openfox 2.0.12 → 2.0.14

package/dist/chunk-4W2Z4B5U.js

@@ -0,0 +1,2077 @@
+import {
+  appendCompactionPrompt
+} from "./chunk-FWJ6YXGA.js";
+import {
+  computeDynamicContextHash,
+  injectWorkflowKickoffIfNeeded,
+  runAgentTurn,
+  runChatTurn
+} from "./chunk-7GJ6XYAF.js";
+import {
+  checkAborted,
+  deleteItemFromDir,
+  devServerManager,
+  executeSubAgent,
+  findAgentById,
+  getAllInstructions,
+  getEnabledSkillMetadata,
+  getSubAgents,
+  getToolRegistryForAgent,
+  jsonSerializer,
+  loadAllAgentsDefault,
+  saveItemToDir,
+  spawnShellProcess
+} from "./chunk-4ZTQO5JP.js";
+import {
+  TurnMetrics,
+  buildTopLevelSystemPrompt,
+  createMessageStartEvent
+} from "./chunk-L7TDUIQY.js";
+import {
+  getPlatformShell,
+  onProcessEvent
+} from "./chunk-PBGOZMVY.js";
+import {
+  getCurrentContextWindowId,
+  getEventStore,
+  getRuntimeConfig
+} from "./chunk-SYG2ENUQ.js";
+import {
+  createChatErrorMessage,
+  createChatMessageMessage,
+  createContextStateMessage,
+  createErrorMessage,
+  createGitStatusMessage,
+  createQueueStateMessage,
+  createSessionRunningMessage,
+  isAskAnswerPayload,
+  isSessionLoadPayload,
+  parseClientMessage,
+  serializeServerMessage,
+  storedEventToServerMessage
+} from "./chunk-3QB2RMX2.js";
+import {
+  provideAnswer
+} from "./chunk-EU3WWTFH.js";
+import {
+  computeSessionStats
+} from "./chunk-VUQCQXXJ.js";
+import {
+  createServerMessage
+} from "./chunk-5BDVM6YI.js";
+import {
+  getGlobalConfigDir
+} from "./chunk-CQGTEGKL.js";
+import {
+  createLLMClient,
+  ensureVersionPrefix
+} from "./chunk-PQ56PX7L.js";
+import {
+  logger
+} from "./chunk-K44MW7JJ.js";
+
+// src/server/ws/server.ts
+import { WebSocketServer, WebSocket as WebSocket2 } from "ws";
+import { spawn as spawn3 } from "child_process";
+import { createHash as createHash2 } from "crypto";
+
+// src/server/ws/terminal.ts
+import WebSocket from "ws";
+
+// src/server/terminal/manager.ts
+import * as pty from "node-pty";
+import os from "os";
+var TerminalManager = class {
+  sessions = /* @__PURE__ */ new Map();
+  outputCallbacks = /* @__PURE__ */ new Set();
+  exitCallbacks = /* @__PURE__ */ new Set();
+  outputHistory = /* @__PURE__ */ new Map();
+  generateId() {
+    return `term_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  }
+  getShell() {
+    return getPlatformShell().command;
+  }
+  resolveWorkdir(workdir) {
+    if (workdir && workdir.length > 0) {
+      return workdir;
+    }
+    return os.homedir();
+  }
+  create(workdir, projectId) {
+    const id = this.generateId();
+    const shell = this.getShell();
+    const cwd = this.resolveWorkdir(workdir);
+    const ptyProcess = pty.spawn(shell, [], {
+      name: "xterm-256color",
+      cols: 80,
+      rows: 24,
+      cwd,
+      env: process.env
+    });
+    const session = {
+      id,
+      pty: ptyProcess,
+      workdir: cwd,
+      projectId: projectId ?? ""
+    };
+    ptyProcess.onData((data) => {
+      const output = { sessionId: id, data };
+      for (const cb of this.outputCallbacks) {
+        cb(output);
+      }
+      const history = this.outputHistory.get(id) || [];
+      history.push(data);
+      if (history.length > 1e4) history.shift();
+      this.outputHistory.set(id, history);
+    });
+    ptyProcess.onExit(({ exitCode }) => {
+      logger.info("Terminal session exited", { id, exitCode });
+      this.sessions.delete(id);
+      this.outputHistory.delete(id);
+      for (const cb of this.exitCallbacks) {
+        cb(id, exitCode);
+      }
+    });
+    this.sessions.set(id, session);
+    logger.info("Terminal session created", { id, shell, cwd });
+    return session;
+  }
+  write(sessionId, data) {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      return false;
+    }
+    try {
+      session.pty.write(data);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  resize(sessionId, cols, rows) {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      return false;
+    }
+    try {
+      session.pty.resize(cols, rows);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  kill(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      return false;
+    }
+    session.pty.kill();
+    this.sessions.delete(sessionId);
+    logger.info("Terminal session killed", { id: sessionId });
+    return true;
+  }
+  get(sessionId) {
+    return this.sessions.get(sessionId);
+  }
+  getAll() {
+    return Array.from(this.sessions.values());
+  }
+  getByProject(projectId) {
+    if (!projectId) return [];
+    return Array.from(this.sessions.values()).filter((s) => s.projectId === projectId);
+  }
+  getOutputHistory(sessionId) {
+    return (this.outputHistory.get(sessionId) || []).join("");
+  }
+  onOutput(callback) {
+    this.outputCallbacks.add(callback);
+    return () => {
+      this.outputCallbacks.delete(callback);
+    };
+  }
+  onExit(callback) {
+    this.exitCallbacks.add(callback);
+    return () => {
+      this.exitCallbacks.delete(callback);
+    };
+  }
+  killAll() {
+    for (const session of this.sessions.values()) {
+      session.pty.kill();
+    }
+    this.sessions.clear();
+    logger.info("All terminal sessions killed");
+  }
+};
+var terminalManager = new TerminalManager();
+
+// src/server/ws/terminal.ts
+var subscriptions = /* @__PURE__ */ new Set();
+var outputHandlerRegistered = false;
+var exitHandlerRegistered = false;
+function registerOutputHandler() {
+  if (outputHandlerRegistered) return;
+  outputHandlerRegistered = true;
+  terminalManager.onOutput((output) => {
+    const subs = Array.from(subscriptions).filter(
+      (s) => s.sessionId === output.sessionId && s.ws.readyState === WebSocket.OPEN
+    );
+    for (const sub of subs) {
+      sub.ws.send(
+        JSON.stringify({
+          type: "terminal.output",
+          payload: { sessionId: output.sessionId, data: output.data }
+        })
+      );
+    }
+  });
+}
+function registerExitHandler() {
+  if (exitHandlerRegistered) return;
+  exitHandlerRegistered = true;
+  terminalManager.onExit((sessionId, exitCode) => {
+    const subs = Array.from(subscriptions).filter(
+      (s) => s.sessionId === sessionId && s.ws.readyState === WebSocket.OPEN
+    );
+    for (const sub of subs) {
+      sub.ws.send(
+        JSON.stringify({
+          type: "terminal.exit",
+          payload: { sessionId, exitCode }
+        })
+      );
+    }
+    for (const sub of subscriptions) {
+      if (sub.sessionId === sessionId) {
+        subscriptions.delete(sub);
+      }
+    }
+  });
+}
+function handleTerminalMessage(ws, message) {
+  switch (message.type) {
+    case "terminal.subscribe": {
+      if (message.payload.sessionId) {
+        const exists = Array.from(subscriptions).some(
+          (sub) => sub.ws === ws && sub.sessionId === message.payload.sessionId
+        );
+        if (!exists) {
+          subscriptions.add({ ws, sessionId: message.payload.sessionId });
+        }
+        registerOutputHandler();
+        registerExitHandler();
+        const sessionId = message.payload.sessionId;
+        const history = terminalManager.getOutputHistory(sessionId);
+        if (history) {
+          setTimeout(() => {
+            ws.send(
+              JSON.stringify({
+                type: "terminal.output",
+                payload: { sessionId, data: history }
+              })
+            );
+          }, 100);
+        }
+      }
+      break;
+    }
+    case "terminal.write": {
+      if (message.payload.sessionId && message.payload.data) {
+        terminalManager.write(message.payload.sessionId, message.payload.data);
+      }
+      break;
+    }
+    case "terminal.resize": {
+      if (message.payload.sessionId && typeof message.payload.cols === "number" && typeof message.payload.rows === "number") {
+        terminalManager.resize(message.payload.sessionId, message.payload.cols, message.payload.rows);
+      }
+      break;
+    }
+    case "terminal.kill": {
+      if (message.payload.sessionId) {
+        terminalManager.kill(message.payload.sessionId);
+        for (const sub of subscriptions) {
+          if (sub.sessionId === message.payload.sessionId) {
+            subscriptions.delete(sub);
+          }
+        }
+        ws.send(
+          JSON.stringify({
+            type: "terminal.killed",
+            payload: { sessionId: message.payload.sessionId }
+          })
+        );
+      }
+      break;
+    }
+  }
+}
+function unsubscribeAllFromTerminal(ws) {
+  for (const sub of subscriptions) {
+    if (sub.ws === ws) {
+      subscriptions.delete(sub);
+    }
+  }
+}
+
+// src/server/workflows/registry.ts
+import { readdir, readFile, writeFile, mkdir, access, unlink } from "fs/promises";
+import { join, dirname } from "path";
