meshy-node 0.9.9 → 0.10.1

package/main.cjs

@@ -7021,7 +7021,7 @@ var require_dist = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.Agent = void 0;
-    var net = __importStar(require("net"));
+    var net2 = __importStar(require("net"));
     var http6 = __importStar(require("http"));
     var https_1 = require("https");
     __exportStar(require_helpers(), exports2);
@@ -7061,7 +7061,7 @@ var require_dist = __commonJS({
         if (!this.sockets[name2]) {
           this.sockets[name2] = [];
         }
-        const fakeSocket = new net.Socket({ writable: false });
+        const fakeSocket = new net2.Socket({ writable: false });
         this.sockets[name2].push(fakeSocket);
         this.totalSocketCount++;
         return fakeSocket;
@@ -7275,7 +7275,7 @@ var require_dist2 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.HttpsProxyAgent = void 0;
-    var net = __importStar(require("net"));
+    var net2 = __importStar(require("net"));
     var tls = __importStar(require("tls"));
     var assert_1 = __importDefault(require("assert"));
     var debug_1 = __importDefault(require_src());
@@ -7284,7 +7284,7 @@ var require_dist2 = __commonJS({
     var parse_proxy_response_1 = require_parse_proxy_response();
     var debug = (0, debug_1.default)("https-proxy-agent");
     var setServernameFromNonIpHost = (options) => {
-      if (options.servername === void 0 && options.host && !net.isIP(options.host)) {
+      if (options.servername === void 0 && options.host && !net2.isIP(options.host)) {
         return {
           ...options,
           servername: options.host
@@ -7324,10 +7324,10 @@ var require_dist2 = __commonJS({
           socket = tls.connect(setServernameFromNonIpHost(this.connectOpts));
         } else {
           debug("Creating `net.Socket`: %o", this.connectOpts);
-          socket = net.connect(this.connectOpts);
+          socket = net2.connect(this.connectOpts);
         }
         const headers = typeof this.proxyHeaders === "function" ? this.proxyHeaders() : { ...this.proxyHeaders };
-        const host = net.isIPv6(opts.host) ? `[${opts.host}]` : opts.host;
+        const host = net2.isIPv6(opts.host) ? `[${opts.host}]` : opts.host;
         let payload = `CONNECT ${host}:${opts.port} HTTP/1.1\r
 `;
         if (proxy.username || proxy.password) {
@@ -7360,7 +7360,7 @@ var require_dist2 = __commonJS({
           return socket;
         }
         socket.destroy();
-        const fakeSocket = new net.Socket({ writable: false });
+        const fakeSocket = new net2.Socket({ writable: false });
         fakeSocket.readable = true;
         req.once("socket", (s) => {
           debug("Replaying proxy buffer for failed request");
@@ -7426,7 +7426,7 @@ var require_dist3 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.HttpProxyAgent = void 0;
-    var net = __importStar(require("net"));
+    var net2 = __importStar(require("net"));
     var tls = __importStar(require("tls"));
     var debug_1 = __importDefault(require_src());
     var events_1 = require("events");
@@ -7499,7 +7499,7 @@ var require_dist3 = __commonJS({
           socket = tls.connect(this.connectOpts);
         } else {
           debug("Creating `net.Socket`: %o", this.connectOpts);
-          socket = net.connect(this.connectOpts);
+          socket = net2.connect(this.connectOpts);
         }
         await (0, events_1.once)(socket, "connect");
         return socket;
@@ -15362,8 +15362,8 @@ var require_node2 = __commonJS({
           break;
         case "PIPE":
         case "TCP":
-          var net = require("net");
-          stream2 = new net.Socket({
+          var net2 = require("net");
+          stream2 = new net2.Socket({
             fd: fd2,
             readable: false,
             writable: true
@@ -51922,7 +51922,7 @@ var require_cross_spawn = __commonJS({
     var cp = require("child_process");
     var parse6 = require_parse3();
     var enoent = require_enoent();
-    function spawn10(command, args, options) {
+    function spawn11(command, args, options) {
       const parsed = parse6(command, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
@@ -51934,8 +51934,8 @@ var require_cross_spawn = __commonJS({
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
     }
-    module2.exports = spawn10;
-    module2.exports.spawn = spawn10;
+    module2.exports = spawn11;
+    module2.exports.spawn = spawn11;
     module2.exports.sync = spawnSync7;
     module2.exports._parse = parse6;
     module2.exports._enoent = enoent;
@@ -71610,12 +71610,12 @@ var require_subchannel_address = __commonJS({
         return address.path;
       }
     }
-    var DEFAULT_PORT = 443;
+    var DEFAULT_PORT2 = 443;
     function stringToSubchannelAddress(addressString, port) {
       if ((0, net_1.isIP)(addressString)) {
         return {
           host: addressString,
-          port: port !== null && port !== void 0 ? port : DEFAULT_PORT
+          port: port !== null && port !== void 0 ? port : DEFAULT_PORT2
         };
       } else {
         return {
@@ -86019,7 +86019,7 @@ var require_transport = __commonJS({
     var resolver_1 = require_resolver();
     var subchannel_address_1 = require_subchannel_address();
     var uri_parser_1 = require_uri_parser();
-    var net = require("net");
+    var net2 = require("net");
     var subchannel_call_1 = require_subchannel_call();
     var call_number_1 = require_call_number();
     var TRACER_NAME = "transport";
@@ -86486,7 +86486,7 @@ var require_transport = __commonJS({
               const errorCallback = (error2) => {
                 reject(error2);
               };
-              const socket = net.connect(address, () => {
+              const socket = net2.connect(address, () => {
                 socket.removeListener("close", closeCallback);
                 socket.removeListener("error", errorCallback);
                 resolve24(socket);
@@ -92318,7 +92318,7 @@ var require_resolver_ip = __commonJS({
     }
     var IPV4_SCHEME = "ipv4";
     var IPV6_SCHEME = "ipv6";
-    var DEFAULT_PORT = 443;
+    var DEFAULT_PORT2 = 443;
     var IpResolver = class {
       constructor(target, listener, channelOptions) {
         var _a;
@@ -92357,7 +92357,7 @@ var require_resolver_ip = __commonJS({
           }
           addresses.push({
             host: hostPort.host,
-            port: (_a = hostPort.port) !== null && _a !== void 0 ? _a : DEFAULT_PORT
+            port: (_a = hostPort.port) !== null && _a !== void 0 ? _a : DEFAULT_PORT2
           });
         }
         this.endpoints = addresses.map((address) => ({ addresses: [address] }));
@@ -115987,14 +115987,14 @@ var init_constants6 = __esm({
 });
 
 // ../../node_modules/.pnpm/@azure+monitor-opentelemetry-exporter@1.0.0-beta.42/node_modules/@azure/monitor-opentelemetry-exporter/dist/esm/platform/nodejs/persist/fileAccessControl.js
-var import_node_fs4, import_node_os6, import_node_child_process15, import_node_process5, FileAccessControl;
+var import_node_fs4, import_node_os6, import_node_child_process16, import_node_process5, FileAccessControl;
 var init_fileAccessControl = __esm({
   "../../node_modules/.pnpm/@azure+monitor-opentelemetry-exporter@1.0.0-beta.42/node_modules/@azure/monitor-opentelemetry-exporter/dist/esm/platform/nodejs/persist/fileAccessControl.js"() {
     "use strict";
     init_cjs_shims();
     import_node_fs4 = require("fs");
     import_node_os6 = require("os");
-    import_node_child_process15 = require("child_process");
+    import_node_child_process16 = require("child_process");
     init_esm8();
     import_node_process5 = __toESM(require("process"), 1);
     FileAccessControl = class _FileAccessControl {
@@ -116054,7 +116054,7 @@ var init_fileAccessControl = __esm({
       }
