openfox 2.0.104 → 2.0.106

package/dist/{chunk-XWW7LOU4.js → chunk-G2VLGZ3Y.js}

@@ -21,10 +21,10 @@ import {
   tokenFromPassword,
   verifyPassword,
   workflowExists
-} from "./chunk-HZXWVD5A.js";
+} from "./chunk-P4APMCTX.js";
 import {
   openFolder
-} from "./chunk-62QCBNPE.js";
+} from "./chunk-WLJJRX22.js";
 import {
   createToolRegistry,
   devServerManager,
@@ -34,7 +34,7 @@ import {
   setMcpManagerForTools,
   setMcpTools,
   setNotifyMcpServersChanged
-} from "./chunk-PKLWSTDB.js";
+} from "./chunk-6M44ZHQA.js";
 import {
   deleteOwnedSkill,
   deleteProjectSkill,
@@ -53,12 +53,12 @@ import {
   setSkillEnabled,
   skillExists,
   updateOwnedSkill
-} from "./chunk-B76OP3OE.js";
+} from "./chunk-LOHVZGCM.js";
 import {
   ALWAYS_ALLOWED,
   ALWAYS_ALLOWED_FOR_SUBAGENTS,
   TOP_LEVEL_ONLY_TOOLS
-} from "./chunk-J27BLIPY.js";
+} from "./chunk-SGJ3LSVA.js";
 import {
   createMcpTools
 } from "./chunk-JE7LW7Y6.js";
@@ -76,11 +76,11 @@ import {
   validateRef,
   validateWorkspaceName,
   workspaceExists
-} from "./chunk-D3SXT3BL.js";
+} from "./chunk-RRTKVJMF.js";
 import {
   getSessionDisabledServers,
   setSessionDisabledServers
-} from "./chunk-UADZ2LZJ.js";
+} from "./chunk-OEPRHAIO.js";
 import {
   emitAssistantMessageStart,
   emitContextState,
@@ -97,7 +97,7 @@ import {
   getEventStore,
   getSessionState,
   initEventStore
-} from "./chunk-DMI2BXHA.js";
+} from "./chunk-GXW4CRR5.js";
 import {
   createContextStateMessage
 } from "./chunk-27SDWNKL.js";
@@ -107,21 +107,21 @@ import {
 import {
   getPathSeparator,
   isAbsolutePath
-} from "./chunk-EF7KGWF6.js";
+} from "./chunk-UXQN7FGB.js";
 import {
   getAgentModelOverride,
   getAgentModelOverrides,
   resolveLLMClientForAgent,
   setAgentModelOverride
-} from "./chunk-5VKT34HE.js";
+} from "./chunk-V6Y6OLB4.js";
 import {
   getProject,
   getProjectByWorkdir,
   updateProject
-} from "./chunk-WWFH5GAR.js";
+} from "./chunk-6FPGJR7O.js";
 import {
   VERSION
-} from "./chunk-MLOCSFIW.js";
+} from "./chunk-C5YV3EA4.js";
 import {
   clearWorkflowExecution,
   createSession,
@@ -141,7 +141,7 @@ import {
   updateSessionRunning,
   updateSessionWorkdir,
   updateWorkflowExecutionStatus
-} from "./chunk-OUMHR7LR.js";
+} from "./chunk-IA4Y3CKA.js";
 import {
   agentExists,
   deleteAgent,
@@ -164,13 +164,13 @@ import {
   saveAgentToProject,
   saveItemToDir,
   setRuntimeConfig
-} from "./chunk-6SIX7P6O.js";
+} from "./chunk-2GM6SUIQ.js";
 import {
   createProviderManager,
   detectModel,
   getLlmStatus,
   parseDefaultModelSelection
-} from "./chunk-2COWPTSJ.js";
+} from "./chunk-UCIZV76E.js";
 import {
   getModelProfile
 } from "./chunk-V4IE7HJY.js";
@@ -183,15 +183,15 @@ import {
 import {
   SessionNotFoundError,
   WorkspaceInUseError
-} from "./chunk-ERKPMNC7.js";
+} from "./chunk-TB7TTPYQ.js";
 import {
   deleteSetting,
   getSetting,
   setSetting
-} from "./chunk-SPA7PQPJ.js";
+} from "./chunk-KIAKWUZ3.js";
 import {
   initDatabase
-} from "./chunk-GLF65XDS.js";
+} from "./chunk-LCQ5AN6Y.js";
 import {
   logger,
   setLogLevel
@@ -2786,6 +2786,50 @@ var SessionManager = class {
     const branch = await getGitBranch(effectiveWorkdir);
     return { workdir: effectiveWorkdir, branch };
   }
+  /**
+   * Verify the session's effective workdir is on the branch the session was
+   * bound to. Used as an early gate before any agent step of a workflow
+   * execution, so we never run against the wrong tree when the session branch
+   * and the actual git branch have diverged (#183).
+   *
+   * Decision matrix (fail-closed):
+   *   - expectedBranch null                 → ok, regardless of actualBranch.
+   *   - expectedBranch set, actualBranch set, equal    → ok.
+   *   - expectedBranch set, actualBranch set, differ   → BLOCKED.
+   *   - expectedBranch set, actualBranch null          → BLOCKED (we cannot
+   *     verify the workdir is on the right branch — detached HEAD, broken
+   *     repository, missing .git, etc.).
+   *
+   * Returning `{ ok: true }` for a session that has a branch expectation but
+   * no resolvable actual branch would be fail-open and is forbidden.
+   */
+  async assertExecutionGitContext(sessionId) {
+    const session = this.requireSession(sessionId);
+    const expectedBranch = session.branch ?? null;
+    const { workdir, branch: actualBranch } = await this.getActualBranchPair(sessionId);
+    if (!expectedBranch) {
+      return { ok: true, workdir, actualBranch, expectedBranch };
+    }
+    if (actualBranch && expectedBranch === actualBranch) {
+      return { ok: true, workdir, actualBranch, expectedBranch };
+    }
+    if (!actualBranch) {
+      return {
+        ok: false,
+        reason: `Cannot verify Git context for workdir '${workdir}': expected branch '${expectedBranch}' but the actual branch is unavailable (detached HEAD, missing .git, or unreadable repository). Refusing to write \u2014 no agent was run, no checkout was performed. Use the workspace tool to switch to branch '${expectedBranch}' (or repair the workdir) and retry.`,
+        workdir,
+        expectedBranch,
+        actualBranch: null
+      };
+    }
+    return {
+      ok: false,
+      reason: `Git context mismatch before Dev & Verify: session branch is '${expectedBranch}' but workdir '${workdir}' is actually on '${actualBranch}'. Refusing to write \u2014 no agent was run, no checkout was performed. Use the workspace tool to switch to branch '${expectedBranch}' (or update the session branch) and retry.`,
+      workdir,
+      expectedBranch,
+      actualBranch
+    };
+  }
   // ============================================================================
   // Session Lifecycle
   // ============================================================================
@@ -3095,8 +3139,8 @@ var SessionManager = class {
   /**
    * Pause at a user step. Sets status to 'waiting' and records step output.