+import { constants } from "fs";
+import { fileURLToPath } from "url";
+var __bundleDir = dirname(fileURLToPath(import.meta.url));
+var DEFAULTS_DIR = join(__bundleDir, "defaults");
+var DEFAULTS_DIR_ALT = join(__bundleDir, "workflow-defaults");
+var WORKFLOW_EXTENSION = ".workflow.json";
+function getWorkflowsDir(configDir) {
+  return join(configDir, "workflows");
+}
+function getProjectWorkflowsDir(projectDir) {
+  return join(projectDir, ".openfox", "workflows");
+}
+async function pathExists(path) {
+  try {
+    await access(path, constants.R_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function loadWorkflowsFromDir(dir) {
+  if (!await pathExists(dir)) {
+    return [];
+  }
+  let files;
+  try {
+    files = (await readdir(dir)).filter((f) => f.endsWith(WORKFLOW_EXTENSION));
+  } catch {
+    return [];
+  }
+  const workflows = [];
+  for (const file of files) {
+    try {
+      const raw = await readFile(join(dir, file), "utf-8");
+      const parsed = JSON.parse(raw);
+      if (parsed.metadata?.id && parsed.steps?.length > 0) {
+        workflows.push(parsed);
+      } else {
+        logger.warn("Skipping invalid workflow file", { file });
+      }
+    } catch (err) {
+      logger.warn("Failed to parse workflow file", { file, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return workflows;
+}
+async function loadDefaultWorkflows() {
+  let defaults = await loadWorkflowsFromDir(DEFAULTS_DIR);
+  if (!defaults.length) {
+    defaults = await loadWorkflowsFromDir(DEFAULTS_DIR_ALT);
+  }
+  return defaults;
+}
+async function loadUserWorkflows(configDir) {
+  return loadWorkflowsFromDir(getWorkflowsDir(configDir));
+}
+async function loadProjectWorkflows(projectDir) {
+  return loadWorkflowsFromDir(getProjectWorkflowsDir(projectDir));
+}
+async function loadAllWorkflows(configDir, projectDir) {
+  const [defaultWorkflows, userWorkflows] = await Promise.all([loadDefaultWorkflows(), loadUserWorkflows(configDir)]);
+  const workflowMap = /* @__PURE__ */ new Map();
+  for (const workflow of defaultWorkflows) {
+    workflowMap.set(workflow.metadata.id, workflow);
+  }
+  for (const workflow of userWorkflows) {
+    workflowMap.set(workflow.metadata.id, workflow);
+  }
+  if (projectDir) {
+    const projectWorkflows = await loadProjectWorkflows(projectDir);
+    for (const workflow of projectWorkflows) {
+      workflowMap.set(workflow.metadata.id, workflow);
+    }
+  }
+  return Array.from(workflowMap.values());
+}
+async function saveWorkflowToProject(projectDir, workflow) {
+  await saveItemToDir(getProjectWorkflowsDir(projectDir), workflow, WORKFLOW_EXTENSION, jsonSerializer);
+}
+async function deleteProjectWorkflow(projectDir, workflowId) {
+  return deleteItemFromDir(getProjectWorkflowsDir(projectDir), workflowId, WORKFLOW_EXTENSION);
+}
+async function getDefaultWorkflowIds() {
+  for (const dir of [DEFAULTS_DIR, DEFAULTS_DIR_ALT]) {
+    try {
+      const files = (await readdir(dir)).filter((f) => f.endsWith(WORKFLOW_EXTENSION));
+      return files.map((f) => f.replace(WORKFLOW_EXTENSION, ""));
+    } catch {
+    }
+  }
+  return [];
+}
+async function isDefaultWorkflow(workflowId) {
+  const defaultIds = await getDefaultWorkflowIds();
+  return defaultIds.includes(workflowId);
+}
+function findWorkflowById(workflowId, workflows) {
+  return workflows.find((p) => p.metadata.id === workflowId);
+}
+async function workflowExists(configDir, workflowId, projectDir) {
+  if (await pathExists(join(getWorkflowsDir(configDir), `${workflowId}${WORKFLOW_EXTENSION}`))) return true;
+  if (projectDir && await pathExists(join(getProjectWorkflowsDir(projectDir), `${workflowId}${WORKFLOW_EXTENSION}`)))
+    return true;
+  return false;
+}
+async function saveWorkflow(configDir, workflow) {
+  const workflowsDir = getWorkflowsDir(configDir);
+  if (!await pathExists(workflowsDir)) {
+    await mkdir(workflowsDir, { recursive: true });
+  }
+  const filePath = join(workflowsDir, `${workflow.metadata.id}${WORKFLOW_EXTENSION}`);
+  await writeFile(filePath, JSON.stringify(workflow, null, 2) + "\n", "utf-8");
+}
+async function deleteWorkflow(configDir, workflowId) {
+  const isDefault = await isDefaultWorkflow(workflowId);
+  if (isDefault) {
+    return { success: false, reason: "Cannot delete built-in defaults" };
+  }
+  const filePath = join(getWorkflowsDir(configDir), `${workflowId}${WORKFLOW_EXTENSION}`);
+  try {
+    await unlink(filePath);
+    return { success: true };
+  } catch {
+    return { success: false };
+  }
+}
+
+// src/server/workflows/types.ts
+var TERMINAL_DONE = "$done";
+var TERMINAL_BLOCKED = "$blocked";
+
+// src/server/git/diff.ts
+import { spawn as spawn2 } from "child_process";
+function getGitDiffFiles(cwd) {
+  return new Promise((resolve) => {
+    const diffProc = spawn2("git", ["diff", "--name-status", "HEAD"], { cwd, stdio: ["ignore", "pipe", "pipe"] });
+    const statusProc = spawn2("git", ["status", "--porcelain"], { cwd, stdio: ["ignore", "pipe", "pipe"] });
+    let diffStdout = "";
+    let statusStdout = "";
+    let diffExited = false;
+    let statusExited = false;
+    let diffCode = null;
+    let statusCode = null;
+    const collect = () => {
+      if (!diffExited || !statusExited) return;
+      const files = [];
+      if (diffCode === 0) {
+        for (const line of diffStdout.split("\n")) {
+          if (!line.trim()) continue;
+          const [statusChar, ...pathParts] = line.split("	");
+          const path = pathParts.join("	") || statusChar || "";
+          if (!path) continue;
+          const status = statusChar === "A" ? "added" : statusChar === "D" ? "deleted" : "modified";
+          files.push({ path, status, additions: 0, deletions: 0 });
+        }
+      }
+      if (statusCode === 0) {
+        for (const line of statusStdout.split("\n")) {
+          if (!line.startsWith("?? ")) continue;
+          const path = line.slice(3).trim();
+          if (!path) continue;
+          files.push({ path, status: "added", additions: 0, deletions: 0 });
+        }
+      }
+      resolve(files);
+    };
+    diffProc.stdout.on("data", (data) => {
+      diffStdout += data.toString();
+    });
+    statusProc.stdout.on("data", (data) => {
+      statusStdout += data.toString();
+    });
+    diffProc.on("close", (code) => {
+      diffExited = true;
+      diffCode = code;
+      collect();
+    });
+    statusProc.on("close", (code) => {
+      statusExited = true;
+      statusCode = code;
+      collect();
+    });
+    diffProc.on("error", () => {
+      diffExited = true;
+      diffCode = 1;
+      collect();
+    });
+    statusProc.on("error", () => {
+      statusExited = true;
+      statusCode = 1;
+      collect();
+    });
+  });
+}
+async function formatGitDiffFiles(cwd) {
+  const files = await getGitDiffFiles(cwd);
+  if (files.length === 0) return "(none)";
+  return files.map((f) => `- ${f.path} (${f.status})`).join("\n");
+}
+
+// src/server/workflows/shell.ts
+function executeShellCommand(command, cwd, timeout, signal) {
+  return new Promise((resolve, reject) => {
+    if (checkAborted(signal)) {
+      reject(new Error("Aborted"));
+      return;
+    }
+    const proc = spawnShellProcess(command, cwd, signal);
+    let stdout = "";
+    let stderr = "";
+    let killed = false;
+    const timer = setTimeout(() => {
+      killed = true;
+      proc.kill("SIGTERM");
+      resolve({ exitCode: 1, stdout, stderr: stderr + "\nCommand timed out", success: false });
+    }, timeout);
+    const onAbort = () => {
+      if (!killed) {
+        killed = true;
+        proc.kill("SIGTERM");
+        clearTimeout(timer);
+        reject(new Error("Aborted"));
+      }
+    };
+    signal?.addEventListener("abort", onAbort);
+    proc.stdout?.on("data", (data) => {
+      stdout += data.toString();
+    });
+    proc.stderr?.on("data", (data) => {
+      stderr += data.toString();
+    });
+    proc.on("close", (code) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      if (killed) return;
+      const exitCode = code ?? 1;
+      resolve({ exitCode, stdout, stderr, success: exitCode === 0 });
+    });
+    proc.on("error", (err) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      if (killed) return;
+      resolve({ exitCode: 1, stdout, stderr: err.message, success: false });
+    });
+  });
+}
+
+// src/server/workflows/executor.ts
+var TEMPLATE_VARIABLES = [
+  { name: "workdir", description: "Working directory of the session" },
+  { name: "reason", description: 'Human-readable reason (e.g. "2 criteria remaining")' },
+  {
+    name: "stepOutput",
+    description: "Structured output from the previous step (content, stdout, stderr, exitCode, etc.)"
