openfox 2.0.76 → 2.0.78

package/dist/{chunk-J7VCI5EX.js → chunk-UMX7MMNW.js}

@@ -21,7 +21,7 @@ import {
   tokenFromPassword,
   verifyPassword,
   workflowExists
-} from "./chunk-OMWVB2XC.js";
+} from "./chunk-DI4SIPFT.js";
 import {
   agentExists,
   createToolRegistry,
@@ -66,7 +66,7 @@ import {
   setSkillEnabled,
   skillExists,
   updateOwnedSkill
-} from "./chunk-D6CI2B7B.js";
+} from "./chunk-SGBXBP3S.js";
 import {
   createMcpTools
 } from "./chunk-NWO6GRYE.js";
@@ -74,14 +74,18 @@ import {
   deleteWorkspace,
   ensureWorkspace,
   getCommitsBehind,
+  getDefaultBranch,
   getGitBranch,
+  getGlobalDataDir,
   getWorkspacesDir,
   loadWorkspaceConfig,
+  resolveAndValidateSourceBranch,
   runGit,
   saveWorkspaceConfig,
+  validateRef,
   validateWorkspaceName,
   workspaceExists
-} from "./chunk-MF3UW36X.js";
+} from "./chunk-37WF2Z3T.js";
 import {
   EventEmitter
 } from "./chunk-EU3WWTFH.js";
@@ -89,25 +93,23 @@ import {
   ALWAYS_ALLOWED,
   ALWAYS_ALLOWED_FOR_SUBAGENTS,
   TOP_LEVEL_ONLY_TOOLS
-} from "./chunk-7772ENZN.js";
-import {
-  getProject
-} from "./chunk-LXFLRM7M.js";
+} from "./chunk-EHVDAVYG.js";
 import {
   getPathSeparator,
   isAbsolutePath
-} from "./chunk-4QHDQP2N.js";
+} from "./chunk-MTUYDBSL.js";
 import {
   deleteSetting,
   getSetting,
   setSetting
-} from "./chunk-YMFCFMMB.js";
+} from "./chunk-AFJLY43Z.js";
+import {
+  getProject
+} from "./chunk-6AE3JPDJ.js";
 import {
   VERSION
-} from "./chunk-KQEVAO2Q.js";
+} from "./chunk-64TKWWNF.js";
 import {
-  createSession,
-  deleteSession,
   emitAssistantMessageStart,
   emitContextState,
   emitCriteriaSet,
@@ -119,32 +121,37 @@ import {
   emitSessionInitialized,
   emitUserMessage,
   getEventStore,
-  getSession,
-  getSessionCachedPrompt,
   getSessionState,
   initEventStore,
+  setRuntimeConfig
+} from "./chunk-M7EFXRDS.js";
+import {
+  createSession,
+  deleteSession,
+  getSession,
+  getSessionCachedPrompt,
   listSessions,
   listSessionsByProject,
-  setRuntimeConfig,
+  updateSessionBranch,
   updateSessionCachedPrompt,
   updateSessionDangerLevel,
   updateSessionMetadata,
   updateSessionProvider,
   updateSessionRunning,
   updateSessionWorkdir
-} from "./chunk-NGJ5XJ7D.js";
+} from "./chunk-AANVMTYU.js";
 import {
   initDatabase
-} from "./chunk-7QXRQ5ZL.js";
+} from "./chunk-RGUUZD5B.js";
 import {
   createContextStateMessage
-} from "./chunk-O3NUNU4H.js";
+} from "./chunk-SJTG56CH.js";
 import {
   createProviderManager,
   detectModel,
   getLlmStatus,
   parseDefaultModelSelection
-} from "./chunk-OCVRIPQP.js";
+} from "./chunk-CJDYSUU5.js";
 import {
   getModelProfile
 } from "./chunk-V4IE7HJY.js";
@@ -163,7 +170,7 @@ import {
 } from "./chunk-K44MW7JJ.js";
 import {
   createServerMessage
-} from "./chunk-5GOOSZX7.js";
+} from "./chunk-X6BXZFO7.js";
 import {
   getGlobalConfigDir
 } from "./chunk-CQGTEGKL.js";
@@ -173,7 +180,7 @@ import express from "express";
 import cors from "cors";
 import { createServer as createHttpServer } from "http";
 import { fileURLToPath as fileURLToPath7 } from "url";
-import { dirname as dirname8, resolve as resolve7, join as join9 } from "path";
+import { dirname as dirname8, resolve as resolve8, join as join10 } from "path";
 import { readFile as readFile4 } from "fs/promises";
 import { createServer as createViteServer } from "vite";
 
@@ -1490,6 +1497,26 @@ var McpManager = class {
         throw new Error(`Unsupported transport: ${entry.config.transport}`);
       }
       if (!transport) throw new Error("Failed to create transport");
+      let sdkOnMessage = void 0;
+      Object.defineProperty(transport, "onmessage", {
+        get() {
+          return sdkOnMessage;
+        },
+        set(fn) {
+          sdkOnMessage = (message) => {
+            const msg = message;
+            if (msg && msg.result && Array.isArray(msg.result.tools)) {
+              for (const tool of msg.result.tools) {
+                if (tool && tool.outputSchema) {
+                  delete tool.outputSchema;
+                }
+              }
+            }
+            fn?.(message);
+          };
+        },
+        configurable: true
+      });
       await client.connect(transport);
       const { tools: mcpTools } = await client.listTools();
       const disabledSet = new Set(entry.config.disabledTools ?? []);
@@ -1585,7 +1612,27 @@ var McpManager = class {
     if (!entry) return { success: false, error: `MCP server '${serverName}' not found` };
     if (!entry.client) return { success: false, error: `MCP server '${serverName}' is not connected` };
     try {
-      const result = await entry.client.callTool({ name: toolName, arguments: args });
+      const timeout = entry.config.timeout;
+      const requestOptions = timeout !== void 0 && timeout > 0 ? { timeout: timeout * 1e3 } : void 0;
+      let result;
+      if (timeout !== void 0 && timeout > 0) {
+        let timer;
+        const timeoutPromise = new Promise((_, reject) => {
+          timer = setTimeout(() => {
+            reject(new Error(`MCP tool call timed out after ${timeout} seconds`));
+          }, timeout * 1e3);
+        });
+        try {
+          result = await Promise.race([
+            entry.client.callTool({ name: toolName, arguments: args }, void 0, requestOptions),
+            timeoutPromise
+          ]);
+        } finally {
+          if (timer) clearTimeout(timer);
+        }
+      } else {
+        result = await entry.client.callTool({ name: toolName, arguments: args });
+      }
       const content = result.content;
       const textParts = content.filter((c) => c.type === "text").map((c) => c.text);
       return { success: !result.isError, output: textParts.join("\n") };
@@ -1731,8 +1778,8 @@ var LspServer = class {
         windowsHide: true,
         shell: needsShell
       });
-      await new Promise((resolve8, reject) => {
-        this.process.once("spawn", resolve8);
+      await new Promise((resolve9, reject) => {
+        this.process.once("spawn", resolve9);
         this.process.once("error", reject);
       });
       if (!this.process.stdin || !this.process.stdout) {
@@ -1952,19 +1999,19 @@ var LspServer = class {
    */
   async getDiagnosticsWithWait(path, timeoutMs = DIAGNOSTIC_WAIT_MS) {
     if (this.openDocuments.has(path)) {
-      return new Promise((resolve8) => {
+      return new Promise((resolve9) => {
         const existing = this.diagnostics.get(path);
         if (existing !== void 0) {
           setTimeout(() => {
-            resolve8(this.diagnostics.get(path) ?? []);
+            resolve9(this.diagnostics.get(path) ?? []);
           }, 100);
           return;
         }
         const timeout = setTimeout(() => {
           this.pendingDiagnostics.delete(path);
-          resolve8(this.diagnostics.get(path) ?? []);
+          resolve9(this.diagnostics.get(path) ?? []);
         }, timeoutMs);
-        this.pendingDiagnostics.set(path, { resolve: resolve8, timeout });
+        this.pendingDiagnostics.set(path, { resolve: resolve9, timeout });
       });
     }
     return this.diagnostics.get(path) ?? [];
@@ -2583,6 +2630,35 @@ var SessionManager = class {
   getCurrentModelContext() {
     return this.providerManager.getCurrentModelContext();
   }
+  /**
+   * Get the effective working directory for a session.
+   * Uses workspace path when active, otherwise the project workdir.