    */
-  waitAtStep(sessionId, executionId, stepId, stepName, stepOutput, workflowId, workflowName, workflowColor) {
-    updateWorkflowExecutionStatus(executionId, "waiting", stepId, stepName, stepOutput);
+  waitAtStep(sessionId, executionId, stepId, stepName, stepOutput, workflowId, workflowName, workflowColor, pendingChoices) {
+    updateWorkflowExecutionStatus(executionId, "waiting", stepId, stepName, stepOutput, pendingChoices);
     emitWorkflowExecutionChanged(
       sessionId,
       executionId,
@@ -3105,7 +3149,8 @@ var SessionManager = class {
       workflowColor,
       "waiting",
       stepId,
-      stepName
+      stepName,
+      pendingChoices
     );
     this.setPhase(sessionId, "waiting");
     const updatedSession = this.requireSession(sessionId);
@@ -3117,7 +3162,7 @@ var SessionManager = class {
   resumeWorkflow(sessionId, executionId, workflowId, workflowName, workflowColor) {
     const row = getActiveWorkflowExecution(sessionId);
     if (!row || row.id !== executionId) return null;
-    updateWorkflowExecutionStatus(executionId, "running");
+    updateWorkflowExecutionStatus(executionId, "running", void 0, void 0, void 0, []);
     emitWorkflowExecutionChanged(
       sessionId,
       executionId,
@@ -3126,7 +3171,8 @@ var SessionManager = class {
       workflowColor,
       "running",
       row.current_step_id ?? void 0,
-      row.current_step_name ?? void 0
+      row.current_step_name ?? void 0,
+      []
     );
     const updatedSession = this.requireSession(sessionId);
     this.emit({ type: "session_updated", session: updatedSession });
@@ -3139,9 +3185,19 @@ var SessionManager = class {
    * Mark workflow as completed and clean up.
    */
   completeWorkflow(sessionId, executionId, workflowId, workflowName, workflowColor) {
-    updateWorkflowExecutionStatus(executionId, "completed");
+    updateWorkflowExecutionStatus(executionId, "completed", void 0, void 0, void 0, []);
     clearWorkflowExecution(executionId);
-    emitWorkflowExecutionChanged(sessionId, executionId, workflowId, workflowName, workflowColor, "completed");
+    emitWorkflowExecutionChanged(
+      sessionId,
+      executionId,
+      workflowId,
+      workflowName,
+      workflowColor,
+      "completed",
+      void 0,
+      void 0,
+      []
+    );
     this.setPhase(sessionId, "done");
     const updatedSession = this.requireSession(sessionId);
     this.emit({ type: "session_updated", session: updatedSession });
@@ -3150,9 +3206,19 @@ var SessionManager = class {
    * Cancel/exit a workflow execution.
    */
   cancelWorkflow(sessionId, executionId, workflowId, workflowName, workflowColor) {
-    updateWorkflowExecutionStatus(executionId, "cancelled");
+    updateWorkflowExecutionStatus(executionId, "cancelled", void 0, void 0, void 0, []);
     clearWorkflowExecution(executionId);
-    emitWorkflowExecutionChanged(sessionId, executionId, workflowId, workflowName, workflowColor, "cancelled");
+    emitWorkflowExecutionChanged(
+      sessionId,
+      executionId,
+      workflowId,
+      workflowName,
+      workflowColor,
+      "cancelled",
+      void 0,
+      void 0,
+      []
+    );
     this.setPhase(sessionId, "build");
     const updatedSession = this.requireSession(sessionId);
     this.emit({ type: "session_updated", session: updatedSession });
@@ -3161,9 +3227,19 @@ var SessionManager = class {
    * Mark workflow as blocked.
    */
   blockWorkflow(sessionId, executionId, workflowId, workflowName, workflowColor) {
-    updateWorkflowExecutionStatus(executionId, "blocked");
+    updateWorkflowExecutionStatus(executionId, "blocked", void 0, void 0, void 0, []);
     clearWorkflowExecution(executionId);
-    emitWorkflowExecutionChanged(sessionId, executionId, workflowId, workflowName, workflowColor, "blocked");
+    emitWorkflowExecutionChanged(
+      sessionId,
+      executionId,
+      workflowId,
+      workflowName,
+      workflowColor,
+      "blocked",
+      void 0,
+      void 0,
+      []
+    );
     this.setPhase(sessionId, "blocked");
     const updatedSession = this.requireSession(sessionId);
     this.emit({ type: "session_updated", session: updatedSession });
@@ -3185,6 +3261,7 @@ var SessionManager = class {
       ...row.current_step_name ? { currentStepName: row.current_step_name } : {},
       stepOutput: JSON.parse(row.step_output ?? "{}"),
       params: JSON.parse(row.params ?? "{}"),
+      ...row.pending_choices ? { pendingChoices: JSON.parse(row.pending_choices) } : {},
       createdAt: row.created_at,
       updatedAt: row.updated_at
     };
@@ -4016,6 +4093,12 @@ import { join as join3 } from "path";
 function computeOverrideIds(defaults, userItems) {
   return userItems.filter((u) => defaults.some((d) => d.metadata.id === u.metadata.id)).map((u) => u.metadata.id);
 }
+function resolveProjectDir(req, fallback) {
+  const workdir = req.query["workdir"];
+  if (typeof workdir !== "string") return fallback;
+  const trimmed = workdir.trim();
+  return trimmed ? trimmed : fallback;
+}
 var ID_REGEX = /^[a-z0-9-]+$/;
 function validateNameIdPrompt(body) {
   const meta = body["metadata"];
@@ -4035,15 +4118,16 @@ async function isProjectItem(projectDir, dirName, id, ext) {
 }
 function createCrudRoutes(config3, configDir, projectDir) {
   const router = Router();
-  router.get("/", async (_req, res) => {
+  router.get("/", async (req, res) => {
+    const effectiveProjectDir = resolveProjectDir(req, projectDir);
     const [defaults, userItems, projectItems] = await Promise.all([
       config3.loadDefaults(),
       config3.loadUser(configDir),
-      projectDir ? config3.loadProject(projectDir) : []
+      effectiveProjectDir ? config3.loadProject(effectiveProjectDir) : []
     ]);
     const userOverrideIds = computeOverrideIds(defaults, userItems);
     const projectOverrideIds = computeOverrideIds(defaults, projectItems);
-    const extra = config3.extraGetData ? await config3.extraGetData() : {};
+    const extra = config3.extraGetData ? await config3.extraGetData(effectiveProjectDir) : {};
     res.json({
       defaults: defaults.map(config3.mapToResponse),
       userItems: userItems.map(config3.mapToResponse),
@@ -4067,7 +4151,8 @@ function createCrudRoutes(config3, configDir, projectDir) {
   });
   router.get("/:id", async (req, res) => {
     const { id } = req.params;
-    const items = await config3.loadAll(configDir, projectDir);
+    const effectiveProjectDir = resolveProjectDir(req, projectDir);
+    const items = await config3.loadAll(configDir, effectiveProjectDir);
     const item = config3.findById(id, items);
     if (!item) {
       return res.status(404).json({ error: "Not found" });
@@ -4083,15 +4168,16 @@ function createCrudRoutes(config3, configDir, projectDir) {
     }
     const id = String(meta["id"]);
     const destination = body["destination"] ?? "user";
-    if (destination === "project" && !projectDir) {
+    const effectiveProjectDir = resolveProjectDir(req, projectDir);
+    if (destination === "project" && !effectiveProjectDir) {
       return res.status(400).json({ error: "No project directory configured" });
     }
-    const exists = await config3.exists(configDir, id, projectDir);
+    const exists = await config3.exists(configDir, id, effectiveProjectDir);
     if (exists) {
       return res.status(409).json({ error: "An item with this ID already exists" });
     }
     if (destination === "project") {
-      await config3.saveToProject(projectDir, body);
+      await config3.saveToProject(effectiveProjectDir, body);
     } else {
       await config3.save(configDir, body);
     }
@@ -4099,7 +4185,8 @@ function createCrudRoutes(config3, configDir, projectDir) {
   });
   router.put("/:id", async (req, res) => {
     const { id } = req.params;
