offhands 0.1.7 → 0.1.9

package/approval-mcp.mjs

@@ -1,18 +1,35 @@
 // offhand MCP toolkit (plain JS, zero deps — spawned BY the agent CLI).
 // Newline-delimited JSON-RPC 2.0 over stdio. Started life as a single tool
 // (`approval_prompt`, still the one named via --permission-prompt-tool
-// mcp__offhand__approval_prompt) — Execution Plan 5 adds `offhand_status_update`
-// alongside it, since a CLI wired in via --mcp-config sees every tool this
-// server exposes, not just the one used as the permission hook. Each call
-// is forwarded to a daemon-local HTTP endpoint (localhost-only by
-// construction); the daemon does the real work, this file is just the wire
-// adapter between JSON-RPC-over-stdio and plain HTTP.
+// mcp__offhand__approval_prompt) — Execution Plan 5 added `offhand_status_update`
+// alongside it, and a later pass added `offhand_send_file`, since a CLI wired
+// in via --mcp-config sees every tool this server exposes, not just the one
+// used as the permission hook. Each call is forwarded to a daemon-local HTTP
+// endpoint (localhost-only by construction) or, for send_file, done directly
+// against the local filesystem once (if wired) that endpoint approves it;
+// the daemon does the real work, this file is just the wire adapter between
+// JSON-RPC-over-stdio and plain HTTP.
 
 import { createInterface } from 'node:readline';
+import { copyFileSync, mkdirSync, readdirSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, join, parse, resolve } from 'node:path';
 
 const APPROVAL_URL = process.env.OFFHAND_APPROVAL_URL ?? 'http://127.0.0.1:4317/approval';
 const STATUS_URL = process.env.OFFHAND_STATUS_URL ?? 'http://127.0.0.1:4317/status';
 const SESSION_ID = process.env.OFFHAND_SESSION_ID ?? '';
+// Derived from STATUS_URL rather than a fourth env var every runner would
+// need to remember to set — same daemon, same port, whatever STATUS_URL
+// already points at (set for both Claude Code and OpenCode today).
+const CONTEXT_URL = process.env.OFFHAND_CONTEXT_URL ?? STATUS_URL.replace(/\/status$/, '/context');
+// Whether a runner actually wired offhand's own approval broker in for this
+// run (only Claude Code does today — see claude-code.ts). Where it isn't,
+// the CLI's own permission model is already the only gate on every other
+// tool call too (OpenCode routes its own tool approvals separately — see
+// opencode-cli.ts's statusOnlyMcpConfigContent doc comment), so send_file
+// stays consistent with that rather than inventing a broker call nothing
+// is listening on.
+const HAS_APPROVAL_CHANNEL = process.env.OFFHAND_APPROVAL_URL !== undefined;
 
 const APPROVAL_TOOL = {
   name: 'approval_prompt',
@@ -41,7 +58,78 @@ const STATUS_TOOL = {
   },
 };
 
-const TOOLS = [APPROVAL_TOOL, STATUS_TOOL];
+const SEND_FILE_TOOL = {
+  name: 'offhand_send_file',
+  description:
+    "Sends a file already on this machine's disk (a screenshot, a generated video, a log, a diff export) to the person's phone. Give an absolute path to a file that exists right now.",
+  inputSchema: {
+    type: 'object',
+    properties: {
+      path: { type: 'string', description: 'Absolute path to the file to send.' },
+    },
+    required: ['path'],
+  },
+};
+
+const CONTEXT_TOOL = {
+  name: 'offhand_context',
+  description:
+    "Looks up locally-relevant repository context (dirty files, recently-changed files, files matching your search terms) before you spend turns rediscovering the same things. This is a best-effort local search, not authoritative — it may be incomplete or wrong. Use it as a starting point, and keep exploring the repository yourself wherever it looks warranted.",
+  inputSchema: {
+    type: 'object',
+    properties: {
+      query: { type: 'string', description: 'What you are looking for or working on right now (e.g. "authentication middleware", "the task at hand").' },
+    },
+    required: ['query'],
+  },
+};
+
+const TOOLS = [APPROVAL_TOOL, STATUS_TOOL, SEND_FILE_TOOL, CONTEXT_TOOL];
+
+/** Duplicated from drop.ts on purpose — this file ships standalone (see the
+ * HAS_APPROVAL_CHANNEL comment above), so it can't import the bundled
+ * daemon's TS modules. Keep in sync by hand if drop.ts's naming rules change. */
+function safeDropName(input) {
+  const base = basename(input).replace(/[<>:"/\\|?*\x00-\x1F]/g, '_').replace(/[. ]+$/g, '').trim();
+  if (!base || base === '.' || base === '..') return 'drop';
+  return base;
+}
+
+function dedupeDropName(desiredName, existingNames) {
+  const safe = safeDropName(desiredName);
+  const existing = new Set(existingNames.map((n) => n.toLowerCase()));
+  if (!existing.has(safe.toLowerCase())) return safe;
+  const parsed = parse(safe);
+  const stem = parsed.name || 'drop';
+  const ext = parsed.ext;
+  for (let i = 1; ; i++) {
+    const candidate = `${stem}-${i}${ext}`;
+    if (!existing.has(candidate.toLowerCase())) return candidate;
+  }
+}
+
+function dropOutboxDir() {
+  const home = process.env.OFFHAND_HOME ?? join(homedir(), '.offhand');
+  return join(home, 'drop-outbox');
+}
+
+/** Copies sourcePath into the daemon's drop outbox — the same directory the
+ * daemon's own file watcher polls for `offhand drop <file>` — so the actual
+ * relay send is handled by code that already exists and is already tested. */
+function queueFileForPhone(sourcePath) {
+  const source = resolve(sourcePath);
+  const st = statSync(source); // throws ENOENT if missing — surfaces as a normal tool error below
+  if (!st.isFile()) throw new Error(`not a file: ${sourcePath}`);
+  const outbox = dropOutboxDir();
+  mkdirSync(outbox, { recursive: true });
+  let existing = [];
+  try {
+    existing = readdirSync(outbox);
+  } catch {}
+  const dest = join(outbox, dedupeDropName(basename(source), existing));
+  copyFileSync(source, dest);
+  return dest;
+}
 
 function send(msg) {
   process.stdout.write(JSON.stringify(msg) + '\n');
@@ -73,6 +161,16 @@ async function sendStatus(text) {
   });
 }
 