       static _runICACLS(args) {
         return new Promise((resolve24, reject) => {
-          const aclProc = (0, import_node_child_process15.spawn)(_FileAccessControl.ICACLS_PATH, args, {
+          const aclProc = (0, import_node_child_process16.spawn)(_FileAccessControl.ICACLS_PATH, args, {
             windowsHide: true
           });
           aclProc.on("error", (e) => reject(e));
@@ -116068,8 +116068,8 @@ var init_fileAccessControl = __esm({
         });
       }
       static _runICACLSSync(args) {
-        if (import_node_child_process15.spawnSync) {
-          const aclProc = (0, import_node_child_process15.spawnSync)(_FileAccessControl.ICACLS_PATH, args, {
+        if (import_node_child_process16.spawnSync) {
+          const aclProc = (0, import_node_child_process16.spawnSync)(_FileAccessControl.ICACLS_PATH, args, {
             windowsHide: true
           });
           if (aclProc.error) {
@@ -116086,7 +116086,7 @@ var init_fileAccessControl = __esm({
           if (_FileAccessControl.ACL_IDENTITY) {
             resolve24(_FileAccessControl.ACL_IDENTITY);
           }
-          const psProc = (0, import_node_child_process15.spawn)(_FileAccessControl.POWERSHELL_PATH, ["-Command", "[System.Security.Principal.WindowsIdentity]::GetCurrent().Name"], {
+          const psProc = (0, import_node_child_process16.spawn)(_FileAccessControl.POWERSHELL_PATH, ["-Command", "[System.Security.Principal.WindowsIdentity]::GetCurrent().Name"], {
             windowsHide: true,
             stdio: ["ignore", "pipe", "pipe"]
             // Needed to prevent hanging on Win 7
@@ -116108,8 +116108,8 @@ var init_fileAccessControl = __esm({
         if (_FileAccessControl.ACL_IDENTITY) {
           return _FileAccessControl.ACL_IDENTITY;
         }
-        if (import_node_child_process15.spawnSync) {
-          const psProc = (0, import_node_child_process15.spawnSync)(_FileAccessControl.POWERSHELL_PATH, ["-Command", "[System.Security.Principal.WindowsIdentity]::GetCurrent().Name"], {
+        if (import_node_child_process16.spawnSync) {
+          const psProc = (0, import_node_child_process16.spawnSync)(_FileAccessControl.POWERSHELL_PATH, ["-Command", "[System.Security.Principal.WindowsIdentity]::GetCurrent().Name"], {
             windowsHide: true,
             stdio: ["ignore", "pipe", "pipe"]
             // Needed to prevent hanging on Win 7
@@ -139368,8 +139368,6 @@ var TaskEngine = class {
     this.eventBus = eventBus;
     this.logDir = logDir;
   }
-  /** Tracks which node a task was previously assigned to, for retry preference. */
-  previousAssignments = /* @__PURE__ */ new Map();
   deletedTaskIds = /* @__PURE__ */ new Set();
   // ── Task CRUD ────────────────────────────────────────────────────────
   createTask(input) {
@@ -139499,7 +139497,6 @@ var TaskEngine = class {
     if (!task) return false;
     const deleted = this.store.deleteTask(id);
     if (!deleted) return false;
-    this.previousAssignments.delete(id);
     this.deletedTaskIds.add(id);
     if (this.logDir) {
       const logFile = path5.join(this.logDir, `${id}.jsonl`);
@@ -139521,7 +139518,6 @@ var TaskEngine = class {
     }
     const now = Date.now();
     this.store.updateTask(id, { status: "cancelled", updatedAt: now });
-    this.previousAssignments.delete(id);
     this.eventBus.emit("task.status", {
       taskId: id,
       status: "cancelled"
@@ -139586,7 +139582,7 @@ var TaskEngine = class {
   // ── Dispatch failure ─────────────────────────────────────────────────
   /**
    * Handle a dispatch failure for a task that is still in `assigned` status.
-   * Mirrors reportFailure() but for the assigned→pending/failed transition.
+   * Dispatch failures are terminal; explicit user retry is handled by retryTask().
    */
   failDispatch(taskId, error2) {
     const task = this.store.getTask(taskId);
@@ -139600,30 +139596,10 @@ var TaskEngine = class {
         400
       );
     }
-    const now = Date.now();
-    const newRetryCount = task.retryCount + 1;
-    if (newRetryCount <= task.maxRetries) {
-      if (task.assignedTo) {
-        this.previousAssignments.set(taskId, task.assignedTo);
-      }
-      const updated2 = this.store.updateTask(taskId, {
-        status: "pending",
-        retryCount: newRetryCount,
-        assignedTo: null,
-        assignedNodeName: null,
-        error: error2,
-        updatedAt: now
-      });
-      this.eventBus.emit("task.status", {
-        taskId,
-        status: "pending"
-      });
-      return updated2;
-    }
     const updated = this.store.updateTask(taskId, {
       status: "failed",
       error: error2,
-      updatedAt: now
+      updatedAt: Date.now()
     });
     this.eventBus.emit("task.status", {
       taskId,
@@ -139687,12 +139663,12 @@ var TaskEngine = class {
         const backoff = this.getRetryBackoff(task.retryCount - 1);
         if (now - task.updatedAt < backoff) continue;
       }
-      const previousNodeId = this.previousAssignments.get(task.id);
       const snapshotOwnerId = getJoinTaskSnapshotOwnerId(task);
-      const candidateNodes = snapshotOwnerId ? availableNodes.filter((node) => node.id === snapshotOwnerId) : availableNodes;
+      const requiredNodeId = snapshotOwnerId ?? task.assignedTo;
+      const candidateNodes = requiredNodeId ? availableNodes.filter((node) => node.id === requiredNodeId) : availableNodes;
       const capableNodes = candidateNodes.filter((node) => nodeSupportsAgent(node, task.agent));
       if (capableNodes.length === 0) continue;
-      const targetNode = this.pickLeastBusyNode(capableNodes, nodeLoad, previousNodeId);
+      const targetNode = this.pickLeastBusyNode(capableNodes, nodeLoad);
       if (!targetNode) continue;
       const assignedAt = Date.now();
       this.store.updateTask(task.id, {
@@ -139754,7 +139730,6 @@ var TaskEngine = class {
       status: "completed",
       result
     });
-    this.previousAssignments.delete(taskId);
     return updated;
   }
   reportFailure(taskId, error2) {
@@ -139769,30 +139744,10 @@ var TaskEngine = class {
         400
       );
     }
-    const now = Date.now();
-    const newRetryCount = task.retryCount + 1;
-    if (newRetryCount <= task.maxRetries) {
-      if (task.assignedTo) {
-        this.previousAssignments.set(taskId, task.assignedTo);
-      }
-      const updated2 = this.store.updateTask(taskId, {
-        status: "pending",
-        retryCount: newRetryCount,
-        assignedTo: null,
-        assignedNodeName: null,
-        error: error2,
-        updatedAt: now
-      });
-      this.eventBus.emit("task.status", {
-        taskId,
-        status: "pending"
-      });
-      return updated2;
-    }
     const updated = this.store.updateTask(taskId, {
       status: "failed",
       error: error2,
-      updatedAt: now
+      updatedAt: Date.now()
     });
     this.eventBus.emit("task.status", {
       taskId,
@@ -139814,15 +139769,10 @@ var TaskEngine = class {
         400
       );
     }
-    if (task.assignedTo) {
-      this.previousAssignments.set(taskId, task.assignedTo);
-    }
     const now = Date.now();
     const updated = this.store.updateTask(taskId, {
       status: "pending",
       retryCount: 0,
-      assignedTo: null,
-      assignedNodeName: null,
       error: null,
       result: null,
       updatedAt: now
@@ -139855,15 +139805,14 @@ var TaskEngine = class {
   getRetryBackoff(retryCount) {
     return Math.min(Math.pow(2, retryCount) * 1e3, 3e4);
   }
-  pickLeastBusyNode(nodes, loadMap, avoidNodeId) {
+  pickLeastBusyNode(nodes, loadMap) {
     if (nodes.length === 0) return null;
     let bestNode = null;
     let bestLoad = Infinity;
     for (const node of nodes) {
       const load = loadMap.get(node.id) ?? 0;