-    const items = await config3.loadAll(configDir, projectDir);
+    const effectiveProjectDir = resolveProjectDir(req, projectDir);
+    const items = await config3.loadAll(configDir, effectiveProjectDir);
     const existing = config3.findById(id, items);
     if (!existing) {
       return res.status(404).json({ error: "Not found" });
@@ -4111,9 +4198,9 @@ function createCrudRoutes(config3, configDir, projectDir) {
       ...body,
       metadata: { ...existing.metadata, ...meta, id }
     };
-    const isProject = await isProjectItem(projectDir, config3.dirName, id, config3.ext);
+    const isProject = await isProjectItem(effectiveProjectDir, config3.dirName, id, config3.ext);
     if (isProject) {
-      await config3.saveToProject(projectDir, updated);
+      await config3.saveToProject(effectiveProjectDir, updated);
     } else {
       await config3.save(configDir, updated);
     }
@@ -4121,18 +4208,15 @@ function createCrudRoutes(config3, configDir, projectDir) {
   });
   router.delete("/:id", async (req, res) => {
     const { id } = req.params;
-    const isProject = await isProjectItem(projectDir, config3.dirName, id, config3.ext);
+    const effectiveProjectDir = resolveProjectDir(req, projectDir);
+    const isProject = await isProjectItem(effectiveProjectDir, config3.dirName, id, config3.ext);
     if (isProject) {
-      const result2 = await config3.deleteProject(projectDir, id);
+      const result2 = await config3.deleteProject(effectiveProjectDir, id);
       if (!result2.success) {
         return res.status(500).json({ error: "Failed to delete project item" });
       }
       return res.json({ success: true });
     }
-    const isDefault = await config3.isDefault(id);
-    if (isDefault) {
-      return res.status(403).json({ error: "Cannot delete built-in defaults" });
-    }
     const result = await config3.delete(configDir, id);
     if (!result.success) {
       return res.status(403).json({ error: result.reason ?? "Cannot delete this item" });
@@ -4141,7 +4225,8 @@ function createCrudRoutes(config3, configDir, projectDir) {
   });
   router.post("/:id/duplicate", async (req, res) => {
     const { id } = req.params;
-    const items = await config3.loadAll(configDir, projectDir);
+    const effectiveProjectDir = resolveProjectDir(req, projectDir);
+    const items = await config3.loadAll(configDir, effectiveProjectDir);
     const source = config3.findById(id, items);
     if (!source) {
       return res.status(404).json({ error: "Not found" });
@@ -4153,8 +4238,8 @@ function createCrudRoutes(config3, configDir, projectDir) {
     };
     const destination = req.body.destination ?? "user";
     if (destination === "project") {
-      if (!projectDir) return res.status(400).json({ error: "No project directory configured" });
-      await config3.saveToProject(projectDir, duplicated);
+      if (!effectiveProjectDir) return res.status(400).json({ error: "No project directory configured" });
+      await config3.saveToProject(effectiveProjectDir, duplicated);
     } else {
       await config3.save(configDir, duplicated);
     }
@@ -4218,6 +4303,11 @@ function validateSkillCreate(body) {
   }
   return null;
 }
+async function findSkillByIdForRequest(req, configDir, projectDir) {
+  const effectiveProjectDir = resolveProjectDir(req, projectDir);
+  const skills = await loadAllSkills(configDir, effectiveProjectDir);
+  return findSkillById(req.params["id"], skills);
+}
 function createConfig(configDir, projectDir) {
   return {
     dirName: "skills",
@@ -4236,8 +4326,9 @@ function createConfig(configDir, projectDir) {
     getDefaultIds: getDefaultSkillIds,
     validateCreate: validateSkillCreate,
     mapToResponse,
-    extraGetData: async () => {
-      const discovery = await loadAllSkillsWithDiagnostics(configDir, projectDir);
+    extraGetData: async (effectiveProjectDir) => {
+      const projectDirParam = effectiveProjectDir ?? projectDir;
+      const discovery = await loadAllSkillsWithDiagnostics(configDir, projectDirParam);
       const items = discovery.skills;
       const configured = configuredDirectory();
       let selectedDirectory = configured ? { configuredPath: configured, resolvedPath: null, available: false, custom: true } : defaultLibrary(configDir);
@@ -4302,24 +4393,21 @@ function createSkillRoutes(configDir, projectDir) {
     });
   });
   router.post("/:id/toggle", async (req, res) => {
-    const skills = await loadAllSkills(configDir, projectDir);
-    const existing = findSkillById(req.params["id"], skills);
+    const existing = await findSkillByIdForRequest(req, configDir, projectDir);
     if (!existing) return res.status(404).json({ error: "Not found" });
     const enabled = !isSkillEnabled(existing.metadata.id);
     setSkillEnabled(existing.metadata.id, enabled);
     res.json({ enabled });
   });
   router.put("/:id", async (req, res) => {
-    const skills = await loadAllSkills(configDir, projectDir);
-    const existing = findSkillById(req.params["id"], skills);
+    const existing = await findSkillByIdForRequest(req, configDir, projectDir);
     if (!existing) return res.status(404).json({ error: "Not found" });
     const updated = await updateOwnedSkill(existing, req.body);
     if (!updated) return res.status(403).json({ error: "This skill is read-only" });
     res.json(updated);
   });
   router.delete("/:id", async (req, res) => {
-    const skills = await loadAllSkills(configDir, projectDir);
-    const existing = findSkillById(req.params["id"], skills);
+    const existing = await findSkillByIdForRequest(req, configDir, projectDir);
     if (!existing) return res.status(404).json({ error: "Not found" });
     const result = await deleteOwnedSkill(existing);
     if (!result.success) return res.status(403).json({ error: result.reason ?? "Cannot delete this skill" });
@@ -4425,16 +4513,18 @@ async function deleteProjectCommand(projectDir, commandId) {
   return deleteItemFromDir(getProjectCommandsDir(projectDir), commandId, COMMAND_EXTENSION);
 }
 async function deleteCommand(configDir, commandId) {
-  const isDefault = await isDefaultCommand(commandId);
-  if (isDefault) {
-    return { success: false, reason: "Cannot delete built-in defaults" };
-  }
   const filePath = join5(getCommandsDir(configDir), `${commandId}${COMMAND_EXTENSION}`);
+  if (!await pathExists(filePath)) {
+    if (await isDefaultCommand(commandId)) {
+      return { success: false, reason: "Cannot delete built-in defaults" };
+    }
+    return { success: false };
+  }
   try {
     await unlink(filePath);
     return { success: true };
   } catch {
-    return { success: false };
+    return { success: false, reason: "Failed to delete command" };
   }
 }
 
@@ -4993,8 +5083,8 @@ function createFileSearchRoutes() {
   return router;
 }
 async function searchFiles(query, workdir) {
-  if (query.endsWith("/")) {
-    return listDirectoryContents(query, workdir);
+  if (/[\\/]$/.test(query)) {
+    return listDirectoryContents(query.replace(/\\/g, "/"), workdir);
   }
   const entries = await fg(["**/*"], {
     cwd: workdir,
@@ -5307,7 +5397,7 @@ function createProviderAuthRoutes(config3, providerManager, registry) {
     try {
       const { challenge, completion } = await adapter.beginLogin({ providerId: provider.id });
       void completion.then(async ({ credentialRef }) => {
-        const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-3FKJV3KI.js");
+        const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-HX7FDKGJ.js");
         const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
         const updatedConfig = updateProvider(globalConfig, provider.id, { credentialRef, authAdapter: adapter.id });