+   */
+  getEffectiveWorkdir(sessionId) {
+    const session = this.requireSession(sessionId);
+    return session.workspace ?? session.workdir;
+  }
+  /**
+   * Return (effectiveWorkdir, actualBranch) for a session.
+   */
+  async getActualBranchPair(sessionId) {
+    const effectiveWorkdir = this.getEffectiveWorkdir(sessionId);
+    const branch = await getGitBranch(effectiveWorkdir);
+    return { workdir: effectiveWorkdir, branch };
+  }
+  /**
+   * Check that the session's persisted branch matches the actual branch on disk.
+   * If they differ (and persisted branch exists), returns a warning message.
+   */
+  async checkBranchConsistency(sessionId) {
+    const session = this.getSession(sessionId);
+    if (!session?.branch) return null;
+    const actualBranch = await getGitBranch(session.workspace ?? session.workdir);
+    if (actualBranch && actualBranch !== session.branch) {
+      return `Branch mismatch: session expects "${session.branch}" but workspace is on "${actualBranch}". The workspace branch was changed externally.`;
+    }
+    return null;
+  }
   // ============================================================================
   // Session Lifecycle
   // ============================================================================
@@ -2606,6 +2682,20 @@ var SessionManager = class {
     const contextWindowId = crypto.randomUUID();
     emitSessionInitialized(dbSession.id, projectId, effectiveWorkdir, contextWindowId, sessionTitle);
     const session = this.buildSessionFromDb(dbSession);
+    getGitBranch(effectiveWorkdir).then((branch) => {
+      if (branch) {
+        updateSessionBranch(session.id, branch);
+        const updatedDb = getSession(session.id);
+        if (updatedDb) {
+          this.emit({ type: "session_updated", session: this.buildSessionFromDb(updatedDb) });
+        }
+      }
+    }).catch((err) => {
+      logger.error("Failed to persist initial branch for session", {
+        sessionId: session.id,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    });
     this.emit({ type: "session_created", session });
     return session;
   }
@@ -2699,6 +2789,16 @@ var SessionManager = class {
     this.emit({ type: "session_updated", session: updatedSession });
     return updatedSession;
   }
+  /**
+   * Emit session_updated for the given session.
+   * Used by REST handlers after updating sibling session branches.
+   */
+  emitBranchChange(sessionId) {
+    const session = this.getSession(sessionId);
+    if (session) {
+      this.emit({ type: "session_updated", session });
+    }
+  }
   /**
    * Change session phase. Emits phase.changed event.
    */
@@ -3209,6 +3309,24 @@ var SessionManager = class {
     const effectiveWorkdir = session.workspace ?? session.workdir;
     return getLspManager(sessionId, effectiveWorkdir);
   }
+  async applyBranchIfNeeded(projectDir, projectName, workspaceName, branch, sourceBranch) {
+    const wsPath = resolve2(await getWorkspacesDir(projectName, projectDir), workspaceName);
+    const currentBranch = await getGitBranch(wsPath);
+    if (currentBranch !== branch) {
+      try {
+        await validateRef(wsPath, branch);
+        await runGit(wsPath, ["checkout", branch]).catch(async () => {
+          const sb = sourceBranch ?? await getDefaultBranch(projectDir);
+          const validated = sourceBranch ? await resolveAndValidateSourceBranch(wsPath, sourceBranch, projectDir) : sb;
+          await runGit(wsPath, ["checkout", "-b", branch, validated]);
+        });
+      } catch (err) {
+        throw new Error(
+          `Failed to apply branch "${branch}" to workspace "${workspaceName}": ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+  }
   // ============================================================================
   // Workspace Lifecycle
   // ============================================================================
@@ -3218,44 +3336,55 @@ var SessionManager = class {
    * Emits a single type of event — switching is always "opening" a workspace.
    * Switches are serialized per-session to prevent race conditions.
    */
-  async switchWorkspace(sessionId, target, branch) {
-    if (target !== "original") {
-      validateWorkspaceName(target);
-    }
+  async switchWorkspace(sessionId, target, branch, sourceBranch) {
+    if (target !== "original") validateWorkspaceName(target);
     const existingLock = this.switchLocks.get(sessionId);
-    if (existingLock) {
-      await existingLock;
-    }
+    if (existingLock) await existingLock;
     const lockPromise = (async () => {
       const session = this.requireSession(sessionId);
       const project = getProject(session.projectId);
       if (!project) throw new Error(`Project not found: ${session.projectId}`);
-      if (target === "original" && !session.workspace) return session;
-      if (target !== "original" && session.workspace?.split("/").pop() === target) return session;
+      const isBranchChangeOnly = target !== "original" && session.workspace?.split("/").pop() === target && branch !== void 0;
+      if (target === "original" && !session.workspace && !branch) return session;
+      if (target !== "original" && session.workspace?.split("/").pop() === target && !branch) return session;
+      if (isBranchChangeOnly) {
+        const currentBranch = await getGitBranch(session.workspace ?? session.workdir);
+        if (currentBranch === branch) return session;
+      }
       const previousPath = session.workspace;
-      if (previousPath) {
-        try {
-          await devServerManager.stop(previousPath);
-        } catch (err) {
-          logger.error("Error stopping dev server for workspace switch", {
-            sessionId,
-            workspace: previousPath,
-            error: err
+      if (previousPath && !isBranchChangeOnly) {
+        const otherSessionsUsingPath = this.listSessions().filter(
+          (s) => s.id !== sessionId && s.workspace === previousPath
+        );
+        if (otherSessionsUsingPath.length === 0) {
+          try {
+            await devServerManager.stop(previousPath);
+          } catch (err) {
+            logger.error("Error stopping dev server for workspace switch", {
+              sessionId,
+              workspace: previousPath,
+              error: err
+            });
+          }
+        } else {
+          logger.info("Skipping dev server stop \u2014 other sessions still use path", {
+            path: previousPath,
+            otherSessions: otherSessionsUsingPath.map((s) => s.id)
           });
         }
       }
       if (target === "original") {
         updateSessionWorkdir(sessionId, project.workdir, null);
-      } else {
+      } else if (!isBranchChangeOnly) {
         const createLockKey = `${project.name}:${target}`;
         const existingCreateLock = this.workspaceCreationLocks.get(createLockKey);
-        if (existingCreateLock) {
-          await existingCreateLock;
-        }
+        if (existingCreateLock) await existingCreateLock;
         const createLockPromise = (async () => {
-          const exists = await workspaceExists(project.name, target);
+          const exists = await workspaceExists(project.name, target, project.workdir);
           if (!exists) {
-            await ensureWorkspace(project.workdir, target, project.name, branch);
+            await ensureWorkspace(project.workdir, target, project.name, branch, sourceBranch);
+          } else if (branch) {
+            await this.applyBranchIfNeeded(project.workdir, project.name, target, branch, sourceBranch);
           }
         })();
         this.workspaceCreationLocks.set(createLockKey, createLockPromise);
@@ -3264,16 +3393,31 @@ var SessionManager = class {
         } finally {
           this.workspaceCreationLocks.delete(createLockKey);
         }
-        const wsPath = resolve2(getWorkspacesDir(project.name), target);
+        const wsDir = await getWorkspacesDir(project.name, project.workdir);
+        const wsPath = resolve2(wsDir, target);
         updateSessionWorkdir(sessionId, project.workdir, wsPath);
+      } else {
+        await this.applyBranchIfNeeded(project.workdir, project.name, target, branch, sourceBranch);
       }
       try {
         await shutdownLspManager(sessionId);
       } catch (err) {
         logger.error("Error shutting down LSP for workspace switch", { sessionId, error: err });
       }
-      const effectiveWorkdir = target === "original" ? project.workdir : resolve2(getWorkspacesDir(project.name), target);
+      const wsDirForBranch = await getWorkspacesDir(project.name, project.workdir);
+      const effectiveWorkdir = target === "original" ? project.workdir : resolve2(wsDirForBranch, target);
       const actualBranch = await getGitBranch(effectiveWorkdir);
+      if (actualBranch) {
+        updateSessionBranch(sessionId, actualBranch);
+        const otherSessionsOnWorkspace = this.listSessions().filter(
+          (s) => s.id !== sessionId && s.workspace === effectiveWorkdir
+        );
+        for (const other of otherSessionsOnWorkspace) {
+          updateSessionBranch(other.id, actualBranch);
+          const updated2 = this.getSession(other.id);
+          if (updated2) this.emit({ type: "session_updated", session: updated2 });
+        }
+      }
       let stalenessHint = "";
       if (target !== "original" && actualBranch) {
         await runGit(effectiveWorkdir, ["fetch", "origin", "--no-tags", "--quiet"]).catch(() => {
@@ -3310,9 +3454,7 @@ All file and git operations should use this directory.
