openfox 1.6.90 → 1.6.92

package/dist/{chunk-ZORPFD4C.js → chunk-2BS6LMIU.js}

@@ -2,7 +2,7 @@ import {
   createVerifierNudgeConfig,
   runBuilderTurn,
   runChatTurn
-} from "./chunk-N7W42N5Y.js";
+} from "./chunk-2TKN2X2A.js";
 import {
   TurnMetrics,
   agentExists,
@@ -10,34 +10,43 @@ import {
   createMessageStartEvent,
   createToolRegistry,
   deleteAgent,
+  deleteItemFromDir,
+  deleteProjectAgent,
+  deleteProjectSkill,
   deleteSkill,
   devServerManager,
   executeSubAgent,
   findAgentById,
   findSkillById,
-  getDefaultAgentContent,
   getDefaultAgentIds,
   getDefaultIds,
-  getDefaultSkillContent,
   getDefaultSkillIds,
   getToolRegistryForAgent,
+  getTopLevelAgents,
+  isDefaultAgent,
+  isDefaultSkill,
   isSkillEnabled,
+  jsonSerializer,
   loadAllAgents,
   loadAllAgentsDefault,
   loadAllSkills,
   loadDefaultAgents,
   loadDefaultSkills,
   loadItemsFromDir,
+  loadProjectAgents,
+  loadProjectSkills,
   loadUserAgents,
   loadUserSkills,
   pathExists,
   performManualContextCompaction,
   saveAgent,
+  saveAgentToProject,
+  saveItemToDir,
   saveSkill,
-  setSkillEnabled,
+  saveSkillToProject,
   skillExists,
   spawnShellProcess
-} from "./chunk-UEZDAB5X.js";
+} from "./chunk-ARJIHQ3S.js";
 import {
   getProject
 } from "./chunk-ZHBL5G5X.js";
@@ -50,18 +59,18 @@ import {
 import {
   createProviderManager,
   parseDefaultModelSelection
-} from "./chunk-6GGYIEBM.js";
+} from "./chunk-7QG6LY5Q.js";
 import {
   SessionNotFoundError,
   createLLMClient,
   detectModel,
   getLlmStatus
-} from "./chunk-JDDNBK6T.js";
+} from "./chunk-WBQNIWAQ.js";
 import {
   detectBackend,
   getBackendDisplayName,
   getModelProfile
-} from "./chunk-YNIAFX24.js";
+} from "./chunk-RJIPM7CO.js";
 import {
   createSession,
   deleteSession,
@@ -87,7 +96,7 @@ import {
   updateSessionProvider,
   updateSessionRunning,
   updateSessionSummary
-} from "./chunk-6P5WQP6Y.js";
+} from "./chunk-YTPPQK55.js";
 import {
   initDatabase
 } from "./chunk-5GVCNVKV.js";
@@ -126,7 +135,7 @@ import {
 import {
   getRuntimeConfig,
   setRuntimeConfig
-} from "./chunk-B5AP3RSV.js";
+} from "./chunk-RW25DL5R.js";
 import {
   logger,
   setLogLevel
@@ -137,7 +146,7 @@ import express from "express";
 import cors from "cors";
 import { createServer as createHttpServer } from "http";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname5, resolve, join as join5 } from "path";
+import { dirname as dirname5, resolve, join as join6 } from "path";
 import { readFile as readFile3 } from "fs/promises";
 import { createServer as createViteServer } from "vite";
 
@@ -1531,6 +1540,9 @@ var WORKFLOW_EXTENSION = ".workflow.json";
 function getWorkflowsDir(configDir) {
   return join(configDir, "workflows");
 }
+function getProjectWorkflowsDir(projectDir) {
+  return join(projectDir, ".openfox", "workflows");
+}
 async function pathExists2(path) {
   try {
     await access(path, constants.R_OK);
@@ -1575,7 +1587,10 @@ async function loadDefaultWorkflows() {
 async function loadUserWorkflows(configDir) {
   return loadWorkflowsFromDir(getWorkflowsDir(configDir));
 }
-async function loadAllWorkflows(configDir) {
+async function loadProjectWorkflows(projectDir) {
+  return loadWorkflowsFromDir(getProjectWorkflowsDir(projectDir));
+}
+async function loadAllWorkflows(configDir, projectDir) {
   const [defaultWorkflows, userWorkflows] = await Promise.all([loadDefaultWorkflows(), loadUserWorkflows(configDir)]);
   const workflowMap = /* @__PURE__ */ new Map();
   for (const workflow of defaultWorkflows) {
@@ -1584,8 +1599,20 @@ async function loadAllWorkflows(configDir) {
   for (const workflow of userWorkflows) {
     workflowMap.set(workflow.metadata.id, workflow);
   }
+  if (projectDir) {
+    const projectWorkflows = await loadProjectWorkflows(projectDir);
+    for (const workflow of projectWorkflows) {
+      workflowMap.set(workflow.metadata.id, workflow);
+    }
+  }
   return Array.from(workflowMap.values());
 }
+async function saveWorkflowToProject(projectDir, workflow) {
+  await saveItemToDir(getProjectWorkflowsDir(projectDir), workflow, WORKFLOW_EXTENSION, jsonSerializer);
+}
+async function deleteProjectWorkflow(projectDir, workflowId) {
+  return deleteItemFromDir(getProjectWorkflowsDir(projectDir), workflowId, WORKFLOW_EXTENSION);
+}
 async function getDefaultWorkflowIds() {
   for (const dir of [DEFAULTS_DIR, DEFAULTS_DIR_ALT]) {
     try {
@@ -1596,10 +1623,6 @@ async function getDefaultWorkflowIds() {
   }
   return [];
 }
-async function getDefaultWorkflowContent(workflowId) {
-  const defaults = await loadDefaultWorkflows();
-  return defaults.find((w) => w.metadata.id === workflowId) ?? null;
-}
 async function isDefaultWorkflow(workflowId) {
   const defaultIds = await getDefaultWorkflowIds();
   return defaultIds.includes(workflowId);
@@ -1607,9 +1630,11 @@ async function isDefaultWorkflow(workflowId) {
 function findWorkflowById(workflowId, workflows) {
   return workflows.find((p) => p.metadata.id === workflowId);
 }
-async function workflowExists(configDir, workflowId) {
-  const filePath = join(getWorkflowsDir(configDir), `${workflowId}${WORKFLOW_EXTENSION}`);
-  return pathExists2(filePath);
+async function workflowExists(configDir, workflowId, projectDir) {
+  if (await pathExists2(join(getWorkflowsDir(configDir), `${workflowId}${WORKFLOW_EXTENSION}`))) return true;
+  if (projectDir && await pathExists2(join(getProjectWorkflowsDir(projectDir), `${workflowId}${WORKFLOW_EXTENSION}`)))
+    return true;
+  return false;
 }
 async function saveWorkflow(configDir, workflow) {
   const workflowsDir = getWorkflowsDir(configDir);
@@ -2480,7 +2505,7 @@ function processQueueAndRestartTurn(sessionManager, sessionId, drainFn, queueMod
 }
 var activeAgents = /* @__PURE__ */ new Map();
 var MAX_SEND_QUEUE_SIZE = 1e3;
-function createWebSocketServer(httpServer, config, getLLMClient, getActiveProvider, sessionManager, providerManager) {
+function createWebSocketServer(httpServer, config4, getLLMClient, getActiveProvider, sessionManager, providerManager) {
   const wss = new WebSocketServer({ server: httpServer });
   const clients = /* @__PURE__ */ new Map();
   moduleClients = clients;
@@ -2507,9 +2532,9 @@ function createWebSocketServer(httpServer, config, getLLMClient, getActiveProvid
     }
     const baseUrl = provider.url.includes("/v1") ? provider.url : `${provider.url}/v1`;
     const sessionConfig = {
-      ...config,
+      ...config4,
       llm: {
-        ...config.llm,
+        ...config4.llm,
         baseUrl,
         model: session.providerModel,
         ...provider.apiKey && { apiKey: provider.apiKey }
@@ -3113,10 +3138,10 @@ var LspServer = class {
   // Pending diagnostic waiters
   pendingDiagnostics = /* @__PURE__ */ new Map();
   commandPath;
-  constructor(config, workdir, commandPath) {
-    this.config = config;
+  constructor(config4, workdir, commandPath) {
+    this.config = config4;
     this.workdir = workdir;
-    this.commandPath = commandPath ?? config.serverCommand;
+    this.commandPath = commandPath ?? config4.serverCommand;
   }
   // ============================================================================
   // Lifecycle
@@ -3939,8 +3964,8 @@ var LspManager = class {
   // ============================================================================
   // Server Management
   // ============================================================================
-  async getOrCreateServer(config) {
-    const langId = config.id;
+  async getOrCreateServer(config4) {
+    const langId = config4.id;
     const existing = this.servers.get(langId);
     if (existing?.isRunning()) {
       return existing;
@@ -3952,7 +3977,7 @@ var LspManager = class {
     if (pending) {
       return pending;
     }
-    const promise = this.startServer(config);
+    const promise = this.startServer(config4);
     this.serverPromises.set(langId, promise);
     try {
       const server = await promise;
@@ -3961,19 +3986,19 @@ var LspManager = class {
       this.serverPromises.delete(langId);
     }
   }
-  async startServer(config) {
-    const langId = config.id;
-    const commandPath = await which(config.serverCommand, this.workdir);
+  async startServer(config4) {
+    const langId = config4.id;
+    const commandPath = await which(config4.serverCommand, this.workdir);
     if (!commandPath) {
       logger.warn("LSP server not installed, skipping", {
         language: langId,
-        command: config.serverCommand,
+        command: config4.serverCommand,
         sessionId: this.sessionId
       });
       this.unavailableServers.add(langId);
       return null;
     }
-    const server = new LspServer(config, this.workdir, commandPath);
+    const server = new LspServer(config4, this.workdir, commandPath);
     try {
       await server.start();
       this.servers.set(langId, server);
@@ -3993,11 +4018,11 @@ var LspManager = class {
     }
   }
   async getServerForFile(path) {
-    const config = detectLanguage(path);
-    if (!config) {
+    const config4 = detectLanguage(path);
+    if (!config4) {
       return null;
     }
-    return this.getOrCreateServer(config);
+    return this.getOrCreateServer(config4);
   }
   // ============================================================================
   // Public Interface
@@ -4028,11 +4053,11 @@ var LspManager = class {
    * Get current diagnostics for a file without triggering a change.