+  },
+  {
+    name: "verifierFindings",
+    description: "@deprecated Use stepOutput.content instead. Output from the last sub-agent step"
+  },
+  {
+    name: "previousStepOutput",
+    description: "@deprecated Use stepOutput.stdout instead. Output from the last shell step"
+  },
+  { name: "criteriaCount", description: "Total number of criteria" },
+  { name: "pendingCount", description: "Number of pending/failed criteria" },
+  { name: "criteriaList", description: "Formatted list of all criteria with status" },
+  { name: "modifiedFiles", description: "List of modified files" }
+];
+function formatCriteriaList(entries) {
+  if (entries.length === 0) return "(none)";
+  return entries.map((e) => {
+    const status = e.status === "passed" ? "[PASSED]" : e.status === "completed" ? "[NEEDS VERIFICATION]" : e.status === "failed" ? "[FAILED]" : "[NOT COMPLETED]";
+    return `- **${e.id}** ${status}: ${e.description}`;
+  }).join("\n");
+}
+async function formatModifiedFiles(session) {
+  return formatGitDiffFiles(session.workdir);
+}
+function resolveTemplate(template, ctx) {
+  let result = template;
+  for (const { name } of TEMPLATE_VARIABLES) {
+    if (name === "stepOutput" || name === "verifierFindings" || name === "previousStepOutput") continue;
+    const value = String(ctx[name]);
+    result = result.replace(new RegExp(`\\{\\{${name}\\}\\}`, "g"), value);
+  }
+  result = result.replace(/\{\{stepOutput\.(\w+)\}\}/g, (_, key) => ctx.stepOutput[key] ?? "");
+  result = result.replace(/\{\{verifierFindings\}\}/g, ctx.stepOutput["content"] ?? "");
+  result = result.replace(/\{\{previousStepOutput\}\}/g, ctx.stepOutput["stdout"] ?? "");
+  return result;
+}
+function evaluateCondition(condition, stepOutcome, metadataEntries) {
+  switch (condition.type) {
+    case "step_result":
+      if (!stepOutcome) return false;
+      return stepOutcome.result === condition.result;
+    case "metadata_all_match": {
+      if (!metadataEntries) return false;
+      const entries = metadataEntries[condition.key];
+      if (!entries || entries.length === 0) return true;
+      return entries.every((e) => e[condition.field] === condition.value);
+    }
+    case "metadata_all_in": {
+      if (!metadataEntries) return false;
+      const entries = metadataEntries[condition.key];
+      if (!entries || entries.length === 0) return true;
+      return entries.every((e) => condition.values.includes(e[condition.field]));
+    }
+    case "always":
+      return true;
+  }
+}
+function evaluateTransitions(transitions, stepOutcome, metadataEntries) {
+  for (const transition of transitions) {
+    if (evaluateCondition(transition.when, stepOutcome, metadataEntries)) {
+      return transition.goto;
+    }
+  }
+  return TERMINAL_BLOCKED;
+}
+function emitWorkflowMessage(eventStore, sessionId, content, windowOptions, onMessage) {
+  const msgId = crypto.randomUUID();
+  eventStore.append(
+    sessionId,
+    createMessageStartEvent(msgId, "user", content, {
+      ...windowOptions ?? {},
+      isSystemGenerated: true,
+      messageKind: "correction",
+      metadata: { type: "workflow", name: "Workflow", color: "#f59e0b" }
+    })
+  );
+  eventStore.append(sessionId, { type: "message.done", data: { messageId: msgId } });
+  if (onMessage) {
+    onMessage(
+      createChatMessageMessage({
+        id: msgId,
+        role: "user",
+        content,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        isSystemGenerated: true,
+        messageKind: "correction",
+        metadata: { type: "workflow", name: "Workflow", color: "#f59e0b" }
+      })
+    );
+  }
+  return msgId;
+}
+function getCurrentWindowMessageOptions(sessionId) {
+  const contextWindowId = getCurrentContextWindowId(sessionId);
+  return contextWindowId ? { contextWindowId } : void 0;
+}
+function buildReason(metadataEntries) {
+  const entries = metadataEntries?.["criteria"] ?? [];
+  const remaining = entries.filter((e) => e.status !== "passed");
+  return `${remaining.length} criteria remaining`;
+}
+async function executeWorkflow(workflow, options, subGroup) {
+  const { sessionManager, sessionId, llmClient, signal, onMessage } = options;
+  const eventStore = getEventStore();
+  const startTime = performance.now();
+  let iterations = 0;
+  const activeSteps = subGroup ? workflow.steps.filter((s) => s.subGroup === subGroup) : workflow.steps;
+  let currentStepId = subGroup ? activeSteps[0]?.id ?? workflow.entryStep : workflow.entryStep;
+  let lastStepOutput = {};
+  const firstEntryForStep = /* @__PURE__ */ new Set();
+  const messagesBeforeWorkflow = sessionManager.requireSession(sessionId).messages.length;
+  const activeStepIds = new Set(activeSteps.map((s) => s.id));
+  const stepsById = /* @__PURE__ */ new Map();
+  for (const step of activeSteps) {
+    stepsById.set(step.id, step);
+  }
+  logger.debug("Workflow executor starting", { sessionId, workflow: workflow.metadata.id });
+  if (workflow.startCondition && workflow.startCondition.type !== "always") {
+    const session = sessionManager.requireSession(sessionId);
+    const conditionMet = evaluateCondition(
+      workflow.startCondition,
+      null,
+      session.metadataEntries
+    );
+    if (!conditionMet) {
+      logger.debug("Workflow start condition not met", { sessionId, condition: workflow.startCondition.type });
+      return {
+        finalAction: {
+          type: "BLOCKED",
+          reason: `Start condition not met: ${workflow.startCondition.type}`,
+          blockedCriteria: []
+        },
+        iterations: 0,
+        totalTime: (performance.now() - startTime) / 1e3
+      };
+    }
+  }
+  const startMsgId = crypto.randomUUID();
+  const startWindowOpts = getCurrentWindowMessageOptions(sessionId);
+  eventStore.append(
+    sessionId,
+    createMessageStartEvent(
+      startMsgId,
+      "user",
+      JSON.stringify({
+        workflowName: workflow.metadata.name,
+        workflowId: workflow.metadata.id,
+        workflowColor: workflow.metadata.color
+      }),
+      { ...startWindowOpts ?? {}, isSystemGenerated: true, messageKind: "workflow-started" }
+    )
+  );
+  eventStore.append(sessionId, { type: "message.done", data: { messageId: startMsgId } });
+  if (options.userMessage) {
+    sessionManager.addMessage(sessionId, {
+      role: "user",
+      content: options.userMessage.content,
+      ...options.userMessage.attachments ? { attachments: options.userMessage.attachments } : {}
+    });
+  }
+  while (iterations < workflow.settings.maxIterations) {
+    if (signal?.aborted) {
+      logger.debug("Workflow executor aborted", { sessionId, iterations });
+      return {
+        finalAction: { type: "RUN_BUILDER", reason: "Aborted" },
+        iterations,
+        totalTime: (performance.now() - startTime) / 1e3
+      };
+    }
+    iterations++;
+    const step = stepsById.get(currentStepId);
+    if (!step) {
+      logger.error("Workflow step not found", { sessionId, stepId: currentStepId });
+      return {
+        finalAction: { type: "BLOCKED", reason: `Step "${currentStepId}" not found in workflow`, blockedCriteria: [] },
+        iterations,
+        totalTime: (performance.now() - startTime) / 1e3
+      };
+    }
+    const session = sessionManager.requireSession(sessionId);
+    const currentWindowMessageOptions = getCurrentWindowMessageOptions(sessionId);
+    const criteriaEntries = session.metadataEntries["criteria"] ?? [];
+    const templateCtx = {
+      workdir: session.workdir,
+      reason: buildReason(session.metadataEntries),
+      verifierFindings: lastStepOutput["content"] ?? "",
+      previousStepOutput: lastStepOutput["stdout"] ?? "",
+      criteriaCount: criteriaEntries.length,
+      pendingCount: criteriaEntries.filter((e) => e.status !== "passed").length,
+      criteriaList: formatCriteriaList(criteriaEntries),
+      modifiedFiles: await formatModifiedFiles(session),
+      stepOutput: lastStepOutput
+    };
+    sessionManager.setPhase(sessionId, step.phase);
+    logger.debug("Workflow step executing", { sessionId, iteration: iterations, stepId: step.id, stepType: step.type });
+    let stepOutcome = null;
+    switch (step.type) {
+      case "agent": {
+        const agentStep = step;
+        const STEP_DONE_PROMPT = "\n\nOnce you're done, call step_done()";
+        const STEP_DONE_NUDGE = "You haven't called step_done(). If you haven't finished the task, continue and when you're finished call step_done()";
+        let promptContent;
+        let nudgeContent;
+        if (!firstEntryForStep.has(step.id) && agentStep.prompt) {
+          const resolvedPrompt = resolveTemplate(agentStep.prompt, templateCtx);
+          promptContent = resolvedPrompt + STEP_DONE_PROMPT;
+          const promptMsgId = crypto.randomUUID();
+          const msgMetadata = { type: "workflow", name: "Workflow", color: "#f59e0b" };
+          eventStore.append(
+            sessionId,
+            createMessageStartEvent(promptMsgId, "user", promptContent, {
+              ...currentWindowMessageOptions ?? {},
+              isSystemGenerated: true,
+              messageKind: "auto-prompt",
+              metadata: msgMetadata
+            })
+          );
+          eventStore.append(sessionId, { type: "message.done", data: { messageId: promptMsgId } });
+          if (onMessage) {
+            onMessage(
+              createChatMessageMessage({
+                id: promptMsgId,
+                role: "user",
+                content: promptContent,
+                timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+                isSystemGenerated: true,
+                messageKind: "auto-prompt",
+                metadata: { type: "workflow", name: "Workflow", color: "#f59e0b" }
+              })
+            );
+          }
+        } else if (firstEntryForStep.has(step.id)) {
+          const parts = [];
+          if (agentStep.nudgePrompt) {