+async function fetchContext(query) {
+  const res = await fetch(CONTEXT_URL, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ sessionId: SESSION_ID, query }),
+  });
+  if (!res.ok) return { block: null, filesSelected: 0 };
+  return res.json();
+}
+
 const rl = createInterface({ input: process.stdin });
 rl.on('line', (line) => {
   if (!line.trim()) return;
@@ -101,6 +199,24 @@ async function handle(msg) {
       reply(id, { tools: TOOLS });
       return;
     case 'tools/call': {
+      if (params?.name === SEND_FILE_TOOL.name) {
+        const path = String(params.arguments?.path ?? '').trim();
+        try {
+          if (!path) throw new Error('no path given');
+          if (HAS_APPROVAL_CHANNEL) {
+            const verdict = await callDaemon({ tool_name: SEND_FILE_TOOL.name, input: { path } });
+            if (!verdict.approve) {
+              reply(id, { content: [{ type: 'text', text: verdict.message ?? 'denied from phone' }] });
+              return;
+            }
+          }
+          const dest = queueFileForPhone(path);
+          reply(id, { content: [{ type: 'text', text: `queued ${basename(dest)} for the phone` }] });
+        } catch (e) {
+          reply(id, { content: [{ type: 'text', text: `could not send file: ${e?.message ?? e}` }] });
+        }
+        return;
+      }
       if (params?.name === STATUS_TOOL.name) {
         const text = String(params.arguments?.text ?? '').trim();
         try {
@@ -113,6 +229,29 @@ async function handle(msg) {
         }
         return;
       }
+      if (params?.name === CONTEXT_TOOL.name) {
+        const query = String(params.arguments?.query ?? '').trim();
+        try {
+          if (!query) throw new Error('no query given');
+          const { block, filesSelected } = await fetchContext(query);
+          reply(id, {
+            content: [
+              {
+                type: 'text',
+                text:
+                  block && filesSelected > 0
+                    ? block
+                    : 'No local repository signal found for this query — proceed with your own discovery as usual.',
+              },
+            ],
+          });
+        } catch (e) {
+          // Same posture as offhand_status_update: a dropped lookup is
+          // never fatal — the agent just falls back to its own discovery.
+          reply(id, { content: [{ type: 'text', text: `context lookup unavailable: ${e?.message ?? e}` }] });
+        }
+        return;
+      }
       if (params?.name !== APPROVAL_TOOL.name) {
         replyError(id, -32602, `unknown tool: ${params?.name}`);
         return;

package/dist/daemon.mjs

@@ -4976,6 +4976,11 @@ var ClaudeCodeRunner = class {
   supportsApprovals = true;
   // Real: every tier maps to a MAX_THINKING_TOKENS value below (see start()).
   effortTiers = ["low", "medium", "high", "max"];
+  // The vendor's own supported install path (code.claude.com/docs/en/setup
+  // lists this as the "advanced installation option" alongside their native
+  // curl/PowerShell installer — npm works fine and is what the daemon can
+  // run unattended). Verified Sept 2026; re-check if this ever 404s.
+  installCommand = { command: "npm", args: ["install", "-g", "@anthropic-ai/claude-code"] };
   loggedIn() {
     return existsSync(join(homedir(), ".claude", ".credentials.json"));
   }
@@ -5143,6 +5148,7 @@ var CodexCliRunner = class {
   name = "OpenAI Codex CLI";
   models = [];
   supportsApprovals = false;
+  installCommand = { command: "npm", args: ["install", "-g", "@openai/codex"] };
   detect = () => commandExists("codex");
   start = (_run) => notImplemented(this.id);
 };
@@ -5151,7 +5157,18 @@ var CursorAgentRunner = class {
   name = "Cursor";
   models = [];
   supportsApprovals = false;
-  detect = () => commandExists("cursor-agent");
+  // No npm package exists — the vendor's real installer is a piped shell
+  // script (`curl https://cursor.com/install | bash` / an iwr|iex on
+  // Windows). Never auto-execute a remote script on the user's behalf;
+  // link out instead of offering a one-tap install here.
+  installUrl = "https://cursor.com/docs/cli/installation";
+  // The installed binary is actually named `agent`, not `cursor-agent`
+  // (confirmed against the vendor's current docs, Sept 2026) — detect()
+  // was checking the wrong command name and would never find a real
+  // install. Fixed alongside the install-hint work since the two are
+  // directly related: there's no point offering install guidance for a
+  // runner whose own detection can never succeed.
+  detect = () => commandExists("agent");
   start = (_run) => notImplemented(this.id);
 };
 var GeminiCliRunner = class {
@@ -5159,6 +5176,7 @@ var GeminiCliRunner = class {
   name = "Gemini CLI";
   models = [];
   supportsApprovals = false;
+  installCommand = { command: "npm", args: ["install", "-g", "@google/gemini-cli"] };
   detect = () => commandExists("gemini");
   start = (_run) => notImplemented(this.id);
 };
@@ -5219,6 +5237,8 @@ var CopilotCliRunner = class {
   // budget flag in Copilot CLI 1.0.31's non-interactive mode. Leaving this
   // undefined (not an empty array) is what tells the phone to hide the
   // effort control here rather than show one that silently does nothing.
+  // Vendor's own docs (docs.github.com/copilot/how-tos/copilot-cli/install-copilot-cli).
+  installCommand = { command: "npm", args: ["install", "-g", "@github/copilot"] };
   /** [command, ...prefixArgs] resolved once. */
   resolved = null;
   resolveCommand() {
@@ -5347,7 +5367,8 @@ import { spawn as spawn4 } from "node:child_process";
 import { createServer } from "node:net";
 import { existsSync as existsSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { delimiter as delimiter2, join as join3 } from "node:path";
+import { delimiter as delimiter2, join as join3, dirname as dirname2 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // ../daemon/src/runners/opencode-map.ts
 function mapOpenCodeEvent(value) {
@@ -5430,9 +5451,25 @@ function truncate3(s2, max) {
 