    */
   getDiagnostics(path) {
-    const config = detectLanguage(path);
-    if (!config) {
+    const config4 = detectLanguage(path);
+    if (!config4) {
       return [];
     }
-    const server = this.servers.get(config.id);
+    const server = this.servers.get(config4.id);
     if (!server?.isRunning()) {
       return [];
     }
@@ -4043,11 +4068,11 @@ var LspManager = class {
    * Returns true if we have or can start a server for this file type.
    */
   isAvailableFor(path) {
-    const config = detectLanguage(path);
-    if (!config) {
+    const config4 = detectLanguage(path);
+    if (!config4) {
       return false;
     }
-    if (this.unavailableServers.has(config.id)) {
+    if (this.unavailableServers.has(config4.id)) {
       return false;
     }
     return true;
@@ -4835,130 +4860,197 @@ ${summary}`,
   }
 };
 
-// src/server/routes/skills.ts
-import { Router } from "express";
-
 // src/server/routes/crud-helpers.ts
+import { Router } from "express";
+import { join as join4 } from "path";
 function computeOverrideIds(defaults, userItems) {
   return userItems.filter((u) => defaults.some((d) => d.metadata.id === u.metadata.id)).map((u) => u.metadata.id);
 }
-
-// src/server/routes/skills.ts
-function createSkillRoutes(configDir) {
+var ID_REGEX = /^[a-z0-9-]+$/;
+function validateNameIdPrompt(body) {
+  const meta = body["metadata"];
+  if (!meta?.["name"] || !body["prompt"]) return "Missing required fields: metadata.name, prompt";
+  if (meta["id"] && !ID_REGEX.test(String(meta["id"]))) return "ID must be lowercase alphanumeric with hyphens only";
+  return null;
+}
+function getProjectItemPath(projectDir, dirName, id, ext) {
+  return join4(projectDir, ".openfox", dirName, `${id}${ext}`);
+}
+async function isProjectItem(projectDir, dirName, id, ext) {
+  if (!projectDir) return false;
+  return pathExists(getProjectItemPath(projectDir, dirName, id, ext));
+}
+function createCrudRoutes(config4, configDir, projectDir) {
   const router = Router();
   router.get("/", async (_req, res) => {
-    const [defaults, userItems] = await Promise.all([loadDefaultSkills(), loadUserSkills(configDir)]);
-    const overrideIds = computeOverrideIds(defaults, userItems);
+    const [defaults, userItems, projectItems] = await Promise.all([
+      config4.loadDefaults(),
+      config4.loadUser(configDir),
+      projectDir ? config4.loadProject(projectDir) : []
+    ]);
+    const userOverrideIds = computeOverrideIds(defaults, userItems);
+    const projectOverrideIds = computeOverrideIds(defaults, projectItems);
+    const extra = config4.extraGetData ? await config4.extraGetData() : {};
     res.json({
-      defaults: defaults.map((s) => ({
-        ...s.metadata,
-        enabled: isSkillEnabled(s.metadata.id)
-      })),
-      userItems: userItems.map((s) => ({
-        ...s.metadata,
-        enabled: isSkillEnabled(s.metadata.id)
-      })),
-      overrideIds
+      defaults: defaults.map(config4.mapToResponse),
+      userItems: userItems.map(config4.mapToResponse),
+      projectItems: projectItems.map(config4.mapToResponse),
+      overrideIds: [...userOverrideIds, ...projectOverrideIds],
+      ...extra
     });
   });
   router.get("/defaults/:id", async (req, res) => {
     const { id } = req.params;
-    const content = await getDefaultSkillContent(id);
-    if (!content) {
-      return res.status(404).json({ error: "Default skill not found" });
+    const allDefaults = await config4.loadDefaults();
+    const item = allDefaults.find((d) => d.metadata.id === id);
+    if (!item) {
+      return res.status(404).json({ error: "Default not found" });
     }
-    res.json(content);
+    res.json(item);
   });
   router.get("/default-ids", async (_req, res) => {
-    const ids = await getDefaultSkillIds();
+    const ids = config4.getDefaultIds ? await config4.getDefaultIds() : [];
     res.json({ ids });
   });
-  router.post("/:id/toggle", (req, res) => {
-    const { id } = req.params;
-    const currentlyEnabled = isSkillEnabled(id);
-    setSkillEnabled(id, !currentlyEnabled);
-    res.json({ id, enabled: !currentlyEnabled });
-  });
   router.get("/:id", async (req, res) => {
     const { id } = req.params;
-    const skills = await loadAllSkills(configDir);
-    const skill = findSkillById(id, skills);
-    if (!skill) {
-      return res.status(404).json({ error: "Skill not found" });
+    const items = await config4.loadAll(configDir, projectDir);
+    const item = config4.findById(id, items);
+    if (!item) {
+      return res.status(404).json({ error: "Not found" });
     }
-    res.json(skill);
+    res.json(item);
   });
   router.post("/", async (req, res) => {
     const body = req.body;
-    if (!body.metadata?.id || !body.metadata?.name || !body.prompt) {
-      return res.status(400).json({ error: "Missing required fields: metadata.id, metadata.name, prompt" });
+    const meta = body["metadata"];
+    const customError = config4.validateCreate?.(body);
+    if (!meta?.["id"] || customError) {
+      return res.status(400).json({ error: customError ?? "Missing required fields" });
     }
-    if (!/^[a-z0-9-]+$/.test(body.metadata.id)) {
-      return res.status(400).json({ error: "Skill ID must be lowercase alphanumeric with hyphens only" });
+    const id = String(meta["id"]);
+    const destination = body["destination"] ?? "user";
+    if (destination === "project" && !projectDir) {
+      return res.status(400).json({ error: "No project directory configured" });
     }
-    const exists = await skillExists(configDir, body.metadata.id);
+    const exists = await config4.exists(configDir, id, projectDir);
     if (exists) {
-      return res.status(409).json({ error: "A skill with this ID already exists" });
+      return res.status(409).json({ error: "An item with this ID already exists" });
+    }
+    if (destination === "project") {
+      await config4.saveToProject(projectDir, body);
+    } else {
+      await config4.save(configDir, body);
     }
-    await saveSkill(configDir, body);
     res.status(201).json(body);
   });
   router.put("/:id", async (req, res) => {
     const { id } = req.params;
-    const skills = await loadAllSkills(configDir);
-    const existing = findSkillById(id, skills);
+    const items = await config4.loadAll(configDir, projectDir);
+    const existing = config4.findById(id, items);
     if (!existing) {
-      return res.status(404).json({ error: "Skill not found" });
+      return res.status(404).json({ error: "Not found" });
     }
     const body = req.body;
+    const meta = body["metadata"];
     const updated = {
-      metadata: { ...existing.metadata, ...body.metadata, id },
-      prompt: body.prompt ?? existing.prompt
+      ...existing,
+      ...body,
+      metadata: { ...existing.metadata, ...meta, id }
     };
-    await saveSkill(configDir, updated);
+    const isProject = await isProjectItem(projectDir, config4.dirName, id, config4.ext);
+    if (isProject) {
+      await config4.saveToProject(projectDir, updated);
+    } else {
+      await config4.save(configDir, updated);
+    }
     res.json(updated);
   });
   router.delete("/:id", async (req, res) => {
     const { id } = req.params;
-    const result = await deleteSkill(configDir, id);
+    const isProject = await isProjectItem(projectDir, config4.dirName, id, config4.ext);
+    if (isProject) {
+      const result2 = await config4.deleteProject(projectDir, id);
+      if (!result2.success) {
+        return res.status(500).json({ error: "Failed to delete project item" });
+      }
+      return res.json({ success: true });
+    }
+    const isDefault = await config4.isDefault(id);
+    if (isDefault) {
+      return res.status(403).json({ error: "Cannot delete built-in defaults" });
+    }
+    const result = await config4.delete(configDir, id);
     if (!result.success) {
-      return res.status(403).json({ error: result.reason ?? "Cannot delete this skill" });
+      return res.status(403).json({ error: result.reason ?? "Cannot delete this item" });
     }
     res.json({ success: true });
   });
   router.post("/:id/duplicate", async (req, res) => {
     const { id } = req.params;
-    const defaults = await loadDefaultSkills();
-    const userItems = await loadUserSkills(configDir);
-    const source = defaults.find((s) => s.metadata.id === id) ?? userItems.find((s) => s.metadata.id === id);
+    const items = await config4.loadAll(configDir, projectDir);
+    const source = config4.findById(id, items);
     if (!source) {
-      return res.status(404).json({ error: "Skill not found" });
+      return res.status(404).json({ error: "Not found" });
     }
     const newId = `${id}-copy-${Date.now()}`;
     const duplicated = {