     })();
     this.switchLocks.set(sessionId, lockPromise);
     lockPromise.finally(() => {
-      if (this.switchLocks.get(sessionId) === lockPromise) {
-        this.switchLocks.delete(sessionId);
-      }
+      if (this.switchLocks.get(sessionId) === lockPromise) this.switchLocks.delete(sessionId);
     });
     return lockPromise;
   }
@@ -3340,12 +3482,13 @@ All file and git operations should use this directory.
     if (currentWsName === target) {
       await this.switchWorkspace(sessionId, "original");
     }
-    const effectivePath = resolve2(getWorkspacesDir(project.name), target);
+    const wsDir = await getWorkspacesDir(project.name, project.workdir);
+    const effectivePath = resolve2(wsDir, target);
     try {
       await devServerManager.stop(effectivePath);
     } catch {
     }
-    await deleteWorkspace(project.name, target);
+    await deleteWorkspace(project.name, target, project.workdir);
     const updated = this.requireSession(sessionId);
     this.emit({ type: "session_updated", session: updated });
     return updated;
@@ -4114,6 +4257,85 @@ function createDevServerRoutes() {
 
 // src/server/routes/workspace-config.ts
 import { Router as Router5 } from "express";
+import { stat as stat2, mkdir as mkdir4, readdir, access as access3 } from "fs/promises";
+import { constants as constants3 } from "fs";
+import { resolve as resolve4, isAbsolute as isAbsolute3, join as join6 } from "path";
+
+// src/shared/workspace.ts
+var BLOCKED_EXACT_PATHS = [
+  "/",
+  "/etc",
+  "/bin",
+  "/sbin",
+  "/lib",
+  "/lib64",
+  "/usr",
+  "/var",
+  "/opt",
+  "/root",
+  "/run",
+  "/tmp",
+  "/home",
+  "/mnt",
+  "/media"
+];
+var BLOCKED_VIRTUAL_FS_PREFIXES = ["/proc/", "/sys/", "/dev/", "/boot/", "/etc/", "/lost+found/"];
+function getRootDirBlockReason(path, exactPaths = BLOCKED_EXACT_PATHS, virtualFsPrefixes = BLOCKED_VIRTUAL_FS_PREFIXES) {
+  if (!path) return null;
+  const normalized = path.replace(/\/+$/, "") || "/";
+  if (exactPaths.includes(normalized)) return "exact";
+  for (const prefix of virtualFsPrefixes) {
+    if (normalized.startsWith(prefix)) return "virtual_fs";
+  }
+  return null;
+}
+
+// src/server/routes/workspace-config.ts
+async function isWritable(path) {
+  try {
+    await access3(path, constants3.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveRootDir(rootDir, workdir) {
+  return isAbsolute3(rootDir) ? rootDir : resolve4(workdir, rootDir);
+}
+async function checkDirExists(path) {
+  try {
+    const st = await stat2(path);
+    return st.isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function validatePathWritable(path) {
+  if (await isWritable(path)) return null;
+  return "Workspace root directory exists but is not writable";
+}
+async function findOrphanedWorkspaces(dir) {
+  const results = [];
+  try {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        try {
+          const gitStat = await stat2(join6(dir, entry.name, ".git"));
+          if (gitStat.isDirectory()) {
+            results.push({ name: entry.name });
+          }
+        } catch {
+        }
+      }
+    }
+  } catch (err) {
+    if (err?.code !== "ENOENT") {
+      logger.error("Error scanning for orphaned workspaces", { dir, error: String(err) });
+    }
+  }
+  return results;
+}
 function createWorkspaceConfigRoutes() {
   const router = Router5();
   router.get("/config", async (req, res) => {
@@ -4125,18 +4347,93 @@ function createWorkspaceConfigRoutes() {
   router.post("/config", async (req, res) => {
     const workdir = req.query["workdir"];
     if (!workdir) return res.status(400).json({ error: "workdir required" });
-    const { setup } = req.body;
-    if (!Array.isArray(setup)) {
+    const { setup, rootDir } = req.body;
+    if (!Array.isArray(setup) && typeof rootDir !== "string") {
+      return res.status(400).json({ error: "At least one of setup or rootDir must be provided" });
+    }
+    if (setup !== void 0 && !Array.isArray(setup)) {
       return res.status(400).json({ error: "setup must be an array of strings" });
     }
+    const config3 = {};
+    if (Array.isArray(setup)) {
+      config3.setup = setup;
+    }
+    if (typeof rootDir === "string") {
+      const trimmed = rootDir.trim();
+      if (trimmed) {
+        const resolvedPath = resolveRootDir(trimmed, workdir);
+        const displayPath = resolvedPath.replace(/\/+$/, "") || "/";
+        const blockReason = getRootDirBlockReason(resolvedPath);
+        if (blockReason === "exact") {
+          return res.status(400).json({ error: `Cannot use "${displayPath}" directly as workspace root. Use a subdirectory instead.` });
+        }
+        if (blockReason === "virtual_fs") {
+          return res.status(400).json({ error: `Cannot use paths under "${displayPath}" for workspaces.` });
+        }
+        const dirExists = await checkDirExists(resolvedPath);
+        if (dirExists) {
+          const writableErr = await validatePathWritable(resolvedPath);
+          if (writableErr) return res.status(400).json({ error: writableErr });
+        }
+        config3.rootDir = trimmed;
+      }
+    }
     try {
-      const config3 = { setup };
       await saveWorkspaceConfig(workdir, config3);
       res.json({ config: config3 });
     } catch (err) {
       res.status(500).json({ error: err instanceof Error ? err.message : "Failed to save config" });
     }
   });
+  router.post("/config/validate", async (req, res) => {
+    const { rootDir, workdir, projectName, createIfMissing } = req.body;
+    if (!rootDir || typeof rootDir !== "string") {
+      return res.status(400).json({ error: "rootDir is required" });
+    }
+    if (!workdir || typeof workdir !== "string") {
+      return res.status(400).json({ error: "workdir is required" });
+    }
+    const resolvedPath = resolveRootDir(rootDir, workdir);
+    const displayPath = resolvedPath.replace(/\/+$/, "") || "/";
+    const blockReason = getRootDirBlockReason(resolvedPath);
+    if (blockReason === "exact") {
+      const suggestion = typeof projectName === "string" ? `${displayPath}/${projectName}` : void 0;
+      return res.status(400).json({
+        error: suggestion ? `Cannot use "${displayPath}" directly as workspace root. Use a subdirectory like "${suggestion}" instead.` : `Cannot use "${displayPath}" directly as workspace root. Use a subdirectory instead.`
+      });
+    }
+    if (blockReason === "virtual_fs") {
+      return res.status(400).json({ error: `Cannot use paths under "${displayPath}" for workspaces.` });
+    }
+    let dirExists = await checkDirExists(resolvedPath);
+    if (dirExists) {
+      const writableErr = await validatePathWritable(resolvedPath);
+      if (writableErr) return res.status(400).json({ error: writableErr });
+    }
+    let created = false;
+    if (!dirExists && createIfMissing) {
+      await mkdir4(resolvedPath, { recursive: true });
+      dirExists = true;
+      created = true;
+    }
+    const workspaces = [];
+    try {
+      const currentConfig = await loadWorkspaceConfig(workdir);
+      const previousRootDir = currentConfig?.rootDir ? resolveRootDir(currentConfig.rootDir, workdir) : null;
+      if (previousRootDir && previousRootDir !== resolvedPath) {
+        const orphans = await findOrphanedWorkspaces(previousRootDir);
+        workspaces.push(...orphans);
+      } else if (!previousRootDir && projectName && typeof projectName === "string") {
+        const defaultDir = join6(getGlobalDataDir(), "workspaces", projectName);
+        if (defaultDir !== resolvedPath) {
+          const orphans = await findOrphanedWorkspaces(defaultDir);
+          workspaces.push(...orphans);
+        }
+      }
+    } catch {
+    }
+    res.json({ exists: dirExists, resolvedPath, created, workspaces });
+  });
   return router;
 }
 
@@ -4183,19 +4480,19 @@ function createTerminalRoutes() {
 
 // src/server/routes/directories.ts
 import { Router as Router7 } from "express";
-import { readdir } from "fs/promises";
-import { resolve as resolve4, join as join6, dirname as dirname5, basename as basename2 } from "path";
+import { readdir as readdir2 } from "fs/promises";
+import { resolve as resolve5, join as join7, dirname as dirname5, basename as basename2 } from "path";
 function createDirectoryRoutes() {
   const router = Router7();
   const DEFAULT_BASE_PATH = process.cwd();
   router.get("/", async (req, res) => {
     const path = req.query["path"] || DEFAULT_BASE_PATH;
     try {
-      const resolvedPath = resolve4(path);