 // ../daemon/src/runners/opencode-cli.ts
 var POLL_INTERVAL_MS = 500;
+var APPROVAL_MCP_PATH2 = join3(dirname2(fileURLToPath2(import.meta.url)), "..", "approval-mcp.mjs");
+function statusOnlyMcpConfigContent(statusUrl2, sessionId) {
+  return JSON.stringify({
+    mcp: {
+      "offhand-status": {
+        type: "local",
+        command: [process.execPath, APPROVAL_MCP_PATH2],
+        environment: {
+          OFFHAND_STATUS_URL: statusUrl2 ?? "",
+          OFFHAND_SESSION_ID: sessionId
+        }
+      }
+    }
+  });
+}
 var OpenCodeRunner = class {
-  constructor(broker2) {
+  constructor(broker2, statusUrl2) {
     this.broker = broker2;
+    this.statusUrl = statusUrl2;
   }
   id = "opencode";
   name = "OpenCode";
@@ -5443,13 +5480,30 @@ var OpenCodeRunner = class {
   // low/medium collide onto minimal/high internally, but all four inputs
   // are genuinely honored, just not 1:1 named.
   effortTiers = ["low", "medium", "high", "max"];
+  // Package name is `opencode-ai` (opencode.ai/docs), not `opencode` or
+  // `@opencode/cli` — verified against the vendor's own install docs.
+  installCommand = { command: "npm", args: ["install", "-g", "opencode-ai"] };
   /** [command, ...prefixArgs] resolved once. */
   resolved = null;
   modelsCache = [];
-  // Lazily-started, shared `opencode serve` instance backing startViaHttpApi.
-  serverPort = null;
-  serverProcess = null;
-  serverStarting = null;
+  // Lazily-started `opencode serve` instances backing startViaHttpApi — ONE
+  // PER OFFHAND SESSION, not a single shared process. A shared server was
+  // the original design (simpler, one cold-start instead of many), but its
+  // MCP config is fixed at spawn time via an env var, and the server itself
+  // is genuinely multi-tenant (concurrent offhand sessions each get their
+  // own opencode-internal session id on the SAME shared HTTP server — see
+  // the `POST /session` call in startViaHttpApi). A single shared server
+  // therefore cannot carry a correct OFFHAND_SESSION_ID for
+  // offhand_status_update: two sessions running at once would have the
+  // second one's status updates silently attributed to the first. Keying
+  // by session id costs an extra `opencode serve` cold-start per session
+  // (kept alive for that session's lifetime, matching how
+  // `resumeConversationId` already expects the SAME server instance across
+  // that session's later turns) in exchange for actually-correct
+  // attribution — worth it; a silently wrong session id is a Rule #2
+  // violation, a slower first prompt is not.
+  servers = /* @__PURE__ */ new Map();
+  serverStarting = /* @__PURE__ */ new Map();
   resolveCommand() {
     if (this.resolved) return this.resolved;
     if (process.platform === "win32") {
@@ -5606,7 +5660,10 @@ var OpenCodeRunner = class {
       child = spawn4(cmd[0], args2, {
         cwd: run.workspace,
         stdio: ["ignore", "pipe", "pipe"],
-        shell: process.platform === "win32"
+        shell: process.platform === "win32",
+        // One-shot process per prompt — no shared-server cross-session risk
+        // here, so the session id can go straight on the env unconditionally.
+        env: { ...process.env, OPENCODE_CONFIG_CONTENT: statusOnlyMcpConfigContent(this.statusUrl, run.sessionId) }
       });
     } catch (e) {
       queue.push({ type: "error", message: `failed to spawn opencode: ${String(e)}` });
@@ -5680,7 +5737,7 @@ stderr: ${stderrTail}` : ""}`
     };
     void (async () => {
       try {
-        port2 = await this.ensureServer();
+        port2 = await this.ensureServer(run.sessionId);
       } catch (e) {
         emit([{ type: "error", message: `failed to start opencode server: ${String(e)}` }]);
         cleanup();
@@ -5830,34 +5887,38 @@ stderr: ${stderrTail}` : ""}`
     } catch {
     }
   }
-  /** Lazily start (once) the shared `opencode serve` instance used for
-   * broker-driven runs, and wait for it to accept connections. */
-  async ensureServer() {
-    if (this.serverPort) return this.serverPort;
-    if (this.serverStarting) return this.serverStarting;
-    this.serverStarting = (async () => {
+  /** Lazily start (once per offhand session) the `opencode serve` instance
+   * backing that session's broker-driven runs, and wait for it to accept
+   * connections. Reused across that session's later turns (so
+   * `resumeConversationId` keeps working); a different session never
+   * shares this instance — see the field comment above for why. */
+  async ensureServer(sessionId) {
+    const existing = this.servers.get(sessionId);
+    if (existing) return existing.port;
+    const inFlight = this.serverStarting.get(sessionId);
+    if (inFlight) return inFlight;
+    const starting = (async () => {
       const cmd = this.resolveCommand();
       if (!cmd) throw new Error("opencode CLI not found");
       const port2 = await findFreePort();
       const proc = spawn4(cmd[0], [...cmd.slice(1), "serve", "--port", String(port2), "--hostname", "127.0.0.1"], {
         stdio: ["ignore", "pipe", "pipe"],
-        shell: process.platform === "win32"
+        shell: process.platform === "win32",
+        env: { ...process.env, OPENCODE_CONFIG_CONTENT: statusOnlyMcpConfigContent(this.statusUrl, sessionId) }
       });
       proc.on("exit", () => {
-        if (this.serverProcess === proc) {
-          this.serverProcess = null;
-          this.serverPort = null;
-        }
+        const cur = this.servers.get(sessionId);
+        if (cur?.process === proc) this.servers.delete(sessionId);
       });
       await waitForServerReady(port2);
-      this.serverProcess = proc;
-      this.serverPort = port2;
+      this.servers.set(sessionId, { port: port2, process: proc });
       return port2;
     })();
+    this.serverStarting.set(sessionId, starting);
     try {
-      return await this.serverStarting;
+      return await starting;
     } finally {
-      this.serverStarting = null;
+      this.serverStarting.delete(sessionId);
     }
   }
 };
@@ -5953,8 +6014,10 @@ function sleep(ms) {
 import { randomUUID } from "node:crypto";
 import { hostname, platform as platform2, tmpdir } from "node:os";
 import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync as readdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join6, basename as basename3, parse as parse2, resolve as resolve3 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { dirname as dirname3, join as join6, basename as basename3, parse as parse2, resolve as resolve3 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { execFile as execFile4 } from "node:child_process";
+import { promisify as promisify4 } from "node:util";
 
 // ../daemon/src/receipts.ts
 import { execFile } from "node:child_process";
@@ -5976,6 +6039,7 @@ async function workspaceInfo(row) {
     path: row.path,
     label: row.label,
     policy: row.policy,
+    intelligenceMode: row.intelligenceMode,
     ...branch ? { gitBranch: branch } : {},
     ...status !== null ? { dirty: status.trim() !== "" } : {},
     ...row.devUrl ? { devUrl: row.devUrl } : {}
@@ -6560,10 +6624,247 @@ async function probeWolCapability() {
   }
 }
 