-      metadata: { ...source.metadata, id: newId, name: `${source.metadata.name} (copy)` },
-      prompt: source.prompt
+      ...source,
+      metadata: { ...source.metadata, id: newId, name: `${source.metadata.name} (copy)` }
     };
-    await saveSkill(configDir, duplicated);
+    const destination = req.body.destination ?? "user";
+    if (destination === "project") {
+      if (!projectDir) return res.status(400).json({ error: "No project directory configured" });
+      await config4.saveToProject(projectDir, duplicated);
+    } else {
+      await config4.save(configDir, duplicated);
+    }
     res.status(201).json(duplicated);
   });
+  config4.extraRoutes?.(router);
   return router;
 }
 
-// src/server/routes/commands.ts
-import { Router as Router2 } from "express";
+// src/server/routes/skills.ts
+var config = {
+  dirName: "skills",
+  ext: ".skill.md",
+  loadDefaults: loadDefaultSkills,
+  loadUser: loadUserSkills,
+  loadProject: loadProjectSkills,
+  loadAll: loadAllSkills,
+  findById: findSkillById,
+  save: saveSkill,
+  saveToProject: saveSkillToProject,
+  delete: deleteSkill,
+  deleteProject: deleteProjectSkill,
+  exists: skillExists,
+  isDefault: isDefaultSkill,
+  getDefaultIds: getDefaultSkillIds,
+  validateCreate: validateNameIdPrompt,
+  mapToResponse: (s) => ({
+    ...s.metadata,
+    enabled: isSkillEnabled(s.metadata.id)
+  })
+};
+function createSkillRoutes(configDir, projectDir) {
+  return createCrudRoutes(config, configDir, projectDir);
+}
 
 // src/server/commands/registry.ts
 import { writeFile as writeFile3, mkdir as mkdir3, unlink as unlink2 } from "fs/promises";
-import { join as join4, dirname as dirname4 } from "path";
+import { join as join5, dirname as dirname4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import matter from "gray-matter";
 var __bundleDir2 = dirname4(fileURLToPath3(import.meta.url));
-var DEFAULTS_DIR2 = join4(__bundleDir2, "defaults");
-var DEFAULTS_DIR_ALT2 = join4(__bundleDir2, "command-defaults");
+var DEFAULTS_DIR2 = join5(__bundleDir2, "defaults");
+var DEFAULTS_DIR_ALT2 = join5(__bundleDir2, "command-defaults");
 var COMMAND_EXTENSION = ".command.md";
 function getCommandsDir(configDir) {
-  return join4(configDir, "commands");
+  return join5(configDir, "commands");
+}
+function getProjectCommandsDir(projectDir) {
+  return join5(projectDir, ".openfox", "commands");
 }
 async function loadDefaultCommands() {
   let defaults = await loadItemsFromDir(DEFAULTS_DIR2, {
@@ -4979,7 +5071,13 @@ async function loadUserCommands(configDir) {
     logName: "command"
   });
 }
-async function loadAllCommands(configDir) {
+async function loadProjectCommands(projectDir) {
+  return loadItemsFromDir(getProjectCommandsDir(projectDir), {
+    extension: COMMAND_EXTENSION,
+    logName: "command"
+  });
+}
+async function loadAllCommands(configDir, projectDir) {
   const [defaultCommands, userCommands] = await Promise.all([loadDefaultCommands(), loadUserCommands(configDir)]);
   const commandMap = /* @__PURE__ */ new Map();
   for (const cmd of defaultCommands) {
@@ -4988,6 +5086,12 @@ async function loadAllCommands(configDir) {
   for (const cmd of userCommands) {
     commandMap.set(cmd.metadata.id, cmd);
   }
+  if (projectDir) {
+    const projectCommands = await loadProjectCommands(projectDir);
+    for (const cmd of projectCommands) {
+      commandMap.set(cmd.metadata.id, cmd);
+    }
+  }
   return Array.from(commandMap.values());
 }
 async function getDefaultCommandIds() {
@@ -4995,10 +5099,6 @@ async function getDefaultCommandIds() {
   if (ids.length) return ids;
   return getDefaultIds(DEFAULTS_DIR_ALT2, COMMAND_EXTENSION);
 }
-async function getDefaultCommandContent(commandId) {
-  const defaults = await loadDefaultCommands();
-  return defaults.find((c) => c.metadata.id === commandId) ?? null;
-}
 async function isDefaultCommand(commandId) {
   const defaultIds = await getDefaultCommandIds();
   return defaultIds.includes(commandId);
@@ -5006,24 +5106,38 @@ async function isDefaultCommand(commandId) {
 function findCommandById(commandId, commands) {
   return commands.find((c) => c.metadata.id === commandId);
 }
-async function commandExists(configDir, commandId) {
-  return pathExists(join4(getCommandsDir(configDir), `${commandId}${COMMAND_EXTENSION}`));
+async function commandExists(configDir, commandId, projectDir) {
+  if (await pathExists(join5(getCommandsDir(configDir), `${commandId}${COMMAND_EXTENSION}`))) return true;
+  if (projectDir && await pathExists(join5(getProjectCommandsDir(projectDir), `${commandId}${COMMAND_EXTENSION}`)))
+    return true;
+  return false;
 }
 async function saveCommand(configDir, command) {
   const commandsDir = getCommandsDir(configDir);
   if (!await pathExists(commandsDir)) {
     await mkdir3(commandsDir, { recursive: true });
   }
-  const filePath = join4(commandsDir, `${command.metadata.id}${COMMAND_EXTENSION}`);
+  const filePath = join5(commandsDir, `${command.metadata.id}${COMMAND_EXTENSION}`);
   const content = matter.stringify(command.prompt, command.metadata);
   await writeFile3(filePath, content, "utf-8");
 }
+async function saveCommandToProject(projectDir, command) {
+  await saveItemToDir(
+    getProjectCommandsDir(projectDir),
+    command,
+    COMMAND_EXTENSION,
+    (c) => matter.stringify(c.prompt, c.metadata)
+  );
+}
+async function deleteProjectCommand(projectDir, commandId) {
+  return deleteItemFromDir(getProjectCommandsDir(projectDir), commandId, COMMAND_EXTENSION);
+}
 async function deleteCommand(configDir, commandId) {
   const isDefault = await isDefaultCommand(commandId);
   if (isDefault) {
     return { success: false, reason: "Cannot delete built-in defaults" };
   }
-  const filePath = join4(getCommandsDir(configDir), `${commandId}${COMMAND_EXTENSION}`);
+  const filePath = join5(getCommandsDir(configDir), `${commandId}${COMMAND_EXTENSION}`);
   try {
     await unlink2(filePath);
     return { success: true };
@@ -5033,292 +5147,106 @@ async function deleteCommand(configDir, commandId) {
 }
 
 // src/server/routes/commands.ts
-function createCommandRoutes(configDir) {
-  const router = Router2();
-  router.get("/", async (_req, res) => {
-    const [defaults, userItems] = await Promise.all([loadDefaultCommands(), loadUserCommands(configDir)]);
-    const overrideIds = computeOverrideIds(defaults, userItems);
-    res.json({
-      defaults: defaults.map((c) => c.metadata),
-      userItems: userItems.map((c) => c.metadata),
-      overrideIds
-    });
-  });
-  router.get("/defaults/:id", async (req, res) => {
-    const { id } = req.params;
-    const content = await getDefaultCommandContent(id);
-    if (!content) {
-      return res.status(404).json({ error: "Default command not found" });
-    }
-    res.json(content);
-  });
-  router.get("/default-ids", async (_req, res) => {
-    const ids = await getDefaultCommandIds();
-    res.json({ ids });
-  });
-  router.get("/:id", async (req, res) => {
-    const { id } = req.params;
-    const commands = await loadAllCommands(configDir);
-    const command = findCommandById(id, commands);
-    if (!command) {
-      return res.status(404).json({ error: "Command not found" });
-    }
-    res.json(command);
-  });
-  router.post("/", async (req, res) => {
-    const body = req.body;
-    if (!body.metadata?.id || !body.metadata?.name || !body.prompt) {
-      return res.status(400).json({ error: "Missing required fields: metadata.id, metadata.name, prompt" });
-    }
-    if (!/^[a-z0-9-]+$/.test(body.metadata.id)) {
-      return res.status(400).json({ error: "Command ID must be lowercase alphanumeric with hyphens only" });
-    }
-    const exists = await commandExists(configDir, body.metadata.id);
-    if (exists) {
-      return res.status(409).json({ error: "A command with this ID already exists" });
-    }
-    await saveCommand(configDir, body);
-    res.status(201).json(body);
-  });
-  router.put("/:id", async (req, res) => {
-    const { id } = req.params;
-    const commands = await loadAllCommands(configDir);
-    const existing = findCommandById(id, commands);
-    if (!existing) {
-      return res.status(404).json({ error: "Command not found" });
-    }
-    const body = req.body;
-    const updated = {
-      metadata: { ...existing.metadata, ...body.metadata, id },
-      prompt: body.prompt ?? existing.prompt
-    };
-    await saveCommand(configDir, updated);
-    res.json(updated);
-  });
-  router.delete("/:id", async (req, res) => {
-    const { id } = req.params;
-    const result = await deleteCommand(configDir, id);
-    if (!result.success) {
-      return res.status(403).json({ error: result.reason ?? "Cannot delete this command" });
-    }
-    res.json({ success: true });
-  });