         await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -5344,7 +5434,7 @@ function createProviderAuthRoutes(config3, providerManager, registry) {
       const ref = provider.credentialRef ?? provider.id;
       await adapter.logout(ref);
     }
-    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-3FKJV3KI.js");
+    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = {
       ...globalConfig,
@@ -5822,7 +5912,7 @@ async function createServerHandle(config3) {
   const mcpManager = new McpManager({
     onToolsDiscovered: async (name, tools) => {
       try {
-        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-3FKJV3KI.js");
+        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
         const mode = config3.mode ?? "production";
         const globalConfig = await loadGlobalConfig(mode, config3.globalConfigPath);
         const mcpServers2 = {
@@ -5854,7 +5944,7 @@ async function createServerHandle(config3) {
       toolRegistry = createToolRegistry();
       logger.info("MCP tools registered", { count: mcpTools.length });
     }
-    const { signalMcpReady } = await import("./server-FKM4FQKD.js");
+    const { signalMcpReady } = await import("./server-CYE6XY7J.js");
     signalMcpReady();
   });
   const app = express();
@@ -5935,7 +6025,7 @@ async function createServerHandle(config3) {
     res.json({ tools });
   });
   app.get("/api/projects", async (_req, res) => {
-    const { listProjects: listProjects2 } = await import("./projects-M5XKC7O6.js");
+    const { listProjects: listProjects2 } = await import("./projects-PQXME5S4.js");
     const projects = listProjects2();
     res.json({ projects });
   });
@@ -5944,7 +6034,7 @@ async function createServerHandle(config3) {
     if (!name || !workdir) {
       return res.status(400).json({ error: "name and workdir are required" });
     }
-    const { createDirectoryWithGit } = await import("./project-creator-SMWFMIU5.js");
+    const { createDirectoryWithGit } = await import("./project-creator-BVA55HY6.js");
     try {
       const project = await createDirectoryWithGit(name, workdir);
       res.status(201).json({ project });
@@ -5962,7 +6052,7 @@ async function createServerHandle(config3) {
     if (!targetPath) {
       return res.status(400).json({ error: "path is required" });
     }
-    const { checkPermissions } = await import("./permissions-CGEK3DGZ.js");
+    const { checkPermissions } = await import("./permissions-K6YEA2ZZ.js");
     const result = await checkPermissions(targetPath);
     if (result.success) {
       res.json(result);
@@ -5979,7 +6069,7 @@ async function createServerHandle(config3) {
     if (!["group", "ownership", "join_group", "join_group_and_group"].includes(action)) {
       return res.status(400).json({ error: 'action must be "group", "ownership", "join_group", or "join_group_and_group"' });
     }
-    const { fixPermissions } = await import("./permissions-CGEK3DGZ.js");
+    const { fixPermissions } = await import("./permissions-K6YEA2ZZ.js");
     const result = await fixPermissions(targetPath, action);
     if (result.success) {
       res.json(result);
@@ -5989,7 +6079,7 @@ async function createServerHandle(config3) {
     }
   });
   app.get("/api/projects/:id", async (req, res) => {
-    const { getProject: getProject2 } = await import("./projects-M5XKC7O6.js");
+    const { getProject: getProject2 } = await import("./projects-PQXME5S4.js");
     const project = getProject2(req.params.id);
     if (!project) {
       return res.status(404).json({ error: "Project not found" });
@@ -5997,13 +6087,13 @@ async function createServerHandle(config3) {
     res.json({ project });
   });
   app.get("/api/projects/:id/open-folder", async (req, res) => {
-    const { getProject: getProject2 } = await import("./projects-M5XKC7O6.js");
+    const { getProject: getProject2 } = await import("./projects-PQXME5S4.js");
     const project = getProject2(req.params.id);
     if (!project) {
       return res.status(404).json({ error: "Project not found" });
     }
     try {
-      const { openFolder: openFolder2 } = await import("./openFolder-Z27FEM5M.js");
+      const { openFolder: openFolder2 } = await import("./openFolder-HX7X356L.js");
       await openFolder2(project.workdir);
       res.json({ success: true });
     } catch (err) {
@@ -6011,7 +6101,7 @@ async function createServerHandle(config3) {
     }
   });
   app.put("/api/projects/:id", async (req, res) => {
-    const { updateProject: updateProject2 } = await import("./projects-M5XKC7O6.js");
+    const { updateProject: updateProject2 } = await import("./projects-PQXME5S4.js");
     const { name, customInstructions, dangerLevel } = req.body;
     const updates = {};
     if (name !== void 0) updates.name = name;
@@ -6024,7 +6114,7 @@ async function createServerHandle(config3) {
     res.json({ project: updated });
   });
   app.delete("/api/projects/:id", async (req, res) => {
-    const { getProject: getProject2, deleteProject } = await import("./projects-M5XKC7O6.js");
+    const { getProject: getProject2, deleteProject } = await import("./projects-PQXME5S4.js");
     const project = getProject2(req.params.id);
     if (!project) {
       return res.status(404).json({ error: "Project not found" });
@@ -6033,7 +6123,7 @@ async function createServerHandle(config3) {
     res.json({ success: true });
   });
   app.put("/api/projects/:id/star", async (req, res) => {
-    const { toggleStar } = await import("./projects-M5XKC7O6.js");
+    const { toggleStar } = await import("./projects-PQXME5S4.js");
     const { isStarred } = req.body;
     if (typeof isStarred !== "boolean") {
       return res.status(400).json({ error: "isStarred is required and must be a boolean" });
@@ -6045,26 +6135,26 @@ async function createServerHandle(config3) {
     res.json({ project });
   });
   app.get("/api/projects/:id/branches", async (req, res) => {
-    const { getProject: getProject2 } = await import("./projects-M5XKC7O6.js");
+    const { getProject: getProject2 } = await import("./projects-PQXME5S4.js");
     const project = getProject2(req.params.id);
     if (!project) return res.status(404).json({ error: "Project not found" });
-    const { listBranches } = await import("./workspace-2NDXTCVR.js");
+    const { listBranches } = await import("./workspace-2OG5VQG6.js");
     const branches = await listBranches(project.workdir);
     res.json({ branches });
   });
   app.post("/api/projects/:id/checkout", async (req, res) => {
-    const { getProject: getProject2 } = await import("./projects-M5XKC7O6.js");
+    const { getProject: getProject2 } = await import("./projects-PQXME5S4.js");
     const project = getProject2(req.params.id);
     if (!project) return res.status(404).json({ error: "Project not found" });
     const { branch } = req.body;
     if (!branch || typeof branch !== "string") return res.status(400).json({ error: "branch is required" });
-    const { checkoutBranch, isGitRepository } = await import("./workspace-2NDXTCVR.js");
+    const { checkoutBranch, isGitRepository } = await import("./workspace-2OG5VQG6.js");
     if (!await isGitRepository(project.workdir)) {
       return res.status(400).json({ error: "Project is not a git repository" });
     }
     try {
       await checkoutBranch(project.workdir, branch);
-      const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-ZV2WRC6K.js");
+      const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-TZNUQJ2I.js");
       const allSessions = sessionManager.listSessions();
       for (const s of allSessions) {
         if (sessionManager.getEffectiveWorkdir(s.id) === project.workdir) {
@@ -6078,12 +6168,12 @@ async function createServerHandle(config3) {
     }
   });
   app.post("/api/projects/:id/checkout-new", async (req, res) => {