-      const adjustedLoad = avoidNodeId && node.id === avoidNodeId ? load + 0.5 : load;
-      if (adjustedLoad < bestLoad) {
-        bestLoad = adjustedLoad;
+      if (load < bestLoad) {
+        bestLoad = load;
         bestNode = node;
       }
     }
@@ -146951,6 +146900,8 @@ var sharedMcpControl;
 var DEFAULT_START_POLL_INTERVAL_MS = 1e4;
 var DEFAULT_START_TIMEOUT_MS = 15 * 6e4;
 var ALWAYS_ONLINE_STARTABLE_DEVBOX_STATUSES = /* @__PURE__ */ new Set(["hibernated", "stopped"]);
+var DEVBOX_MCP_COMMAND = "npx";
+var DEVBOX_MCP_ARGS = ["-y", "-p", "node@22", "-p", "@microsoft/devbox-mcp@latest", "devbox-mcp-server"];
 function getDevBoxControl(deps) {
   if (deps.devBoxControl) return deps.devBoxControl;
   sharedMcpControl ??= new McpDevBoxControl(deps.logger);
@@ -147108,7 +147059,7 @@ var McpDevBoxControl = class {
       Promise.resolve().then(() => (init_stdio2(), stdio_exports))
     ]);
     const client = new Client2({ name: "meshy-devbox", version: "0.1.0" }, { capabilities: {} });
-    const transport = new StdioClientTransport2({ command: "npx", args: ["-y", "@microsoft/devbox-mcp"] });
+    const transport = new StdioClientTransport2({ command: DEVBOX_MCP_COMMAND, args: DEVBOX_MCP_ARGS });
     transport.onclose = () => {
       this.clientPromise = null;
     };
@@ -148669,9 +148620,365 @@ function isRecord9(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 
+// ../../packages/api/src/node/copilot-tunnel-service.ts
+init_cjs_shims();
+var import_node_child_process10 = require("child_process");
+var import_node_net = __toESM(require("net"), 1);
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_PORT = 8314;
+var DEFAULT_OUTPUT_LIMIT_BYTES = 8e3;
+var DEFAULT_PORT_CHECK_TIMEOUT_MS = 750;
+var DEFAULT_POLL_INTERVAL_MS = 1e3;
+var DEFAULT_STARTUP_TIMEOUT_MS = 15 * 60 * 1e3;
+var DEFAULT_STOP_TIMEOUT_MS = 3e3;
+var GHC_TUNNEL_ARGS = ["-y", "ghc-tunnel@latest", "-d"];
+var trackedTunnels = /* @__PURE__ */ new Map();
+function createTail() {
+  return { text: "", observedBytes: 0, truncated: false };
+}
+function appendTail(tail, chunk, limitBytes) {
+  tail.observedBytes += chunk.length;
+  const current = Buffer.from(tail.text, "utf8");
+  const combined = Buffer.concat([current, chunk]);
+  const next = combined.length > limitBytes ? combined.subarray(combined.length - limitBytes) : combined;
+  tail.text = next.toString("utf8");
+  tail.truncated = tail.observedBytes > limitBytes;
+}
+function sleep2(ms) {
+  return new Promise((resolve24) => setTimeout(resolve24, ms));
+}
+function defaultSpawnTunnel(command, args, options) {
+  return (0, import_node_child_process10.spawn)(command, args, options);
+}
+function execFileText(command, args) {
+  return new Promise((resolve24) => {
+    (0, import_node_child_process10.execFile)(command, args, { windowsHide: true }, (error2, stdout) => {
+      resolve24(error2 ? "" : stdout);
+    });
+  });
+}
+function parseProcessIds(output) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const token of output.split(/\s+/)) {
+    const pid = Number(token.trim());
+    if (Number.isInteger(pid) && pid > 0 && pid !== process.pid) seen.add(pid);
+  }
+  return [...seen];
+}
+async function defaultFindPortProcessIds(port) {
+  if (process.platform === "win32") {
+    const output2 = await execFileText("powershell.exe", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-Command",
+      `Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue | Select-Object -ExpandProperty OwningProcess -Unique`
+    ]);
+    return parseProcessIds(output2);
+  }
+  const output = await execFileText("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"]);
+  return parseProcessIds(output);
+}
+async function defaultKillProcessId(pid, signal) {
+  if (pid === process.pid) return;
+  if (process.platform === "win32") {
+    const args = ["/PID", String(pid), "/T"];
+    if (signal === "SIGKILL") args.push("/F");
+    await execFileText("taskkill.exe", args);
+    return;
+  }
+  try {
+    process.kill(pid, signal);
+  } catch (err) {
+    if (err.code !== "ESRCH") throw err;
+  }
+}
+function tunnelKey(host, port) {
+  return `${host}:${port}`;
+}
+function tunnelCommand(platform6) {
+  return platform6 === "win32" ? "npx.cmd" : "npx";
+}
+function tunnelArgs() {
+  return [...GHC_TUNNEL_ARGS];
+}
+function windowsShellQuote(value) {
+  return /[\s&()^|<>"]/.test(value) ? `"${value.replace(/"/g, '\\"')}"` : value;
+}
+function createCopilotTunnelSpawnInvocation(host, port, platform6 = process.platform) {
+  void host;
+  void port;
+  const displayCommand = tunnelCommand(platform6);
+  const displayArgs = tunnelArgs();
+  if (platform6 !== "win32") return { command: displayCommand, args: displayArgs, displayCommand, displayArgs };
+  return {
+    command: "cmd.exe",
+    args: ["/d", "/s", "/c", [displayCommand, ...displayArgs].map(windowsShellQuote).join(" ")],
+    displayCommand,
+    displayArgs
+  };
+}
+function checkTcpPort(host, port, timeoutMs) {
+  return new Promise((resolve24) => {
+    const socket = import_node_net.default.createConnection({ host, port });
+    let settled = false;
+    const finish = (available) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve24(available);
+    };
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => finish(true));
+    socket.once("timeout", () => finish(false));
+    socket.once("error", () => finish(false));
+  });
+}
+function normalizeLoopbackHost(host) {
+  return host.toLowerCase().replace(/^\[|\]$/g, "");
+}
+function loopbackProbeHosts(host) {
+  const normalized = normalizeLoopbackHost(host);
+  if (normalized !== DEFAULT_HOST && normalized !== "localhost" && normalized !== "::1") return [host];
+  return Array.from(/* @__PURE__ */ new Set([normalized, DEFAULT_HOST, "localhost", "::1"]));
+}
+async function checkCopilotLoopbackPort(host, port, timeoutMs, checker = checkTcpPort) {
+  const hosts = loopbackProbeHosts(host);
+  const results = await Promise.all(hosts.map((candidate) => checker(candidate, port, timeoutMs)));
+  return results.some(Boolean);
+}
+function parseGithubDeviceFlow(output) {
+  const url3 = output.match(/Please visit:\s*(https?:\/\/\S+)/i)?.[1];
+  const code = output.match(/enter the code:\s*([A-Z0-9]{4}-[A-Z0-9]{4})/i)?.[1];
+  if (!url3 || !code) return null;
+  const expires = output.match(/expires in\s+(\d+)\s+seconds/i)?.[1];
+  return {
+    url: url3,
+    code,
+    ...expires ? { expiresInSeconds: Number(expires) } : {}
+  };
+}
+function buildResult(options) {
+  const available = options.available ?? (options.status === "already-running" || options.status === "available");
+  return {
+    ok: options.status !== "failed",
+    available,
+    port: options.port,
+    host: options.host,
+    command: options.command,
+    args: options.args,
+    pid: options.pid,
+    status: options.status,
+    stdout: options.stdout.text,
+    stderr: options.stderr.text,
+    stdoutTruncated: options.stdout.truncated,
+    stderrTruncated: options.stderr.truncated,
+    auth: options.auth ?? null,
+    detail: options.detail ?? null
+  };
+}
+async function checkGithubCopilotTunnel(options = {}) {
+  const host = options.host ?? DEFAULT_HOST;
+  const port = options.port ?? DEFAULT_PORT;
+  const invocation = createCopilotTunnelSpawnInvocation(host, port);
+  const command = invocation.displayCommand;
+  const args = invocation.displayArgs;
+  const stdout = createTail();
+  const stderr = createTail();
+  const portCheckTimeoutMs = options.portCheckTimeoutMs ?? DEFAULT_PORT_CHECK_TIMEOUT_MS;
+  const portChecker = options.portChecker ?? checkCopilotLoopbackPort;
+  const status = await portChecker(host, port, portCheckTimeoutMs) ? "already-running" : "unavailable";
+  const pid = trackedTunnels.get(tunnelKey(host, port))?.pid ?? null;