-  router.post("/:id/duplicate", async (req, res) => {
-    const { id } = req.params;
-    const defaults = await loadDefaultCommands();
-    const userItems = await loadUserCommands(configDir);
-    const source = defaults.find((c) => c.metadata.id === id) ?? userItems.find((c) => c.metadata.id === id);
-    if (!source) {
-      return res.status(404).json({ error: "Command not found" });
-    }
-    const newId = `${id}-copy-${Date.now()}`;
-    const duplicated = {
-      metadata: { ...source.metadata, id: newId, name: `${source.metadata.name} (copy)` },
-      prompt: source.prompt
-    };
-    await saveCommand(configDir, duplicated);
-    res.status(201).json(duplicated);
-  });
-  return router;
+var config2 = {
+  dirName: "commands",
+  ext: ".command.md",
+  loadDefaults: loadDefaultCommands,
+  loadUser: loadUserCommands,
+  loadProject: loadProjectCommands,
+  loadAll: loadAllCommands,
+  findById: findCommandById,
+  save: saveCommand,
+  saveToProject: saveCommandToProject,
+  delete: deleteCommand,
+  deleteProject: deleteProjectCommand,
+  exists: commandExists,
+  isDefault: isDefaultCommand,
+  getDefaultIds: getDefaultCommandIds,
+  validateCreate: validateNameIdPrompt,
+  mapToResponse: (c) => c.metadata
+};
+function createCommandRoutes(configDir, projectDir) {
+  return createCrudRoutes(config2, configDir, projectDir);
 }
 
 // src/server/routes/agents.ts
-import { Router as Router3 } from "express";
-function createAgentRoutes(configDir) {
-  const router = Router3();
-  router.get("/", async (_req, res) => {
-    const [defaults, userItems] = await Promise.all([loadDefaultAgents(), loadUserAgents(configDir)]);
-    const overrideIds = computeOverrideIds(defaults, userItems);
-    res.json({
-      defaults: defaults.map((a) => a.metadata),
-      userItems: userItems.map((a) => a.metadata),
-      overrideIds
-    });
-  });
-  router.get("/defaults/:id", async (req, res) => {
-    const { id } = req.params;
-    const content = await getDefaultAgentContent(id);
-    if (!content) {
-      return res.status(404).json({ error: "Default agent not found" });
-    }
-    res.json(content);
-  });
-  router.get("/default-ids", async (_req, res) => {
-    const ids = await getDefaultAgentIds();
-    res.json({ ids });
-  });
-  router.get("/:id", async (req, res) => {
-    const { id } = req.params;
-    const agents = await loadAllAgents(configDir);
-    const agent = findAgentById(id, agents);
-    if (!agent) {
-      return res.status(404).json({ error: "Agent not found" });
-    }
-    res.json(agent);
-  });
-  router.post("/", async (req, res) => {
-    const body = req.body;
-    if (!body?.metadata?.id || !body?.prompt) {
-      return res.status(400).json({ error: "Missing required fields: metadata.id, prompt" });
-    }
-    const exists = await agentExists(configDir, body.metadata.id);
-    if (exists) {
-      return res.status(409).json({ error: "An agent with this ID already exists" });
-    }
-    await saveAgent(configDir, body);
-    res.status(201).json(body);
-  });
-  router.put("/:id", async (req, res) => {
-    const { id } = req.params;
-    if (!id) {
-      return res.status(400).json({ error: "Missing agent ID" });
-    }
-    const body = req.body;
-    const agents = await loadAllAgents(configDir);
-    const existing = findAgentById(id, agents);
-    if (!existing) {
-      return res.status(404).json({ error: "Agent not found" });
-    }
-    const updated = {
-      metadata: { ...existing.metadata, ...body.metadata, id },
-      prompt: body.prompt ?? existing.prompt
-    };
-    await saveAgent(configDir, updated);
-    res.json(updated);
-  });
-  router.delete("/:id", async (req, res) => {
-    const { id } = req.params;
-    const result = await deleteAgent(configDir, id);
-    if (!result.success) {
-      return res.status(403).json({ error: result.reason ?? "Cannot delete this agent" });
-    }
-    res.json({ success: true });
-  });
-  router.post("/:id/duplicate", async (req, res) => {
-    const { id } = req.params;
-    const defaults = await loadDefaultAgents();
-    const userItems = await loadUserAgents(configDir);
-    const source = defaults.find((a) => a.metadata.id === id) ?? userItems.find((a) => a.metadata.id === id);
-    if (!source) {
-      return res.status(404).json({ error: "Agent not found" });
-    }
-    const newId = `${id}-copy-${Date.now()}`;
-    const duplicated = {
-      metadata: { ...source.metadata, id: newId, name: `${source.metadata.name} (copy)` },
-      prompt: source.prompt
-    };
-    await saveAgent(configDir, duplicated);
-    res.status(201).json(duplicated);
-  });
-  return router;
+var config3 = {
+  dirName: "agents",
+  ext: ".agent.md",
+  loadDefaults: loadDefaultAgents,
+  loadUser: loadUserAgents,
+  loadProject: loadProjectAgents,
+  loadAll: loadAllAgents,
+  findById: findAgentById,
+  save: saveAgent,
+  saveToProject: saveAgentToProject,
+  delete: deleteAgent,
+  deleteProject: deleteProjectAgent,
+  exists: agentExists,
+  isDefault: isDefaultAgent,
+  getDefaultIds: getDefaultAgentIds,
+  validateCreate: (body) => {
+    const meta = body["metadata"];
+    if (!meta?.["id"] || !body["prompt"]) return "Missing required fields: metadata.id, prompt";
+    return null;
+  },
+  mapToResponse: (a) => a.metadata
+};
+function createAgentRoutes(configDir, projectDir) {
+  return createCrudRoutes(config3, configDir, projectDir);
 }
 
 // src/server/routes/workflows.ts
-import { Router as Router4 } from "express";
-function createWorkflowRoutes(configDir, config) {
-  const router = Router4();
-  router.get("/", async (_req, res) => {
-    const [defaults, userItems] = await Promise.all([loadDefaultWorkflows(), loadUserWorkflows(configDir)]);
-    const overrideIds = computeOverrideIds(defaults, userItems);
-    res.json({
-      defaults: defaults.map((p) => ({ ...p.metadata, startCondition: p.startCondition })),
-      userItems: userItems.map((p) => ({ ...p.metadata, startCondition: p.startCondition })),
-      activeWorkflowId: config.activeWorkflowId ?? "default",
-      overrideIds
-    });
-  });
-  router.get("/template-variables", (_req, res) => {
-    res.json({ variables: TEMPLATE_VARIABLES });
-  });
-  router.get("/defaults/:id", async (req, res) => {
-    const { id } = req.params;
-    const content = await getDefaultWorkflowContent(id);
-    if (!content) {
-      return res.status(404).json({ error: "Default workflow not found" });
-    }
-    res.json(content);
-  });
-  router.get("/default-ids", async (_req, res) => {
-    const ids = await getDefaultWorkflowIds();
-    res.json({ ids });
-  });
-  router.get("/:id", async (req, res) => {
-    const { id } = req.params;
-    const workflows = await loadAllWorkflows(configDir);
-    const workflow = findWorkflowById(id, workflows);
-    if (!workflow) {
-      return res.status(404).json({ error: "Workflow not found" });
-    }
-    res.json(workflow);
-  });
-  router.post("/", async (req, res) => {
-    const body = req.body;
-    if (!body?.metadata?.id || !body?.steps?.length) {
-      return res.status(400).json({ error: "Missing required fields: metadata.id, steps" });
-    }
-    const exists = await workflowExists(configDir, body.metadata.id);
-    if (exists) {
-      return res.status(409).json({ error: "A workflow with this ID already exists" });
-    }
-    await saveWorkflow(configDir, body);
-    res.status(201).json(body);
-  });
-  router.put("/:id", async (req, res) => {
-    const { id } = req.params;
-    const workflows = await loadAllWorkflows(configDir);
-    const existing = findWorkflowById(id, workflows);
-    if (!existing) {
-      return res.status(404).json({ error: "Workflow not found" });
-    }
-    const body = req.body;
-    const updated = {
-      ...body,
-      metadata: { ...body.metadata, id }
-    };
-    await saveWorkflow(configDir, updated);
-    res.json(updated);
-  });
-  router.delete("/:id", async (req, res) => {
-    const { id } = req.params;
-    const result = await deleteWorkflow(configDir, id);
-    if (!result.success) {
-      return res.status(403).json({ error: result.reason ?? "Cannot delete this workflow" });
-    }
-    res.json({ success: true });
-  });
-  router.post("/:id/duplicate", async (req, res) => {
-    const { id } = req.params;
-    const defaults = await loadDefaultWorkflows();
-    const userItems = await loadUserWorkflows(configDir);
-    const source = defaults.find((w) => w.metadata.id === id) ?? userItems.find((w) => w.metadata.id === id);
-    if (!source) {
-      return res.status(404).json({ error: "Workflow not found" });
+import "express";
+function createWorkflowRoutes(configDir, config4, projectDir) {
+  const crudConfig = {
+    dirName: "workflows",