-    const { getProject: getProject2 } = await import("./projects-M5XKC7O6.js");
+    const { getProject: getProject2 } = await import("./projects-PQXME5S4.js");
     const project = getProject2(req.params.id);
     if (!project) return res.status(404).json({ error: "Project not found" });
     const { name, sourceBranch } = req.body;
     if (!name || typeof name !== "string") return res.status(400).json({ error: "name is required" });
-    const { createBranch, resolveAndValidateSourceBranch: resolveAndValidateSourceBranch2, validateRef: validateRef2, getDefaultBranch, isGitRepository } = await import("./workspace-2NDXTCVR.js");
+    const { createBranch, resolveAndValidateSourceBranch: resolveAndValidateSourceBranch2, validateRef: validateRef2, getDefaultBranch, isGitRepository } = await import("./workspace-2OG5VQG6.js");
     if (!await isGitRepository(project.workdir)) {
       return res.status(400).json({ error: "Project is not a git repository" });
     }
@@ -6100,7 +6190,7 @@ async function createServerHandle(config3) {
         );
       }
       await createBranch(project.workdir, name, sb);
-      const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-ZV2WRC6K.js");
+      const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-TZNUQJ2I.js");
       const allSessions = sessionManager.listSessions();
       for (const s of allSessions) {
         if (sessionManager.getEffectiveWorkdir(s.id) === project.workdir) {
@@ -6117,7 +6207,7 @@ async function createServerHandle(config3) {
     const session = sessionManager.getSession(req.params.id);
     if (!session) return res.status(404).json({ error: "Session not found" });
     const effectiveWorkdir = sessionManager.getEffectiveWorkdir(req.params.id);
-    const { listBranches, getDefaultBranch } = await import("./workspace-2NDXTCVR.js");
+    const { listBranches, getDefaultBranch } = await import("./workspace-2OG5VQG6.js");
     const [branches, defaultBranch] = await Promise.all([
       listBranches(effectiveWorkdir),
       getDefaultBranch(session.workdir)
@@ -6131,8 +6221,8 @@ async function createServerHandle(config3) {
     const { branch } = req.body;
     if (!branch || typeof branch !== "string") return res.status(400).json({ error: "branch is required" });
     const effectiveWorkdir = sessionManager.getEffectiveWorkdir(req.params.id);
-    const { checkoutBranch, validateRef: validateRef2 } = await import("./workspace-2NDXTCVR.js");
-    const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-ZV2WRC6K.js");
+    const { checkoutBranch, validateRef: validateRef2 } = await import("./workspace-2OG5VQG6.js");
+    const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-TZNUQJ2I.js");
     try {
       await validateRef2(effectiveWorkdir, branch);
       await checkoutBranch(effectiveWorkdir, branch);
@@ -6174,16 +6264,16 @@ All file and git operations should use this branch.
     const { name, sourceBranch } = req.body;
     if (!name || typeof name !== "string") return res.status(400).json({ error: "name is required" });
     const effectiveWorkdir = sessionManager.getEffectiveWorkdir(req.params.id);
-    const { validateRef: validateRef2 } = await import("./workspace-2NDXTCVR.js");
-    const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-ZV2WRC6K.js");
+    const { validateRef: validateRef2 } = await import("./workspace-2OG5VQG6.js");
+    const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-TZNUQJ2I.js");
     try {
       await validateRef2(effectiveWorkdir, name);
       if (sourceBranch) {
-        const { resolveAndValidateSourceBranch: resolveAndValidateSourceBranch2, createBranch } = await import("./workspace-2NDXTCVR.js");
+        const { resolveAndValidateSourceBranch: resolveAndValidateSourceBranch2, createBranch } = await import("./workspace-2OG5VQG6.js");
         const sb = await resolveAndValidateSourceBranch2(effectiveWorkdir, sourceBranch, session.workdir);
         await createBranch(effectiveWorkdir, name, sb);
       } else {
-        const { createBranch, getDefaultBranch, resolveAndValidateSourceBranch: resolveAndValidateSourceBranch2 } = await import("./workspace-2NDXTCVR.js");
+        const { createBranch, getDefaultBranch, resolveAndValidateSourceBranch: resolveAndValidateSourceBranch2 } = await import("./workspace-2OG5VQG6.js");
         const defaultBranch = await getDefaultBranch(session.workdir);
         const sb = await resolveAndValidateSourceBranch2(effectiveWorkdir, defaultBranch, session.workdir);
         await createBranch(effectiveWorkdir, name, sb);
@@ -6221,17 +6311,17 @@ All file and git operations should use this branch.
     }
   });
   app.get("/api/projects/:id/workspaces", async (req, res) => {
-    const { getProject: getProject2 } = await import("./projects-M5XKC7O6.js");
+    const { getProject: getProject2 } = await import("./projects-PQXME5S4.js");
     const project = getProject2(req.params.id);
     if (!project) return res.status(404).json({ error: "Project not found" });
-    const { listWorkspaces } = await import("./workspace-2NDXTCVR.js");
+    const { listWorkspaces } = await import("./workspace-2OG5VQG6.js");
     const all = await listWorkspaces(project.name, project.workdir);
     const workspacesList = all.filter((ws) => ws.path !== project.workdir);
     res.json({ workspaces: workspacesList });
   });
   app.get("/api/sessions", async (req, res) => {
-    const { getRecentUserPromptsForSession } = await import("./events-BGVLDGLK.js");
-    const { getPendingConfirmationsBySession } = await import("./path-security-JCDBLFIE.js");
+    const { getRecentUserPromptsForSession } = await import("./events-OJ2R6OEM.js");
+    const { getPendingConfirmationsBySession } = await import("./path-security-QCIA6YFV.js");
     const projectId = req.query["projectId"];
     const limit = Math.min(parseInt(req.query["limit"]) || 20, 100);
     const offset = parseInt(req.query["offset"]) || 0;
@@ -6277,7 +6367,7 @@ All file and git operations should use this branch.
         disabledServers = mcpManager.getAllServers().filter((s) => s.config.disabled).map((s) => s.name);
       }
       if (disabledServers.length > 0) {
-        const { setSessionDisabledServers: setSessionDisabledServers2 } = await import("./session-overrides-HA5IQYLI.js");
+        const { setSessionDisabledServers: setSessionDisabledServers2 } = await import("./session-overrides-SFWPS5CT.js");
         setSessionDisabledServers2(session.id, disabledServers);
       }
     } catch {
@@ -6314,7 +6404,7 @@ All file and git operations should use this branch.
     if (!target || typeof target !== "string") return res.status(400).json({ error: "target is required" });
     const project = sessionManager.getProject(session.projectId);
     if (!project) return res.status(404).json({ error: "Project not found" });
-    const { isGitRepository } = await import("./workspace-2NDXTCVR.js");
+    const { isGitRepository } = await import("./workspace-2OG5VQG6.js");
     if (!await isGitRepository(project.workdir)) {
       return res.status(400).json({ error: "Project is not a git repository" });
     }
@@ -6332,7 +6422,7 @@ All file and git operations should use this branch.
     if (!target || typeof target !== "string") return res.status(400).json({ error: "target is required" });
     const project = sessionManager.getProject(session.projectId);
     if (!project) return res.status(404).json({ error: "Project not found" });
-    const { isGitRepository } = await import("./workspace-2NDXTCVR.js");
+    const { isGitRepository } = await import("./workspace-2OG5VQG6.js");
     if (!await isGitRepository(project.workdir)) {
       return res.status(400).json({ error: "Project is not a git repository" });
     }
@@ -6350,12 +6440,12 @@ All file and git operations should use this branch.