+// ../daemon/src/intelligence/ripgrep.ts
+import { execFile as execFile3 } from "node:child_process";
+import { promisify as promisify3 } from "node:util";
+var exec3 = promisify3(execFile3);
+var cachedAvailable = null;
+async function detectRipgrep() {
+  if (cachedAvailable !== null) return cachedAvailable;
+  try {
+    await exec3("rg", ["--version"], { timeout: 5e3 });
+    cachedAvailable = true;
+  } catch {
+    cachedAvailable = false;
+  }
+  return cachedAvailable;
+}
+async function searchTerms(workspace, terms, opts = {}) {
+  if (terms.length === 0) return [];
+  const timeoutMs = opts.timeoutMs ?? 3e3;
+  const maxMatches = opts.maxMatches ?? 40;
+  const args2 = [
+    "--fixed-strings",
+    "--ignore-case",
+    "--line-number",
+    "--no-heading",
+    "--max-count",
+    "3",
+    "--max-filesize",
+    "1M",
+    "--glob",
+    "!.git",
+    "--glob",
+    "!node_modules",
+    ...terms.flatMap((t2) => ["-e", t2]),
+    "."
+  ];
+  try {
+    const { stdout } = await exec3("rg", args2, { cwd: workspace, timeout: timeoutMs, maxBuffer: 4 * 1024 * 1024 });
+    return parseRipgrepOutput(stdout).slice(0, maxMatches);
+  } catch (e) {
+    const err = e;
+    return err.stdout ? parseRipgrepOutput(err.stdout).slice(0, maxMatches) : [];
+  }
+}
+function parseRipgrepOutput(stdout) {
+  const hits = [];
+  for (const line of stdout.split("\n")) {
+    if (!line) continue;
+    const m3 = /^(.+?):(\d+):(.*)$/.exec(line);
+    if (!m3) continue;
+    hits.push({ file: m3[1], line: Number(m3[2]), text: m3[3].trim().slice(0, 200) });
+  }
+  return hits;
+}
+
+// ../daemon/src/intelligence/context-inject.ts
+var DEFAULT_MAX_CHARS = 8e3;
+var OVERALL_TIMEOUT_MS = 4e3;
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "to",
+  "for",
+  "in",
+  "on",
+  "of",
+  "and",
+  "or",
+  "is",
+  "are",
+  "be",
+  "been",
+  "add",
+  "please",
+  "can",
+  "you",
+  "we",
+  "this",
+  "that",
+  "it",
+  "with",
+  "from",
+  "when",
+  "where",
+  "how",
+  "what",
+  "i",
+  "my",
+  "our",
+  "some",
+  "make",
+  "sure",
+  "need",
+  "needs",
+  "want",
+  "wants",
+  "like",
+  "using",
+  "use",
+  "so",
+  "up",
+  "as",
+  "at",
+  "by",
+  "not",
+  "do",
+  "does",
+  "did",
+  "have",
+  "has",
+  "had",
+  "will",
+  "would",
+  "should",
+  "could",
+  "also",
+  "into",
+  "if",
+  "then",
+  "than"
+]);
+function extractTerms(prompt, maxTerms = 8) {
+  const raw = prompt.toLowerCase().split(/[^a-z0-9._-]+/).map((t2) => t2.replace(/^[._-]+|[._-]+$/g, "")).filter((t2) => t2.length >= 3 && !STOPWORDS.has(t2) && !/^\d+$/.test(t2));
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = [];
+  for (const t2 of raw) {
+    if (seen.has(t2)) continue;
+    seen.add(t2);
+    deduped.push(t2);
+  }
+  return deduped.slice().sort((a2, b2) => b2.length - a2.length).slice(0, maxTerms);
+}
+async function buildContext(workspace, prompt, opts = {}) {
+  const startedAt = Date.now();
+  const maxChars = opts.maxChars ?? (Number(process.env.OFFHAND_INTEL_MAX_CHARS) || DEFAULT_MAX_CHARS);
+  const work = gatherFindings(workspace, prompt);
+  const timeout = new Promise((resolve6) => setTimeout(() => resolve6("timeout"), OVERALL_TIMEOUT_MS));
+  const result = await Promise.race([work, timeout]);
+  const durationMs = Date.now() - startedAt;
+  if (result === "timeout") {
+    return {
+      block: "",
+      meta: {
+        promptChars: prompt.length,
+        contextChars: 0,
+        filesConsidered: 0,
+        filesSelected: 0,
+        retrievalOpsRun: 0,
+        durationMs,
+        ripgrepAvailable: false,
+        timedOut: true
+      }
+    };
+  }
+  const { findings, retrievalOpsRun, ripgrepAvailable, gitState } = result;
+  if (findings.length === 0) return null;
+  findings.sort((a2, b2) => b2.priority - a2.priority);
+  const { text: block, selectedCount } = formatBlock(prompt, findings, gitState, maxChars);
+  if (selectedCount === 0) return null;
+  return {
+    block,
+    meta: {
+      promptChars: prompt.length,
+      contextChars: block.length,
+      filesConsidered: findings.length,
+      filesSelected: selectedCount,
+      retrievalOpsRun,
+      durationMs: Date.now() - startedAt,
+      ripgrepAvailable,
+      timedOut: false
+    }
+  };
+}
+async function gatherFindings(workspace, prompt) {
+  let retrievalOpsRun = 0;
+  const byPath = /* @__PURE__ */ new Map();
+  const add = (path, reason, priority) => {
+    const existing = byPath.get(path);
+    if (existing) {
+      if (!existing.reasons.includes(reason)) existing.reasons.push(reason);
+      existing.priority = Math.max(existing.priority, priority);
+    } else {
+      byPath.set(path, { path, reasons: [reason], priority });
+    }
+  };
+  const statusOut = await git(workspace, "status", "--porcelain");
+  retrievalOpsRun++;
+  let gitState = null;
+  if (statusOut !== null) {
+    const dirtyFiles = statusOut.split("\n").filter((l2) => l2.length > 3).map((l2) => l2.slice(3).trim()).filter(Boolean);
+    for (const f2 of dirtyFiles.slice(0, 15)) add(f2, "currently dirty", 3);
+    gitState = dirtyFiles.length > 0 ? `${dirtyFiles.length} file(s) with uncommitted changes` : "clean working tree";
+  }
+  const ripgrepAvailable = await detectRipgrep();
+  retrievalOpsRun++;
+  const terms = extractTerms(prompt);
+  if (ripgrepAvailable && terms.length > 0) {
+    const hits = await searchTerms(workspace, terms);
+    retrievalOpsRun++;
+    for (const hit of hits) {
+      const term = terms.find((t2) => hit.text.toLowerCase().includes(t2));
+      add(hit.file, term ? `matched "${term}"` : "matched search terms", 2);
+    }
+  }
+  const logOut = await git(workspace, "log", "-n", "15", "--name-only", "--pretty=format:");
+  retrievalOpsRun++;
+  if (logOut !== null) {
+    const recentFiles = [...new Set(logOut.split("\n").map((l2) => l2.trim()).filter(Boolean))];
+    for (const f2 of recentFiles.slice(0, 10)) add(f2, "recently changed", 1);
+  }
+  return { findings: [...byPath.values()], retrievalOpsRun, ripgrepAvailable, gitState };
+}
+function formatBlock(prompt, rankedFindings, gitState, maxChars) {
+  const header = `TASK
+${prompt}
+
+OFFHAND REPOSITORY CONTEXT
+`;
+  const gitLine = gitState ? `- Current git state: ${gitState}
+` : "";
+  const footer = "\nIMPORTANT: This context was generated from local repository analysis and may be incomplete or wrong. Verify against the workspace and search further wherever it looks warranted \u2014 do not treat this as the complete picture.";
