,
-      summary
-    });
-  }));
-  router.get("/:id/output/tree", asyncHandler3(async (req, res) => {
-    const taskId = req.params.id;
-    const query = TaskOutputTreeQuery.parse(req.query);
-    const root = await resolveTaskOutputOrProxy(req, res, taskId, "/tree", void 0, {
-      kind: "task-output-tree",
-      taskId,
-      path: query.path
-    });
-    if (root === null) return;
-    try {
-      const entries = listDirectory(root, query.path);
-      res.json({
-        rootPath: root,
-        currentPath: query.path,
-        entries
-      });
-    } catch (err) {
-      if (err instanceof Error && err.message === "Path traversal detected") {
-        throw new MeshyError("VALIDATION_ERROR", "Invalid directory path", 400);
-      }
-      throw err;
-    }
-  }));
-  router.get("/:id/output/content", asyncHandler3(async (req, res) => {
-    const taskId = req.params.id;
-    const query = TaskOutputContentQuery.parse(req.query);
-    const root = await resolveTaskOutputOrProxy(req, res, taskId, "/content", void 0, {
-      kind: "task-output-content",
-      taskId,
-      path: query.path
-    });
-    if (root === null) return;
-    try {
-      const content = readFileContent(root, query.path);
-      res.json({
-        ...content,
-        downloadUrl: `/api/tasks/${taskId}/output/download?path=${encodeURIComponent(query.path)}`
-      });
-    } catch (err) {
-      if (err instanceof Error && err.message === "Path traversal detected") {
-        throw new MeshyError("VALIDATION_ERROR", "Invalid file path", 400);
-      }
-      if (err instanceof Error && err.message === "File not found") {
-        throw new MeshyError("TASK_NOT_FOUND", `File not found: ${query.path}`, 404);
-      }
-      throw err;
-    }
-  }));
-  router.get("/:id/output/download", asyncHandler3(async (req, res) => {
-    const taskId = req.params.id;
-    const query = TaskOutputDownloadQuery.parse(req.query);
-    const root = await resolveTaskOutputOrProxy(req, res, taskId, "/download", void 0, {
-      kind: "task-output-download",
-      taskId,
-      path: query.path
-    });
-    if (root === null) return;
-    try {
-      const absolutePath = resolveOutputPath(root, query.path);
-      if (!fs14.existsSync(absolutePath) || !fs14.statSync(absolutePath).isFile()) {
-        throw new MeshyError("TASK_NOT_FOUND", `File not found: ${query.path}`, 404);
-      }
-      const { mimeType } = classifyFile(absolutePath);
-      const fileName = path14.basename(absolutePath).replace(/"/g, "");
-      const content = fs14.readFileSync(absolutePath);
-      res.setHeader("Content-Type", mimeType);
-      res.setHeader("Content-Disposition", `inline; filename="${fileName}"`);
-      res.setHeader("Cache-Control", "no-cache");
-      res.send(content);
-    } catch (err) {
-      if (err instanceof MeshyError) throw err;
-      if (err instanceof Error && err.message === "Path traversal detected") {
-        throw new MeshyError("VALIDATION_ERROR", "Invalid file path", 400);
-      }
-      throw err;
-    }
-  }));
-  router.get("/:id/output/diff", asyncHandler3(async (req, res) => {
-    const taskId = req.params.id;
-    const root = await resolveTaskOutputOrProxy(req, res, taskId, "/diff", void 0, {
-      kind: "task-output-diff",
-      taskId
-    });
-    if (root === null) return;
-    const diff = getGitDiff(root);
-    res.json(diff);
-  }));
-  router.post("/:id/output/preview-sessions", asyncHandler3(async (req, res) => {
-    const { taskEngine, nodeRegistry, heartbeat, logger: rootLogger } = req.app.locals.deps;
-    const log = rootLogger.child("tasks/preview");
-    const taskId = req.params.id;
-    const body = TaskPreviewSessionBody.parse(req.body ?? {});
-    const task = taskEngine.getTask(taskId);
-    if (!task) {
-      throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
-    }
-    const effectivePath = task.effectiveProjectPath;
-    if (!effectivePath) {
-      throw new MeshyError("VALIDATION_ERROR", "Task output not available", 400);