     }
   });
   app.get("/api/sessions/:id", async (req, res) => {
-    const { getEventStore: getEventStore2, combineEventsWithSnapshot } = await import("./events-BGVLDGLK.js");
-    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-AJMZBHNR.js");
-    const { getPendingQuestionsForSession } = await import("./tools-KKALZLKX.js");
-    const { getMaxVisibleItems } = await import("./settings-TGCITCVA.js");
-    const { getAgentModelOverride: getAgentModelOverride2 } = await import("./model-overrides-BLEFI7FQ.js");
-    const { updateSessionProvider: updateSessionProvider2 } = await import("./sessions-ZV2WRC6K.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot } = await import("./events-OJ2R6OEM.js");
+    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-DUZSKCZF.js");
+    const { getPendingQuestionsForSession } = await import("./tools-Y4F4HJPO.js");
+    const { getMaxVisibleItems } = await import("./settings-5LG7IB3K.js");
+    const { getAgentModelOverride: getAgentModelOverride2 } = await import("./model-overrides-36SQR3JR.js");
+    const { updateSessionProvider: updateSessionProvider2 } = await import("./sessions-TZNUQJ2I.js");
     let session = sessionManager.getSession(req.params.id);
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
@@ -6394,8 +6484,8 @@ All file and git operations should use this branch.
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { stopSessionExecution } = await import("./chat-handler-G2ZJNAVB.js");
-    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-KKALZLKX.js");
+    const { stopSessionExecution } = await import("./chat-handler-A22X22VZ.js");
+    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-Y4F4HJPO.js");
     sessionManager.clearMessageQueue(sessionId);
     stopSessionExecution(sessionId, sessionManager);
     abortSession(sessionId);
@@ -6424,9 +6514,9 @@ All file and git operations should use this branch.
     res.json({ success: true });
   });
   app.post("/api/sessions/:id/provider", async (req, res) => {
-    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEv } = await import("./events-BGVLDGLK.js");
-    const { buildMessagesFromStoredEvents } = await import("./folding-AJMZBHNR.js");
-    const { getMaxVisibleItems } = await import("./settings-TGCITCVA.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEv } = await import("./events-OJ2R6OEM.js");
+    const { buildMessagesFromStoredEvents } = await import("./folding-DUZSKCZF.js");
+    const { getMaxVisibleItems } = await import("./settings-5LG7IB3K.js");
     const sessionId = req.params.id;
     const session = sessionManager.getSession(sessionId);
     if (!session) {
@@ -6461,7 +6551,7 @@ All file and git operations should use this branch.
     if (!result.success) {
       return res.status(500).json({ error: result.error ?? "Failed to set default model" });
     }
-    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-3FKJV3KI.js");
+    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-HX7FDKGJ.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = setDefaultModelSelection(globalConfig, providerId, model);
     await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -6539,11 +6629,11 @@ All file and git operations should use this branch.
     res.json({ success: true });
   });
   app.put("/api/sessions/:id/mode", async (req, res) => {
-    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEv } = await import("./events-BGVLDGLK.js");
-    const { buildMessagesFromStoredEvents } = await import("./folding-AJMZBHNR.js");
-    const { getMaxVisibleItems } = await import("./settings-TGCITCVA.js");
-    const { getAgentModelOverride: getAgentModelOverride2 } = await import("./model-overrides-BLEFI7FQ.js");
-    const { updateSessionProvider: updateSessionProvider2 } = await import("./sessions-ZV2WRC6K.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEv } = await import("./events-OJ2R6OEM.js");
+    const { buildMessagesFromStoredEvents } = await import("./folding-DUZSKCZF.js");
+    const { getMaxVisibleItems } = await import("./settings-5LG7IB3K.js");
+    const { getAgentModelOverride: getAgentModelOverride2 } = await import("./model-overrides-36SQR3JR.js");
+    const { updateSessionProvider: updateSessionProvider2 } = await import("./sessions-TZNUQJ2I.js");
     const sessionId = req.params.id;
     const session = sessionManager.getSession(sessionId);
     if (!session) {
@@ -6645,7 +6735,7 @@ All file and git operations should use this branch.
     if (alwaysAllow !== void 0 && typeof alwaysAllow !== "boolean") {
       return res.status(400).json({ error: "alwaysAllow must be a boolean if provided" });
     }
-    const { providePathConfirmation, getConfirmationSessionId } = await import("./tools-KKALZLKX.js");
+    const { providePathConfirmation, getConfirmationSessionId } = await import("./tools-Y4F4HJPO.js");
     const pendingSessionId = getConfirmationSessionId(callId);
     if (!pendingSessionId) {
       return res.status(404).json({ error: "No pending path confirmation with that ID" });
@@ -6657,11 +6747,11 @@ All file and git operations should use this branch.
     if (!result.found) {
       return res.status(404).json({ error: "No pending path confirmation with that ID" });
     }
-    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEvents } = await import("./events-BGVLDGLK.js");
-    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-AJMZBHNR.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEvents } = await import("./events-OJ2R6OEM.js");
+    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-DUZSKCZF.js");
     const { createSessionStateMessage } = await import("./protocol-YDNGGADL.js");
-    const { getPendingQuestionsForSession } = await import("./tools-KKALZLKX.js");
-    const { getMaxVisibleItems } = await import("./settings-TGCITCVA.js");
+    const { getPendingQuestionsForSession } = await import("./tools-Y4F4HJPO.js");
+    const { getMaxVisibleItems } = await import("./settings-5LG7IB3K.js");
     const eventStore = getEventStore2();
     const { snapshot, events: eventsSinceSnapshot } = eventStore.getEventsSinceSnapshot(sessionId);
     const events = combineEvents(sessionId, snapshot, eventsSinceSnapshot);
@@ -6697,7 +6787,7 @@ All file and git operations should use this branch.
     if (!skip && typeof answer !== "string") {
       return res.status(400).json({ error: "answer is required when not skipping" });
     }
-    const { provideAnswer } = await import("./tools-KKALZLKX.js");
+    const { provideAnswer } = await import("./tools-Y4F4HJPO.js");
     const found = provideAnswer(callId, answer ?? "", skip ?? false);
     if (!found) {
       return res.status(404).json({ error: "No pending question with that ID" });
@@ -6730,7 +6820,7 @@ All file and git operations should use this branch.
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-TGCITCVA.js");
+    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-5LG7IB3K.js");
     if (getSetting2(SETTINGS_KEYS.CACHE_WARMING) !== "true") {
       return res.json({ success: false, reason: "disabled" });
     }
@@ -6762,7 +6852,7 @@ All file and git operations should use this branch.
       backend: activeProvider?.backend ?? llmClient.getBackend(),
       model: llmClient.getModel()
     };
-    const { runAgentTurn, TurnMetrics } = await import("./orchestrator-SYAYO6NS.js");
+    const { runAgentTurn, TurnMetrics } = await import("./orchestrator-VZORJ7KF.js");
     runAgentTurn(
       {
         sessionManager,
@@ -6800,15 +6890,15 @@ All file and git operations should use this branch.