+  const budget = maxChars - header.length - gitLine.length - footer.length;
+  const lines = [];
+  let used = 0;
+  let selectedCount = 0;
+  for (const f2 of rankedFindings) {
+    const line = `- ${f2.path} \u2014 ${f2.reasons.join(", ")}
+`;
+    if (used + line.length > budget) break;
+    lines.push(line);
+    used += line.length;
+    selectedCount++;
+  }
+  const text = header + gitLine + lines.join("") + footer;
+  return { text, selectedCount };
+}
+
 // ../daemon/src/session-manager.ts
 function resolveDaemonVersion() {
   try {
-    const pkgPath = join6(dirname2(fileURLToPath2(import.meta.url)), "..", "package.json");
+    const pkgPath = join6(dirname3(fileURLToPath3(import.meta.url)), "..", "package.json");
     const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -6571,6 +6872,7 @@ function resolveDaemonVersion() {
   }
 }
 var DAEMON_VERSION = resolveDaemonVersion();
+var execFileAsync = promisify4(execFile4);
 var SYSTEM_LOG_SESSION_ID = "system";
 var MOBILE_SESSION_PREAMBLE_BASE = "You're being driven remotely from a phone via offhand \u2014 the person who sent this prompt isn't at this keyboard and can't see this terminal. Lean on visual proof (screenshots, diffs, clear file paths) over long text explanations where you can, since they're reading this on a phone screen, not a terminal.";
 var MOBILE_SESSION_PREAMBLE_STATUS_TOOL = " You have an offhand_status_update tool available \u2014 call it with a short plain-English note at meaningful checkpoints (starting a long step, hitting a snag, finishing a phase) so they see progress without waiting for the whole run to end.";
@@ -6586,6 +6888,9 @@ var SessionManager = class {
   // sessionId → workspace
   queues = /* @__PURE__ */ new Map();
   // sessionId → queued prompts
+  /** reviewId → an Offhand Intelligence proposal (Execution Plan 8) awaiting
+   * `intelligence-response` — not tied to any run, since none exists yet. */
+  pendingIntelligence = /* @__PURE__ */ new Map();
   runners = /* @__PURE__ */ new Map();
   runnerAvailability = /* @__PURE__ */ new Map();
   /** handoverId → what was proposed, so `handover-response` (which only
@@ -6656,7 +6961,9 @@ var SessionManager = class {
       ...r2.loggedIn ? { loggedIn: r2.loggedIn() } : {},
       models: r2.models,
       supportsApprovals: r2.supportsApprovals,
-      ...r2.effortTiers ? { effortTiers: [...r2.effortTiers] } : {}
+      ...r2.effortTiers ? { effortTiers: [...r2.effortTiers] } : {},
+      ...r2.installCommand ? { installCommand: `${r2.installCommand.command} ${r2.installCommand.args.join(" ")}` } : {},
+      ...r2.installUrl ? { installUrl: r2.installUrl } : {}
     }));
     const workspaces = await Promise.all(
       this.store.listWorkspaces().map((w2) => workspaceInfo(w2))
@@ -6688,28 +6995,86 @@ var SessionManager = class {
           reply({ type: "error", message: `unknown session ${msg.sessionId}` });
           return;
         }
-        let prompt = msg.prompt;
-        if (msg.attachments?.length && this.attachmentFetcher) {
-          try {
-            prompt += "\n\nAttached files (read them from disk):";
-            for (const a2 of msg.attachments) {
-              const bytes = await this.attachmentFetcher(a2.blobId);
-              const dir = join6(tmpdir(), "offhand-attachments");
-              mkdirSync2(dir, { recursive: true });
-              const path = join6(dir, `${a2.blobId.slice(0, 8)}-${basename3(a2.name)}`);
-              writeFileSync2(path, bytes);
-              prompt += `
-- ${path} (${a2.mime})`;
-            }
-          } catch (e) {
-            reply({ type: "error", message: `attachment staging failed: ${String(e)}` });
-            return;
+        let prompt;
+        try {
+          prompt = await this.stageAttachments(msg.prompt, msg.attachments);
+        } catch (e) {
+          reply({ type: "error", message: `attachment staging failed: ${String(e)}` });
+          return;
+        }
+        this.enqueuePrompt(session, prompt);
+        await this.broadcastManifest();
+        return;
+      }
+      case "intelligence-set": {
+        this.store.setWorkspaceIntelligenceMode(msg.workspace, msg.mode);
+        await this.broadcastManifest();
+        return;
+      }
+      case "intelligence-prepare": {
+        const session = this.store.getSession(msg.sessionId);
+        if (!session) {
+          reply({ type: "error", message: `unknown session ${msg.sessionId}` });
+          return;
+        }
+        let prompt;
+        try {
+          prompt = await this.stageAttachments(msg.prompt, msg.attachments);
+        } catch (e) {
+          reply({ type: "error", message: `attachment staging failed: ${String(e)}` });
+          return;
+        }
+        const built = await buildContext(session.workspace, prompt);
+        this.record(session.id, (seq) => ({
+          type: "run-event",
+          sessionId: session.id,
+          runId: "",
+          seq,
+          event: {
+            type: "intelligence-built",
+            promptChars: prompt.length,
+            contextChars: built?.meta.contextChars ?? 0,
+            filesConsidered: built?.meta.filesConsidered ?? 0,
+            filesSelected: built?.meta.filesSelected ?? 0,
+            retrievalOpsRun: built?.meta.retrievalOpsRun ?? 0,
+            durationMs: built?.meta.durationMs ?? 0,
+            ripgrepAvailable: built?.meta.ripgrepAvailable ?? false,
+            timedOut: built?.meta.timedOut ?? false,
+            attached: built !== null && built.block !== ""
           }
+        }));
+        if (!built || built.block === "") {
+          this.enqueuePrompt(session, prompt);
+          await this.broadcastManifest();
+          return;
         }
-        const q2 = this.queues.get(session.id) ?? [];
-        q2.push(prompt);
-        this.queues.set(session.id, q2);
-        this.pump(session.id);
+        const reviewId = randomUUID();
+        this.pendingIntelligence.set(reviewId, { sessionId: session.id, prompt, block: built.block });
+        this.record(session.id, (seq) => ({
+          type: "intelligence-review",
+          sessionId: session.id,
+          seq,
+          reviewId,
+          originalPrompt: prompt,
+          block: built.block,
+          filesSelected: built.meta.filesSelected
+        }));
+        return;
+      }
+      case "intelligence-response": {
+        const pending = this.pendingIntelligence.get(msg.reviewId);
+        if (!pending || pending.sessionId !== msg.sessionId) return;