-      const entries = await readdir(resolvedPath, { withFileTypes: true });
+      const resolvedPath = resolve5(path);
+      const entries = await readdir2(resolvedPath, { withFileTypes: true });
       const directories = entries.filter((entry) => entry.isDirectory()).map((entry) => ({
         name: entry.name,
-        path: join6(resolvedPath, entry.name)
+        path: join7(resolvedPath, entry.name)
       })).sort((a, b) => a.name.localeCompare(b.name));
       const parent = dirname5(resolvedPath);
       const hasParent = parent !== resolvedPath;
@@ -4349,7 +4646,7 @@ function isDevMode() {
   return process.env["NODE_ENV"] === "development";
 }
 async function getRemote() {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = spawn2("git", ["remote"], {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
@@ -4360,23 +4657,23 @@ async function getRemote() {
     });
     child.on("close", () => {
       const remotes = output.trim().split("\n").map((r) => r.trim()).filter(Boolean);
-      if (remotes.includes("upstream")) resolve8("upstream");
-      else if (remotes.includes("origin")) resolve8("origin");
-      else resolve8("origin");
+      if (remotes.includes("upstream")) resolve9("upstream");
+      else if (remotes.includes("origin")) resolve9("origin");
+      else resolve9("origin");
     });
-    child.on("error", () => resolve8("origin"));
+    child.on("error", () => resolve9("origin"));
   });
 }
 async function getLatestDevelopVersion() {
   const remote = await getRemote();
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const fetchChild = spawn2("git", ["fetch", remote, "develop", "--no-tags"], {
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true
     });
     fetchChild.on("error", (err) => {
       logger.error("[auto-update] Git fetch error", { error: err.message });
-      resolve8("unknown");
+      resolve9("unknown");
     });
     fetchChild.on("close", (code) => {
       if (code !== 0) {
@@ -4392,7 +4689,7 @@ async function getLatestDevelopVersion() {
       });
       tagChild.on("close", (tagCode) => {
         if (tagCode === 0 && tagOutput.trim()) {
-          resolve8(tagOutput.trim());
+          resolve9(tagOutput.trim());
         } else {
           const fallbackChild = spawn2("git", ["describe", "--tags", "--abbrev=0", "develop"], {
             stdio: ["ignore", "pipe", "pipe"],
@@ -4404,18 +4701,18 @@ async function getLatestDevelopVersion() {
           });
           fallbackChild.on("close", (fallbackCode) => {
             if (fallbackCode === 0 && fallbackOutput.trim()) {
-              resolve8(fallbackOutput.trim());
+              resolve9(fallbackOutput.trim());
             } else {
               logger.warn("[auto-update] No tags found on develop branch");
-              resolve8("unknown");
+              resolve9("unknown");
             }
           });
-          fallbackChild.on("error", () => resolve8("unknown"));
+          fallbackChild.on("error", () => resolve9("unknown"));
         }
       });
       tagChild.on("error", (err) => {
         logger.error("[auto-update] Git tag error", { error: err.message });
-        resolve8("unknown");
+        resolve9("unknown");
       });
     });
   });
@@ -4432,7 +4729,7 @@ function createAutoUpdateRoutes(options = {}) {
       return;
     }
     try {
-      const latest = isDev ? await getLatestDevelopVersion() : await new Promise((resolve8, reject) => {
+      const latest = isDev ? await getLatestDevelopVersion() : await new Promise((resolve9, reject) => {
         const win = process.platform === "win32";
         const child = spawn2(win ? "npm view openfox version" : "npm", win ? [] : ["view", "openfox", "version"], {
           stdio: ["ignore", "pipe", "pipe"],
@@ -4445,7 +4742,7 @@ function createAutoUpdateRoutes(options = {}) {
         });
         child.on("close", (code) => {
           if (code === 0) {
-            resolve8(stdout.trim());
+            resolve9(stdout.trim());
           } else {
             reject(new Error(`npm view exited with code ${code}`));
           }
@@ -4460,12 +4757,13 @@ function createAutoUpdateRoutes(options = {}) {
       const latestVersion = latest.replace(/^v/, "");
       const isUpdateAvailable = currentVersion !== latestVersion;
       const now = Date.now();
-      versionCache.data = { current, latest, isUpdateAvailable, isService };
+      versionCache.data = { current, latest: latestVersion, isUpdateAvailable, isService };
       versionCache.timestamp = now;
-      res.json({ current, latest, isUpdateAvailable, isService });
+      res.json({ current, latest: latestVersion, isUpdateAvailable, isService });
     } catch (err) {
       logger.error("[auto-update] Error in version check", { error: err instanceof Error ? err.message : String(err) });
-      res.json({ current, latest: current, isUpdateAvailable: false, isService });
+      const currentVersion = isDev ? current.replace(/-dev$/, "") : current;
+      res.json({ current, latest: currentVersion, isUpdateAvailable: false, isService });
     }
   });
   router.post("/", async (req, res) => {
@@ -4496,9 +4794,9 @@ function createAutoUpdateRoutes(options = {}) {
       const timeout = setTimeout(() => {
         child.kill();
       }, UPDATE_TIMEOUT);
-      const exitCode = await new Promise((resolve8) => {
-        child.on("close", resolve8);
-        child.on("error", () => resolve8(1));
+      const exitCode = await new Promise((resolve9) => {
+        child.on("close", resolve9);
+        child.on("error", () => resolve9(1));
       });
       clearTimeout(timeout);
       if (exitCode === 0) {
@@ -4559,7 +4857,7 @@ function createProviderAuthRoutes(config3, providerManager, registry) {
     try {
       const { challenge, completion } = await adapter.beginLogin({ providerId: provider.id });
       void completion.then(async ({ credentialRef }) => {
-        const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-EUMVEFHU.js");
+        const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-MD74ETY5.js");
         const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
         const updatedConfig = updateProvider(globalConfig, provider.id, { credentialRef, authAdapter: adapter.id });
         await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -4593,7 +4891,7 @@ function createProviderAuthRoutes(config3, providerManager, registry) {
     if (!context) return;
     const { provider, adapter } = context;
     if (provider.credentialRef && adapter) await adapter.logout(provider.credentialRef);
-    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-EUMVEFHU.js");
+    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-MD74ETY5.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = {
       ...globalConfig,
@@ -4670,26 +4968,26 @@ var ProviderRegistry = class {
 };
 
 // src/server/providers/plugins/loader.ts
-import { readdir as readdir2, readFile as readFile2, stat as stat2 } from "fs/promises";
-import { dirname as dirname6, join as join7, resolve as resolve5 } from "path";
+import { readdir as readdir3, readFile as readFile2, stat as stat3 } from "fs/promises";
+import { dirname as dirname6, join as join8, resolve as resolve6 } from "path";
 import { fileURLToPath as fileURLToPath5, pathToFileURL } from "url";
 async function packageDirectories(root) {
   let entries;
   try {
-    entries = await readdir2(root, { withFileTypes: true });
+    entries = await readdir3(root, { withFileTypes: true });
   } catch {
     return [];
   }
   const directories = [];
   for (const entry of entries) {
-    const entryPath = join7(root, entry.name);
-    const isDirectory = entry.isDirectory() || entry.isSymbolicLink() && (await stat2(entryPath).catch(() => void 0))?.isDirectory();
+    const entryPath = join8(root, entry.name);
+    const isDirectory = entry.isDirectory() || entry.isSymbolicLink() && (await stat3(entryPath).catch(() => void 0))?.isDirectory();
     if (!isDirectory) continue;
     if (entry.name.startsWith("@")) {
-      const scoped = await readdir2(entryPath, { withFileTypes: true }).catch(() => []);
+      const scoped = await readdir3(entryPath, { withFileTypes: true }).catch(() => []);
       for (const child of scoped) {
-        const childPath = join7(entryPath, child.name);
-        const childIsDirectory = child.isDirectory() || child.isSymbolicLink() && (await stat2(childPath).catch(() => void 0))?.isDirectory();
+        const childPath = join8(entryPath, child.name);