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { stopSessionExecution } = await import("./chat-handler-G2ZJNAVB.js");
-    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-KKALZLKX.js");
+    const { stopSessionExecution } = await import("./chat-handler-A22X22VZ.js");
+    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-Y4F4HJPO.js");
     const queuedMessages = sessionManager.getQueueState(sessionId);
     sessionManager.clearMessageQueue(sessionId);
     stopSessionExecution(sessionId, sessionManager);
     abortSession(sessionId);
     cancelQuestionsForSession(sessionId, "Session stopped by user");
     cancelPathConfirmationsForSession(sessionId, "Session stopped by user");
-    const eventStore = (await import("./events-BGVLDGLK.js")).getEventStore();
+    const eventStore = (await import("./events-OJ2R6OEM.js")).getEventStore();
     eventStore.append(sessionId, { type: "running.changed", data: { isRunning: false } });
     res.json({ success: true, queuedMessages });
   });
@@ -6822,7 +6912,7 @@ All file and git operations should use this branch.
     if (typeof messageIndex !== "number" || messageIndex < 0) {
       return res.status(400).json({ error: "messageIndex must be a non-negative number" });
     }
-    const { truncateSessionMessages } = await import("./events-BGVLDGLK.js");
+    const { truncateSessionMessages } = await import("./events-OJ2R6OEM.js");
     truncateSessionMessages(sessionId, messageIndex);
     res.json({ success: true });
   });
@@ -6839,8 +6929,8 @@ All file and git operations should use this branch.
     if (content !== void 0 && (typeof content !== "string" || !content.trim())) {
       return res.status(400).json({ error: "content must be a non-empty string if provided" });
     }
-    const { getEventStore: getEventStore2 } = await import("./events-BGVLDGLK.js");
-    const { buildMessagesFromStoredEvents } = await import("./folding-AJMZBHNR.js");
+    const { getEventStore: getEventStore2 } = await import("./events-OJ2R6OEM.js");
+    const { buildMessagesFromStoredEvents } = await import("./folding-DUZSKCZF.js");
     const eventStore = getEventStore2();
     const events = eventStore.getEvents(sessionId);
     const { messages } = buildMessagesFromStoredEvents(events);
@@ -6852,7 +6942,7 @@ All file and git operations should use this branch.
     if (msg.role !== "user" || msg.isSystemGenerated) {
       return res.status(400).json({ error: "Can only replay user messages" });
     }
-    const { truncateSessionMessages } = await import("./events-BGVLDGLK.js");
+    const { truncateSessionMessages } = await import("./events-OJ2R6OEM.js");
     truncateSessionMessages(sessionId, msgIndex - 1);
     sessionManager.queueMessage(sessionId, "asap", content ?? msg.content, msg.attachments, msg.messageKind);
     res.json({ success: true });
@@ -6908,7 +6998,7 @@ All file and git operations should use this branch.
     res.json({ accepted: true });
   });
   app.get("/api/settings", async (req, res) => {
-    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-TGCITCVA.js");
+    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-5LG7IB3K.js");
     const keysParam = req.query["keys"];
     if (!keysParam) {
       return res.status(400).json({ error: "keys query parameter is required" });
@@ -6921,19 +7011,19 @@ All file and git operations should use this branch.
     res.json(result);
   });
   app.get("/api/settings/:key", async (req, res) => {
-    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-TGCITCVA.js");
+    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-5LG7IB3K.js");
     const key = req.params.key;
     const value = getSetting2(key) ?? SETTINGS_DEFAULTS[key] ?? null;
     res.json({ key, value });
   });
   app.get("/api/settings/:key", async (req, res) => {
-    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-TGCITCVA.js");
+    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-5LG7IB3K.js");
     const key = req.params.key;
     const value = getSetting2(key) ?? SETTINGS_DEFAULTS[key] ?? null;
     res.json({ key, value });
   });
   app.put("/api/settings/:key", async (req, res) => {
-    const { setSetting: setSetting2 } = await import("./settings-TGCITCVA.js");
+    const { setSetting: setSetting2 } = await import("./settings-5LG7IB3K.js");
     const key = req.params.key;
     const { value } = req.body;
     if (value === void 0) {
@@ -6960,7 +7050,7 @@ All file and git operations should use this branch.
     }
   });
   app.get("/api/tools/shells", async (_req, res) => {
-    const { listAvailableShells } = await import("./platform-GZ2WIDS5.js");
+    const { listAvailableShells } = await import("./platform-Q6T3AUHA.js");
     res.json({ shells: listAvailableShells() });
   });
   app.get("/api/config", async (_req, res) => {
@@ -6969,7 +7059,7 @@ All file and git operations should use this branch.
     let visionFallback;
     let globalWorkdir;
     try {
-      const { loadGlobalConfig, getVisionFallback } = await import("./config-3FKJV3KI.js");
+      const { loadGlobalConfig, getVisionFallback } = await import("./config-HX7FDKGJ.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const fallback = getVisionFallback(globalConfig);
       if (fallback) {
@@ -7050,7 +7140,7 @@ All file and git operations should use this branch.
     }));
   }
   app.post("/api/proxy/test", async (_req, res) => {
-    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-TGCITCVA.js");
+    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-5LG7IB3K.js");
     const proxyUrl = getSetting2(SETTINGS_KEYS.PROXY_URL);
     if (!proxyUrl) {
       return res.status(400).json({ success: false, error: "No proxy URL configured" });
@@ -7142,7 +7232,7 @@ All file and git operations should use this branch.
     }
   });
   app.post("/api/proxy/test", async (_req, res) => {
-    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-TGCITCVA.js");
+    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-5LG7IB3K.js");
     const proxyUrl = getSetting2(SETTINGS_KEYS.PROXY_URL);
     if (!proxyUrl) {
       return res.status(400).json({ success: false, error: "No proxy URL configured" });
@@ -7169,7 +7259,7 @@ All file and git operations should use this branch.
     const backend = req.query["backend"];
     if (!url) return res.status(400).json({ error: "url is required" });
     try {
-      const { fetchModelsWithContext } = await import("./provider-manager-AUYP3QAM.js");
+      const { fetchModelsWithContext } = await import("./provider-manager-RUC5QQ75.js");
       const { getModelProfile: getModelProfile2 } = await import("./profiles-5J7F4BML.js");
       const models = await fetchModelsWithContext(
         url,
@@ -7239,8 +7329,8 @@ All file and git operations should use this branch.
       }
       const { getModelProfile: getModelProfile2 } = await import("./profiles-5J7F4BML.js");
       const { getBackendCapabilities } = await import("./backend-P3GHHLHJ.js");
-      const { buildNonStreamingCreateParams } = await import("./client-pure-ONSVWEG5.js");
-      const { OpenAIHttpClient } = await import("./http-client-A7A4XWNK.js");
+      const { buildNonStreamingCreateParams } = await import("./client-pure-USVHN4WG.js");
+      const { OpenAIHttpClient } = await import("./http-client-KJXFSK7A.js");
       const { ensureVersionPrefix } = await import("./url-utils-SAJP7AEX.js");
       const profile = getModelProfile2(model);
       const capabilities = getBackendCapabilities(backend || "unknown");
@@ -7310,7 +7400,7 @@ All file and git operations should use this branch.
       return res.status(400).json({ error: "name, url, and backend are required" });
     }
     try {
-      const { loadGlobalConfig, saveGlobalConfig, addProvider, setDefaultModelSelection } = await import("./config-3FKJV3KI.js");
+      const { loadGlobalConfig, saveGlobalConfig, addProvider, setDefaultModelSelection } = await import("./config-HX7FDKGJ.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const providerBackend = backend;
       const providerModels = modelConfigs?.length ? buildModelConfigs(modelConfigs) : model ? [{ id: model, contextWindow: 2e5, source: "user" }] : [];
@@ -7351,7 +7441,7 @@ All file and git operations should use this branch.
   app.post("/api/init/config", async (req, res) => {
     const { workdir, visionFallback } = req.body;
     try {
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-3FKJV3KI.js");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const updatedVf = visionFallback ? { ...globalConfig.visionFallback, ...visionFallback } : globalConfig.visionFallback;
       const updatedConfig = {
@@ -7376,7 +7466,8 @@ All file and git operations should use this branch.
       model: z.string().optional(),
       timeout: z.number().positive().optional(),
       backend: z.enum(["ollama", "openai"]).optional(),
-      providerModelRef: z.string().optional()
+      providerModelRef: z.string().optional(),
+      apiKey: z.string().optional()
     });
     const parsed = visionFallbackUpdateSchema.safeParse(req.body);
     if (!parsed.success) {
@@ -7385,7 +7476,7 @@ All file and git operations should use this branch.