-    }
-    const selfId = nodeRegistry.getSelf()?.id;
-    const needsProxy = !!(task.assignedTo && task.assignedTo !== selfId);
-    if (needsProxy) {
-      const node = nodeRegistry.getNode(task.assignedTo);
-      if (!node) {
-        throw new MeshyError("NODE_NOT_FOUND", `Assigned node ${task.assignedTo} not found`, 404);
-      }
-      const canPushToNode = heartbeat?.canPushToNode?.(task.assignedTo) ?? true;
-      if (!canPushToNode && heartbeat?.requestWorkerControl) {
-        log.debug("skipping direct preview proxy because worker is keepalive-only", {
-          taskId,
-          assignedTo: task.assignedTo
-        });
-        const controlResponse = await heartbeat.requestWorkerControl(task.assignedTo, {
-          kind: "task-preview-session",
-          taskId,
-          path: body.path
-        });
-        sendWorkerControlResponse(res, controlResponse);
-        return;
-      }
-      try {
-        const { endpoint, response: proxyRes } = await fetchNodeWithFallback(node, "/api/worker/preview-session", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ taskId, path: body.path })
-        });
-        const workerEndpoint = endpoint;
-        log.debug("proxying preview session request to worker", { taskId, workerEndpoint });
-        await sendProxyResponse(res, proxyRes);
-        return;
-      } catch (err) {
-        if (heartbeat?.requestWorkerControl) {
-          log.warn("direct preview proxy failed, falling back to keepalive control", {
-            taskId,
-            assignedTo: task.assignedTo,
-            error: err instanceof Error ? err.message : String(err)
-          });
-          try {
-            const controlResponse = await heartbeat.requestWorkerControl(task.assignedTo, {
-              kind: "task-preview-session",
-              taskId,
-              path: body.path
-            });
-            sendWorkerControlResponse(res, controlResponse);
-            return;
-          } catch (fallbackErr) {
-            log.warn("keepalive preview fallback failed", {
-              taskId,
-              assignedTo: task.assignedTo,
-              error: fallbackErr instanceof Error ? fallbackErr.message : String(fallbackErr)
-            });
-          }
-        }
-        log.warn("preview session proxy error", { error: err instanceof Error ? err.message : String(err) });
-        throw new MeshyError("NODE_OFFLINE", "Cannot reach worker for preview session", 502);
-      }
-    }
-    res.json(await createPreviewSessionPayload(req.app.locals.deps, taskId, body.path));
-  }));
+  router.use(createTaskOutputRoutes());
   return router;
 }
 
 // ../../packages/api/src/routes/worker.ts
-var import_express4 = __toESM(require_express2(), 1);
+var import_express5 = __toESM(require_express2(), 1);
 var WorkerMessageBody = external_exports.object({
   taskId: external_exports.string().min(1)
 }).and(SendMessageBody);
 var WorkerTaskBody = external_exports.object({
   taskId: external_exports.string().min(1)
 });
-function asyncHandler4(fn) {
+function asyncHandler5(fn) {
   return (req, res, next) => fn(req, res, next).catch(next);
 }
 function createWorkerRoutes() {
-  const router = (0, import_express4.Router)();
-  router.post("/execute", asyncHandler4(async (req, res) => {
+  const router = (0, import_express5.Router)();
+  router.post("/execute", asyncHandler5(async (req, res) => {
     const { taskEngine, engineRegistry, nodeRegistry, eventBus, logger: rootLogger, workDir } = req.app.locals.deps;
     const log = rootLogger.child("worker/execute");
     const task = req.body;
@@ -33863,7 +33832,7 @@ function createWorkerRoutes() {
       }
     }
   }));
-  router.post("/message", asyncHandler4(async (req, res) => {
+  router.post("/message", asyncHandler5(async (req, res) => {
     const { engineRegistry, taskEngine, nodeRegistry, eventBus, logger: rootLogger } = req.app.locals.deps;
     const log = rootLogger.child("worker/message");