+        this.pendingIntelligence.delete(msg.reviewId);
+        const session = this.store.getSession(msg.sessionId);
+        if (!session) return;
+        this.record(session.id, (seq) => ({
+          type: "intelligence-resolved",
+          sessionId: session.id,
+          seq,
+          reviewId: msg.reviewId,
+          useContext: msg.useContext
+        }));
+        this.enqueuePrompt(session, pending.prompt, msg.useContext ? pending.block : void 0);
         await this.broadcastManifest();
         return;
       }
@@ -6779,10 +7144,7 @@ var SessionManager = class {
           seq,
           event: { type: "handover-accepted", id: msg.handoverId, fromRunnerId, toRunnerId: pending.toRunnerId }
         }));
-        const q2 = this.queues.get(session.id) ?? [];
-        q2.push(prompt);
-        this.queues.set(session.id, q2);
-        this.pump(session.id);
+        this.enqueuePrompt(session, prompt);
         await this.broadcastManifest();
         return;
       }
@@ -6864,6 +7226,36 @@ var SessionManager = class {
         await this.recheckWolCapability();
         reply(this.hello());
         return;
+      case "runner-install": {
+        const runner = this.runners.get(msg.runnerId);
+        if (!runner?.installCommand) {
+          reply({
+            type: "runner-install-response",
+            rpcId: msg.rpcId,
+            ok: false,
+            message: `No one-tap install available for "${msg.runnerId}".`
+          });
+          return;
+        }
+        try {
+          const { stderr } = await execFileAsync(runner.installCommand.command, runner.installCommand.args, {
+            timeout: 18e4
+          });
+          this.runnerAvailability.set(runner.id, await runner.detect());
+          reply({
+            type: "runner-install-response",
+            rpcId: msg.rpcId,
+            ok: true,
+            message: stderr.trim() || "Installed."
+          });
+          await this.broadcastManifest();
+        } catch (e) {
+          const err = e;
+          const detail = (err.stderr?.trim() || err.message || String(e)).slice(0, 500);
+          reply({ type: "runner-install-response", rpcId: msg.rpcId, ok: false, message: detail });
+        }
+        return;
+      }
     }
   }
   /** The daemon's own relay connection dropped — logged durably so a phone
@@ -6886,6 +7278,37 @@ var SessionManager = class {
       event: { type: "status-update", text }
     }));
   }
+  /** Offhand Intelligence Phase 5 (Execution Plan 8) — the agent itself
+   * calls this via the offhand_context MCP tool, mid-run, instead of a
+   * human reviewing on the phone first. Same buildContext() mechanism and
+   * telemetry as the mobile review path (Phase 2); the tool's own response
+   * carries the same "may be incomplete, keep searching" framing so the
+   * agent's discovery is supplemented, never restricted. */
+  async buildContextFor(sessionId, query) {
+    const session = this.store.getSession(sessionId);
+    if (!session) return null;
+    const built = await buildContext(session.workspace, query);
+    this.record(sessionId, (seq) => ({
+      type: "run-event",
+      sessionId,
+      runId: "",
+      seq,
+      event: {
+        type: "intelligence-built",
+        promptChars: query.length,
+        contextChars: built?.meta.contextChars ?? 0,
+        filesConsidered: built?.meta.filesConsidered ?? 0,
+        filesSelected: built?.meta.filesSelected ?? 0,
+        retrievalOpsRun: built?.meta.retrievalOpsRun ?? 0,
+        durationMs: built?.meta.durationMs ?? 0,
+        ripgrepAvailable: built?.meta.ripgrepAvailable ?? false,
+        timedOut: built?.meta.timedOut ?? false,
+        attached: built !== null && built.block !== ""
+      }
+    }));
+    if (!built || built.block === "") return null;
+    return { block: built.block, filesSelected: built.meta.filesSelected };
+  }
   recordDeviceReconnected(offlineForMs) {
     this.record(SYSTEM_LOG_SESSION_ID, (seq) => ({
       type: "device-reconnected",
@@ -6913,13 +7336,40 @@ var SessionManager = class {
   pump(sessionId) {
     if (this.active.has(sessionId)) return;
     const q2 = this.queues.get(sessionId);
-    const prompt = q2?.shift();
-    if (!prompt) return;
+    const item = q2?.shift();
+    if (!item) return;
     const session = this.store.getSession(sessionId);
     if (!session) return;
-    void this.runOne(session, prompt);
+    void this.runOne(session, item.prompt, item.block);
+  }
+  /** Appends staged-attachment file paths to a prompt — shared by `prompt`
+   * and `intelligence-prepare` so the two paths can't drift. Throws on
+   * fetch/write failure; callers turn that into an `error` reply. */
+  async stageAttachments(prompt, attachments) {
+    if (!attachments?.length || !this.attachmentFetcher) return prompt;
+    let out = prompt + "\n\nAttached files (read them from disk):";
+    for (const a2 of attachments) {
+      const bytes = await this.attachmentFetcher(a2.blobId);
+      const dir = join6(tmpdir(), "offhand-attachments");
+      mkdirSync2(dir, { recursive: true });
+      const path = join6(dir, `${a2.blobId.slice(0, 8)}-${basename3(a2.name)}`);
+      writeFileSync2(path, bytes);
+      out += `
+- ${path} (${a2.mime})`;
+    }
+    return out;
+  }
+  /** Pushes a prompt onto a session's queue and pumps it — the one place
+   * every prompt (plain, post-review, or a translated handover packet)
+   * enters execution, so none of those callers duplicate queue/pump/
+   * broadcast bookkeeping. */
+  enqueuePrompt(session, prompt, block) {
+    const q2 = this.queues.get(session.id) ?? [];
+    q2.push(block !== void 0 ? { prompt, block } : { prompt });
+    this.queues.set(session.id, q2);
+    this.pump(session.id);
   }
-  async runOne(session, prompt) {
+  async runOne(session, prompt, precomputedBlock) {
     const runner = this.runners.get(session.runnerId);
     if (!runner || !(this.runnerAvailability.get(session.runnerId) ?? false)) {
       this.record(session.id, (seq) => ({
@@ -6939,9 +7389,36 @@ var SessionManager = class {
     let limitHitEmitted = false;
     let budgetWarned = false;
     const hasStatusTool = runner.id === "claude-code" && session.permissionMode !== "bypass";
-    const sentPrompt = session.conversationId ? prompt : `${MOBILE_SESSION_PREAMBLE_BASE}${hasStatusTool ? MOBILE_SESSION_PREAMBLE_STATUS_TOOL : ""}
+    const preambled = session.conversationId ? prompt : `${MOBILE_SESSION_PREAMBLE_BASE}${hasStatusTool ? MOBILE_SESSION_PREAMBLE_STATUS_TOOL : ""}
 