+    ext: ".workflow.json",
+    loadDefaults: loadDefaultWorkflows,
+    loadUser: loadUserWorkflows,
+    loadProject: loadProjectWorkflows,
+    loadAll: loadAllWorkflows,
+    findById: findWorkflowById,
+    save: saveWorkflow,
+    saveToProject: saveWorkflowToProject,
+    delete: deleteWorkflow,
+    deleteProject: deleteProjectWorkflow,
+    exists: workflowExists,
+    isDefault: isDefaultWorkflow,
+    getDefaultIds: getDefaultWorkflowIds,
+    validateCreate: (body) => {
+      const steps = body["steps"];
+      if (!Array.isArray(steps) || steps.length === 0) return "Missing required fields: metadata.id, steps";
+      return null;
+    },
+    mapToResponse: (w) => ({
+      ...w.metadata,
+      startCondition: w.startCondition
+    }),
+    extraGetData: () => Promise.resolve({ activeWorkflowId: config4.activeWorkflowId ?? "default" }),
+    extraRoutes: (router) => {
+      router.get("/template-variables", (_req, res) => {
+        res.json({ variables: TEMPLATE_VARIABLES });
+      });
     }
-    const newId = `${id}-copy-${Date.now()}`;
-    const duplicated = {
-      ...source,
-      metadata: { ...source.metadata, id: newId, name: `${source.metadata.name} (copy)` }
-    };
-    await saveWorkflow(configDir, duplicated);
-    res.status(201).json(duplicated);
-  });
-  return router;
+  };
+  return createCrudRoutes(crudConfig, configDir, projectDir);
 }
 
 // src/server/routes/dev-server.ts
-import { Router as Router5 } from "express";
+import { Router as Router3 } from "express";
 function createDevServerRoutes() {
-  const router = Router5();
+  const router = Router3();
   router.get("/", async (req, res) => {
     const workdir = req.query["workdir"];
     if (!workdir) return res.status(400).json({ error: "workdir required" });
     const status = devServerManager.getStatus(workdir);
     if (!status.config) {
-      const config = await devServerManager.loadConfig(workdir);
-      if (config) {
-        status.config = config;
-        status.url = config.url;
-        status.hotReload = config.hotReload;
+      const config4 = await devServerManager.loadConfig(workdir);
+      if (config4) {
+        status.config = config4;
+        status.url = config4.url;
+        status.hotReload = config4.hotReload;
       }
     }
     res.json(status);
@@ -5364,8 +5292,8 @@ function createDevServerRoutes() {
   router.get("/config", async (req, res) => {
     const workdir = req.query["workdir"];
     if (!workdir) return res.status(400).json({ error: "workdir required" });
-    const config = await devServerManager.loadConfig(workdir);
-    res.json({ config });
+    const config4 = await devServerManager.loadConfig(workdir);
+    res.json({ config: config4 });
   });
   router.post("/config", async (req, res) => {
     const workdir = req.query["workdir"];
@@ -5375,9 +5303,9 @@ function createDevServerRoutes() {
       return res.status(400).json({ error: "command and url are required" });
     }
     try {
-      const config = { command, url, hotReload: hotReload ?? false, disableInspect: disableInspect ?? false };
-      await devServerManager.saveConfig(workdir, config);
-      res.json({ config });
+      const config4 = { command, url, hotReload: hotReload ?? false, disableInspect: disableInspect ?? false };
+      await devServerManager.saveConfig(workdir, config4);
+      res.json({ config: config4 });
     } catch (err) {
       res.status(500).json({ error: err instanceof Error ? err.message : "Failed to save config" });
     }
@@ -5386,9 +5314,9 @@ function createDevServerRoutes() {
 }
 
 // src/server/routes/terminals.ts
-import { Router as Router6 } from "express";
+import { Router as Router4 } from "express";
 function createTerminalRoutes() {
-  const router = Router6();
+  const router = Router4();
   router.get("/", (req, res) => {
     const projectId = req.query["projectId"];
     const sessions = projectId ? terminalManager.getByProject(projectId) : [];
@@ -5426,19 +5354,105 @@ function createTerminalRoutes() {
   return router;
 }
 
+// src/server/routes/auto-update.ts
+import { Router as Router5 } from "express";
+import { spawn as spawn4 } from "child_process";
+
 // src/constants.ts
-var VERSION = "1.6.90";
+var VERSION = "1.6.92";
+
+// src/server/routes/auto-update.ts
+var updateInProgress = false;
+function createAutoUpdateRoutes(options = {}) {
+  const router = Router5();
+  router.get("/check", async (req, res) => {
+    const isTest = req.query["test"] === "1";
+    const current = VERSION;
+    if (isTest) {
+      res.json({ current: "1.0.0", latest: "1.1.0", isUpdateAvailable: true });
+      return;
+    }
+    try {
+      const latest = await new Promise((resolve2, reject) => {
+        const child = spawn4("npm", ["view", "openfox", "version"], {
+          stdio: ["ignore", "pipe", "pipe"]
+        });
+        let stdout = "";
+        child.stdout?.on("data", (data) => {
+          stdout += data.toString();
+        });
+        child.on("close", (code) => {
+          if (code === 0) {
+            resolve2(stdout.trim());
+          } else {
+            reject(new Error(`npm view exited with code ${code}`));
+          }
+        });
+        child.on("error", reject);
+        setTimeout(() => {
+          child.kill();
+          reject(new Error("npm view timed out"));
+        }, 1e4);
+      });
+      const isUpdateAvailable = current !== latest;
+      res.json({ current, latest, isUpdateAvailable });
+    } catch {
+      res.json({ current, latest: current, isUpdateAvailable: false });
+    }
+  });
+  router.post("/", async (req, res) => {
+    if (options.requireAuth) {
+      const authorized = await options.requireAuth(req);
+      if (!authorized) {
+        res.status(401).json({ error: "Unauthorized" });
+        return;
+      }
+    }
+    if (updateInProgress) {
+      res.status(409).json({ error: "Update already in progress" });
+      return;
+    }
+    try {
+      let stderr = "";
+      const child = spawn4("bash", ["-c", "openfox update"], {
+        detached: true,
+        stdio: ["ignore", "ignore", "pipe"]
+      });
+      if (child.stderr) {
+        child.stderr.on("data", (data) => {
+          stderr += data.toString();
+        });
+      }
+      child.unref();
+      updateInProgress = true;
+      child.on("close", () => {
+        updateInProgress = false;
+      });
+      setTimeout(() => {
+        if (stderr) {
+          console.error("[auto-update] subprocess error:", stderr);
+        }
+        updateInProgress = false;
+      }, 3e4);
+      res.json({ success: true });
+    } catch (err) {
+      updateInProgress = false;
+      res.status(500).json({ error: err instanceof Error ? err.message : "Update failed to start" });
+    }
+  });
+  return router;
+}
 
 // src/server/index.ts
 var __dirname2 = dirname5(fileURLToPath4(import.meta.url));
-async function createServerHandle(config) {
-  setRuntimeConfig(config);
-  setLogLevel(config.logging?.level ?? void 0, config.mode);
+async function createServerHandle(config4) {
+  setRuntimeConfig(config4);
+  setLogLevel(config4.logging?.level ?? void 0, config4.mode);
   await loadServerAuthConfig();
-  const db = initDatabase(config);
+  const db = initDatabase(config4);
   initEventStore(db);
-  const configDir = getGlobalConfigDir(config.mode ?? "production");
-  const providerManager = createProviderManager(config);
+  const configDir = getGlobalConfigDir(config4.mode ?? "production");
+  const providerManager = createProviderManager(config4);
   const sessionManager = new SessionManager(providerManager);
   devServerManager.setSessionManager(sessionManager);
   const useMock = process.env["OPENFOX_MOCK_LLM"] === "true";
@@ -5451,20 +5465,20 @@ async function createServerHandle(config) {
     const llmClient = getLLMClient();
     let backend;
     const useMock2 = process.env["OPENFOX_MOCK_LLM"] === "true";
-    if (config.llm.backend === "auto") {
-      backend = await detectBackend(config.llm.baseUrl, void 0, useMock2);
+    if (config4.llm.backend === "auto") {
+      backend = await detectBackend(config4.llm.baseUrl, void 0, useMock2);
       llmClient.setBackend(backend);
       if (!useMock2) {
         logger.info("Auto-detected LLM backend", { backend: getBackendDisplayName(backend) });
       }
     } else {
-      backend = config.llm.backend;
+      backend = config4.llm.backend;
       llmClient.setBackend(backend);
       if (!useMock2) {
         logger.info("Using configured LLM backend", { backend: getBackendDisplayName(backend) });
       }
     }
-    const detected = await detectModel(config.llm.baseUrl);
+    const detected = await detectModel(config4.llm.baseUrl);
     if (detected) {
       llmClient.setModel(detected);