+  return buildResult({ host, port, command, args, pid, status, stdout, stderr });
+}
+function waitForProcessClose(child, timeoutMs) {
+  return new Promise((resolve24) => {
+    let settled = false;
+    const finish = (closed) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve24(closed);
+    };
+    const timer = setTimeout(() => finish(false), timeoutMs);
+    child.once("close", () => finish(true));
+  });
+}
+async function terminateChildProcess(child, timeoutMs) {
+  const closedAfterTerm = waitForProcessClose(child, timeoutMs);
+  child.kill?.("SIGTERM");
+  if (await closedAfterTerm) return;
+  const closedAfterKill = waitForProcessClose(child, Math.min(timeoutMs, 1e3));
+  child.kill?.("SIGKILL");
+  await closedAfterKill;
+}
+async function waitForPortToClose(options) {
+  const deadline = Date.now() + options.timeoutMs;
+  do {
+    if (!await options.portChecker(options.host, options.port, options.portCheckTimeoutMs)) return true;
+    await sleep2(Math.min(200, Math.max(0, deadline - Date.now())));
+  } while (Date.now() < deadline);
+  return !await options.portChecker(options.host, options.port, options.portCheckTimeoutMs);
+}
+async function stopPortOwners(options) {
+  const pids = await options.findPortProcessIds(options.port);
+  if (pids.length === 0) {
+    return {
+      pids,
+      available: await options.portChecker(options.host, options.port, options.portCheckTimeoutMs)
+    };
+  }
+  await Promise.all(pids.map((pid) => options.killProcessId(pid, "SIGTERM")));
+  let closed = await waitForPortToClose({ ...options, timeoutMs: options.stopTimeoutMs });
+  if (!closed) {
+    await Promise.all(pids.map((pid) => options.killProcessId(pid, "SIGKILL")));
+    closed = await waitForPortToClose({ ...options, timeoutMs: Math.min(options.stopTimeoutMs, 1e3) });
+  }
+  return { pids, available: !closed };
+}
+function formatProcessList(pids) {
+  return pids.length === 1 ? `process ${pids[0]}` : `processes ${pids.join(", ")}`;
+}
+async function disableGithubCopilotTunnel(options = {}) {
+  const host = options.host ?? DEFAULT_HOST;
+  const port = options.port ?? DEFAULT_PORT;
+  const invocation = createCopilotTunnelSpawnInvocation(host, port);
+  const command = invocation.displayCommand;
+  const args = invocation.displayArgs;
+  const stdout = createTail();
+  const stderr = createTail();
+  const portCheckTimeoutMs = options.portCheckTimeoutMs ?? DEFAULT_PORT_CHECK_TIMEOUT_MS;
+  const stopTimeoutMs = options.stopTimeoutMs ?? DEFAULT_STOP_TIMEOUT_MS;
+  const portChecker = options.portChecker ?? checkCopilotLoopbackPort;
+  const findPortProcessIds = options.findPortProcessIds ?? defaultFindPortProcessIds;
+  const killProcessId = options.killProcessId ?? defaultKillProcessId;
+  const key = tunnelKey(host, port);
+  const child = trackedTunnels.get(key);
+  if (!child) {
+    const available2 = await portChecker(host, port, portCheckTimeoutMs);
+    if (available2) {
+      const stopped = await stopPortOwners({ host, port, stopTimeoutMs, portCheckTimeoutMs, portChecker, findPortProcessIds, killProcessId });
+      return buildResult({
+        host,
+        port,
+        command,
+        args,
+        pid: stopped.pids[0] ?? null,
+        status: stopped.available ? "failed" : "stopped",
+        available: stopped.available,
+        stdout,
+        stderr,
+        detail: stopped.pids.length === 0 ? `No process owner was found for port ${port}` : stopped.available ? `Stopped ${formatProcessList(stopped.pids)} but port ${port} is still reachable` : `Stopped ${formatProcessList(stopped.pids)} on port ${port}`
+      });
+    }
+    return buildResult({
+      host,
+      port,
+      command,
+      args,
+      pid: null,
+      status: "stopped",
+      available: false,
+      stdout,
+      stderr,
+      detail: null
+    });
+  }
+  const pid = typeof child.pid === "number" ? child.pid : null;
+  await terminateChildProcess(child, stopTimeoutMs);
+  trackedTunnels.delete(key);
+  let available = await portChecker(host, port, portCheckTimeoutMs);
+  let stoppedOwners = [];
+  if (available) {
+    const stopped = await stopPortOwners({ host, port, stopTimeoutMs, portCheckTimeoutMs, portChecker, findPortProcessIds, killProcessId });
+    available = stopped.available;
+    stoppedOwners = stopped.pids;
+  }
+  return buildResult({
+    host,
+    port,
+    command,
+    args,
+    pid,
+    status: available ? "failed" : "stopped",
+    available,
+    stdout,
+    stderr,
+    detail: available ? `Copilot tunnel process ${pid ?? "unknown"} stopped but port ${port} is still reachable` : stoppedOwners.length > 0 ? `Stopped ${formatProcessList(stoppedOwners)} on port ${port}` : null
+  });
+}
+async function enableGithubCopilotTunnel(options = {}) {
+  const host = options.host ?? DEFAULT_HOST;
+  const port = options.port ?? DEFAULT_PORT;
+  const invocation = createCopilotTunnelSpawnInvocation(host, port);
+  const command = invocation.displayCommand;
+  const args = invocation.displayArgs;
+  const stdout = createTail();
+  const stderr = createTail();
+  const outputLimitBytes = options.outputLimitBytes ?? DEFAULT_OUTPUT_LIMIT_BYTES;
+  const portCheckTimeoutMs = options.portCheckTimeoutMs ?? DEFAULT_PORT_CHECK_TIMEOUT_MS;
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const stopTimeoutMs = options.stopTimeoutMs ?? DEFAULT_STOP_TIMEOUT_MS;
+  const startupTimeoutMs = options.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
+  const portChecker = options.portChecker ?? checkCopilotLoopbackPort;
+  const key = tunnelKey(host, port);
+  if (await portChecker(host, port, portCheckTimeoutMs)) {
+    return buildResult({ host, port, command, args, pid: null, status: "already-running", stdout, stderr });
+  }
+  let auth = null;
+  const childState = { exit: null, spawnError: null };
+  const child = (options.spawnTunnel ?? defaultSpawnTunnel)(invocation.command, invocation.args, {
+    cwd: options.cwd ?? process.cwd(),
+    shell: false,
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const pid = typeof child.pid === "number" ? child.pid : null;
+  const publish2 = (status, detail) => {
+    options.onProgress?.(buildResult({ host, port, command, args, pid, status, stdout, stderr, auth, detail }));
+  };
+  const handleOutput = (target, chunk) => {
+    appendTail(target, chunk, outputLimitBytes);
+    auth = parseGithubDeviceFlow(`${stdout.text}
+${stderr.text}`) ?? auth;
+    publish2(auth ? "auth-required" : "starting");
+  };
+  child.stdout?.on("data", (chunk) => handleOutput(stdout, Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
+  child.stderr?.on("data", (chunk) => handleOutput(stderr, Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
+  child.once("error", (err) => {
+    childState.spawnError = err instanceof Error ? err : new Error(String(err));
+  });
+  child.once("close", (code, signal) => {
+    childState.exit = { code, signal };
+    if (trackedTunnels.get(key) === child) trackedTunnels.delete(key);
+  });
+  publish2("starting");
+  const deadline = Date.now() + startupTimeoutMs;
+  while (Date.now() < deadline) {
+    if (await portChecker(host, port, portCheckTimeoutMs)) {
+      trackedTunnels.set(key, child);
+      child.unref?.();
+      return buildResult({ host, port, command, args, pid, status: "available", stdout, stderr, auth });
+    }
+    if (childState.spawnError) {
+      return buildResult({ host, port, command, args, pid, status: "failed", stdout, stderr, auth, detail: childState.spawnError.message });
+    }
+    if (childState.exit) {
+      const detail = childState.exit.code === 0 ? `ghc-tunnel exited before port ${port} became reachable` : `ghc-tunnel exited with code ${childState.exit.code ?? "null"}${childState.exit.signal ? ` (${childState.exit.signal})` : ""}`;