+            const resolvedNudge = resolveTemplate(agentStep.nudgePrompt, templateCtx);
+            parts.push(resolvedNudge);
+          }
+          parts.push(STEP_DONE_NUDGE);
+          nudgeContent = parts.join("\n\n");
+          emitWorkflowMessage(eventStore, sessionId, nudgeContent, currentWindowMessageOptions, onMessage);
+        }
+        const turnMetrics = new TurnMetrics();
+        const es = getEventStore();
+        const append = (event) => es.append(sessionId, event);
+        let stepDoneCalled = false;
+        const agentResult = await runAgentTurn(
+          {
+            sessionManager,
+            sessionId,
+            llmClient,
+            ...options.statsIdentity ? { statsIdentity: options.statsIdentity } : {},
+            ...signal ? { signal } : {},
+            ...onMessage ? { onMessage } : {}
+          },
+          turnMetrics,
+          agentStep.agentId ?? "planner",
+          append,
+          {
+            ...!firstEntryForStep.has(step.id) && !agentStep.prompt && options.injectWorkflowKickoff === true ? { injectKickoff: () => injectWorkflowKickoffIfNeeded(sessionManager, sessionId, es) } : {},
+            onToolExecuted: (toolCall, toolResult) => {
+              if (toolCall.name === "step_done" && toolResult.success) {
+                stepDoneCalled = true;
+              }
+              if (toolResult.success && ["write_file", "edit_file"].includes(toolCall.name)) {
+                const path = toolCall.arguments["path"];
+                sessionManager.addModifiedFile(sessionId, path);
+              }
+            }
+          }
+        );
+        firstEntryForStep.add(step.id);
+        const agentReturnValue = agentResult.returnValueResult ?? "completed";
+        lastStepOutput = {
+          ...agentResult.returnValueContent ? { content: agentResult.returnValueContent } : {},
+          ...agentResult.returnValueResult ? { result: agentResult.returnValueResult } : {},
+          stepDoneCalled: String(stepDoneCalled)
+        };
+        stepOutcome = { result: agentReturnValue, output: lastStepOutput };
+        if (!stepDoneCalled) {
+          logger.debug("step_done not called, looping agent step", {
+            sessionId,
+            stepId: step.id,
+            iteration: iterations
+          });
+          continue;
+        }
+        break;
+      }
+      case "sub_agent": {
+        const subStep = step;
+        const turnMetrics = new TurnMetrics();
+        const promptTemplate = subStep.prompt ?? "Perform your task.";
+        const resolvedPrompt = resolveTemplate(promptTemplate, templateCtx);
+        const allAgents = await loadAllAgentsDefault();
+        const agentDef = findAgentById(subStep.subAgentType, allAgents);
+        if (!agentDef) {
+          logger.error("Sub-agent definition not found", { subAgentType: subStep.subAgentType });
+          stepOutcome = { result: "error", output: {} };
+          break;
+        }
+        const toolRegistry = getToolRegistryForAgent(agentDef);
+        const filteredToolRegistry = {
+          tools: toolRegistry.tools.filter((t) => t.name !== "step_done"),
+          definitions: toolRegistry.definitions.filter((d) => d.type === "function" && d.function.name !== "step_done"),
+          execute: toolRegistry.execute
+        };
+        const result = await executeSubAgent({
+          subAgentType: subStep.subAgentType,
+          prompt: resolvedPrompt,
+          sessionManager,
+          sessionId,
+          llmClient,
+          toolRegistry: filteredToolRegistry,
+          turnMetrics,
+          statsIdentity: options.statsIdentity ?? {
+            providerId: "",
+            providerName: "",
+            backend: "unknown",
+            model: llmClient.getModel()
+          },
+          ...signal ? { signal } : {},
+          ...onMessage ? { onMessage } : {}
+        });
+        lastStepOutput = { content: result.content ?? "", ...result.result ? { result: result.result } : {} };
+        stepOutcome = { result: result.result ?? "success", output: lastStepOutput };
+        break;
+      }
+      case "shell": {
+        const shellStep = step;
+        const command = resolveTemplate(shellStep.command, templateCtx);
+        const timeout = shellStep.timeout ?? 6e4;
+        const successCodes = shellStep.successExitCodes ?? [0];
+        const shellMsgId = crypto.randomUUID();
+        eventStore.append(
+          sessionId,
+          createMessageStartEvent(shellMsgId, "user", `Running: \`${command}\``, {
+            ...currentWindowMessageOptions ?? {},
+            isSystemGenerated: true,
+            messageKind: "auto-prompt",
+            metadata: { type: "workflow", name: "Workflow", color: "#f59e0b" }
+          })
+        );
+        if (onMessage) {
+          onMessage(
+            createChatMessageMessage({
+              id: shellMsgId,
+              role: "user",
+              content: `Running: \`${command}\``,
+              timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              isSystemGenerated: true,
+              messageKind: "auto-prompt",
+              metadata: { type: "workflow", name: "Workflow", color: "#f59e0b" }
+            })
+          );
+        }
+        const result = await executeShellCommand(command, session.workdir, timeout, signal);
+        const output = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+        lastStepOutput = { stdout: result.stdout ?? "", stderr: result.stderr ?? "", exitCode: String(result.exitCode) };
+        const outputContent = output ? `Exit code: ${result.exitCode}
+\`\`\`
+${output.slice(0, 1e4)}
+\`\`\`` : `Exit code: ${result.exitCode}`;
+        eventStore.append(sessionId, { type: "message.done", data: { messageId: shellMsgId } });
+        const outputMsgId = crypto.randomUUID();
+        eventStore.append(
+          sessionId,
+          createMessageStartEvent(outputMsgId, "user", outputContent, {
+            ...currentWindowMessageOptions ?? {},
+            isSystemGenerated: true,
+            messageKind: "correction"
+          })
+        );
+        eventStore.append(sessionId, { type: "message.done", data: { messageId: outputMsgId } });
+        if (onMessage) {
+          onMessage(
+            createChatMessageMessage({
+              id: outputMsgId,
+              role: "user",
+              content: outputContent,
+              timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              isSystemGenerated: true,
+              messageKind: "correction"
+            })
+          );
+        }
+        stepOutcome = { result: successCodes.includes(result.exitCode) ? "success" : "failure", output: lastStepOutput };
+        break;
+      }
+    }
+    const refreshedSession = sessionManager.requireSession(sessionId);
+    const effectiveTransitions = subGroup ? step.transitions.filter((t) => !t.subGroup || t.subGroup === subGroup) : step.transitions;
+    const rawNextStepId = evaluateTransitions(effectiveTransitions, stepOutcome, refreshedSession.metadataEntries);
+    const nextStepId = subGroup && rawNextStepId !== TERMINAL_DONE && rawNextStepId !== TERMINAL_BLOCKED && !activeStepIds.has(rawNextStepId) ? TERMINAL_DONE : rawNextStepId;
+    if (nextStepId === TERMINAL_DONE) {
+      sessionManager.setPhase(sessionId, "done");
+      const totalTimeSeconds = Math.round((performance.now() - startTime) / 100) / 10;
+      const completedSession = sessionManager.requireSession(sessionId);
+      const workflowMessages = completedSession.messages.slice(messagesBeforeWorkflow);
+      const workflowStats = computeSessionStats(workflowMessages);
+      const totalToolCalls = workflowMessages.reduce((sum, m) => sum + (m.toolCalls?.length ?? 0), 0);
+      const taskCompletedData = {
+        summary: null,
+        iterations,
+        totalTimeSeconds,
+        totalToolCalls,
+        totalTokensGenerated: workflowStats?.generationTokens ?? 0,
+        avgGenerationSpeed: workflowStats?.avgGenerationSpeed ?? 0,
+        responseCount: workflowStats?.responseCount ?? 0,
+        llmCallCount: workflowStats?.llmCallCount ?? 0,
+        criteria: [],
+        workflowName: workflow.metadata.name,
+        workflowId: workflow.metadata.id,
+        ...workflow.metadata.color ? { workflowColor: workflow.metadata.color } : {}
+      };
+      eventStore.append(sessionId, { type: "task.completed", data: taskCompletedData });
+      const markerMsgId = crypto.randomUUID();
+      eventStore.append(
+        sessionId,
+        createMessageStartEvent(markerMsgId, "user", JSON.stringify(taskCompletedData), {
+          ...currentWindowMessageOptions ?? {},
+          isSystemGenerated: true,
+          messageKind: "task-completed"
+        })
+      );
+      eventStore.append(sessionId, { type: "message.done", data: { messageId: markerMsgId } });
+      logger.debug("Workflow executor complete", { sessionId, iterations });
+      const doneAction = { type: "DONE" };
+      return {
+        finalAction: doneAction,
+        iterations,
+        totalTime: totalTimeSeconds
+      };
+    }
+    if (nextStepId === TERMINAL_BLOCKED) {
+      sessionManager.setPhase(sessionId, "blocked");
+      const reason = "No matching transition";
+      emitWorkflowMessage(eventStore, sessionId, `Runner blocked: ${reason}`, currentWindowMessageOptions, onMessage);
+      logger.warn("Workflow executor blocked", { sessionId, iterations, reason });
+      const blockedAction = { type: "BLOCKED", reason, blockedCriteria: [] };
+      return {
+        finalAction: blockedAction,
+        iterations,
+        totalTime: (performance.now() - startTime) / 1e3
+      };
+    }
+    currentStepId = nextStepId;
+  }
+  logger.warn("Workflow executor max iterations reached", { sessionId, iterations });
+  return {
+    finalAction: {
+      type: "BLOCKED",
+      reason: `Max iterations (${workflow.settings.maxIterations}) reached`,