 ${prompt}`;
+    let sentPrompt = preambled;
+    if (precomputedBlock !== void 0) {
+      sentPrompt = preambled.replace(prompt, precomputedBlock);
+    } else if (process.env.OFFHAND_INTEL_DEBUG === "1") {
+      const built = await buildContext(session.workspace, prompt);
+      this.record(session.id, (seq) => ({
+        type: "run-event",
+        sessionId: session.id,
+        runId,
+        seq,
+        event: {
+          type: "intelligence-built",
+          promptChars: prompt.length,
+          contextChars: built?.meta.contextChars ?? 0,
+          filesConsidered: built?.meta.filesConsidered ?? 0,
+          filesSelected: built?.meta.filesSelected ?? 0,
+          retrievalOpsRun: built?.meta.retrievalOpsRun ?? 0,
+          durationMs: built?.meta.durationMs ?? 0,
+          ripgrepAvailable: built?.meta.ripgrepAvailable ?? false,
+          timedOut: built?.meta.timedOut ?? false,
+          attached: built !== null && built.block !== ""
+        }
+      }));
+      if (built && built.block !== "") {
+        sentPrompt = preambled.replace(prompt, built.block);
+      }
+    }
     const handle = runner.start(
       {
         runId,
@@ -7098,7 +7575,7 @@ function listFolders(path) {
     const full = join6(current, entry.name);
     return { name: entry.name, path: full, isGit: existsSync7(join6(full, ".git")) };
   }).sort((a2, b2) => Number(b2.isGit) - Number(a2.isGit) || a2.name.localeCompare(b2.name)).slice(0, 200);
-  return { path: current, parent: isRoot(current) ? null : dirname2(current), dirs };
+  return { path: current, parent: isRoot(current) ? null : dirname3(current), dirs };
 }
 function driveRoots() {
   if (process.platform !== "win32") return [{ name: "/", path: "/", isGit: existsSync7("/.git") }];
@@ -7200,6 +7677,10 @@ var Store = class {
       this.db.exec(`ALTER TABLE sessions ADD COLUMN budget_minutes_cap INTEGER`);
     } catch {
     }
+    try {
+      this.db.exec(`ALTER TABLE workspaces ADD COLUMN intelligence_mode TEXT NOT NULL DEFAULT 'off'`);
+    } catch {
+    }
   }
   // ---- sessions -------------------------------------------------------------
   createSession(workspace, runnerId, model, label) {
@@ -7342,12 +7823,16 @@ var Store = class {
       path: r2.path,
       label: r2.label,
       devUrl: r2.dev_url ?? null,
-      policy: r2.policy ?? "balanced"
+      policy: r2.policy ?? "balanced",
+      intelligenceMode: r2.intelligence_mode ?? "off"
     }));
   }
   setWorkspacePolicy(path, policy) {
     this.db.prepare(`UPDATE workspaces SET policy = ? WHERE path = ?`).run(policy, path);
   }
+  setWorkspaceIntelligenceMode(path, mode) {
+    this.db.prepare(`UPDATE workspaces SET intelligence_mode = ? WHERE path = ?`).run(mode, path);
+  }
   // ---- device capability (Execution Plan 7) ----------------------------------
   getWolCapability() {
     const row = this.db.prepare(`SELECT * FROM device WHERE id = 1`).get();
@@ -11585,6 +12070,26 @@ var RunEventSchema = external_exports.discriminatedUnion("type", [
   external_exports.object({
     type: external_exports.literal("status-update"),
     text: external_exports.string()
+  }),
+  /** Telemetry for Offhand Intelligence's Phase 1 (Execution Plan 8) — one
+   * record per run where the deterministic context-injection step actually
+   * ran, so Intelligence-ON vs Intelligence-OFF is eventually a real
+   * measurement, not a guess. Never carries the context block's own text —
+   * just the shape of what happened — reusing the existing event-log spine
+   * rather than a parallel telemetry system. */
+  external_exports.object({
+    type: external_exports.literal("intelligence-built"),
+    promptChars: external_exports.number().int(),
+    contextChars: external_exports.number().int(),
+    filesConsidered: external_exports.number().int(),
+    filesSelected: external_exports.number().int(),
+    retrievalOpsRun: external_exports.number().int(),
+    durationMs: external_exports.number().int(),
+    ripgrepAvailable: external_exports.boolean(),
+    timedOut: external_exports.boolean(),
+    /** Whether the block was actually attached to the run (false when
+     * buildContext found nothing worth attaching, or timed out). */
+    attached: external_exports.boolean()
   })
 ]);
 var PermissionModeSchema = external_exports.enum(["guarded", "plan", "acceptEdits", "bypass"]);
@@ -11623,9 +12128,18 @@ var RunnerInfoSchema = external_exports.object({
   /** Thinking-budget tiers this runner actually honors (Execution Plan 3) —
    * undefined means the phone should hide the effort control entirely for
    * this runner, not show one that silently does nothing. */
-  effortTiers: external_exports.array(external_exports.enum(["low", "medium", "high", "max"])).optional()
+  effortTiers: external_exports.array(external_exports.enum(["low", "medium", "high", "max"])).optional(),
+  /** Display string for the vendor's own install command (e.g. "npm install
+   * -g @anthropic-ai/claude-code") — present only when the daemon can run
+   * it unattended via `runner-install`. */
+  installCommand: external_exports.string().optional(),
+  /** Where to send the user instead, when there's no safe one-tap install
+   * (a piped shell-script installer, a GUI app, etc.) — never set alongside
+   * installCommand. */
+  installUrl: external_exports.string().optional()
 });
 var ApprovalPolicySchema = external_exports.enum(["paranoid", "balanced", "trusting"]);
+var IntelligenceModeSchema = external_exports.enum(["off", "automatic", "manual"]);
 var WorkspaceInfoSchema = external_exports.object({
   path: external_exports.string(),
   label: external_exports.string(),
@@ -11634,7 +12148,8 @@ var WorkspaceInfoSchema = external_exports.object({
   devUrl: external_exports.string().optional(),
   /** Approval policy: paranoid = ask everything the CLI would ask; balanced =
    * same (default); trusting = auto-approve low-risk, ask only high-risk. */
-  policy: ApprovalPolicySchema
+  policy: ApprovalPolicySchema,
+  intelligenceMode: IntelligenceModeSchema
 });
 var SessionInfoSchema = external_exports.object({
   id: external_exports.string(),
@@ -11749,6 +12264,29 @@ var ClientMessageSchema = external_exports.discriminatedUnion("type", [
     workspace: external_exports.string(),
     policy: ApprovalPolicySchema
   }),
+  /** Set a workspace's Offhand Intelligence mode (Execution Plan 8). */
+  external_exports.object({
+    type: external_exports.literal("intelligence-set"),
+    workspace: external_exports.string(),
+    mode: IntelligenceModeSchema
+  }),
+  /** Like `prompt`, but routes through Offhand Intelligence first — the
+   * daemon replies with `intelligence-review` instead of queueing
+   * immediately, and queueing happens only after `intelligence-response`. */
+  external_exports.object({
+    type: external_exports.literal("intelligence-prepare"),
+    sessionId: external_exports.string(),
+    prompt: external_exports.string().min(1),
+    attachments: external_exports.array(external_exports.object({ blobId: external_exports.string(), name: external_exports.string(), mime: external_exports.string() })).optional()
+  }),
+  /** Resolves a pending `intelligence-review` — useContext=false sends the
+   * plain original prompt, never a dead end that discards it. */
+  external_exports.object({
+    type: external_exports.literal("intelligence-response"),
+    sessionId: external_exports.string(),
+    reviewId: external_exports.string(),
+    useContext: external_exports.boolean()
+  }),
   // History RPC (request/response by rpcId; responses are not in the seq log)
   external_exports.object({
     type: external_exports.literal("history-request"),
@@ -11785,7 +12323,12 @@ var ClientMessageSchema = external_exports.discriminatedUnion("type", [
   /** Re-run the Wake-on-LAN/WiFi capability probe (Execution Plan 7) — an
    * explicit "check again" action, since drivers/BIOS settings/network type
    * can change after first setup. */
-  external_exports.object({ type: external_exports.literal("wol-recheck") })
+  external_exports.object({ type: external_exports.literal("wol-recheck") }),
+  /** One-tap install: run a runner's own vendor install command on the
+   * daemon's machine. Only valid for a runner whose manifest entry carries
+   * `installCommand` — the daemon refuses (with a reply, not a hang) for
+   * any other runnerId. */
+  external_exports.object({ type: external_exports.literal("runner-install"), rpcId: external_exports.string(), runnerId: external_exports.string() })
 ]);
 var ReceiptSchema = external_exports.object({
   runId: external_exports.string(),
@@ -11854,6 +12397,26 @@ var ServerMessageSchema = external_exports.discriminatedUnion("type", [
     atMs: external_exports.number().int(),
     offlineForMs: external_exports.number().int().nonnegative()
   }),
+  /** Offhand Intelligence (Execution Plan 8) proposed a context block for a
+   * prompt not yet queued to any runner — not a RunEvent, since no run
+   * exists at this point. `filesSelected` is a quick summary for the sheet
+   * header; the full reasoning lives in `block` itself. */
+  external_exports.object({
+    type: external_exports.literal("intelligence-review"),
+    sessionId: external_exports.string(),
+    seq: external_exports.number().int(),
+    reviewId: external_exports.string(),
+    originalPrompt: external_exports.string(),
+    block: external_exports.string(),
+    filesSelected: external_exports.number().int()
+  }),
+  external_exports.object({
+    type: external_exports.literal("intelligence-resolved"),
+    sessionId: external_exports.string(),
+    seq: external_exports.number().int(),
+    reviewId: external_exports.string(),
+    useContext: external_exports.boolean()
+  }),
   // RPC responses (not seq-logged)
   external_exports.object({
     type: external_exports.literal("history-response"),
@@ -11886,6 +12449,15 @@ var ServerMessageSchema = external_exports.discriminatedUnion("type", [
      * routed back to whoever asked, with the listing unchanged either way. */
     error: external_exports.string().optional()
   }),
+  /** Reply to `runner-install` — always sent, success or failure, never a
+   * silent hang. On failure `message` carries the real error (e.g. npm's
+   * own stderr tail), not a generic "install failed". */
+  external_exports.object({
+    type: external_exports.literal("runner-install-response"),
+    rpcId: external_exports.string(),
+    ok: external_exports.boolean(),
+    message: external_exports.string()
+  }),
   external_exports.object({ type: external_exports.literal("error"), message: external_exports.string() })
 ]);
 var parseClientMessage = (raw) => ClientMessageSchema.parse(JSON.parse(raw));
@@ -42550,6 +43122,20 @@ var LocalSessionServer = class {
       }
       return;
     }
+    if (req.method === "POST" && req.url === "/context") {
+      try {
+        const chunks = [];
+        for await (const c2 of req) chunks.push(c2);
+        const body = JSON.parse(Buffer.concat(chunks).toString());
+        const result = typeof body.sessionId === "string" && typeof body.query === "string" && body.query.trim() ? await this.manager.buildContextFor(body.sessionId, body.query.trim()) : null;
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify(result ?? { block: null, filesSelected: 0 }));
+      } catch (e) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ block: null, filesSelected: 0, message: `bad context request: ${String(e)}` }));
+      }
+      return;
+    }
     res.writeHead(404);
     res.end();
   }
@@ -42926,6 +43512,7 @@ var ApprovalBroker = class {
   }
 };
 function classifyRisk(toolName, input) {
+  if (toolName === "offhand_send_file") return "high";
   const i2 = input ?? {};
   const text = [toolName, i2.command, i2.file_path, i2.path, i2.filepath].filter((x2) => typeof x2 === "string").join(" ");
   return /\b(rm|del|rmdir|rd|format|mkfs|shutdown|reboot|kill|drop\s+table|truncate|git\s+push\s+--force|--hard)\b/i.test(
@@ -43021,12 +43608,12 @@ async function downloadArtifact(relayUrl2, sessionId, blobId, keys) {
 