       if (!useMock2) {
@@ -5472,7 +5486,7 @@ async function createServerHandle(config) {
       }
     } else {
       if (!useMock2) {
-        logger.warn("Could not auto-detect model, using config", { model: config.llm.model });
+        logger.warn("Could not auto-detect model, using config", { model: config4.llm.model });
       }
     }
     const activeProvider = providerManager.getActiveProvider();
@@ -5494,7 +5508,7 @@ async function createServerHandle(config) {
   app.use(express.json({ limit: "10mb" }));
   const authMiddleware = async (req, res, next) => {
     const path = req.path;
-    const publicPaths = ["/health", "/auth", "/auth/login"];
+    const publicPaths = ["/health", "/auth", "/auth/login", "/auto-update/check"];
     if (publicPaths.includes(path)) {
       return next();
     }
@@ -5642,7 +5656,7 @@ async function createServerHandle(config) {
     res.json({ project });
   });
   app.get("/api/sessions", async (req, res) => {
-    const { getRecentUserPromptsForSession } = await import("./events-AQKDXJFK.js");
+    const { getRecentUserPromptsForSession } = await import("./events-K6AYMXFT.js");
     const projectId = req.query["projectId"];
     const limit = Math.min(parseInt(req.query["limit"]) || 20, 100);
     const offset = parseInt(req.query["offset"]) || 0;
@@ -5670,12 +5684,12 @@ async function createServerHandle(config) {
     if (!project) {
       return res.status(404).json({ error: "Project not found" });
     }
-    const { providerId, model } = parseDefaultModelSelection(config.defaultModelSelection);
+    const { providerId, model } = parseDefaultModelSelection(config4.defaultModelSelection);
     const session = sessionManager.createSession(projectId, title, providerId ?? null, model ?? null);
     res.status(201).json({ session });
   });
   app.get("/api/sessions/:id", async (req, res) => {
-    const { getEventStore: getEventStore2 } = await import("./events-AQKDXJFK.js");
+    const { getEventStore: getEventStore2 } = await import("./events-K6AYMXFT.js");
     const { buildMessagesFromStoredEvents: buildMessagesFromStoredEvents2 } = await import("./folding-4VHGQE6Y.js");
     const session = sessionManager.getSession(req.params.id);
     if (!session) {
@@ -5706,7 +5720,7 @@ async function createServerHandle(config) {
     res.json({ success: true });
   });
   app.post("/api/sessions/:id/provider", async (req, res) => {
-    const { getEventStore: getEventStore2 } = await import("./events-AQKDXJFK.js");
+    const { getEventStore: getEventStore2 } = await import("./events-K6AYMXFT.js");
     const { buildMessagesFromStoredEvents: buildMessagesFromStoredEvents2 } = await import("./folding-4VHGQE6Y.js");
     const sessionId = req.params.id;
     const session = sessionManager.getSession(sessionId);
@@ -5718,11 +5732,11 @@ async function createServerHandle(config) {
       return res.status(400).json({ error: "providerId is required" });
     }
     sessionManager.setSessionProvider(sessionId, providerId, model ?? "auto");
-    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-HMMPXQ46.js");
-    const globalConfig = await loadGlobalConfig(config.mode ?? "production");
+    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-7XJQNOKX.js");
+    const globalConfig = await loadGlobalConfig(config4.mode ?? "production");
     const updatedConfig = setDefaultModelSelection(globalConfig, providerId, model ?? "auto");
-    await saveGlobalConfig(config.mode ?? "production", updatedConfig);
-    config.defaultModelSelection = updatedConfig.defaultModelSelection;
+    await saveGlobalConfig(config4.mode ?? "production", updatedConfig);
+    config4.defaultModelSelection = updatedConfig.defaultModelSelection;
     const contextState = sessionManager.getContextState(sessionId);
     const eventStore = getEventStore2();
     const events = eventStore.getEvents(sessionId);
@@ -5744,7 +5758,7 @@ async function createServerHandle(config) {
     res.json({ success: true });
   });
   app.put("/api/sessions/:id/mode", async (req, res) => {
-    const { getEventStore: getEventStore2 } = await import("./events-AQKDXJFK.js");
+    const { getEventStore: getEventStore2 } = await import("./events-K6AYMXFT.js");
     const { buildMessagesFromStoredEvents: buildMessagesFromStoredEvents2 } = await import("./folding-4VHGQE6Y.js");
     const sessionId = req.params.id;
     const session = sessionManager.getSession(sessionId);
@@ -5752,12 +5766,16 @@ async function createServerHandle(config) {
       return res.status(404).json({ error: "Session not found" });
     }
     const { mode } = req.body;
-    if (!mode || !["planner", "builder"].includes(mode)) {
-      return res.status(400).json({ error: 'mode is required and must be "planner" or "builder"' });
+    if (!mode) {
+      return res.status(400).json({ error: "mode is required" });
+    }
+    const allAgents = await loadAllAgentsDefault();
+    const topLevelIds = getTopLevelAgents(allAgents).map((a) => a.metadata.id);
+    if (!topLevelIds.includes(mode)) {
+      return res.status(400).json({ error: `Invalid mode. Must be one of: ${topLevelIds.join(", ")}` });
     }
     sessionManager.setMode(sessionId, mode);
     const eventStore = getEventStore2();
-    eventStore.append(sessionId, { type: "mode.changed", data: { mode, auto: false } });
     const events = eventStore.getEvents(sessionId);
     const messages = buildMessagesFromStoredEvents2(events);
     const updatedSession = sessionManager.getSession(sessionId);
@@ -5797,12 +5815,12 @@ async function createServerHandle(config) {
     if (!callId || approved === void 0) {
       return res.status(400).json({ error: "callId and approved are required" });
     }
-    const { providePathConfirmation } = await import("./tools-7MGUWXDP.js");
+    const { providePathConfirmation } = await import("./tools-NFFQWH6M.js");
     const result = providePathConfirmation(callId, approved, alwaysAllow);
     if (!result.found) {
       return res.status(404).json({ error: "No pending path confirmation with that ID" });
     }
-    const { getEventStore: getEventStore2 } = await import("./events-AQKDXJFK.js");
+    const { getEventStore: getEventStore2 } = await import("./events-K6AYMXFT.js");
     const { buildMessagesFromStoredEvents: buildMessagesFromStoredEvents2, foldPendingConfirmations: foldPendingConfirmations2 } = await import("./folding-4VHGQE6Y.js");
     const { createSessionStateMessage: createSessionStateMessage2 } = await import("./protocol-QDSVJTRN.js");
     const eventStore = getEventStore2();
@@ -5821,7 +5839,7 @@ async function createServerHandle(config) {
     if (!callId || !answer) {
       return res.status(400).json({ error: "callId and answer are required" });
     }
-    const { provideAnswer: provideAnswer2 } = await import("./tools-7MGUWXDP.js");
+    const { provideAnswer: provideAnswer2 } = await import("./tools-NFFQWH6M.js");
     const found = provideAnswer2(callId, answer);
     if (!found) {
       return res.status(404).json({ error: "No pending question with that ID" });
@@ -5857,14 +5875,14 @@ async function createServerHandle(config) {
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { stopSessionExecution } = await import("./chat-handler-6ATTKNZT.js");
-    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-7MGUWXDP.js");
+    const { stopSessionExecution } = await import("./chat-handler-UPAEF6HR.js");
+    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-NFFQWH6M.js");
     stopSessionExecution(sessionId, sessionManager);
     abortSession(sessionId);
     cancelQuestionsForSession(sessionId, "Session stopped by user");
     cancelPathConfirmationsForSession(sessionId, "Session stopped by user");
     sessionManager.clearMessageQueue(sessionId);
-    const eventStore = (await import("./events-AQKDXJFK.js")).getEventStore();
+    const eventStore = (await import("./events-K6AYMXFT.js")).getEventStore();
     eventStore.append(sessionId, { type: "running.changed", data: { isRunning: false } });
     res.json({ success: true });
   });
@@ -5878,7 +5896,7 @@ async function createServerHandle(config) {
     if (typeof messageIndex !== "number" || messageIndex < 0) {
       return res.status(400).json({ error: "messageIndex must be a non-negative number" });
     }
-    const { truncateSessionMessages } = await import("./events-AQKDXJFK.js");
+    const { truncateSessionMessages } = await import("./events-K6AYMXFT.js");
     truncateSessionMessages(sessionId, messageIndex);
     res.json({ success: true });
   });
@@ -5909,13 +5927,13 @@ async function createServerHandle(config) {
     res.json({ accepted: true });
   });
   app.get("/api/settings/:key", async (req, res) => {