+      blockedCriteria: []
+    },
+    iterations,
+    totalTime: (performance.now() - startTime) / 1e3
+  };
+}
+
+// src/server/runner/orchestrator.ts
+async function runOrchestrator(options) {
+  const runtimeConfig = getRuntimeConfig();
+  const workflowId = options.workflowId ?? runtimeConfig.activeWorkflowId ?? "default";
+  const configDir = getGlobalConfigDir(runtimeConfig.mode ?? "production");
+  const workflows = await loadAllWorkflows(configDir);
+  const workflow = findWorkflowById(workflowId, workflows);
+  if (!workflow) {
+    throw new Error(`Workflow "${workflowId}" not found`);
+  }
+  logger.debug("Using workflow executor", {
+    sessionId: options.sessionId,
+    workflow: workflow.metadata.id,
+    subGroup: options.subGroup
+  });
+  return executeWorkflow(workflow, options, options.subGroup);
+}
+
+// src/server/auth.ts
+import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { join as join2, dirname as dirname2 } from "path";
+import { createHash, privateDecrypt, createPublicKey } from "crypto";
+function getAuthConfigPath() {
+  const configDir = getRuntimeConfig();
+  const mode = configDir.mode === "development" ? "development" : configDir.mode === "test" ? "test" : "production";
+  if (mode === "test") {
+    const cwd = process.cwd();
+    const base = cwd.endsWith("/e2e") ? cwd : join2(cwd, "e2e");
+    const testAuthPath = join2(base, ".openfox-test", "auth.json");
+    return testAuthPath;
+  }
+  const home = process.env["HOME"] || process.env["USERPROFILE"] || "";
+  const basePath = process.env["XDG_CONFIG_HOME"] || `${home}/.config`;
+  const suffix = mode === "development" ? "-dev" : "";
+  return `${basePath}/openfox${suffix}/auth.json`;
+}
+function getKeyPath() {
+  const authPath = getAuthConfigPath();
+  const dir = dirname2(authPath);
+  return join2(dir, "auth.key");
+}
+var cachedAuth = null;
+var cachedPrivateKey = null;
+async function loadPrivateKey() {
+  if (cachedPrivateKey) {
+    return cachedPrivateKey;
+  }
+  const keyPath = getKeyPath();
+  const keyDir = dirname2(keyPath);
+  try {
+    cachedPrivateKey = await readFile2(keyPath, "utf-8");
+    return cachedPrivateKey;
+  } catch {
+    const { privateKey } = await import("crypto").then(
+      (c) => c.generateKeyPairSync("rsa", {
+        modulusLength: 2048,
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+        publicKeyEncoding: { type: "spki", format: "pem" }
+      })
+    );
+    await mkdir2(keyDir, { recursive: true });
+    await writeFile2(keyPath, privateKey, { mode: 384 });
+    cachedPrivateKey = privateKey;
+    return privateKey;
+  }
+}
+async function loadServerAuthConfig() {
+  const configDir = getRuntimeConfig();
+  const isTestMode = configDir.mode === "test";
+  if (!isTestMode) {
+    if (cachedAuth) {
+      return cachedAuth;
+    }
+  }
+  try {
+    const authPath = getAuthConfigPath();
+    const data = await readFile2(authPath, "utf-8");
+    const authConfig = JSON.parse(data);
+    cachedAuth = authConfig;
+    return authConfig;
+  } catch {
+    return null;
+  }
+}
+function getAuthConfig() {
+  return cachedAuth;
+}
+function hashPassword(password) {
+  return createHash("sha256").update(password).digest("hex");
+}
+function requiresAuth() {
+  return cachedAuth?.strategy === "network";
+}
+function hasPassword() {
+  return cachedAuth?.encryptedPassword != null && cachedAuth.encryptedPassword.length > 0;
+}
+async function verifyPassword(password) {
+  const encryptedPassword = cachedAuth?.encryptedPassword;
+  if (!encryptedPassword) return false;
+  const privateKey = await loadPrivateKey();
+  try {
+    const decrypted = privateDecrypt({ key: privateKey, padding: 1 }, Buffer.from(encryptedPassword, "base64"));
+    return decrypted.toString() === password;
+  } catch {
+    return false;
+  }
+}
+async function tokenFromPassword(password) {
+  const privateKey = await loadPrivateKey();
+  const passwordHash = hashPassword(password);
+  const sign = await import("crypto").then((c) => {
+    const s = c.createSign("SHA256");
+    s.update(passwordHash);
+    s.end();
+    return s.sign(privateKey, "base64");
+  });
+  return sign;
+}
+async function isValidToken(token) {
+  if (!cachedAuth?.encryptedPassword) return false;
+  const privateKey = await loadPrivateKey();
+  try {
+    const decrypted = privateDecrypt(
+      { key: privateKey, padding: 1 },
+      Buffer.from(cachedAuth.encryptedPassword, "base64")
+    );
+    const storedPassword = decrypted.toString();
+    const storedHash = hashPassword(storedPassword);
+    const verify = await import("crypto").then((c) => {
+      const v = c.createVerify("SHA256");
+      v.update(storedHash);
+      v.end();
+      return v;
+    });
+    const publicKey = createPublicKey(privateKey).export({ type: "spki", format: "pem" });
+    return verify.verify(publicKey, token, "base64");
+  } catch {
+    return false;
+  }
+}
+
+// src/server/ws/server.ts
+var _mcpManager;
+function setMcpManagerForWs(mgr) {
+  _mcpManager = mgr;
+}
+function moduleGitBranch(cwd) {
+  return new Promise((resolve) => {
+    const proc = spawn3("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+      cwd,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    let stdout = "";
+    proc.stdout.on("data", (data) => {
+      stdout += data.toString();
+    });
+    proc.on("close", (code) => {
+      if (code === 0 && stdout.trim()) {
+        resolve(stdout.trim());
+      } else {
+        resolve(null);
+      }
+    });
+    proc.on("error", () => resolve(null));
+  });
+}
+function hashContent(content) {
+  return createHash2("sha256").update(content).digest("hex");
+}
+function moduleGitDiff(cwd) {
+  return new Promise((resolve) => {
+    const diffProc = spawn3("git", ["diff", "--name-status", "HEAD"], {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const statusProc = spawn3("git", ["status", "--porcelain"], {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let diffStdout = "";
+    let statusStdout = "";
+    let diffExited = false;
+    let statusExited = false;
+    let diffCode = null;
+    let statusCode = null;
+    const processResults = () => {
+      if (!diffExited || !statusExited) return;
+      const raw = diffStdout + statusStdout;
+      const hash = raw ? hashContent(raw) : "";
+      const files = [];
+      if (diffCode === 0) {
+        for (const line of diffStdout.split("\n")) {
+          if (!line.trim()) continue;
+          const [statusChar, ...pathParts] = line.split("	");
+          const path = pathParts.join("	") || statusChar || "";
+          if (!path) continue;
+          const status = statusChar === "A" ? "added" : statusChar === "D" ? "deleted" : "modified";
+          files.push({ path, status, additions: 0, deletions: 0 });
+        }
+      }
+      if (statusCode === 0) {
+        for (const line of statusStdout.split("\n")) {
+          if (!line.startsWith("?? ")) continue;
+          const path = line.slice(3).trim();
+          if (!path) continue;
+          files.push({ path, status: "added", additions: 0, deletions: 0 });
+        }
+      }
+      resolve({ hash, files });
+    };
+    diffProc.stdout.on("data", (data) => {
+      diffStdout += data.toString();
+    });
+    statusProc.stdout.on("data", (data) => {
+      statusStdout += data.toString();
+    });
+    diffProc.on("close", (code) => {
+      diffExited = true;
+      diffCode = code;
+      processResults();
+    });
+    statusProc.on("close", (code) => {
+      statusExited = true;
+      statusCode = code;
+      processResults();
+    });
+    diffProc.on("error", () => {
+      diffExited = true;
+      diffCode = 1;
+      processResults();
+    });
+    statusProc.on("error", () => {
+      statusExited = true;
+      statusCode = 1;
+      processResults();
+    });
+  });
+}
+var moduleWorkdirLastHash = /* @__PURE__ */ new Map();
+var moduleWorkdirInterval = /* @__PURE__ */ new Map();
+var gitPollInterval = parseInt(process.env["OPENFOX_GIT_POLL_INTERVAL"] ?? "", 10) || 1e4;
+var moduleClients = null;
+var moduleEnqueueSend = null;
+function moduleGitPoll(workdir) {
+  ;
+  (async () => {
+    try {
+      const branch = await moduleGitBranch(workdir);
+      const { hash, files } = await moduleGitDiff(workdir);
+      const lastHash = moduleWorkdirLastHash.get(workdir);
+      if (hash !== lastHash) {
+        moduleWorkdirLastHash.set(workdir, hash);
+        const msg = createGitStatusMessage(branch, files);
+        const activeClients = moduleClients;
+        const sendFn = moduleEnqueueSend;
+        if (!activeClients || !sendFn) return;
+        for (const [ws, client] of activeClients) {
+          if (client.activeWorkdir === workdir && ws.readyState === WebSocket2.OPEN) {
+            const seq = client.lastSentSeq + 1;
+            sendFn(client, serializeServerMessage({ ...msg, sessionId: client.activeSessionId ?? "" }), seq);
+          }
+        }
+      }
+    } catch {
+    }
+  })();
+}
+function moduleStartGitPolling(workdir) {
+  if (moduleWorkdirInterval.has(workdir)) return;
+  const interval = setInterval(() => moduleGitPoll(workdir), gitPollInterval);
+  moduleWorkdirInterval.set(workdir, interval);
+}
+function moduleStopGitPolling(workdir) {
+  const interval = moduleWorkdirInterval.get(workdir);
+  if (interval !== void 0) {
+    clearInterval(interval);
+    moduleWorkdirInterval.delete(workdir);
+    moduleWorkdirLastHash.delete(workdir);
+  }
+}
+function resolveStatsIdentity(llmClient, getActiveProvider) {
+  const provider = getActiveProvider?.();
+  const model = llmClient.getModel();
+  const backend = provider?.backend ?? (llmClient.getBackend() === "unknown" ? "unknown" : llmClient.getBackend());
+  return {
+    providerId: provider?.id ?? `provider:${model}`,
+    providerName: provider?.name ?? "Unknown Provider",
+    backend,
+    model
+  };
+}