     const body = WorkerMessageBody.parse(req.body);
@@ -33906,7 +33875,7 @@ function createWorkerRoutes() {
     }
     res.json({ ok: true });
   }));
-  router.post("/cancel", asyncHandler4(async (req, res) => {
+  router.post("/cancel", asyncHandler5(async (req, res) => {
     const { taskEngine, engineRegistry, logger: rootLogger } = req.app.locals.deps;
     const log = rootLogger.child("worker/cancel");
     const body = WorkerTaskBody.parse(req.body);
@@ -33926,7 +33895,7 @@ function createWorkerRoutes() {
       terminal: result.terminal
     });
   }));
-  router.post("/output", asyncHandler4(async (req, res) => {
+  router.post("/output", asyncHandler5(async (req, res) => {
     const { eventBus, engineRegistry, taskEngine, logger: rootLogger } = req.app.locals.deps;
     const log = rootLogger.child("worker/output");
     const { taskId, event } = req.body;
@@ -33941,7 +33910,7 @@ function createWorkerRoutes() {
     }
     res.json({ ok: true });
   }));
-  router.post("/heartbeat", asyncHandler4(async (req, res) => {
+  router.post("/heartbeat", asyncHandler5(async (req, res) => {
     const { heartbeat, logger: rootLogger } = req.app.locals.deps;
     const log = rootLogger.child("worker/heartbeat");
     const body = req.body;
@@ -33958,7 +33927,7 @@ function createWorkerRoutes() {
     });
     res.json(response);
   }));
-  router.post("/keepalive", asyncHandler4(async (req, res) => {
+  router.post("/keepalive", asyncHandler5(async (req, res) => {
     const { heartbeat, logger: rootLogger } = req.app.locals.deps;
     const log = rootLogger.child("worker/keepalive");
     const body = req.body;
@@ -33978,17 +33947,17 @@ function createWorkerRoutes() {
     });
     res.json(response);
   }));
-  router.post("/vote", asyncHandler4(async (req, res) => {
+  router.post("/vote", asyncHandler5(async (req, res) => {
     const { election } = req.app.locals.deps;
     const response = election.handleVoteRequest(req.body);
     res.json(response);
   }));
-  router.post("/announce", asyncHandler4(async (req, res) => {
+  router.post("/announce", asyncHandler5(async (req, res) => {
     const { election } = req.app.locals.deps;
     election.handleLeaderAnnounce(req.body);
     res.json({ ok: true });
   }));
-  router.post("/preview-session", asyncHandler4(async (req, res) => {
+  router.post("/preview-session", asyncHandler5(async (req, res) => {
     const { logger: rootLogger } = req.app.locals.deps;
     const log = rootLogger.child("worker/preview-session");
     const body = TaskPreviewSessionBody.extend({
@@ -33998,7 +33967,7 @@ function createWorkerRoutes() {
     log.info("created preview session", { taskId: body.taskId, entryPath: payload.entryPath });
     res.json(payload);
   }));
-  router.post("/control-response", asyncHandler4(async (req, res) => {
+  router.post("/control-response", asyncHandler5(async (req, res) => {
     const { heartbeat, logger: rootLogger } = req.app.locals.deps;
     const log = rootLogger.child("worker/control-response");
     const body = req.body;
@@ -34018,13 +33987,13 @@ function createWorkerRoutes() {
 }
 
 // ../../packages/api/src/routes/system.ts
-var import_express5 = __toESM(require_express2(), 1);
-function asyncHandler5(fn) {
+var import_express6 = __toESM(require_express2(), 1);
+function asyncHandler6(fn) {
   return (req, res, next) => fn(req, res, next).catch(next);
 }
 function createSystemRoutes() {
-  const router = (0, import_express5.Router)();
-  router.get("/health", asyncHandler5(async (req, res) => {
+  const router = (0, import_express6.Router)();
+  router.get("/health", asyncHandler6(async (req, res) => {
     const { logger: rootLogger } = req.app.locals.deps;
     rootLogger.child("system/health").info("received system health API call", {
       method: req.method,
@@ -34033,7 +34002,7 @@ function createSystemRoutes() {
     });
     res.json({ status: "ok", timestamp: Date.now() });
   }));
-  router.get("/info", asyncHandler5(async (req, res) => {