 // ../daemon/src/autostart.ts
 import { homedir as homedir8 } from "node:os";
-import { join as join10, resolve as resolve4, dirname as dirname3 } from "node:path";
+import { join as join10, resolve as resolve4, dirname as dirname4 } from "node:path";
 import { existsSync as existsSync9, readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, rmSync } from "node:fs";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { spawnSync } from "node:child_process";
 import { tmpdir as tmpdir3 } from "node:os";
-var __dirname2 = dirname3(fileURLToPath3(import.meta.url));
+var __dirname2 = dirname4(fileURLToPath4(import.meta.url));
 var SHORTCUT_NAME = "OffhandDaemon.lnk";
 var OFFHAND_HOME = process.env.OFFHAND_HOME ?? join10(homedir8(), ".offhand");
 function getStartupDir() {
@@ -43166,10 +43753,11 @@ for (const w2 of wsArgs) {
 if (store.listWorkspaces().length === 0) store.upsertWorkspace(process.cwd(), devUrl);
 var broker = new ApprovalBroker(approvalTimeoutMs);
 var approvalUrl = `http://127.0.0.1:${port}/approval`;
+var statusUrl = approvalUrl.replace(/\/approval$/, "/status");
 var runners = [
   new ClaudeCodeRunner(broker, approvalUrl),
   new CopilotCliRunner(),
-  new OpenCodeRunner(broker),
+  new OpenCodeRunner(broker, statusUrl),
   new CodexCliRunner(),
   new CursorAgentRunner(),
   new GeminiCliRunner()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "offhands",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Phone → coding-agent relay. Daemon runs on your laptop, PWA on your phone. E2E encrypted.",
   "license": "UNLICENSED",
   "type": "module",