-    const { getSetting, SETTINGS_DEFAULTS } = await import("./settings-VTVOBDYG.js");
+    const { getSetting, SETTINGS_DEFAULTS } = await import("./settings-AYSWDZUI.js");
     const key = req.params.key;
     const value = getSetting(key) ?? SETTINGS_DEFAULTS[key] ?? null;
     res.json({ key, value });
   });
   app.put("/api/settings/:key", async (req, res) => {
-    const { setSetting } = await import("./settings-VTVOBDYG.js");
+    const { setSetting } = await import("./settings-AYSWDZUI.js");
     const key = req.params.key;
     const { value } = req.body;
     if (value === void 0) {
@@ -5930,8 +5948,8 @@ async function createServerHandle(config) {
     let visionFallback;
     let globalWorkdir;
     try {
-      const { loadGlobalConfig, getVisionFallback } = await import("./config-HMMPXQ46.js");
-      const globalConfig = await loadGlobalConfig(config.mode ?? "production");
+      const { loadGlobalConfig, getVisionFallback } = await import("./config-7XJQNOKX.js");
+      const globalConfig = await loadGlobalConfig(config4.mode ?? "production");
       const fallback = getVisionFallback(globalConfig);
       if (fallback) {
         visionFallback = {
@@ -5948,13 +5966,13 @@ async function createServerHandle(config) {
       version: VERSION,
       model: llmClient.getModel(),
       maxContext: providerManager.getCurrentModelContext(),
-      llmUrl: activeProvider?.url ?? config.llm.baseUrl,
+      llmUrl: activeProvider?.url ?? config4.llm.baseUrl,
       llmStatus: getLlmStatus(),
       backend: llmClient.getBackend(),
-      workdir: globalWorkdir ?? config.workdir,
+      workdir: globalWorkdir ?? config4.workdir,
       providers: providerManager.getProviders(),
       activeProviderId: providerManager.getActiveProviderId(),
-      defaultModelSelection: config.defaultModelSelection,
+      defaultModelSelection: config4.defaultModelSelection,
       visionFallback
     });
   });
@@ -5963,7 +5981,7 @@ async function createServerHandle(config) {
     const currentModel = providerManager.getCurrentModel();
     if (currentModel === "auto") {
       const activeProvider = providerManager.getActiveProvider();
-      const baseUrl = activeProvider?.url ?? config.llm.baseUrl;
+      const baseUrl = activeProvider?.url ?? config4.llm.baseUrl;
       const detected = await detectModel(baseUrl);
       if (detected) {
         llmClient.setModel(detected);
@@ -6009,8 +6027,8 @@ async function createServerHandle(config) {
       return res.status(400).json({ error: "name, url, and backend are required" });
     }
     try {
-      const { loadGlobalConfig, saveGlobalConfig, addProvider, setDefaultModelSelection } = await import("./config-HMMPXQ46.js");
-      const globalConfig = await loadGlobalConfig(config.mode ?? "production");
+      const { loadGlobalConfig, saveGlobalConfig, addProvider, setDefaultModelSelection } = await import("./config-7XJQNOKX.js");
+      const globalConfig = await loadGlobalConfig(config4.mode ?? "production");
       const providerBackend = backend;
       const configWithProvider = addProvider(globalConfig, {
         name,
@@ -6025,7 +6043,7 @@ async function createServerHandle(config) {
         configWithProvider.providers[configWithProvider.providers.length - 1].id,
         model ?? "auto"
       );
-      await saveGlobalConfig(config.mode ?? "production", finalConfig);
+      await saveGlobalConfig(config4.mode ?? "production", finalConfig);
       providerManager.setProviders(finalConfig.providers, finalConfig.defaultModelSelection ?? void 0);
       const newProvider = finalConfig.providers[finalConfig.providers.length - 1];
       res.status(201).json({
@@ -6042,14 +6060,14 @@ async function createServerHandle(config) {
   app.post("/api/init/config", async (req, res) => {
     const { workdir, visionFallback } = req.body;
     try {
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HMMPXQ46.js");
-      const globalConfig = await loadGlobalConfig(config.mode ?? "production");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-7XJQNOKX.js");
+      const globalConfig = await loadGlobalConfig(config4.mode ?? "production");
       const updatedConfig = {
         ...globalConfig,
         workspace: workdir ? { workdir } : globalConfig.workspace,
         visionFallback: visionFallback ?? globalConfig.visionFallback
       };
-      await saveGlobalConfig(config.mode ?? "production", updatedConfig);
+      await saveGlobalConfig(config4.mode ?? "production", updatedConfig);
       res.json({ success: true });
     } catch (error) {
       res.status(500).json({
@@ -6070,10 +6088,10 @@ async function createServerHandle(config) {
   });
   app.delete("/api/providers/:id", async (req, res) => {
     const { id } = req.params;
-    const { loadGlobalConfig, saveGlobalConfig, removeProvider } = await import("./config-HMMPXQ46.js");
-    const globalConfig = await loadGlobalConfig(config.mode ?? "production");
+    const { loadGlobalConfig, saveGlobalConfig, removeProvider } = await import("./config-7XJQNOKX.js");
+    const globalConfig = await loadGlobalConfig(config4.mode ?? "production");
     const updatedConfig = removeProvider(globalConfig, id);
-    await saveGlobalConfig(config.mode ?? "production", updatedConfig);
+    await saveGlobalConfig(config4.mode ?? "production", updatedConfig);
     providerManager.setProviders(updatedConfig.providers, updatedConfig.defaultModelSelection ?? void 0);
     res.json({ success: true });
   });
@@ -6090,10 +6108,10 @@ async function createServerHandle(config) {
       return res.status(400).json({ error: result.error });
     }
     const llmClient = getLLMClient();
-    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-HMMPXQ46.js");
-    const globalConfig = await loadGlobalConfig(config.mode ?? "production");
+    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-7XJQNOKX.js");
+    const globalConfig = await loadGlobalConfig(config4.mode ?? "production");
     const updatedConfig = setDefaultModelSelection(globalConfig, id, llmClient.getModel());
-    await saveGlobalConfig(config.mode ?? "production", updatedConfig);
+    await saveGlobalConfig(config4.mode ?? "production", updatedConfig);
     res.json({
       success: true,
       activeProviderId: id,
@@ -6121,8 +6139,8 @@ async function createServerHandle(config) {
     if (!result.success) {
       return res.status(400).json({ error: result.error });
     }
-    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HMMPXQ46.js");
-    const globalConfig = await loadGlobalConfig(config.mode ?? "production");
+    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-7XJQNOKX.js");
+    const globalConfig = await loadGlobalConfig(config4.mode ?? "production");
     const updatedProviders = providerManager.getProviders();
     const updatedConfig = {
       ...globalConfig,
@@ -6130,7 +6148,7 @@ async function createServerHandle(config) {
       activeProviderId: providerManager.getActiveProviderId(),
       defaultModelSelection: providerManager.getActiveProviderId() ? `${providerManager.getActiveProviderId()}/${providerManager.getCurrentModel()}` : void 0
     };
-    await saveGlobalConfig(config.mode ?? "production", updatedConfig);
+    await saveGlobalConfig(config4.mode ?? "production", updatedConfig);
     let contextState = null;
     const sessions = sessionManager.listSessions();
     if (sessions.length > 0) {
@@ -6165,12 +6183,27 @@ async function createServerHandle(config) {
       status: updatedProvider?.status ?? "unknown"
     });
   });
-  app.use("/api/skills", createSkillRoutes(configDir));
-  app.use("/api/commands", createCommandRoutes(configDir));
-  app.use("/api/agents", createAgentRoutes(configDir));
-  app.use("/api/workflows", createWorkflowRoutes(configDir, config));
+  const projectDir = config4.workdir;
+  app.use("/api/skills", createSkillRoutes(configDir, projectDir));
+  app.use("/api/commands", createCommandRoutes(configDir, projectDir));
+  app.use("/api/agents", createAgentRoutes(configDir, projectDir));
+  app.use("/api/workflows", createWorkflowRoutes(configDir, config4, projectDir));
   app.use("/api/dev-server", createDevServerRoutes());
   app.use("/api/terminals", createTerminalRoutes());
+  app.use(
+    "/api/auto-update",
+    createAutoUpdateRoutes({
+      requireAuth: async (req) => {
+        const authConfig = getAuthConfig();
+        if (authConfig?.strategy !== "network" || !authConfig?.encryptedPassword) {
+          return true;
+        }
+        const token = req.headers["x-session-token"];
+        if (!token) return false;
+        return Boolean(await isValidToken(token));
+      }
+    })
+  );
   app.get("/api/sessions/:id/background-processes", async (req, res) => {
     const { getSessionProcesses } = await import("./manager-W7N3XQ4Q.js");