+  router.get("/info", asyncHandler6(async (req, res) => {
     const { nodeRegistry, getTransportType, config, dashboardOrigin } = req.app.locals.deps;
     const self = nodeRegistry.getSelf();
     res.json({
@@ -34049,7 +34018,7 @@ function createSystemRoutes() {
       }
     });
   }));
-  router.post("/transport", asyncHandler5(async (req, res) => {
+  router.post("/transport", asyncHandler6(async (req, res) => {
     const { switchTransport } = req.app.locals.deps;
     if (!switchTransport) {
       res.status(501).json({ error: "Transport switching not available" });
@@ -34063,7 +34032,7 @@ function createSystemRoutes() {
     const newEndpoint = await switchTransport(type);
     res.json({ ok: true, transportType: type, endpoint: newEndpoint });
   }));
-  router.post("/devtunnel", asyncHandler5(async (req, res) => {
+  router.post("/devtunnel", asyncHandler6(async (req, res) => {
     const { enableDevTunnel, disableDevTunnel, nodeRegistry, taskEngine } = req.app.locals.deps;
     if (!enableDevTunnel || !disableDevTunnel) {
       res.status(501).json({ error: "DevTunnel control not available" });
@@ -34092,7 +34061,7 @@ function createSystemRoutes() {
       });
     }
   }));
-  router.get("/metrics", asyncHandler5(async (req, res) => {
+  router.get("/metrics", asyncHandler6(async (req, res) => {
     const { taskEngine } = req.app.locals.deps;
     const metrics = taskEngine.getMetrics();
     res.json(metrics);
@@ -34101,7 +34070,7 @@ function createSystemRoutes() {
 }
 
 // ../../packages/api/src/routes/events.ts
-var import_express6 = __toESM(require_express2(), 1);
+var import_express7 = __toESM(require_express2(), 1);
 var HEARTBEAT_INTERVAL_MS = 15e3;
 var CATEGORY_MAP = {
   tasks: "task.",
@@ -34136,7 +34105,7 @@ function shouldIncludeEvent(eventName, categories) {
   });
 }
 function createEventRoutes() {
-  const router = (0, import_express6.Router)();
+  const router = (0, import_express7.Router)();
   router.get("/", (req, res) => {
     const { eventBus } = req.app.locals.deps;
     const categories = parseFilter(req.query.filter);
@@ -34187,8 +34156,8 @@ var JSON_BODY_LIMIT_LARGE = "25mb";
 function resolveRuntimeBaseDir() {
   const entryPath = process.argv[1];
   if (typeof entryPath === "string" && entryPath.length > 0) {
-    const resolved = fs15.realpathSync(path15.resolve(entryPath));
-    return path15.dirname(resolved);
+    const resolved = fs14.realpathSync(path14.resolve(entryPath));
+    return path14.dirname(resolved);
   }
   return process.cwd();
 }
@@ -34196,25 +34165,25 @@ function resolveStaticDir(baseDir) {
   const envStaticDir = process.env.MESHY_STATIC_DIR;
   const candidateDirs = [
     envStaticDir,
-    path15.resolve(baseDir, "dashboard"),
-    path15.resolve(baseDir, "../dashboard"),
-    path15.resolve(baseDir, "../../dashboard/dist"),
-    path15.resolve(baseDir, "../../../packages/dashboard/dist"),
-    path15.resolve(baseDir, "../public"),
-    path15.resolve(baseDir, "../../packages/api/public"),
-    path15.resolve(baseDir, "../../../packages/api/public"),
-    path15.resolve(process.cwd(), "packages/dashboard/dist"),
-    path15.resolve(process.cwd(), "packages/api/public")
+    path14.resolve(baseDir, "dashboard"),
+    path14.resolve(baseDir, "../dashboard"),
+    path14.resolve(baseDir, "../../dashboard/dist"),
+    path14.resolve(baseDir, "../../../packages/dashboard/dist"),
+    path14.resolve(baseDir, "../public"),
+    path14.resolve(baseDir, "../../packages/api/public"),
+    path14.resolve(baseDir, "../../../packages/api/public"),
+    path14.resolve(process.cwd(), "packages/dashboard/dist"),
+    path14.resolve(process.cwd(), "packages/api/public")
   ].filter((value) => typeof value === "string" && value.length > 0);
   for (const candidate of candidateDirs) {
-    if (fs15.existsSync(candidate)) {
+    if (fs14.existsSync(candidate)) {
       return candidate;
     }
   }
   return null;
 }
 function createServer2(deps) {
-  const app = (0, import_express7.default)();