+function addUserMessageAndBroadcast(sessionManager, sessionId, message, broadcastFn) {
+  const userMessage = sessionManager.addMessage(sessionId, {
+    role: "user",
+    content: message.content,
+    ...message.attachments ? { attachments: message.attachments } : {},
+    ...message.messageKind ? { messageKind: message.messageKind } : {}
+  });
+  broadcastFn(sessionId, createChatMessageMessage(userMessage));
+  return userMessage;
+}
+function processQueueAndRestartTurn(sessionManager, sessionId, drainFn, queueMode, broadcastFn, activeAgents2, startTurnFn, queueMessageFn) {
+  const messages = drainFn(sessionId);
+  const next = messages[0];
+  if (!next) return false;
+  for (const remaining of messages.slice(1)) {
+    if (queueMessageFn) {
+      queueMessageFn(
+        sessionId,
+        queueMode,
+        remaining.content,
+        remaining.attachments,
+        remaining.messageKind
+      );
+    } else {
+      sessionManager.queueMessage(sessionId, queueMode, remaining.content, remaining.attachments);
+    }
+  }
+  broadcastFn(sessionId, createQueueStateMessage(sessionManager.getQueueState(sessionId)));
+  addUserMessageAndBroadcast(
+    sessionManager,
+    sessionId,
+    {
+      content: next.content,
+      ...next.attachments ? { attachments: next.attachments } : {},
+      ...next.messageKind ? { messageKind: next.messageKind } : {}
+    },
+    broadcastFn
+  );
+  const newController = new AbortController();
+  activeAgents2.set(sessionId, newController);
+  startTurnFn(sessionId, newController);
+  return true;
+}
+var activeAgents = /* @__PURE__ */ new Map();
+var MAX_SEND_QUEUE_SIZE = 1e3;
+function createWebSocketServer(httpServer, config, getLLMClient, getActiveProvider, sessionManager, providerManager) {
+  const wss = new WebSocketServer({ server: httpServer });
+  const clients = /* @__PURE__ */ new Map();
+  moduleClients = clients;
+  const sessionLLMClients = /* @__PURE__ */ new Map();
+  function getSessionLLMClient(sessionId) {
+    const session = sessionManager.getSession(sessionId);
+    if (!session?.providerId || !session?.providerModel || !providerManager) {
+      return getLLMClient();
+    }
+    const cacheKey = `${session.providerId}:${session.providerModel}`;
+    const cached = sessionLLMClients.get(sessionId);
+    if (cached && cached.key === cacheKey) {
+      return cached.client;
+    }
+    const provider = providerManager.getProviders().find((p) => p.id === session.providerId);
+    if (!provider) {
+      logger.warn("Session references deleted provider, falling back to global", {
+        sessionId,
+        providerId: session.providerId
+      });
+      sessionManager.setSessionProvider(sessionId, null, null);
+      sessionLLMClients.delete(sessionId);
+      return getLLMClient();
+    }
+    const modelConfig = provider.models.find((m) => m.id === session.providerModel);
+    const reasoningEffort = modelConfig?.thinkingEnabled && modelConfig?.thinkingLevel ? modelConfig.thinkingLevel : void 0;
+    const baseUrl = ensureVersionPrefix(provider.url);
+    const sessionConfig = {
+      ...config,
+      llm: {
+        ...config.llm,
+        baseUrl,
+        model: session.providerModel,
+        ...provider.apiKey && { apiKey: provider.apiKey },
+        ...provider.thinkingField && { thinkingField: provider.thinkingField },
+        ...reasoningEffort && { reasoningEffort }
+      }
+    };
+    const client = createLLMClient(sessionConfig);
+    if (provider.backend !== "unknown") {
+      client.setBackend(provider.backend);
+    }
+    client.setModel(session.providerModel);
+    sessionLLMClients.set(sessionId, { key: cacheKey, client });
+    return client;
+  }
+  function getSessionStatsIdentity(sessionId) {
+    const session = sessionManager.getSession(sessionId);
+    if (!session?.providerId || !providerManager) {
+      return resolveStatsIdentity(getLLMClient(), getActiveProvider);
+    }
+    const provider = providerManager.getProviders().find((p) => p.id === session.providerId);
+    const client = getSessionLLMClient(sessionId);
+    return {
+      providerId: provider?.id ?? session.providerId,
+      providerName: provider?.name ?? "Unknown Provider",
+      backend: provider?.backend ?? client.getBackend(),
+      model: client.getModel()
+    };
+  }
+  const isSubscribedToSession = (client, sessionId) => {
+    return client.activeSessionId === sessionId;
+  };
+  const broadcastForSession = (sessionId, msg) => {
+    for (const [clientWs, client] of clients) {
+      if (isSubscribedToSession(client, sessionId) && clientWs.readyState === WebSocket2.OPEN) {
+        clientWs.send(serializeServerMessage({ ...msg, sessionId }));
+      }
+    }
+  };
+  function enqueueSend(client, data, seq) {
+    if (client.sendQueue.length >= MAX_SEND_QUEUE_SIZE) {
+      logger.warn("WebSocket send queue full, dropping message", {
+        queueSize: client.sendQueue.length,
+        sessionId: client.activeSessionId
+      });
+      return;
+    }
+    client.sendQueue.push({ data, seq });
+    processSendQueue(client);
+  }
+  moduleEnqueueSend = enqueueSend;
+  function processSendQueue(client) {
+    if (client.isSending || client.sendQueue.length === 0) {
+      return;
+    }
+    client.isSending = true;
+    const item = client.sendQueue.shift();
+    if (client.ws.readyState === WebSocket2.OPEN) {
+      client.ws.send(item.data, (err) => {
+        if (err) {
+          logger.debug("WebSocket send error", { error: err });
+        }
+        client.isSending = false;
+        client.lastSentSeq = item.seq;
+        processSendQueue(client);
+      });
+    } else {
+      client.isSending = false;
+      processSendQueue(client);
+    }
+  }
+  const llmForSession = (sessionId) => getSessionLLMClient?.(sessionId) ?? getLLMClient();
+  const statsForSession = (sessionId) => getSessionStatsIdentity?.(sessionId) ?? resolveStatsIdentity(getLLMClient(), getActiveProvider);
+  function cleanupAfterTurn(sessionId, controller, sendFn, setRunningOnEarlyReturn) {
+    if (activeAgents.get(sessionId) !== controller) {
+      return;
+    }
+    activeAgents.delete(sessionId);
+    const processed = processQueueAndRestartTurn(
+      sessionManager,
+      sessionId,
+      (sid) => sessionManager.drainAsapMessages(sid),
+      "asap",
+      sendFn,
+      activeAgents,
+      startTurnWithCompletionChain,
+      (sid, mode, content, attachments, messageKind) => sessionManager.queueMessage(sid, mode, content, attachments, messageKind)
+    );
+    if (processed) {
+      if (setRunningOnEarlyReturn) sessionManager.setRunning(sessionId, false);
+      return;
+    }
+    const processedCompletion = processQueueAndRestartTurn(
+      sessionManager,
+      sessionId,
+      (sid) => sessionManager.drainCompletionMessages(sid),
+      "completion",
+      sendFn,
+      activeAgents,
+      startTurnWithCompletionChain
+    );
+    if (processedCompletion) {
+      if (setRunningOnEarlyReturn) sessionManager.setRunning(sessionId, false);
+      return;
+    }
+    sessionManager.clearMessageQueue(sessionId);
+    const contextState = sessionManager.getContextState(sessionId);
+    sendFn(sessionId, createContextStateMessage(contextState));
+  }
+  function startTurnWithCompletionChain(sessionId, controller) {
+    runChatTurn({
+      sessionManager,
+      sessionId,
+      llmClient: llmForSession(sessionId),
+      statsIdentity: statsForSession(sessionId),
+      signal: controller.signal,
+      onMessage: (msg) => broadcastForSession(sessionId, msg)
+    }).catch((error) => {
+      if (error instanceof Error && error.message === "Aborted") {
+        return;
+      }
+      logger.error("Chat turn error", { error });
+    }).finally(() => {
+      cleanupAfterTurn(sessionId, controller, broadcastForSession, false);
+    });
+  }
+  const broadcastAll = (msg) => {
+    const serialized = serializeServerMessage(msg);
+    for (const [clientWs, client] of clients) {
+      if (clientWs.readyState === WebSocket2.OPEN) {
+        const seq = client.lastSentSeq + 1;
+        enqueueSend(client, serialized, seq);
+      }
+    }
+  };
+  devServerManager.onOutput((workdir, chunk) => {
+    broadcastAll(
+      createServerMessage("devServer.output", {
+        workdir,
+        stream: chunk.stream,
+        content: chunk.content
+      })
+    );
+  });
+  devServerManager.onStateChange((workdir, state, errorMessage) => {
+    broadcastAll(
+      createServerMessage("devServer.state", {
+        workdir,
+        state,
+        errorMessage
+      })
+    );
+  });
+  onProcessEvent((_processId, msg) => {
+    const sessionId = msg.sessionId;
+    if (!sessionId) return;
+    for (const [clientWs, client] of clients) {
+      if (client.activeSessionId === sessionId) {
+        if (clientWs.readyState === WebSocket2.OPEN) {
+          const seq = client.lastSentSeq + 1;
+          enqueueSend(client, serializeServerMessage(msg), seq);
+        }
+      }
+    }
+  });
+  wss.on("connection", async (ws, req) => {
+    const url = new URL(req.url || "/", `http://${req.headers.host}`);
+    const token = url.searchParams.get("token");
+    const authConfig = getAuthConfig();
+    if (authConfig?.strategy === "network" && authConfig.encryptedPassword) {
+      if (!token || !await isValidToken(token)) {
+        setTimeout(() => {
+          ws.close(4e3, "Unauthorized");
+        }, 100);
+        return;
+      }
+    }
+    logger.debug("WebSocket client connected");
+    clients.set(ws, {
+      ws,
+      activeSessionId: null,
+      activeWorkdir: null,
+      globalSubscription: null,
+      sendQueue: [],
+      isSending: false,
+      lastSentSeq: 0
+    });
+    const eventStore = getEventStore();
+    const { iterator: globalIterator, unsubscribe: globalUnsubscribe } = eventStore.subscribeAll();
+    clients.get(ws).globalSubscription = globalUnsubscribe;
+    (async () => {
+      try {