+      return buildResult({ host, port, command, args, pid, status: "failed", stdout, stderr, auth, detail });
+    }
+    await sleep2(pollIntervalMs);
+  }
+  await terminateChildProcess(child, stopTimeoutMs);
+  return buildResult({ host, port, command, args, pid, status: "failed", stdout, stderr, auth, detail: `Timed out waiting for port ${port}` });
+}
+
 // ../../packages/api/src/node/node-operation-service.ts
 var LEADER_REPORT_RETRY_MS = 5e3;
+var REMOTE_OPERATION_REFRESH_TIMEOUT_MS = 2e3;
 var OPERATION_COMMIT_EFFECT = /* @__PURE__ */ Symbol("operationCommitEffect");
+function sleep3(ms) {
+  return new Promise((resolve24) => setTimeout(resolve24, ms));
+}
 var NodeOperationFailure = class extends Error {
   constructor(message, result) {
     super(message);
@@ -148708,6 +149015,9 @@ var NodeOperationService = class {
     this.registerHandler("devbox.start", runDevBoxStartOperation);
     this.registerHandler("runtime.restart", runRuntimeRestartOperation);
     this.registerHandler("workdir.branch-create", runWorkDirBranchCreateOperation);
+    this.registerHandler("copilot.tunnel.status", runCopilotTunnelStatusOperation);
+    this.registerHandler("copilot.tunnel", runCopilotTunnelOperation);
+    this.registerHandler("copilot.tunnel.disable", runCopilotTunnelDisableOperation);
   }
   handlers = /* @__PURE__ */ new Map();
   leaderReportRetryTimers = /* @__PURE__ */ new Map();
@@ -148737,6 +149047,15 @@ var NodeOperationService = class {
   list(filter) {
     return this.store.list(filter);
   }
+  async waitForTerminal(id, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      const current = this.store.get(id);
+      if (!current || isTerminalStatus(current.status)) return current;
+      await sleep3(50);
+    }
+    return this.store.get(id);
+  }
   accept(operation) {
     const current = this.store.get(operation.id);
     if (current) {
@@ -148754,6 +149073,9 @@ var NodeOperationService = class {
   }
   applyRemoteUpdate(operation) {
     const current = this.store.get(operation.id);
+    if (current && isTerminalStatus(current.status) && !isTerminalStatus(operation.status)) {
+      return current;
+    }
     const saved = this.store.upsert(current ? { ...current, ...operation } : operation);
     this.applyOperationSideEffects(saved);
     this.deps.eventBus.emit("node.operation.updated", { operation: saved });
@@ -148779,7 +149101,9 @@ var NodeOperationService = class {
     try {
       const handler = this.handlers.get(running.kind);
       if (!handler) throw new Error(`No node operation handler registered for kind: ${running.kind}`);
-      const handled = readOperationCommitEffect(await handler(running, this.deps));
+      const handled = readOperationCommitEffect(await handler(running, this.deps, {
+        updateProgress: (result) => this.update(id, { result }, { reportToLeader: true })
+      }));
       const saved = this.update(id, { status: "succeeded", result: handled.result, completedAt: Date.now() }, {
         reportToLeader: handled.afterCommit ? false : true
       });
@@ -148892,19 +149216,69 @@ function getNodeOperationService(deps) {
   deps.nodeOperationService = service;
   return service;
 }
-async function dispatchNodeOperation(deps, operation, node) {
-  const message = createNodeMessage("node.operation.execute", { operation });
+async function refreshRemoteNodeOperation(deps, operation) {
+  if (isTerminalStatus(operation.status)) return operation;
+  const self2 = deps.nodeRegistry.getSelf();
+  if (operation.nodeId === self2.id) return operation;
+  const node = deps.nodeRegistry.getNode(operation.nodeId);
+  if (!node) return operation;
+  const message = createNodeMessage("node.operation.get", { operationId: operation.id });
+  const heartbeat = deps.heartbeat;
+  try {
+    const response = heartbeat.canPushToNode?.(node.id) === false && heartbeat.requestNodeMessage ? await heartbeat.requestNodeMessage(node.id, { ...message, expectsResponse: true }, REMOTE_OPERATION_REFRESH_TIMEOUT_MS) : await new NodeMessageClient({
+      heartbeat: heartbeat.requestNodeMessage ? { requestNodeMessage: heartbeat.requestNodeMessage.bind(heartbeat) } : void 0,
+      timeoutMs: REMOTE_OPERATION_REFRESH_TIMEOUT_MS,
+      logger: deps.logger
+    }).request(node, message);
+    const remote = readOperationFromResponse(response);
+    return remote ? getNodeOperationService(deps).applyRemoteUpdate(remote) : operation;
+  } catch (err) {
+    deps.logger.child("node-operation").debug("failed to refresh remote node operation", {
+      operationId: operation.id,
+      kind: operation.kind,
+      nodeId: operation.nodeId,
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return operation;
+  }
+}
+async function dispatchNodeOperation(deps, operation, node, options = {}) {
+  const message = createNodeMessage("node.operation.execute", {
+    operation,
+    ...options.waitForCompletionMs !== void 0 ? { waitForCompletionMs: options.waitForCompletionMs } : {}
+  });
   const heartbeat = deps.heartbeat;
   if (heartbeat.canPushToNode?.(node.id) === false) {
+    if (options.waitForCompletionMs !== void 0 && heartbeat.requestNodeMessage) {
+      const response = await heartbeat.requestNodeMessage(node.id, message, options.waitForCompletionMs + 1e4);
+      return applyOperationResponse(deps, response);
+    }
     if (!heartbeat.enqueueNodeMessage) throw new Error(`Cannot queue node operation for ${node.id}`);
     heartbeat.enqueueNodeMessage(node.id, message);
-    return;
+    return null;
   }
   const client = new NodeMessageClient({
-    heartbeat: heartbeat.enqueueNodeMessage ? { enqueueNodeMessage: heartbeat.enqueueNodeMessage.bind(heartbeat) } : void 0,
+    heartbeat: {
+      ...heartbeat.enqueueNodeMessage ? { enqueueNodeMessage: heartbeat.enqueueNodeMessage.bind(heartbeat) } : {},
+      ...heartbeat.requestNodeMessage ? { requestNodeMessage: heartbeat.requestNodeMessage.bind(heartbeat) } : {}
+    },
     logger: deps.logger
   });
+  if (options.waitForCompletionMs !== void 0) {
+    return applyOperationResponse(deps, await client.request(node, message));
+  }
   await client.send(node, message);
+  return null;
+}
+function applyOperationResponse(deps, response) {
+  if (!response.ok) throw new Error(`Node operation delivery failed with HTTP ${response.statusCode}`);
+  const operation = readOperationFromResponse(response);
+  return operation ? getNodeOperationService(deps).applyRemoteUpdate(operation) : null;
+}
+function readOperationFromResponse(response) {
+  if (!response.ok) return null;
+  const operation = response.body && typeof response.body === "object" ? response.body.operation : void 0;
+  return operation && typeof operation === "object" ? operation : null;
 }
 function runAgentUpgradeOperation(operation, deps) {
   const agent = readPayloadString(operation, "agent");
@@ -148953,6 +149327,23 @@ function runWorkDirBranchCreateOperation(operation, deps) {
     }
   );
 }
+async function runCopilotTunnelOperation(_operation, deps, context4) {
+  const result = await (deps.enableCopilotTunnel?.({ onProgress: context4.updateProgress, cwd: deps.workDir }) ?? enableGithubCopilotTunnel({ onProgress: context4.updateProgress, cwd: deps.workDir }));
+  if (!result.ok) {
+    throw new NodeOperationFailure(result.detail ?? "Copilot tunnel failed", result);
+  }
+  return result;
+}
+async function runCopilotTunnelStatusOperation(_operation, deps) {
+  return deps.checkCopilotTunnel?.({}) ?? checkGithubCopilotTunnel();
+}
+async function runCopilotTunnelDisableOperation(_operation, deps) {
+  const result = await (deps.disableCopilotTunnel?.({}) ?? disableGithubCopilotTunnel());
+  if (!result.ok) {
+    throw new NodeOperationFailure(result.detail ?? "Copilot tunnel stop failed", result);