+  const app = (0, import_express8.default)();
   app.locals.deps = deps;
   if (typeof deps.heartbeat.setControlRequestHandler === "function") {
     deps.heartbeat.setControlRequestHandler((request) => executeWorkerControlRequest(deps, request));
@@ -34238,7 +34207,7 @@ function createServer2(deps) {
   const runtimeBaseDir = resolveRuntimeBaseDir();
   const staticDir = resolveStaticDir(runtimeBaseDir);
   if (staticDir) {
-    const staticMiddleware = import_express7.default.static(staticDir);
+    const staticMiddleware = import_express8.default.static(staticDir);
     app.use((req, res, next) => {
       if (isApiRequest(req)) {
         next();
@@ -34251,10 +34220,10 @@ function createServer2(deps) {
       staticMiddleware(req, res, next);
     });
   }
-  app.use(import_express7.default.json({ limit: JSON_BODY_LIMIT }));
+  app.use(import_express8.default.json({ limit: JSON_BODY_LIMIT }));
   app.use(createAuthMiddleware(authConfig));
   app.use(createRoutingMiddleware(deps.dataRouter));
-  const largeBodyParser = import_express7.default.json({ limit: JSON_BODY_LIMIT_LARGE });
+  const largeBodyParser = import_express8.default.json({ limit: JSON_BODY_LIMIT_LARGE });
   app.use("/api/cluster", createClusterRoutes());
   app.use("/api/nodes", createNodeRoutes());
   app.use("/api/tasks", largeBodyParser, createTaskRoutes());
@@ -34262,8 +34231,8 @@ function createServer2(deps) {
   app.use("/api/system", createSystemRoutes());
   app.use("/api/events", createEventRoutes());
   if (staticDir) {
-    const indexPath = path15.join(staticDir, "index.html");
-    if (fs15.existsSync(indexPath)) {
+    const indexPath = path14.join(staticDir, "index.html");
+    if (fs14.existsSync(indexPath)) {
       app.get("*", (req, res, next) => {
         if (isApiRequest(req)) {
           next();
@@ -34281,6 +34250,34 @@ function createServer2(deps) {
   return app;
 }
 
+// ../../packages/api/src/output-server.ts
+var import_express9 = __toESM(require_express2(), 1);
+var JSON_BODY_LIMIT_LARGE2 = "25mb";
+function createOutputServer(deps) {
+  if (!deps.previewSessionManager) {
+    throw new Error("Preview session manager is required for the output server");
+  }
+  const app = (0, import_express9.default)();
+  app.locals.deps = deps;
+  app.use((req, res, next) => {
+    if (handlePreviewRequest(deps.previewSessionManager, req, res)) {
+      return;
+    }
+    next();
+  });
+  const authConfig = {
+    apiKey: deps.config.apiKey,
+    validateBearerToken: deps.config.validateBearerToken,
+    allowTrustedHostBypass: false
+  };
+  const largeBodyParser = import_express9.default.json({ limit: JSON_BODY_LIMIT_LARGE2 });
+  app.use("/api/tasks", largeBodyParser, createAuthMiddleware(authConfig), createTaskOutputRoutes({
+    allowRemoteProxy: false
+  }));
+  app.use(createErrorMiddleware());
+  return app;
+}
+
 // ../../packages/transport/src/direct.ts
 var import_node_os = require("os");
 var import_node_http = require("http");
@@ -34591,8 +34588,8 @@ function createTransport(config) {
 }
 
 // src/startup.ts
-var fs16 = __toESM(require("fs"), 1);
-var path16 = __toESM(require("path"), 1);
+var fs15 = __toESM(require("fs"), 1);
+var path15 = __toESM(require("path"), 1);
 var readline = __toESM(require("readline/promises"), 1);
 var import_node_child_process6 = require("child_process");
 function getDefaultNodeName() {
@@ -34656,19 +34653,19 @@ function createDefaultCommandRunner(platform) {
   };
 }
 function getNodeMetadataPath2(storagePath) {
-  return path16.join(storagePath, "metadata.json");
+  return path15.join(storagePath, "metadata.json");
 }
 function readStartupMetadataFile(storagePath) {
   try {
-    const raw = JSON.parse(fs16.readFileSync(getNodeMetadataPath2(storagePath), "utf-8"));
+    const raw = JSON.parse(fs15.readFileSync(getNodeMetadataPath2(storagePath), "utf-8"));
     return typeof raw === "object" && raw !== null ? raw : {};
   } catch {
     return {};
   }
 }
 function writeStartupMetadataFile(storagePath, metadata) {