+        for await (const storedEvent of globalIterator) {
+          if (ws.readyState !== WebSocket2.OPEN) break;
+          const serverMsg = storedEventToServerMessage(storedEvent);
+          if (serverMsg) {
+            const client = clients.get(ws);
+            enqueueSend(
+              client,
+              serializeServerMessage({ ...serverMsg, seq: storedEvent.seq, sessionId: storedEvent.sessionId }),
+              storedEvent.seq
+            );
+          }
+        }
+      } catch (error) {
+        logger.debug("Global event subscription ended", { error });
+      }
+    })();
+    ws.on("message", async (data) => {
+      const message = parseClientMessage(data.toString());
+      if (!message) {
+        const client2 = clients.get(ws);
+        const seq = client2.lastSentSeq + 1;
+        enqueueSend(
+          client2,
+          serializeServerMessage(createErrorMessage("INVALID_MESSAGE", "Invalid message format")),
+          seq
+        );
+        return;
+      }
+      if (message.type.startsWith("terminal.")) {
+        handleTerminalMessage(ws, message);
+        return;
+      }
+      const client = clients.get(ws);
+      try {
+        await handleClientMessage(
+          ws,
+          client,
+          message,
+          getLLMClient,
+          getActiveProvider,
+          sessionManager,
+          broadcastForSession,
+          providerManager,
+          getSessionLLMClient,
+          getSessionStatsIdentity,
+          llmForSession,
+          statsForSession,
+          startTurnWithCompletionChain,
+          cleanupAfterTurn,
+          enqueueSend
+        );
+      } catch (error) {
+        logger.error("Error handling client message", { error, type: message.type });
+        const client2 = clients.get(ws);
+        const seq = client2.lastSentSeq + 1;
+        enqueueSend(
+          client2,
+          serializeServerMessage(
+            createErrorMessage("INTERNAL_ERROR", error instanceof Error ? error.message : "Unknown error", message.id)
+          ),
+          seq
+        );
+      }
+    });
+    ws.on("close", () => {
+      logger.debug("WebSocket client disconnected");
+      const client = clients.get(ws);
+      const disconnectedWorkdir = client?.activeWorkdir ?? null;
+      if (client?.globalSubscription) {
+        client.globalSubscription();
+      }
+      unsubscribeAllFromTerminal(ws);
+      clients.delete(ws);
+      if (disconnectedWorkdir) {
+        const hasRemaining = [...clients.values()].some((c) => c.activeWorkdir === disconnectedWorkdir);
+        if (!hasRemaining) {
+          moduleStopGitPolling(disconnectedWorkdir);
+        }
+      }
+    });
+    ws.on("error", (error) => {
+      logger.error("WebSocket error", { error });
+    });
+  });
+  return {
+    wss,
+    abortSession: (sessionId) => {
+      const controller = activeAgents.get(sessionId);
+      if (controller) {
+        activeAgents.delete(sessionId);
+        controller.abort();
+        return true;
+      }
+      return false;
+    },
+    close: (cb) => wss.close(cb),
+    broadcastForSession
+  };
+}
+async function handleClientMessage(ws, client, message, _getLLMClient, _getActiveProvider, sessionManager, _broadcastForSession, _providerManager, _getSessionLLMClient, _getSessionStatsIdentity, llmForSession, statsForSession, _startTurnWithCompletionChain, cleanupAfterTurn, enqueueSendFn) {
+  const send = (msg) => {
+    if (ws.readyState === WebSocket2.OPEN) {
+      const seq = client.lastSentSeq + 1;
+      enqueueSendFn(client, serializeServerMessage(msg), seq);
+    }
+  };
+  const sendForSession = (sessionId, msg) => {
+    send({ ...msg, sessionId });
+  };
+  const ensureEventStoreSubscription = (_sessionId) => {
+  };
+  switch (message.type) {
+    // =========================================================================
+    // DEPRECATED: All CRUD operations moved to REST API
+    // If you see this error, update your code to use REST endpoints instead.
+    // See docs/REST-API.md for details.
+    // =========================================================================
+    case "project.create":
+    case "project.create-with-dir":
+    case "project.list":
+    case "project.load":
+    case "project.update":
+    case "project.delete":
+    case "settings.get":
+    case "settings.set":
+    case "session.create":
+    case "session.list":
+    case "session.delete":
+    case "session.deleteAll":
+    case "session.setProvider":
+      send(
+        createErrorMessage(
+          "DEPRECATED_MESSAGE_TYPE",
+          `${message.type} removed. Use REST API instead. See docs/REST-API.md`,
+          message.id
+        )
+      );
+      return;
+    // =========================================================================
+    // Session Load - Sets active session for event routing
+    // Note: Data loading is done via REST API: GET /api/sessions/:id
+    // This WebSocket message is ONLY to tell the server which session is active
+    // so it can route real-time events correctly.
+    // =========================================================================
+    case "session.load": {
+      if (!isSessionLoadPayload(message.payload)) {
+        send(createErrorMessage("INVALID_PAYLOAD", "Invalid session.load payload", message.id));
+        return;
+      }
+      const session = sessionManager.getSession(message.payload.sessionId);
+      if (!session) {
+        send(createErrorMessage("NOT_FOUND", "Session not found", message.id));
+        return;
+      }
+      client.activeSessionId = session.id;
+      client.activeWorkdir = session.workdir;
+      if (session.workdir) {
+        const branch = await moduleGitBranch(session.workdir);
+        const { files } = await moduleGitDiff(session.workdir);
+        const msg = createGitStatusMessage(branch, files);
+        send(msg);
+        if (branch) moduleStartGitPolling(session.workdir);
+      }
+      ensureEventStoreSubscription(session.id);
+      send({ type: "ack", payload: { sessionId: session.id }, id: message.id });
+      const sendContextState = () => {
+        const contextState = sessionManager.getContextState(session.id);
+        send(createContextStateMessage(contextState));
+      };
+      sendContextState();
+      const cachedHash = sessionManager.getCachedPrompt(session.id)?.hash;
+      if (cachedHash) {
+        ;
+        (async () => {
+          try {
+            const { content: instructionContent } = await getAllInstructions(session.workdir, session.projectId);
+            const runtimeConfig = getRuntimeConfig();
+            const configDir = getGlobalConfigDir(runtimeConfig.mode ?? "production");
+            const skills = await getEnabledSkillMetadata(configDir, runtimeConfig.workdir);
+            const dynamicInputs = JSON.stringify({
+              instructions: instructionContent,
+              skills: skills.map((s) => s.id).sort()
+            });
+            const currentHash = createHash2("sha256").update(dynamicInputs).digest("hex");
+            if (currentHash !== cachedHash) {
+              sessionManager.setDynamicContextChanged(session.id, true);
+              sendContextState();
+            }
+          } catch {
+          }
+        })();
+      }
+      break;
+    }
+    // =========================================================================
+    // Context Management
+    // =========================================================================
+    case "context.compact": {
+      if (!client.activeSessionId) {
+        send(createErrorMessage("NO_SESSION", "No active session", message.id));
+        return;
+      }
+      const session = sessionManager.requireSession(client.activeSessionId);
+      const sessionId = client.activeSessionId;
+      if (session.isRunning) {
+        send(createErrorMessage("SESSION_RUNNING", "Cannot compact while session is running", message.id));
+        return;
+      }
+      send({ type: "ack", payload: {}, id: message.id });
+      appendCompactionPrompt(sessionId, (event) => getEventStore().append(sessionId, event));
+      runChatTurn({
+        sessionManager,
+        sessionId,
+        llmClient: llmForSession(sessionId),
+        statsIdentity: statsForSession(sessionId),
+        onMessage: (msg) => _broadcastForSession(sessionId, msg),
+        initialCompacting: true
+      }).then(() => {
+        const newContextState = sessionManager.getContextState(sessionId);
+        sendForSession(sessionId, createContextStateMessage(newContextState));
+      }).catch((error) => {
+        if (error instanceof Error && error.message === "Aborted") return;
+        logger.error("Compaction failed", { error, sessionId });
+        sendForSession(
+          sessionId,
+          createChatErrorMessage(
+            `Compaction failed: ${error instanceof Error ? error.message : "Unknown error"}`,
+            true
+          )
+        );
+      }).finally(() => {
+        sessionManager.setRunning(sessionId, false);
+        sendForSession(sessionId, createSessionRunningMessage(false));
+      });
+      break;
+    }
+    case "context.checkDynamic": {
+      if (!client.activeSessionId) {
+        send(createErrorMessage("NO_SESSION", "No active session", message.id));
+        return;
+      }
+      const sessionId = client.activeSessionId;
+      const session = sessionManager.requireSession(sessionId);
+      (async () => {
+        try {
+          const { content: instructionContent } = await getAllInstructions(session.workdir, session.projectId);
+          const runtimeConfig = getRuntimeConfig();
+          const configDir = getGlobalConfigDir(runtimeConfig.mode ?? "production");
+          const skills = await getEnabledSkillMetadata(configDir, runtimeConfig.workdir);
+          const mcpTools = _mcpManager ? _mcpManager.getToolDefinitions() : [];
+          const toolFingerprint = mcpTools.map(