+  }
+  return result;
+}
 function readPayloadString(operation, key) {
   const payload = operation.payload;
   if (!payload || typeof payload !== "object") return "";
@@ -149406,14 +149797,14 @@ init_cjs_shims();
 
 // ../../packages/api/src/node/node-terminal-session-service.ts
 init_cjs_shims();
-var import_node_child_process10 = require("child_process");
+var import_node_child_process11 = require("child_process");
 var import_node_crypto8 = require("crypto");
 
 // ../../packages/api/src/node/node-terminal-service.ts
 init_cjs_shims();
 var fs22 = __toESM(require("fs"), 1);
 var path26 = __toESM(require("path"), 1);
-var DEFAULT_OUTPUT_LIMIT_BYTES = 64 * 1024;
+var DEFAULT_OUTPUT_LIMIT_BYTES2 = 64 * 1024;
 function isAbsolutePath2(value) {
   return path26.isAbsolute(value) || /^[A-Za-z]:[\/]/.test(value);
 }
@@ -149434,7 +149825,7 @@ var MAX_COMPLETED_SESSIONS = 10;
 function createOutputBuffer() {
   return { chunks: [], bytes: 0, observedBytes: 0 };
 }
-function appendTail(buffer, chunk, limitBytes) {
+function appendTail2(buffer, chunk, limitBytes) {
   buffer.observedBytes += chunk.length;
   const nextChunk = chunk.length > limitBytes ? chunk.subarray(chunk.length - limitBytes) : chunk;
   buffer.chunks.push(nextChunk);
@@ -149487,7 +149878,7 @@ var NodeTerminalSessionService = class {
     }
     const cwd = resolveNodeTerminalCwd(nodeId, rootPath, options.cwd);
     const startedAt = Date.now();
-    const child = (0, import_node_child_process10.spawn)(normalizedCommand, {
+    const child = (0, import_node_child_process11.spawn)(normalizedCommand, {
       cwd,
       shell: true,
       windowsHide: true,
@@ -149518,15 +149909,15 @@ var NodeTerminalSessionService = class {
       stderr: createOutputBuffer(),
       sequence: this.nextSequence++
     };
-    const outputLimitBytes = options.outputLimitBytes ?? DEFAULT_OUTPUT_LIMIT_BYTES;
+    const outputLimitBytes = options.outputLimitBytes ?? DEFAULT_OUTPUT_LIMIT_BYTES2;
     this.sessions.set(session.id, state3);
     child.stdout?.on("data", (chunk) => {
-      appendTail(state3.stdout, chunk, outputLimitBytes);
+      appendTail2(state3.stdout, chunk, outputLimitBytes);
       this.refreshOutput(state3, outputLimitBytes);
     });
     child.stderr?.on("data", (chunk) => {
       if (state3.session.status === "stopped") return;
-      appendTail(state3.stderr, chunk, outputLimitBytes);
+      appendTail2(state3.stderr, chunk, outputLimitBytes);
       this.refreshOutput(state3, outputLimitBytes);
     });
     child.on("error", (err) => {
@@ -150976,8 +151367,28 @@ async function executeWorkerControlRequest(deps, request2) {
         if (!operation || typeof operation !== "object") {
           throw new MeshyError("VALIDATION_ERROR", "node.operation.execute requires an operation payload", 400);
         }
-        const accepted = getNodeOperationService(deps).accept(operation);
-        response = jsonResponse(request2.id, 202, { operationId: accepted.id, accepted: true });
+        const service = getNodeOperationService(deps);
+        const accepted = service.accept(operation);
+        const waitForCompletionMs = payloadValue(request2, "waitForCompletionMs", 0);
+        const observed = waitForCompletionMs > 0 ? await service.waitForTerminal(accepted.id, waitForCompletionMs) : accepted;
+        const current = observed ?? accepted;
+        response = jsonResponse(request2.id, current.status === "queued" || current.status === "running" ? 202 : 200, {
+          operationId: accepted.id,
+          accepted: true,
+          operation: current
+        });
+        break;
+      }
+      case "node.operation.get": {
+        const operationId = payloadValue(request2, "operationId", "");
+        if (typeof operationId !== "string" || !operationId.trim()) {
+          throw new MeshyError("VALIDATION_ERROR", "node.operation.get requires operationId", 400);
+        }
+        const operation = getNodeOperationService(deps).get(operationId);
+        if (!operation) {
+          throw new MeshyError("NODE_NOT_FOUND", `Node operation ${operationId} not found`, 404);
+        }
+        response = jsonResponse(request2.id, 200, { operation });
         break;
       }
       case "node.capabilities.list": {
@@ -151217,6 +151628,49 @@ async function sendNodeAgentUpgrade(req, res, nodeId, agentParam) {
   res.status(202).json(operation);
 }
 
+// ../../packages/api/src/routes/node-copilot-tunnel.ts
+init_cjs_shims();
+var COPILOT_TUNNEL_PORT = 8314;
+var REMOTE_COPILOT_TUNNEL_WAIT_MS = 4e3;
+async function sendNodeCopilotTunnelOperation(req, res, nodeId, kind, actionLabel) {
+  const deps = req.app.locals.deps;
+  const self2 = deps.nodeRegistry.getSelf();
+  const isSelf2 = nodeId === self2.id;
+  if (!isSelf2 && !deps.election.isLeader()) {
+    throw new MeshyError("NOT_LEADER", `Only the leader can ${actionLabel} Copilot tunnels on other nodes`, 403);
+  }
+  const node = isSelf2 ? self2 : deps.nodeRegistry.getNode(nodeId);
+  if (!node) {
+    throw new MeshyError("NODE_NOT_FOUND", `Node ${nodeId} not found`, 404);
+  }
+  const operations = getNodeOperationService(deps);
+  const operation = operations.create(kind, nodeId, { port: COPILOT_TUNNEL_PORT });
+  if (isSelf2) {
+    operations.runLocal(operation.id);
+  } else {
+    try {
+      const observed = await dispatchNodeOperation(deps, operation, node, { waitForCompletionMs: REMOTE_COPILOT_TUNNEL_WAIT_MS });
+      if (observed) {
+        res.status(202).json(observed);
+        return;
+      }
+    } catch (err) {
+      operations.markFailed(operation.id, err instanceof Error ? err.message : String(err));
+      throw new MeshyError("NODE_OFFLINE", `Cannot reach node ${nodeId} to ${actionLabel} Copilot tunnel`, 502);
+    }
+  }
+  res.status(202).json(operation);
+}
+async function sendNodeCopilotTunnelStatus(req, res, nodeId) {
+  await sendNodeCopilotTunnelOperation(req, res, nodeId, "copilot.tunnel.status", "check");
+}
+async function sendNodeCopilotTunnelEnable(req, res, nodeId) {
+  await sendNodeCopilotTunnelOperation(req, res, nodeId, "copilot.tunnel", "enable");
+}
+async function sendNodeCopilotTunnelDisable(req, res, nodeId) {
+  await sendNodeCopilotTunnelOperation(req, res, nodeId, "copilot.tunnel.disable", "disable");
+}
+
 // ../../packages/api/src/routes/node-runtime.ts
 init_cjs_shims();
 async function sendNodeRuntimeRestart(req, res, nodeId) {
@@ -151845,6 +152299,15 @@ function createNodeRoutes() {
   router.post("/:id/agents/:agent/upgrade", asyncHandler3(async (req, res) => {
     await sendNodeAgentUpgrade(req, res, req.params.id, req.params.agent);
   }));
+  router.post("/:id/copilot-tunnel/enable", asyncHandler3(async (req, res) => {
+    await sendNodeCopilotTunnelEnable(req, res, req.params.id);
+  }));
+  router.post("/:id/copilot-tunnel/status", asyncHandler3(async (req, res) => {
+    await sendNodeCopilotTunnelStatus(req, res, req.params.id);
+  }));
+  router.post("/:id/copilot-tunnel/disable", asyncHandler3(async (req, res) => {
+    await sendNodeCopilotTunnelDisable(req, res, req.params.id);
+  }));
   router.post("/:id/runtime/restart", asyncHandler3(async (req, res) => {
     await sendNodeRuntimeRestart(req, res, req.params.id);
   }));
@@ -152666,7 +153129,7 @@ function startLocalTaskFollowUp(deps, task, content, assignedTo, metadata) {
 // ../../packages/api/src/tasks/task-message-queue.ts
 var registeredDrainers = /* @__PURE__ */ new WeakSet();
 var drainingTaskIds = /* @__PURE__ */ new Set();
-var QUEUE_DRAIN_STATUSES = /* @__PURE__ */ new Set(["completed", "cancelled"]);
+var QUEUE_DRAIN_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
 function restoreQueuedMessage(taskEngine, taskId, message) {