+        const childIsDirectory = child.isDirectory() || child.isSymbolicLink() && (await stat3(childPath).catch(() => void 0))?.isDirectory();
         if (childIsDirectory) directories.push(childPath);
       }
     } else {
@@ -4701,16 +4999,16 @@ async function packageDirectories(root) {
 async function loadProviderPlugins(options) {
   const moduleDirectory = dirname6(fileURLToPath5(import.meta.url));
   const roots = [
-    join7(options.configDirectory, "plugins"),
-    join7(options.cwd ?? process.cwd(), "node_modules"),
-    resolve5(moduleDirectory, "node_modules"),
-    resolve5(moduleDirectory, "../../../../node_modules")
+    join8(options.configDirectory, "plugins"),
+    join8(options.cwd ?? process.cwd(), "node_modules"),
+    resolve6(moduleDirectory, "node_modules"),
+    resolve6(moduleDirectory, "../../../../node_modules")
   ];
   const seen = /* @__PURE__ */ new Set();
   const diagnostics = [];
   for (const root of roots) {
     for (const packageDir of await packageDirectories(root)) {
-      const manifestPath = join7(packageDir, "package.json");
+      const manifestPath = join8(packageDir, "package.json");
       let manifest;
       try {
         manifest = JSON.parse(await readFile2(manifestPath, "utf8"));
@@ -4751,7 +5049,7 @@ async function loadProviderPlugins(options) {
         }
       };
       try {
-        const module = await import(pathToFileURL(join7(packageDir, plugin)).href);
+        const module = await import(pathToFileURL(join8(packageDir, plugin)).href);
         if (typeof module.register !== "function") throw new Error("Plugin does not export register(registry)");
         await module.register(trackingRegistry);
         diagnostic.loaded = true;
@@ -4766,9 +5064,9 @@ async function loadProviderPlugins(options) {
 // src/server/routes/plugins.ts
 import { Router as Router11 } from "express";
 import { fileURLToPath as fileURLToPath6, pathToFileURL as pathToFileURL2 } from "url";
-import { dirname as dirname7, resolve as resolve6, join as join8 } from "path";
+import { dirname as dirname7, resolve as resolve7, join as join9 } from "path";
 import { existsSync } from "fs";
-import { readFile as readFile3, readdir as readdir3, rm as rm2, rename as rename2 } from "fs/promises";
+import { readFile as readFile3, readdir as readdir4, rm as rm2, rename as rename2 } from "fs/promises";
 import { platform } from "os";
 import { execFile } from "child_process";
 import { promisify } from "util";
@@ -4794,9 +5092,9 @@ function createPluginRoutes(options) {
         return res.json({ plugins: registryCache.data });
       }
       const moduleDir = dirname7(fileURLToPath6(import.meta.url));
-      let registryPath = resolve6(moduleDir, "../plugins-registry.json");
+      let registryPath = resolve7(moduleDir, "../plugins-registry.json");
       if (!existsSync(registryPath)) {
-        registryPath = resolve6(moduleDir, "../../../plugins-registry.json");
+        registryPath = resolve7(moduleDir, "../../../plugins-registry.json");
       }
       const data = JSON.parse(await readFile3(registryPath, "utf8"));
       registryCache = { data, ts: now };
@@ -4819,9 +5117,9 @@ function createPluginRoutes(options) {
     if (!/^[a-zA-Z0-9_-]+$/.test(repoName)) {
       return res.status(400).json({ error: "Invalid repository name" });
     }
-    const pluginsDir = join8(getGlobalConfigDir(config3.mode ?? "production"), "plugins");
-    const targetDir = join8(pluginsDir, repoName);
-    const tmpDir = join8(pluginsDir, `.${repoName}-tmp-${Date.now()}`);
+    const pluginsDir = join9(getGlobalConfigDir(config3.mode ?? "production"), "plugins");
+    const targetDir = join9(pluginsDir, repoName);
+    const tmpDir = join9(pluginsDir, `.${repoName}-tmp-${Date.now()}`);
     try {
       await execFileP("mkdir", ["-p", pluginsDir], { timeout: 5e3 });
     } catch {
@@ -4852,7 +5150,7 @@ function createPluginRoutes(options) {
       }
       if (!loadError) {
         try {
-          const manifest = JSON.parse(await readFile3(join8(targetDir, "package.json"), "utf8"));
+          const manifest = JSON.parse(await readFile3(join9(targetDir, "package.json"), "utf8"));
           const pluginEntry = manifest.openfox?.plugin;
           const apiVersion = manifest.openfox?.apiVersion;
           if (!pluginEntry || !manifest.name) {
@@ -4860,7 +5158,7 @@ function createPluginRoutes(options) {
           } else if (apiVersion !== 1) {
             loadError = `Unsupported plugin API version: ${String(apiVersion)}`;
           } else {
-            const mod = await import(pathToFileURL2(join8(targetDir, pluginEntry)).href);
+            const mod = await import(pathToFileURL2(join9(targetDir, pluginEntry)).href);
             if (typeof mod.register !== "function") {
               loadError = "Plugin does not export register(registry)";
             } else {
@@ -4909,13 +5207,13 @@ function createPluginRoutes(options) {
     }
   });
   router.get("/installed", async (_req, res) => {
-    const pluginsDir = join8(getGlobalConfigDir(config3.mode ?? "production"), "plugins");
+    const pluginsDir = join9(getGlobalConfigDir(config3.mode ?? "production"), "plugins");
     try {
-      const entries = await readdir3(pluginsDir, { withFileTypes: true });
+      const entries = await readdir4(pluginsDir, { withFileTypes: true });
       const installed = [];
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const pkgPath = join8(pluginsDir, entry.name, "package.json");
+        const pkgPath = join9(pluginsDir, entry.name, "package.json");
         let version = null;
         try {
           const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
@@ -4930,13 +5228,13 @@ function createPluginRoutes(options) {
     }
   });
   router.get("/open-folder", async (_req, res) => {
-    const pluginsDir = join8(getGlobalConfigDir(config3.mode ?? "production"), "plugins");
+    const pluginsDir = join9(getGlobalConfigDir(config3.mode ?? "production"), "plugins");
     await openFolder(pluginsDir, res);
   });
   router.get("/:name/open-folder", async (req, res) => {
     const name = req.params.name;
     if (!/^[a-zA-Z0-9_-]+$/.test(name)) return res.status(400).json({ error: "Invalid plugin name" });
-    const targetDir = join8(getGlobalConfigDir(config3.mode ?? "production"), "plugins", name);
+    const targetDir = join9(getGlobalConfigDir(config3.mode ?? "production"), "plugins", name);
     await openFolder(targetDir, res);
   });
   router.delete("/:name", async (req, res) => {
@@ -4944,7 +5242,7 @@ function createPluginRoutes(options) {
     if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
       return res.status(400).json({ error: "Invalid plugin name" });
     }
-    const targetDir = join8(getGlobalConfigDir(config3.mode ?? "production"), "plugins", name);
+    const targetDir = join9(getGlobalConfigDir(config3.mode ?? "production"), "plugins", name);
     try {
       await rm2(targetDir, { recursive: true, force: true });
       for (let i = pluginDiagnostics.length - 1; i >= 0; i--) {
@@ -5073,7 +5371,7 @@ async function createServerHandle(config3) {
   const mcpManager = new McpManager({
     onToolsDiscovered: async (name, tools) => {
       try {
-        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-EUMVEFHU.js");
+        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-MD74ETY5.js");
         const mode = config3.mode ?? "production";
         const globalConfig = await loadGlobalConfig(mode, config3.globalConfigPath);
         const mcpServers2 = {
@@ -5104,12 +5402,11 @@ async function createServerHandle(config3) {
       setMcpTools(mcpTools);
       logger.info("MCP tools registered", { count: mcpTools.length });
     }
-    const { signalMcpReady } = await import("./server-SPYFMFQE.js");
+    const { signalMcpReady } = await import("./server-3XUD2NB7.js");
     signalMcpReady();
   });
   const app = express();
   app.use(cors());
-  app.use(express.json({ limit: "10mb" }));
   const authMiddleware = async (req, res, next) => {
     const path = req.path;
     const publicPaths = ["/health", "/auth", "/auth/login", "/auto-update/check"];
@@ -5127,6 +5424,7 @@ async function createServerHandle(config3) {
     next();
   };
   app.use("/api", authMiddleware);
+  app.use(express.json({ limit: "75mb" }));
   app.get("/api/health", (_req, res) => {
     res.json({ status: "ok", timestamp: (/* @__PURE__ */ new Date()).toISOString() });
   });
@@ -5166,7 +5464,7 @@ async function createServerHandle(config3) {
     res.json({ tools });
   });