+            (t) => `${t.function.name}:${JSON.stringify(t.function.parameters)}`
+          ).sort().join("|");
+          const currentHash = computeDynamicContextHash(instructionContent, skills, toolFingerprint);
+          const cachedHash = sessionManager.getCachedPrompt(sessionId)?.hash;
+          if (cachedHash) {
+            if (currentHash !== cachedHash) {
+              if (!sessionManager.getDynamicContextChanged(sessionId)) {
+                sessionManager.setDynamicContextChanged(sessionId, true);
+                const newContextState = sessionManager.getContextState(sessionId);
+                sendForSession(sessionId, createContextStateMessage(newContextState));
+              }
+            } else if (sessionManager.getDynamicContextChanged(sessionId)) {
+              sessionManager.setDynamicContextChanged(sessionId, false);
+              const newContextState = sessionManager.getContextState(sessionId);
+              sendForSession(sessionId, createContextStateMessage(newContextState));
+            }
+          }
+          send({ type: "ack", payload: {}, id: message.id });
+        } catch (error) {
+          logger.error("Failed to check dynamic context", { error, sessionId });
+          send({ type: "ack", payload: {}, id: message.id });
+        }
+      })();
+      break;
+    }
+    case "context.applyDynamic": {
+      if (!client.activeSessionId) {
+        send(createErrorMessage("NO_SESSION", "No active session", message.id));
+        return;
+      }
+      const sessionId = client.activeSessionId;
+      const session = sessionManager.requireSession(sessionId);
+      if (session.isRunning) {
+        send(createErrorMessage("SESSION_RUNNING", "Cannot apply dynamic context while session is running", message.id));
+        return;
+      }
+      ;
+      (async () => {
+        try {
+          const { content: instructionContent } = await getAllInstructions(session.workdir, session.projectId);
+          const runtimeConfig = getRuntimeConfig();
+          const configDir = getGlobalConfigDir(runtimeConfig.mode ?? "production");
+          const skills = await getEnabledSkillMetadata(configDir, runtimeConfig.workdir);
+          const mcpTools = _mcpManager ? _mcpManager.getToolDefinitions() : [];
+          const toolFingerprint = mcpTools.map(
+            (t) => `${t.function.name}:${JSON.stringify(t.function.parameters)}`
+          ).sort().join("|");
+          const dynamicHash = computeDynamicContextHash(instructionContent, skills, toolFingerprint);
+          const allAgents = await loadAllAgentsDefault();
+          const subAgentDefs = getSubAgents(allAgents);
+          const systemPrompt = buildTopLevelSystemPrompt(
+            session.workdir,
+            instructionContent || void 0,
+            skills,
+            subAgentDefs
+          );
+          sessionManager.setCachedPrompt(sessionId, systemPrompt, mcpTools, dynamicHash);
+          sessionManager.setDynamicContextChanged(sessionId, false);
+          const newContextState = sessionManager.getContextState(sessionId);
+          sendForSession(sessionId, createContextStateMessage(newContextState));
+          send({ type: "ack", payload: {}, id: message.id });
+        } catch (error) {
+          logger.error("Failed to apply dynamic context", { error, sessionId });
+          sendForSession(
+            sessionId,
+            createChatErrorMessage(
+              `Failed to apply dynamic context: ${error instanceof Error ? error.message : "Unknown error"}`,
+              true
+            )
+          );
+          send({ type: "ack", payload: {}, id: message.id });
+        }
+      })();
+      break;
+    }
+    // =========================================================================
+    // Runner (Auto-Loop)
+    // =========================================================================
+    case "runner.launch": {
+      if (!client.activeSessionId) {
+        send(createErrorMessage("NO_SESSION", "No active session", message.id));
+        return;
+      }
+      const session = sessionManager.requireSession(client.activeSessionId);
+      if (session.isRunning) {
+        const launchPayload2 = message.payload;
+        const content = launchPayload2?.content ?? "";
+        const attachments = launchPayload2?.attachments;
+        const workflowId = launchPayload2?.workflowId;
+        let fullContent = content;
+        if (workflowId) {
+          const workflowInfo = `// Workflow: ${workflowId}`;
+          fullContent = content ? `${workflowInfo}
+
+${content}` : workflowInfo;
+        }
+        sessionManager.queueMessage(client.activeSessionId, "asap", fullContent, attachments, "workflow-launch");
+        const queueState = sessionManager.getQueueState(client.activeSessionId);
+        send({
+          type: "queue.state",
+          payload: { success: true, queueState },
+          id: message.id
+        });
+        return;
+      }
+      const launchPayloadEarly = message.payload;
+      const pendingCriteria = session.criteria.filter((c) => c.status.type !== "passed");
+      if (!launchPayloadEarly?.workflowId && pendingCriteria.length === 0) {
+        send(createErrorMessage("NO_WORK", "No pending criteria to work on", message.id));
+        return;
+      }
+      const sessionId = client.activeSessionId;
+      if (session.phase === "blocked") {
+        logger.info("User launched runner - resetting blocked state", { sessionId });
+        sessionManager.setPhase(sessionId, "build");
+      }
+      const launchPayload = message.payload;
+      const launchAttachments = launchPayload?.attachments;
+      const hasUserContent = launchPayload?.content && typeof launchPayload.content === "string" && launchPayload.content.trim();
+      const hasUserAttachments = launchAttachments && launchAttachments.length > 0;
+      const hasUserMessage = hasUserContent || hasUserAttachments;
+      sessionManager.setRunning(sessionId, true);
+      sendForSession(sessionId, createSessionRunningMessage(true));
+      const controller = new AbortController();
+      const existingController = activeAgents.get(sessionId);
+      if (existingController) {
+        logger.warn("Aborting existing agent before starting new one", { sessionId });
+        existingController.abort();
+      }
+      activeAgents.set(sessionId, controller);
+      send({ type: "ack", payload: {}, id: message.id });
+      ensureEventStoreSubscription(sessionId);
+      logger.info("Runner launching", { sessionId, pendingCriteria: pendingCriteria.length });
+      runOrchestrator({
+        sessionManager,
+        sessionId,
+        llmClient: llmForSession(sessionId),
+        statsIdentity: statsForSession(sessionId),
+        injectWorkflowKickoff: !hasUserMessage,
+        ...launchPayload?.workflowId ? { workflowId: launchPayload.workflowId } : {},
+        ...launchPayload?.subGroup ? { subGroup: launchPayload.subGroup } : {},
+        ...hasUserMessage ? {
+          userMessage: {
+            content: hasUserContent ? launchPayload.content : "",
+            ...hasUserAttachments ? { attachments: launchAttachments } : {}
+          }
+        } : {},
+        signal: controller.signal,
+        onMessage: (msg) => sendForSession(sessionId, msg)
+        // For path confirmation dialogs
+      }).catch((error) => {
+        if (error instanceof Error && error.message === "Aborted") {
+          return;
+        }
+        logger.error("Runner error", { error, sessionId });
+      }).finally(() => {
+        sessionManager.setRunning(sessionId, false);
+        sendForSession(sessionId, createSessionRunningMessage(false));
+        cleanupAfterTurn(sessionId, controller, sendForSession, true);
+      });
+      break;
+    }
+    // =========================================================================
+    // Path Confirmation
+    // =========================================================================
+    case "path.confirm": {
+      send(
+        createErrorMessage(
+          "DEPRECATED",
+          "path.confirm removed. Use REST API: POST /api/sessions/:id/confirm-path",
+          message.id
+        )
+      );
+      break;
+    }
+    // =========================================================================
+    // Ask User
+    // =========================================================================
+    case "ask.answer": {
+      if (!client.activeSessionId) {
+        send(createErrorMessage("NO_SESSION", "No active session", message.id));
+        return;
+      }
+      if (!isAskAnswerPayload(message.payload)) {
+        send(createErrorMessage("INVALID_PAYLOAD", "Invalid ask.answer payload", message.id));
+        return;
+      }
+      const { callId, answer, skip } = message.payload;
+      const found = provideAnswer(callId, answer, skip);
+      if (!found) {
+        send(createErrorMessage("NOT_FOUND", "No pending question with that ID", message.id));
+        return;
+      }
+      logger.debug("Ask user answer received", {
+        sessionId: client.activeSessionId,
+        callId,
+        answerLength: answer.length
+      });
+      send({ type: "ack", payload: {}, id: message.id });
+      break;
+    }
+    default: {
+      send(createErrorMessage("UNKNOWN_MESSAGE", `Unknown message type: ${message.type}`, message.id));
+    }
+  }
+}
+
+export {
+  terminalManager,
+  loadDefaultWorkflows,
+  loadUserWorkflows,
+  loadProjectWorkflows,
+  loadAllWorkflows,
+  saveWorkflowToProject,
+  deleteProjectWorkflow,
+  getDefaultWorkflowIds,
+  isDefaultWorkflow,
+  findWorkflowById,
+  workflowExists,
+  saveWorkflow,
+  deleteWorkflow,
+  TEMPLATE_VARIABLES,
+  loadServerAuthConfig,
+  getAuthConfig,
+  requiresAuth,
+  hasPassword,
+  verifyPassword,
+  tokenFromPassword,
+  isValidToken,
+  setMcpManagerForWs,
+  createWebSocketServer
+};
+//# sourceMappingURL=chunk-4W2Z4B5U.js.map