   const current = taskEngine.getTask(taskId);
   if (!current) return;
@@ -153750,7 +154213,7 @@ function createTaskRoutes() {
     if (!task) {
       throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
     }
-    if (!["running", "completed", "cancelled"].includes(task.status)) {
+    if (!["running", "completed", "cancelled", "failed"].includes(task.status)) {
       throw new MeshyError("VALIDATION_ERROR", `Cannot send message to task in ${task.status} status`, 400);
     }
     if (task.status === "running") {
@@ -154494,7 +154957,8 @@ function createNodeOperationRoutes() {
   router.get("/:id", asyncHandler12(async (req, res) => {
     if (await maybeProxyReadToLeader(req, res)) return;
     const deps = req.app.locals.deps;
-    const operation = getNodeOperationService(deps).get(req.params.id);
+    const current = getNodeOperationService(deps).get(req.params.id);
+    const operation = current ? await refreshRemoteNodeOperation(deps, current) : null;
     if (!operation) {
       throw new MeshyError("NODE_NOT_FOUND", `Node operation ${req.params.id} not found`, 404);
     }
@@ -154592,6 +155056,7 @@ var REQUEST_TELEMETRY_SUPPRESSED_ROUTES = /* @__PURE__ */ new Set([
   "GET /api/system/info",
   "GET /api/cluster/state",
   "GET /api/tasks",
+  "GET /api/node-operations",
   "POST /api/worker/heartbeat",
   "POST /api/worker/keepalive",
   "POST /api/cluster-control/heartbeat",
@@ -154710,31 +155175,6 @@ function resolveRuntimeBaseDir() {
   }
   return process.cwd();
 }
-function escapeInlineJson(value) {
-  return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
-}
-function buildDashboardRuntimeConfigScript(req, deps) {
-  const dashboardTunnelAuthorization = isShareHostRequest(req, deps.shareOrigin) ? null : deps.dashboardTunnelAuthorization ?? null;
-  return `<script>window.__MESHY_RUNTIME_CONFIG__=${escapeInlineJson({ dashboardTunnelAuthorization })};</script>`;
-}
-function injectDashboardRuntimeConfig(html, req, deps) {
-  const script = buildDashboardRuntimeConfigScript(req, deps);
-  return html.includes("</head>") ? html.replace("</head>", `${script}</head>`) : `${script}${html}`;
-}
-function serveDashboardIndex(indexPath, deps) {
-  return (req, res, next) => {
-    fs27.readFile(indexPath, "utf8", (err, html) => {
-      if (err) {
-        next(err);
-        return;
-      }
-      res.type("html").send(injectDashboardRuntimeConfig(html, req, deps));
-    });
-  };
-}
-function isDashboardIndexAssetRequest(req) {
-  return req.method === "GET" && (req.path === "/" || req.path === "/index.html");
-}
 function resolveStaticDir(baseDir) {
   const envStaticDir = process.env.MESHY_STATIC_DIR;
   const candidateDirs = [
@@ -154821,8 +155261,6 @@ function createServer2(deps) {
   const staticDir = resolveStaticDir(runtimeBaseDir);
   if (staticDir) {
     const staticMiddleware = import_express17.default.static(staticDir);
-    const indexPath = path31.join(staticDir, "index.html");
-    const serveIndex = fs27.existsSync(indexPath) ? serveDashboardIndex(indexPath, deps) : null;
     app.use((req, res, next) => {
       if (isApiRequest(req) || isPreviewRequest(req)) {
         next();
@@ -154832,10 +155270,6 @@ function createServer2(deps) {
         res.status(404).type("text/plain").send("Not Found");
         return;
       }
-      if (serveIndex && isDashboardIndexAssetRequest(req)) {
-        serveIndex(req, res, next);
-        return;
-      }
       staticMiddleware(req, res, next);
     });
   }
@@ -154887,7 +155321,6 @@ function createServer2(deps) {
   if (staticDir) {
     const indexPath = path31.join(staticDir, "index.html");
     if (fs27.existsSync(indexPath)) {
-      const serveIndex = serveDashboardIndex(indexPath, deps);
       app.get("*", (req, res, next) => {
         if (isApiRequest(req)) {
           next();
@@ -154897,7 +155330,7 @@ function createServer2(deps) {
           res.status(404).type("text/plain").send("Not Found");
           return;
         }
-        serveIndex(req, res, next);
+        res.sendFile(indexPath);
       });
     }
   }
@@ -155060,7 +155493,7 @@ var DirectTransport = class {
 
 // ../../packages/transport/src/devtunnel.ts
 init_cjs_shims();
-var import_node_child_process11 = require("child_process");
+var import_node_child_process12 = require("child_process");
 var fs28 = __toESM(require("fs"), 1);
 var path32 = __toESM(require("path"), 1);
 function hiddenPipeOptions() {
@@ -155078,7 +155511,7 @@ function isInstalled(cmd) {
     return fs28.existsSync(cmd);
   }
   try {
-    (0, import_node_child_process11.execFileSync)(process.platform === "win32" ? "where.exe" : "which", [cmd], hiddenPipeOptions());
+    (0, import_node_child_process12.execFileSync)(process.platform === "win32" ? "where.exe" : "which", [cmd], hiddenPipeOptions());
     return true;
   } catch {
     return false;
@@ -155132,10 +155565,10 @@ function resolveDevTunnelCommand() {
   return "devtunnel";
 }
 function runDevTunnel(command, args) {
-  return (0, import_node_child_process11.execFileSync)(command, args, hiddenPipeOptions());
+  return (0, import_node_child_process12.execFileSync)(command, args, hiddenPipeOptions());
 }
 function runDevTunnelText(command, args) {
-  const result = (0, import_node_child_process11.spawnSync)(command, args, hiddenTextOptions());
+  const result = (0, import_node_child_process12.spawnSync)(command, args, hiddenTextOptions());
   if (result.error) {
     throw result.error;
   }
@@ -155177,7 +155610,7 @@ var DevTunnelTransport = class {
       );
     }
     const hostArgs = this.buildHostArgs(localPort, devTunnelCommand);
-    const child = (0, import_node_child_process11.spawn)(devTunnelCommand, hostArgs, hiddenSpawnOptions());
+    const child = (0, import_node_child_process12.spawn)(devTunnelCommand, hostArgs, hiddenSpawnOptions());
     this.process = child;
     this.publicUrl = await new Promise((resolve24, reject) => {
       const timeout = setTimeout(() => {
@@ -155503,7 +155936,7 @@ init_cjs_shims();
 var fs29 = __toESM(require("fs"), 1);
 var path33 = __toESM(require("path"), 1);
 var readline = __toESM(require("readline/promises"), 1);
-var import_node_child_process12 = require("child_process");
+var import_node_child_process13 = require("child_process");
 var STARTUP_REQUIREMENTS = ["az", "devtunnel", "claude", "codex", "copilot"];
 function writeLine(stream, message = "") {
   stream.write(`${message}
@@ -155533,7 +155966,7 @@ function createPromptSession(prompt) {
 }
 function createDefaultCommandRunner(platform6) {
   return (command, args, interactive = false) => {
-    const result = (0, import_node_child_process12.spawnSync)(command, args, {
+    const result = (0, import_node_child_process13.spawnSync)(command, args, {
       encoding: "utf-8",
       shell: platform6 === "win32",
       stdio: interactive ? "inherit" : "pipe",
@@ -155644,7 +156077,7 @@ function isRequirementSatisfied(requirement, status) {
   }
   return true;
 }
-function sleep2(ms) {
+function sleep4(ms) {
   return new Promise((resolve24) => setTimeout(resolve24, ms));
 }
 function areCachedAuthRequirementsCurrent(commandRunner) {
@@ -155708,7 +156141,7 @@ async function ensureRequirementAuthenticated(requirement, getAsk, commandRunner
     if (isAuthenticated(requirement, commandRunner)) {
       return { authenticated: true, status: "ok" };
     }
-    await sleep2(Math.max(0, authPollIntervalMs));
+    await sleep4(Math.max(0, authPollIntervalMs));
   }
   writeLine(stderr, `${requirement} login finished, but authentication was not available before timeout.`);
   return { authenticated: false, status: "login-failed" };
@@ -156018,7 +156451,7 @@ function formatLoadedStartMetadata(info, authEnabled) {
 init_cjs_shims();
 var fs31 = __toESM(require("fs"), 1);