   app.get("/api/projects", async (_req, res) => {
-    const { listProjects } = await import("./projects-WSVINK2C.js");
+    const { listProjects } = await import("./projects-ZGJGICGT.js");
     const projects = listProjects();
     res.json({ projects });
   });
@@ -5175,7 +5473,7 @@ async function createServerHandle(config3) {
     if (!name || !workdir) {
       return res.status(400).json({ error: "name and workdir are required" });
     }
-    const { createDirectoryWithGit } = await import("./project-creator-C22J43BC.js");
+    const { createDirectoryWithGit } = await import("./project-creator-NNUITNUI.js");
     try {
       const project = await createDirectoryWithGit(name, workdir);
       res.status(201).json({ project });
@@ -5220,7 +5518,7 @@ async function createServerHandle(config3) {
     }
   });
   app.get("/api/projects/:id", async (req, res) => {
-    const { getProject: getProject2 } = await import("./projects-WSVINK2C.js");
+    const { getProject: getProject2 } = await import("./projects-ZGJGICGT.js");
     const project = getProject2(req.params.id);
     if (!project) {
       return res.status(404).json({ error: "Project not found" });
@@ -5228,7 +5526,7 @@ async function createServerHandle(config3) {
     res.json({ project });
   });
   app.put("/api/projects/:id", async (req, res) => {
-    const { updateProject } = await import("./projects-WSVINK2C.js");
+    const { updateProject } = await import("./projects-ZGJGICGT.js");
     const { name, customInstructions, dangerLevel } = req.body;
     const updates = {};
     if (name !== void 0) updates.name = name;
@@ -5241,7 +5539,7 @@ async function createServerHandle(config3) {
     res.json({ project: updated });
   });
   app.delete("/api/projects/:id", async (req, res) => {
-    const { getProject: getProject2, deleteProject } = await import("./projects-WSVINK2C.js");
+    const { getProject: getProject2, deleteProject } = await import("./projects-ZGJGICGT.js");
     const project = getProject2(req.params.id);
     if (!project) {
       return res.status(404).json({ error: "Project not found" });
@@ -5250,7 +5548,7 @@ async function createServerHandle(config3) {
     res.json({ success: true });
   });
   app.put("/api/projects/:id/star", async (req, res) => {
-    const { toggleStar } = await import("./projects-WSVINK2C.js");
+    const { toggleStar } = await import("./projects-ZGJGICGT.js");
     const { isStarred } = req.body;
     if (typeof isStarred !== "boolean") {
       return res.status(400).json({ error: "isStarred is required and must be a boolean" });
@@ -5262,37 +5560,60 @@ async function createServerHandle(config3) {
     res.json({ project });
   });
   app.get("/api/projects/:id/branches", async (req, res) => {
-    const { getProject: getProject2 } = await import("./projects-WSVINK2C.js");
+    const { getProject: getProject2 } = await import("./projects-ZGJGICGT.js");
     const project = getProject2(req.params.id);
     if (!project) return res.status(404).json({ error: "Project not found" });
-    const { listBranches } = await import("./workspace-6QTTUMMW.js");
+    const { listBranches } = await import("./workspace-J74ZMSOJ.js");
     const branches = await listBranches(project.workdir);
     res.json({ branches });
   });
   app.post("/api/projects/:id/checkout", async (req, res) => {
-    const { getProject: getProject2 } = await import("./projects-WSVINK2C.js");
+    const { getProject: getProject2 } = await import("./projects-ZGJGICGT.js");
     const project = getProject2(req.params.id);
     if (!project) return res.status(404).json({ error: "Project not found" });
     const { branch } = req.body;
     if (!branch || typeof branch !== "string") return res.status(400).json({ error: "branch is required" });
-    const { checkoutBranch } = await import("./workspace-6QTTUMMW.js");
+    const { checkoutBranch } = await import("./workspace-J74ZMSOJ.js");
     try {
       await checkoutBranch(project.workdir, branch);
+      const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-SFG42M4W.js");
+      const allSessions = sessionManager.listSessions();
+      for (const s of allSessions) {
+        const effectiveWorkdir = s.workspace ?? s.workdir;
+        if (effectiveWorkdir === project.workdir) {
+          updateSessionBranch2(s.id, branch);
+          sessionManager.emitBranchChange(s.id);
+        }
+      }
       res.json({ branch });
     } catch (err) {
       res.status(400).json({ error: err instanceof Error ? err.message : "Failed to checkout branch" });
     }
   });
   app.post("/api/projects/:id/checkout-new", async (req, res) => {
-    const { getProject: getProject2 } = await import("./projects-WSVINK2C.js");
+    const { getProject: getProject2 } = await import("./projects-ZGJGICGT.js");
     const project = getProject2(req.params.id);
     if (!project) return res.status(404).json({ error: "Project not found" });
-    const { name } = req.body;
+    const { name, sourceBranch } = req.body;
     if (!name || typeof name !== "string") return res.status(400).json({ error: "name is required" });
-    const { createBranch } = await import("./workspace-6QTTUMMW.js");
+    const { createBranch, resolveAndValidateSourceBranch: resolveAndValidateSourceBranch2, validateRef: validateRef2 } = await import("./workspace-J74ZMSOJ.js");
     try {
-      await createBranch(project.workdir, name);
-      res.json({ branch: name });
+      await validateRef2(project.workdir, name);
+      let sb;
+      if (sourceBranch) {
+        sb = await resolveAndValidateSourceBranch2(project.workdir, sourceBranch, project.workdir);
+      }
+      await createBranch(project.workdir, name, sb);
+      const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-SFG42M4W.js");
+      const allSessions = sessionManager.listSessions();
+      for (const s of allSessions) {
+        const effectiveWorkdir = s.workspace ?? s.workdir;
+        if (effectiveWorkdir === project.workdir) {
+          updateSessionBranch2(s.id, name);
+          sessionManager.emitBranchChange(s.id);
+        }
+      }
+      res.json({ branch: name, sourceBranch: sourceBranch ?? null });
     } catch (err) {
       res.status(400).json({ error: err instanceof Error ? err.message : "Failed to create branch" });
     }
@@ -5301,9 +5622,13 @@ async function createServerHandle(config3) {
     const session = sessionManager.getSession(req.params.id);
     if (!session) return res.status(404).json({ error: "Session not found" });
     const effectiveWorkdir = session.workspace ?? session.workdir;
-    const { listBranches } = await import("./workspace-6QTTUMMW.js");
-    const branches = await listBranches(effectiveWorkdir);
-    res.json({ branches });
+    const { listBranches, getDefaultBranch: getDefaultBranch2 } = await import("./workspace-J74ZMSOJ.js");
+    const [branches, defaultBranch] = await Promise.all([
+      listBranches(effectiveWorkdir),
+      getDefaultBranch2(session.workdir)
+      // project root, not workspace, for real upstream origin/HEAD
+    ]);
+    res.json({ branches, defaultBranch });
   });
   app.post("/api/sessions/:id/checkout", async (req, res) => {
     const session = sessionManager.getSession(req.params.id);
@@ -5311,10 +5636,21 @@ async function createServerHandle(config3) {
     const { branch } = req.body;
     if (!branch || typeof branch !== "string") return res.status(400).json({ error: "branch is required" });
     const effectiveWorkdir = session.workspace ?? session.workdir;
-    const { checkoutBranch, validateRef } = await import("./workspace-6QTTUMMW.js");
+    const { checkoutBranch, validateRef: validateRef2 } = await import("./workspace-J74ZMSOJ.js");
+    const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-SFG42M4W.js");
     try {
-      await validateRef(effectiveWorkdir, branch);
+      await validateRef2(effectiveWorkdir, branch);
       await checkoutBranch(effectiveWorkdir, branch);
+      updateSessionBranch2(req.params.id, branch);
+      if (session.workspace) {
+        const all = sessionManager.listSessions();
+        for (const s of all) {
+          if (s.id !== req.params.id && s.workspace === session.workspace) {
+            updateSessionBranch2(s.id, branch);
+            sessionManager.emitBranchChange(s.id);
+          }
+        }
+      }
       res.json({ branch });
     } catch (err) {
       res.status(400).json({ error: err instanceof Error ? err.message : "Failed to checkout branch" });
@@ -5323,30 +5659,48 @@ async function createServerHandle(config3) {