     const sessionId = req.params.id;
@@ -6204,7 +6237,7 @@ async function createServerHandle(config) {
       const entries = await import("fs/promises").then((m) => m.readdir(resolvedPath, { withFileTypes: true }));
       const directories = entries.filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => ({
         name: entry.name,
-        path: join5(resolvedPath, entry.name)
+        path: join6(resolvedPath, entry.name)
       })).sort((a, b) => a.name.localeCompare(b.name));
       const parent = dirname5(resolvedPath);
       const hasParent = parent !== resolvedPath;
@@ -6225,7 +6258,7 @@ async function createServerHandle(config) {
     }
   });
   const webDir = resolve(__dirname2, "../../web");
-  const isDev = config.mode === "development";
+  const isDev = config4.mode === "development";
   let viteServer;
   if (isDev) {
     logger.info("Dev mode: using Vite middleware");
@@ -6251,7 +6284,7 @@ async function createServerHandle(config) {
       }
     });
     app.get("/fox.svg", (_req, res) => {
-      readFile3(join5(webDir, "fox.svg")).then((content) => {
+      readFile3(join6(webDir, "fox.svg")).then((content) => {
         res.set("Content-Type", "image/svg+xml");
         res.send(content);
       }).catch(() => {
@@ -6260,7 +6293,7 @@ async function createServerHandle(config) {
     });
     app.use(
       "/sounds",
-      express.static(join5(webDir, "public", "sounds"), {
+      express.static(join6(webDir, "public", "sounds"), {
         setHeaders: (res) => {
           res.set("Content-Type", "audio/mpeg");
         }
@@ -6269,24 +6302,24 @@ async function createServerHandle(config) {
     app.use("/__inspect__.js", (_req, res) => {
       res.set("Access-Control-Allow-Origin", "*");
       res.set("Content-Type", "application/javascript");
-      readFile3(join5(webDir, "public", "__inspect__.js")).then((content) => res.send(content)).catch(() => res.status(404).send("Not found"));
+      readFile3(join6(webDir, "public", "__inspect__.js")).then((content) => res.send(content)).catch(() => res.status(404).send("Not found"));
     });
     app.get("/*path", (req, res) => {
       if (req.path.startsWith("/api/")) {
         return;
       }
-      readFile3(join5(webDir, "index.html"), "utf-8").then((indexHtml) => viteServer.transformIndexHtml(req.originalUrl, indexHtml)).then((transformed) => res.send(transformed)).catch((err) => {
+      readFile3(join6(webDir, "index.html"), "utf-8").then((indexHtml) => viteServer.transformIndexHtml(req.originalUrl, indexHtml)).then((transformed) => res.send(transformed)).catch((err) => {
         logger.error("Error serving index.html", { error: err });
         res.status(500).send("Server error");
       });
     });
-    logger.info("Vite middleware ready", { port: config.server.port });
+    logger.info("Vite middleware ready", { port: config4.server.port });
   }
   if (!isDev) {
     const distWebDir = resolve(__dirname2, "web");
     app.use(
       "/assets",
-      express.static(join5(distWebDir, "assets"), {
+      express.static(join6(distWebDir, "assets"), {
         setHeaders: (res, filepath) => {
           if (filepath.endsWith(".css")) {
             res.set("Content-Type", "text/css");
@@ -6294,11 +6327,11 @@ async function createServerHandle(config) {
         }
       })
     );
-    app.use("/manifest.webmanifest", express.static(join5(distWebDir, "manifest.webmanifest")));
-    app.use("/registerSW.js", express.static(join5(distWebDir, "registerSW.js")));
-    app.use("/sw.js", express.static(join5(distWebDir, "sw.js")));
+    app.use("/manifest.webmanifest", express.static(join6(distWebDir, "manifest.webmanifest")));
+    app.use("/registerSW.js", express.static(join6(distWebDir, "registerSW.js")));
+    app.use("/sw.js", express.static(join6(distWebDir, "sw.js")));
     app.get("/fox.svg", (_req, res) => {
-      readFile3(join5(distWebDir, "fox.svg")).then((content) => {
+      readFile3(join6(distWebDir, "fox.svg")).then((content) => {
         res.set("Content-Type", "image/svg+xml");
         res.send(content);
       }).catch(() => {
@@ -6307,7 +6340,7 @@ async function createServerHandle(config) {
     });
     app.use(
       "/sounds",
-      express.static(join5(distWebDir, "sounds"), {
+      express.static(join6(distWebDir, "sounds"), {
         setHeaders: (res) => {
           res.set("Content-Type", "audio/mpeg");
         }
@@ -6316,15 +6349,15 @@ async function createServerHandle(config) {
     app.use("/__inspect__.js", (_req, res) => {
       res.set("Access-Control-Allow-Origin", "*");
       res.set("Content-Type", "application/javascript");
-      readFile3(join5(distWebDir, "__inspect__.js")).then((content) => res.send(content)).catch(() => res.status(404).send("Not found"));
+      readFile3(join6(distWebDir, "__inspect__.js")).then((content) => res.send(content)).catch(() => res.status(404).send("Not found"));
     });
     app.use("/__inspect__.js", (_req, res) => {
       res.set("Access-Control-Allow-Origin", "*");
       res.set("Content-Type", "application/javascript");
-      readFile3(join5(distWebDir, "__inspect__.js")).then((content) => res.send(content)).catch(() => res.status(404).send("Not found"));
+      readFile3(join6(distWebDir, "__inspect__.js")).then((content) => res.send(content)).catch(() => res.status(404).send("Not found"));
     });
     app.get("/", (_req, res) => {
-      readFile3(join5(distWebDir, "index.html"), "utf-8").then((content) => res.send(content)).catch(() => {
+      readFile3(join6(distWebDir, "index.html"), "utf-8").then((content) => res.send(content)).catch(() => {
         res.status(404).send("Web UI not built. Run `npm run build:web`");
       });
     });
@@ -6332,7 +6365,7 @@ async function createServerHandle(config) {
       if (req.path.startsWith("/api/") || req.path.startsWith("/assets/") || req.path.startsWith("/sounds/") || req.path.startsWith("/manifest.webmanifest") || req.path.startsWith("/registerSW.js") || req.path.startsWith("/sw.js") || req.path === "/fox.svg") {
         return;
       }
-      readFile3(join5(distWebDir, "index.html"), "utf-8").then((content) => res.send(content)).catch(() => {
+      readFile3(join6(distWebDir, "index.html"), "utf-8").then((content) => res.send(content)).catch(() => {
         res.status(404).send("Web UI not built");
       });
     });
@@ -6340,14 +6373,14 @@ async function createServerHandle(config) {
   const httpServer = createHttpServer(app);
   const wssExports = createWebSocketServer(
     httpServer,
-    config,
+    config4,
     getLLMClient,
     () => providerManager.getActiveProvider(),
     sessionManager,
     providerManager
   );
   const wss = wssExports.wss;
-  const { QueueProcessor } = await import("./processor-4SOP4Q6S.js");
+  const { QueueProcessor } = await import("./processor-D4XQ5QMB.js");
   const queueProcessor = new QueueProcessor({
     sessionManager,
     providerManager,
@@ -6366,17 +6399,17 @@ async function createServerHandle(config) {
   };
   return {
     httpServer,
-    ctx: { config, sessionManager, llmClient: getLLMClient(), toolRegistry, providerManager },
+    ctx: { config: config4, sessionManager, llmClient: getLLMClient(), toolRegistry, providerManager },
     start: (port) => new Promise((resolve2, reject) => {
-      const listenPort = port ?? config.server.port;
-      const host = config.server.host;
+      const listenPort = port ?? config4.server.port;
+      const host = config4.server.host;
       httpServer.listen(listenPort, host, () => {
         const addr = httpServer.address();
         const actualPort = typeof addr === "object" && addr ? addr.port : listenPort;
         const client = getLLMClient();
         logger.info(`OpenFox server running at http://${host}:${actualPort}`);
         logger.info(`WebSocket available at ws://${host}:${actualPort}/ws`);
-        logger.info(`LLM backend: ${client.getBackend()}, model: ${client.getModel()}, url: ${config.llm.baseUrl}`);
+        logger.info(`LLM backend: ${client.getBackend()}, model: ${client.getModel()}, url: ${config4.llm.baseUrl}`);
         resolve2({ port: actualPort });
       });
       httpServer.on("error", reject);
@@ -6399,8 +6432,8 @@ async function createServerHandle(config) {
     })
   };
 }
-async function createServer(config) {
-  const handle = await createServerHandle(config);
+async function createServer(config4) {
+  const handle = await createServerHandle(config4);
   await handle.start();
   const shutdown = () => {
     const forceExitTimer = setTimeout(() => {
@@ -6422,4 +6455,4 @@ export {
   createServerHandle,
   createServer
 };
-//# sourceMappingURL=chunk-ZORPFD4C.js.map
+//# sourceMappingURL=chunk-2BS6LMIU.js.map