 var path34 = __toESM(require("path"), 1);
-var import_node_child_process13 = require("child_process");
+var import_node_child_process14 = require("child_process");
 var runtimeDir = resolveRuntimeDir();
 var appRoot = resolveAppRoot(runtimeDir);
 var repoRoot = path34.resolve(appRoot, "../..");
@@ -156114,7 +156547,7 @@ function readRepositoryUrlFromManifest(manifest) {
 }
 function readGitValue(args) {
   try {
-    const output = (0, import_node_child_process13.execFileSync)("git", args, {
+    const output = (0, import_node_child_process14.execFileSync)("git", args, {
       cwd: repoRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
@@ -156226,7 +156659,7 @@ function isDevTunnelOrigin(value) {
 init_cjs_shims();
 var fs32 = __toESM(require("fs"), 1);
 var nodePath2 = __toESM(require("path"), 1);
-var import_node_child_process14 = require("child_process");
+var import_node_child_process15 = require("child_process");
 var RUNTIME_UPDATE_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
 function resolveRuntimeRestartStartArgs(hydratedArgs, restartArgs) {
   return restartArgs ? { ...restartArgs } : hydratedArgs;
@@ -156335,7 +156768,7 @@ function compareSemver2(left, right) {
   return 0;
 }
 function runRuntimePackageCommand(command, args) {
-  const result = (0, import_node_child_process14.spawnSync)(command, args, {
+  const result = (0, import_node_child_process15.spawnSync)(command, args, {
     encoding: "utf-8",
     windowsHide: true,
     timeout: 2500
@@ -156360,7 +156793,7 @@ function resolveDevelopmentRepoRoot(cwd, env3, platform6) {
   const packageParent = pathApi.basename(pathApi.dirname(cwd));
   return packageDir === "node" && packageParent === "apps" ? pathApi.dirname(pathApi.dirname(cwd)) : cwd;
 }
-function windowsShellQuote(value) {
+function windowsShellQuote2(value) {
   return /[\s&()^|<>"]/.test(value) ? `"${value.replace(/"/g, '\\"')}"` : value;
 }
 function createSpawnableCommand(command, args, platform6) {
@@ -156368,13 +156801,13 @@ function createSpawnableCommand(command, args, platform6) {
   if (platform6 !== "win32") return { command, args, displayCommand };
   return {
     command: "cmd.exe",
-    args: ["/d", "/s", "/c", [command, ...args].map(windowsShellQuote).join(" ")],
+    args: ["/d", "/s", "/c", [command, ...args].map(windowsShellQuote2).join(" ")],
     displayCommand
   };
 }
 function readProcessCommand(pid, platform6) {
   if (platform6 === "win32") return null;
-  const result = (0, import_node_child_process14.spawnSync)("ps", ["-p", String(pid), "-o", "args="], {
+  const result = (0, import_node_child_process15.spawnSync)("ps", ["-p", String(pid), "-o", "args="], {
     encoding: "utf-8",
     windowsHide: true,
     timeout: 1e3
@@ -156468,7 +156901,7 @@ function createRuntimeRestartLaunchPlan(options) {
 function scheduleRuntimeRestart(plan, options = {}) {
   fs32.mkdirSync(nodePath2.dirname(plan.logPath), { recursive: true });
   const logFd = fs32.openSync(plan.logPath, "a");
-  const spawnImpl = options.spawnImpl ?? import_node_child_process14.spawn;
+  const spawnImpl = options.spawnImpl ?? import_node_child_process15.spawn;
   const env3 = {
     ...process.env,
     MESHY_RESTART_PARENT_PID: String(options.parentPid ?? process.pid),
@@ -164918,7 +165351,6 @@ async function fetchWithTimeout2(fetchImpl, url3, timeoutMs) {
 function createTunnelManager(options) {
   const { authMetadata, config: config2, meshyNode } = options;
   let dashboardOrigin;
-  let dashboardTunnelAuthorization;
   let shareOrigin;
   let dashboardTransport = null;
   let shareTransport = null;
@@ -164959,10 +165391,6 @@ function createTunnelManager(options) {
     options.onDashboardOriginChange(origin);
     meshyNode.getNodeRegistry().updateDashboardOrigin(meshyNode.getNodeRegistry().getSelf().id, origin);
   }
-  function setDashboardTunnelAuthorization(authorization) {
-    dashboardTunnelAuthorization = authorization;
-    options.onDashboardTunnelAuthorizationChange(authorization);
-  }
   function setShareOrigin(origin) {
     shareOrigin = origin;
     options.onShareOriginChange(origin);
@@ -165003,32 +165431,17 @@ function createTunnelManager(options) {
       if (dashboardOrigin) {
         setDashboardOrigin(void 0);
       }
-      setDashboardTunnelAuthorization(void 0);
       return;
     }
     await dashboardTransport.stop().catch(() => void 0);
     dashboardTransport = null;
     setDashboardOrigin(void 0);
-    setDashboardTunnelAuthorization(void 0);
     meshyNode.getLogger().info("stopped dashboard tunnel", {
       reason,
       mainTransportType: meshyNode.getTransportType(),
       sidecarEnabled: meshyNode.isDevTunnelEnabled()
     });
   }
-  async function resolveDashboardTunnelAuthorization(transport) {
-    if (typeof transport.getAuthorizationHeader !== "function") {
-      return void 0;
-    }
-    try {
-      return await transport.getAuthorizationHeader();
-    } catch (err) {
-      meshyNode.getLogger().warn("failed to create dashboard tunnel authorization header", {
-        error: err instanceof Error ? err.message : String(err)
-      });
-      return void 0;
-    }
-  }
   async function restartDashboardTransport(reason) {
     const transportConfig = createDashboardTransportConfig();
     const previousTransport = dashboardTransport;
@@ -165037,15 +165450,12 @@ function createTunnelManager(options) {
       await previousTransport.stop().catch(() => void 0);
       dashboardTransport = null;
       setDashboardOrigin(void 0);
-      setDashboardTunnelAuthorization(void 0);
     }
     try {
       nextTransport = createTransport(transportConfig);
       await nextTransport.start(config2.node.port);
       const nextOrigin = await nextTransport.getEndpoint();
-      const nextAuthorization = await resolveDashboardTunnelAuthorization(nextTransport);
       dashboardTransport = nextTransport;
-      setDashboardTunnelAuthorization(nextAuthorization);
       setDashboardOrigin(nextOrigin);
       meshyNode.getLogger().info("started dashboard tunnel", {
         reason,
@@ -165060,7 +165470,6 @@ function createTunnelManager(options) {
       }
       dashboardTransport = null;
       setDashboardOrigin(void 0);
-      setDashboardTunnelAuthorization(void 0);
       meshyNode.getLogger().warn("failed to start dashboard transport", {
         reason,
         error: err instanceof Error ? err.message : String(err),
@@ -165272,7 +165681,6 @@ function createTunnelManager(options) {
       await dashboardTransport.stop();
       dashboardTransport = null;
       setDashboardOrigin(void 0);
-      setDashboardTunnelAuthorization(void 0);
     }
     if (shareTransport) {
       await shareTransport.stop();
@@ -165283,7 +165691,6 @@ function createTunnelManager(options) {
   return {
     ensureShareTunnel,
     getDashboardOrigin: () => dashboardOrigin,
-    getDashboardTunnelAuthorization: () => dashboardTunnelAuthorization,
     getShareOrigin: () => shareOrigin,
     startHealthChecks,
     stop,
@@ -165531,11 +165938,6 @@ async function startNode(args) {
           deps.dashboardOrigin = origin;
         }
       },
-      onDashboardTunnelAuthorizationChange: (authorization) => {
-        if (deps) {
-          deps.dashboardTunnelAuthorization = authorization;
-        }
-      },
       onShareOriginChange: (origin) => {
         if (deps) {
           deps.shareOrigin = origin;
@@ -165644,7 +166046,6 @@ async function startNode(args) {
         runtimeMetadata
       }),
       dashboardOrigin: tunnelManager.getDashboardOrigin(),
-      dashboardTunnelAuthorization: tunnelManager.getDashboardTunnelAuthorization(),
       shareOrigin: tunnelManager.getShareOrigin(),
       ensureShareTunnel: () => tunnelManager.ensureShareTunnel(),
       runtimeMetadata,