   app.post("/api/sessions/:id/checkout-new", async (req, res) => {
     const session = sessionManager.getSession(req.params.id);
     if (!session) return res.status(404).json({ error: "Session not found" });
-    const { name } = req.body;
+    const { name, sourceBranch } = req.body;
     if (!name || typeof name !== "string") return res.status(400).json({ error: "name is required" });
     const effectiveWorkdir = session.workspace ?? session.workdir;
-    const { createBranch, validateRef } = await import("./workspace-6QTTUMMW.js");
+    const { validateRef: validateRef2 } = await import("./workspace-J74ZMSOJ.js");
+    const { updateSessionBranch: updateSessionBranch2 } = await import("./sessions-SFG42M4W.js");
     try {
-      await validateRef(effectiveWorkdir, name);
-      await createBranch(effectiveWorkdir, name);
-      res.json({ branch: name });
+      await validateRef2(effectiveWorkdir, name);
+      if (sourceBranch) {
+        const { resolveAndValidateSourceBranch: resolveAndValidateSourceBranch2, createBranch } = await import("./workspace-J74ZMSOJ.js");
+        const sb = await resolveAndValidateSourceBranch2(effectiveWorkdir, sourceBranch, session.workdir);
+        await createBranch(effectiveWorkdir, name, sb);
+      } else {
+        const { createBranch } = await import("./workspace-J74ZMSOJ.js");
+        await createBranch(effectiveWorkdir, name);
+      }
+      updateSessionBranch2(req.params.id, name);
+      if (session.workspace) {
+        const all = sessionManager.listSessions();
+        for (const s of all) {
+          if (s.id !== req.params.id && s.workspace === session.workspace) {
+            updateSessionBranch2(s.id, name);
+            sessionManager.emitBranchChange(s.id);
+          }
+        }
+      }
+      res.json({ branch: name, sourceBranch: sourceBranch ?? null });
     } catch (err) {
       res.status(400).json({ error: err instanceof Error ? err.message : "Failed to create branch" });
     }
   });
   app.get("/api/projects/:id/workspaces", async (req, res) => {
-    const { getProject: getProject2 } = await import("./projects-WSVINK2C.js");
+    const { getProject: getProject2 } = await import("./projects-ZGJGICGT.js");
     const project = getProject2(req.params.id);
     if (!project) return res.status(404).json({ error: "Project not found" });
-    const { listWorkspaces } = await import("./workspace-6QTTUMMW.js");
-    const all = await listWorkspaces(project.name);
+    const { listWorkspaces } = await import("./workspace-J74ZMSOJ.js");
+    const all = await listWorkspaces(project.name, project.workdir);
     const workspacesList = all.filter((ws) => ws.path !== project.workdir);
     res.json({ workspaces: workspacesList });
   });
   app.get("/api/sessions", async (req, res) => {
-    const { getRecentUserPromptsForSession } = await import("./events-FLWRLM6V.js");
-    const { getPendingConfirmationsBySession } = await import("./path-security-ZROWNL22.js");
+    const { getRecentUserPromptsForSession } = await import("./events-KNOZX7YG.js");
+    const { getPendingConfirmationsBySession } = await import("./path-security-HUXQHEQ5.js");
     const projectId = req.query["projectId"];
     const limit = Math.min(parseInt(req.query["limit"]) || 20, 100);
     const offset = parseInt(req.query["offset"]) || 0;
@@ -5384,7 +5738,7 @@ async function createServerHandle(config3) {
     }
     const { providerId, model } = parseDefaultModelSelection(config3.defaultModelSelection);
     const session = sessionManager.createSession(projectId, title, providerId ?? null, model ?? null);
-    wssExports.broadcastAll({
+    wssExports.broadcastForProject(projectId, session.id, {
       type: "session.created",
       sessionId: session.id,
       payload: {
@@ -5412,10 +5766,10 @@ async function createServerHandle(config3) {
   app.post("/api/sessions/:id/switch-workspace", async (req, res) => {
     const session = sessionManager.getSession(req.params.id);
     if (!session) return res.status(404).json({ error: "Session not found" });
-    const { target, branch } = req.body;
+    const { target, branch, sourceBranch } = req.body;
     if (!target || typeof target !== "string") return res.status(400).json({ error: "target is required" });
     try {
-      const updated = await sessionManager.switchWorkspace(req.params.id, target, branch);
+      const updated = await sessionManager.switchWorkspace(req.params.id, target, branch, sourceBranch);
       res.json({ session: updated });
     } catch (err) {
       res.status(400).json({ error: err instanceof Error ? err.message : "Failed to switch workspace" });
@@ -5434,21 +5788,32 @@ async function createServerHandle(config3) {
     }
   });
   app.get("/api/sessions/:id", async (req, res) => {
-    const { getEventStore: getEventStore2 } = await import("./events-FLWRLM6V.js");
-    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-ONH3D4OK.js");
-    const { getPendingQuestionsForSession } = await import("./tools-JRCUWPJO.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot } = await import("./events-KNOZX7YG.js");
+    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-OPP2BVUB.js");
+    const { getPendingQuestionsForSession } = await import("./tools-HGKUD327.js");
+    const { getMaxVisibleItems } = await import("./settings-6M55N4Q2.js");
     const session = sessionManager.getSession(req.params.id);
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
     const eventStore = getEventStore2();
-    const events = eventStore.getEvents(req.params.id);
-    const messages = buildMessagesFromStoredEvents(events);
+    const { snapshot, events: eventsSinceSnapshot } = eventStore.getEventsSinceSnapshot(req.params.id);
+    const events = combineEventsWithSnapshot(req.params.id, snapshot, eventsSinceSnapshot);
+    const maxVisibleItems = req.query["full"] === "true" ? void 0 : getMaxVisibleItems() || void 0;
+    const { messages, hiddenCount } = buildMessagesFromStoredEvents(events, maxVisibleItems);
     const contextState = sessionManager.getContextState(req.params.id);
     const queueState = sessionManager.getQueueState(req.params.id);
     const pendingQuestions = getPendingQuestionsForSession(req.params.id);
     const pendingConfirmations = foldPendingConfirmations(events);
-    res.json({ session, messages, contextState, queueState, pendingQuestions, pendingConfirmations });
+    res.json({
+      session,
+      messages,
+      hiddenCount,
+      contextState,
+      queueState,
+      pendingQuestions,
+      pendingConfirmations
+    });
   });
   app.delete("/api/sessions/:id", async (req, res) => {
     const sessionId = req.params["id"];
@@ -5456,8 +5821,8 @@ async function createServerHandle(config3) {
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { stopSessionExecution } = await import("./chat-handler-3BZ4PDL2.js");
-    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-JRCUWPJO.js");
+    const { stopSessionExecution } = await import("./chat-handler-5ZHPYU24.js");
+    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-HGKUD327.js");
     sessionManager.clearMessageQueue(sessionId);
     stopSessionExecution(sessionId, sessionManager);
     abortSession(sessionId);
@@ -5486,8 +5851,9 @@ async function createServerHandle(config3) {
     res.json({ success: true });
   });
   app.post("/api/sessions/:id/provider", async (req, res) => {
-    const { getEventStore: getEventStore2 } = await import("./events-FLWRLM6V.js");
-    const { buildMessagesFromStoredEvents } = await import("./folding-ONH3D4OK.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEv } = await import("./events-KNOZX7YG.js");
+    const { buildMessagesFromStoredEvents } = await import("./folding-OPP2BVUB.js");
+    const { getMaxVisibleItems } = await import("./settings-6M55N4Q2.js");
     const sessionId = req.params.id;
     const session = sessionManager.getSession(sessionId);
     if (!session) {
@@ -5502,10 +5868,12 @@ async function createServerHandle(config3) {
     sessionManager.setSessionProvider(sessionId, providerId, resolvedModel);
     const contextState = sessionManager.getContextState(sessionId);
     const eventStore = getEventStore2();
-    const events = eventStore.getEvents(sessionId);
-    const messages = buildMessagesFromStoredEvents(events);
+    const { snapshot, events: eventsSinceSnapshot } = eventStore.getEventsSinceSnapshot(sessionId);
+    const events = combineEv(sessionId, snapshot, eventsSinceSnapshot);