-  fs16.mkdirSync(storagePath, { recursive: true });
-  fs16.writeFileSync(getNodeMetadataPath2(storagePath), JSON.stringify(metadata, null, 2) + "\n", "utf-8");
+  fs15.mkdirSync(storagePath, { recursive: true });
+  fs15.writeFileSync(getNodeMetadataPath2(storagePath), JSON.stringify(metadata, null, 2) + "\n", "utf-8");
 }
 function formatLocalDate(now) {
   const year = now.getFullYear();
@@ -34913,9 +34910,9 @@ function parseArgs(argv) {
   }
   return result;
 }
-function loadConfigFile(path17) {
+function loadConfigFile(path16) {
   try {
-    const raw = fs16.readFileSync(path17, "utf-8");
+    const raw = fs15.readFileSync(path16, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -35164,14 +35161,35 @@ async function main() {
   });
   await meshyNode.start();
   const previewSessionManager = new PreviewSessionManager();
-  const previewServer = new PreviewServer(previewSessionManager);
   const previewPort = config.node.port + 1;
-  const actualPreviewPort = await previewServer.start(previewPort);
+  let actualPreviewPort = previewPort;
   let dashboardTransport = null;
   let dashboardOrigin;
   let previewTransport = null;
   let previewOrigin;
+  let outputServer = null;
   let deps;
+  async function listen(app2, port) {
+    return new Promise((resolve10, reject) => {
+      const server2 = http2.createServer(app2);
+      server2.listen(port, () => resolve10(server2));
+      server2.on("error", reject);
+    });
+  }
+  async function closeServer(server2) {
+    if (!server2) {
+      return;
+    }
+    await new Promise((resolve10, reject) => {
+      server2.close((err) => {
+        if (err) {
+          reject(err);
+          return;
+        }
+        resolve10();
+      });
+    });
+  }
   function createDashboardTransportConfig() {
     return {
       type: "devtunnel",
@@ -35294,6 +35312,10 @@ async function main() {
       const nextOrigin = await nextTransport.getEndpoint();
       previewTransport = nextTransport;
       setAdvertisedPreviewOrigin(nextOrigin);
+      meshyNode.getLogger().info("started output preview tunnel", {
+        previewOrigin: nextOrigin,
+        previewPort: actualPreviewPort
+      });
       if (previousTransport) {
         await previousTransport.stop().catch(() => void 0);
       }
@@ -35372,6 +35394,11 @@ async function main() {
   deps.previewPort = actualPreviewPort;
   deps.dashboardOrigin = dashboardOrigin;
   deps.previewOrigin = previewOrigin;
+  const outputApp = createOutputServer(deps);
+  outputServer = await listen(outputApp, previewPort);
+  const outputAddress = outputServer.address();
+  actualPreviewPort = typeof outputAddress === "object" && outputAddress ? outputAddress.port : previewPort;
+  deps.previewPort = actualPreviewPort;
   meshyNode.getLogger().info("configured node auth mode", {
     authEnabled: authMetadata.enabled,
     allowSameTenant: authMetadata.allowSameTenant,
@@ -35379,6 +35406,7 @@ async function main() {
     mainTransportType: meshyNode.getTransportType(),
     sidecarEnabled: meshyNode.isDevTunnelEnabled()
   });
+  await restartPreviewTransport(createPreviewTransportConfig());
   await syncDashboardTransport("startup");
   const previewHealthTimer = setInterval(() => {
     void (async () => {
@@ -35391,6 +35419,7 @@ async function main() {
       meshyNode.getLogger().warn("preview transport became unhealthy and was cleared", {
         previewPort: actualPreviewPort
       });
+      await restartPreviewTransport(createPreviewTransportConfig());
     })();
   }, config.cluster.heartbeatInterval);
   const dashboardHealthTimer = setInterval(() => {
@@ -35437,9 +35466,9 @@ async function main() {
       if (previewTransport) {
         await previewTransport.stop();
       }
-      await previewServer.stop();
+      await closeServer(outputServer);
       await meshyNode.stop();
-      server.close();
+      await closeServer(server);
       console.log("Goodbye!");
       process.exit(0);
     } catch (err) {