     }
     const updates = parsed.data;
     try {
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-3FKJV3KI.js");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const filteredUpdates = Object.fromEntries(Object.entries(updates).filter(([, v]) => v !== void 0));
       const updatedConfig = {
@@ -7417,7 +7508,8 @@ All file and git operations should use this branch.
       model: z.string().optional(),
       backend: z.enum(["ollama", "openai"]).optional(),
       providerModelRef: z.string().optional(),
-      timeout: z.number().positive().optional()
+      timeout: z.number().positive().optional(),
+      apiKey: z.string().optional()
     });
     const parsed = testSchema.safeParse(req.body);
     if (!parsed.success) {
@@ -7426,8 +7518,8 @@ All file and git operations should use this branch.
     }
     const testConfig = parsed.data;
     try {
-      const { resolveVisionFallback } = await import("./config-3FKJV3KI.js");
-      const { loadGlobalConfig } = await import("./config-3FKJV3KI.js");
+      const { resolveVisionFallback } = await import("./config-HX7FDKGJ.js");
+      const { loadGlobalConfig } = await import("./config-HX7FDKGJ.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const filteredTestConfig = Object.fromEntries(Object.entries(testConfig).filter(([, v]) => v !== void 0));
       const testVisionFallback = {
@@ -7478,7 +7570,7 @@ All file and git operations should use this branch.
   });
   app.delete("/api/providers/:id", async (req, res) => {
     const { id } = req.params;
-    const { loadGlobalConfig, saveGlobalConfig, removeProvider } = await import("./config-3FKJV3KI.js");
+    const { loadGlobalConfig, saveGlobalConfig, removeProvider } = await import("./config-HX7FDKGJ.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = removeProvider(globalConfig, id);
     await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -7490,7 +7582,7 @@ All file and git operations should use this branch.
     const { id } = req.params;
     const { isLocal } = req.body;
     try {
-      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-3FKJV3KI.js");
+      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-HX7FDKGJ.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const provider = globalConfig.providers.find((p) => p.id === id);
       if (!provider) {
@@ -7522,7 +7614,7 @@ All file and git operations should use this branch.
       transportAdapter
     } = req.body;
     try {
-      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-3FKJV3KI.js");
+      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-HX7FDKGJ.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const provider = globalConfig.providers.find((p) => p.id === id);
       if (!provider) {
@@ -7563,7 +7655,7 @@ All file and git operations should use this branch.
       return res.status(400).json({ error: result.error });
     }
     const llmClient = getLLMClient();
-    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-3FKJV3KI.js");
+    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-HX7FDKGJ.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = setDefaultModelSelection(globalConfig, id, llmClient.getModel());
     await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -7590,7 +7682,7 @@ All file and git operations should use this branch.
   });
   async function rebuildMcpTools() {
     const { createMcpTools: createMcpTools2 } = await import("./tool-adapter-FEAHWU5C.js");
-    const { setMcpTools: setMcpTools2 } = await import("./tools-KKALZLKX.js");
+    const { setMcpTools: setMcpTools2 } = await import("./tools-Y4F4HJPO.js");
     const mcpTools = createMcpTools2(mcpManager);
     setMcpTools2(mcpTools);
     toolRegistry = createToolRegistry();
@@ -7661,7 +7753,7 @@ All file and git operations should use this branch.
       };
       await mcpManager.addServer(name, serverCfg);
       const server = mcpManager.getServer(name);
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-3FKJV3KI.js");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const updatedMcpServers = { ...globalConfig.mcpServers ?? {}, [name]: serverCfg };
       await saveGlobalConfig(
@@ -7719,7 +7811,7 @@ All file and git operations should use this branch.
       return res.status(400).json({ error: "disabled must be a boolean" });
     }
     try {
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-3FKJV3KI.js");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
       const { applyMcpServerUpdate } = await import("./update-server-4I6LXE5K.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const mcpServers2 = { ...globalConfig.mcpServers ?? {} };
@@ -7765,7 +7857,7 @@ All file and git operations should use this branch.
       return res.status(404).json({ error: `MCP server '${name}' not found` });
     }
     mcpManager.removeServer(name);
-    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-3FKJV3KI.js");
+    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedMcpServers = { ...globalConfig.mcpServers ?? {} };
     delete updatedMcpServers[name];
@@ -7795,7 +7887,7 @@ All file and git operations should use this branch.
       await mcpManager.setToolEnabled(name, toolName, enabled);
       const server = mcpManager.getServer(name);
       if (server) {
-        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-3FKJV3KI.js");
+        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-HX7FDKGJ.js");
         const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
         const mcpServers2 = { ...globalConfig.mcpServers ?? {} };
         const serverCfg = mcpServers2[name];
@@ -7824,7 +7916,7 @@ All file and git operations should use this branch.
       res.status(400).json({ error: error instanceof Error ? error.message : String(error) });
     }
   });
-  const { listProjects } = await import("./projects-M5XKC7O6.js");
+  const { listProjects } = await import("./projects-PQXME5S4.js");
   const allProjects = listProjects();
   const projectDir = allProjects.find(
     (p) => p.workdir === config3.workdir || config3.workdir && p.workdir.startsWith(config3.workdir + "/")
@@ -7851,13 +7943,13 @@ All file and git operations should use this branch.
     })
   );
   app.get("/api/sessions/:id/background-processes", async (req, res) => {
-    const { getSessionProcesses } = await import("./manager-GGIIENDX.js");
+    const { getSessionProcesses } = await import("./manager-N27WNW5B.js");
     const sessionId = req.params.id;
     const processes = getSessionProcesses(sessionId);
     res.json({ processes });
   });
   app.post("/api/sessions/:id/background-process/:processId/stop", async (req, res) => {
-    const { stopProcess } = await import("./manager-GGIIENDX.js");
+    const { stopProcess } = await import("./manager-N27WNW5B.js");
     const sessionId = req.params.id;
     const processId = req.params.processId;
     const session = sessionManager.getSession(sessionId);
@@ -8002,7 +8094,7 @@ All file and git operations should use this branch.
     const state = sessionManager.getContextState(sessionId);
     wssExports.broadcastForSession(sessionId, createContextStateMessage(state));
   });
-  const { QueueProcessor } = await import("./processor-CBGV2K4E.js");
+  const { QueueProcessor } = await import("./processor-QYVHKRIV.js");
   const queueProcessor = new QueueProcessor({
     sessionManager,
     providerManager,
@@ -8044,7 +8136,7 @@ All file and git operations should use this branch.
       void (async () => {
         await devServerManager.stopAll();
         await mcpManager.disconnectAll();
-        const { stopAllInspectProxies } = await import("./inspect-proxy-GF6OI7MR.js");
+        const { stopAllInspectProxies } = await import("./inspect-proxy-N42Z5TOG.js");
         stopAllInspectProxies();
         const { cleanupAllProcesses } = await import("./store-SARB6V2N.js");
         cleanupAllProcesses();
@@ -8086,4 +8178,4 @@ export {
   createServerHandle,
   createServer
 };
-//# sourceMappingURL=chunk-XWW7LOU4.js.map
+//# sourceMappingURL=chunk-G2VLGZ3Y.js.map