+    const maxVisibleItems = getMaxVisibleItems();
+    const { messages, hiddenCount } = buildMessagesFromStoredEvents(events, maxVisibleItems || void 0);
     const updatedSession = sessionManager.getSession(sessionId);
-    res.json({ session: updatedSession, messages, contextState });
+    res.json({ session: updatedSession, messages, hiddenCount, contextState });
   });
   app.post("/api/default-model", async (req, res) => {
     const { providerId, model } = req.body;
@@ -5520,7 +5888,7 @@ async function createServerHandle(config3) {
     if (!result.success) {
       return res.status(500).json({ error: result.error ?? "Failed to set default model" });
     }
-    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-EUMVEFHU.js");
+    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-MD74ETY5.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = setDefaultModelSelection(globalConfig, providerId, model);
     await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -5598,8 +5966,9 @@ async function createServerHandle(config3) {
     res.json({ success: true });
   });
   app.put("/api/sessions/:id/mode", async (req, res) => {
-    const { getEventStore: getEventStore2 } = await import("./events-FLWRLM6V.js");
-    const { buildMessagesFromStoredEvents } = await import("./folding-ONH3D4OK.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEv } = await import("./events-KNOZX7YG.js");
+    const { buildMessagesFromStoredEvents } = await import("./folding-OPP2BVUB.js");
+    const { getMaxVisibleItems } = await import("./settings-6M55N4Q2.js");
     const sessionId = req.params.id;
     const session = sessionManager.getSession(sessionId);
     if (!session) {
@@ -5616,10 +5985,12 @@ async function createServerHandle(config3) {
     }
     sessionManager.setMode(sessionId, mode);
     const eventStore = getEventStore2();
-    const events = eventStore.getEvents(sessionId);
-    const messages = buildMessagesFromStoredEvents(events);
+    const { snapshot, events: eventsSinceSnapshot } = eventStore.getEventsSinceSnapshot(sessionId);
+    const events = combineEv(sessionId, snapshot, eventsSinceSnapshot);
+    const maxVisibleItems = getMaxVisibleItems();
+    const { messages, hiddenCount } = buildMessagesFromStoredEvents(events, maxVisibleItems || void 0);
     const updatedSession = sessionManager.getSession(sessionId);
-    res.json({ session: updatedSession, messages });
+    res.json({ session: updatedSession, messages, hiddenCount });
   });
   app.put("/api/sessions/:id/danger-level", async (req, res) => {
     const sessionId = req.params.id;
@@ -5652,29 +6023,50 @@ async function createServerHandle(config3) {
   app.post("/api/sessions/:id/confirm-path", async (req, res) => {
     const sessionId = req.params.id;
     const { callId, approved, alwaysAllow } = req.body;
-    if (!callId || approved === void 0) {
-      return res.status(400).json({ error: "callId and approved are required" });
+    if (!callId || typeof approved !== "boolean") {
+      return res.status(400).json({ error: "callId and approved (boolean) are required" });
+    }
+    if (alwaysAllow !== void 0 && typeof alwaysAllow !== "boolean") {
+      return res.status(400).json({ error: "alwaysAllow must be a boolean if provided" });
+    }
+    const { providePathConfirmation, getConfirmationSessionId } = await import("./tools-HGKUD327.js");
+    const pendingSessionId = getConfirmationSessionId(callId);
+    if (!pendingSessionId) {
+      return res.status(404).json({ error: "No pending path confirmation with that ID" });
+    }
+    if (pendingSessionId !== sessionId) {
+      return res.status(403).json({ error: "Confirmation does not belong to this session" });
     }
-    const { providePathConfirmation } = await import("./tools-JRCUWPJO.js");
     const result = providePathConfirmation(callId, approved, alwaysAllow);
     if (!result.found) {
       return res.status(404).json({ error: "No pending path confirmation with that ID" });
     }
-    const { getEventStore: getEventStore2 } = await import("./events-FLWRLM6V.js");
-    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-ONH3D4OK.js");
-    const { createSessionStateMessage } = await import("./protocol-EWEVW65B.js");
-    const { getPendingQuestionsForSession } = await import("./tools-JRCUWPJO.js");
+    const { getEventStore: getEventStore2, combineEventsWithSnapshot: combineEvents } = await import("./events-KNOZX7YG.js");
+    const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-OPP2BVUB.js");
+    const { createSessionStateMessage } = await import("./protocol-Q7X4NEME.js");
+    const { getPendingQuestionsForSession } = await import("./tools-HGKUD327.js");
+    const { getMaxVisibleItems } = await import("./settings-6M55N4Q2.js");
     const eventStore = getEventStore2();
-    const events = eventStore.getEvents(sessionId);
-    const messages = buildMessagesFromStoredEvents(events);
+    const { snapshot, events: eventsSinceSnapshot } = eventStore.getEventsSinceSnapshot(sessionId);
+    const events = combineEvents(sessionId, snapshot, eventsSinceSnapshot);
+    const maxVisibleItems = getMaxVisibleItems();
+    const { messages, hiddenCount } = buildMessagesFromStoredEvents(events, maxVisibleItems || void 0);
     const pendingConfirmations = foldPendingConfirmations(events);
     const pendingQuestions = getPendingQuestionsForSession(sessionId);
     const session = sessionManager.getSession(sessionId);
     if (session) {
-      const stateMsg = createSessionStateMessage(session, messages, pendingConfirmations, pendingQuestions);
+      const stateMsg = createSessionStateMessage(
+        session,
+        messages,
+        pendingConfirmations,
+        pendingQuestions,
+        void 0,
+        void 0,
+        hiddenCount
+      );
       wssExports.broadcastForSession(sessionId, { ...stateMsg, sessionId });
     }
-    wssExports.broadcastAll({
+    wssExports.broadcastForSession(sessionId, {
       type: "session.confirmation_resolved",
       sessionId,
       payload: { sessionId, callId }
@@ -5689,7 +6081,7 @@ async function createServerHandle(config3) {
     if (!skip && typeof answer !== "string") {
       return res.status(400).json({ error: "answer is required when not skipping" });
     }
-    const { provideAnswer } = await import("./tools-JRCUWPJO.js");
+    const { provideAnswer } = await import("./tools-HGKUD327.js");
     const found = provideAnswer(callId, answer ?? "", skip ?? false);
     if (!found) {
       return res.status(404).json({ error: "No pending question with that ID" });
@@ -5717,7 +6109,7 @@ async function createServerHandle(config3) {
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-7XDMSPIC.js");
+    const { getSetting: getSetting2, SETTINGS_KEYS } = await import("./settings-6M55N4Q2.js");
     if (getSetting2(SETTINGS_KEYS.CACHE_WARMING) !== "true") {
       return res.json({ success: false, reason: "disabled" });
     }
@@ -5749,7 +6141,7 @@ async function createServerHandle(config3) {
       backend: activeProvider?.backend ?? llmClient.getBackend(),
       model: llmClient.getModel()
     };
-    const { runAgentTurn, TurnMetrics } = await import("./orchestrator-5IMCWX5P.js");
+    const { runAgentTurn, TurnMetrics } = await import("./orchestrator-L6LX5BV7.js");
     runAgentTurn(
       {
         sessionManager,
@@ -5787,15 +6179,15 @@ async function createServerHandle(config3) {
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { stopSessionExecution } = await import("./chat-handler-3BZ4PDL2.js");
-    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-JRCUWPJO.js");
+    const { stopSessionExecution } = await import("./chat-handler-5ZHPYU24.js");
+    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-HGKUD327.js");
     const queuedMessages = sessionManager.getQueueState(sessionId);
     sessionManager.clearMessageQueue(sessionId);
     stopSessionExecution(sessionId, sessionManager);
     abortSession(sessionId);
     cancelQuestionsForSession(sessionId, "Session stopped by user");
     cancelPathConfirmationsForSession(sessionId, "Session stopped by user");
-    const eventStore = (await import("./events-FLWRLM6V.js")).getEventStore();
+    const eventStore = (await import("./events-KNOZX7YG.js")).getEventStore();
     eventStore.append(sessionId, { type: "running.changed", data: { isRunning: false } });
     res.json({ success: true, queuedMessages });
   });
@@ -5809,7 +6201,7 @@ async function createServerHandle(config3) {
     if (typeof messageIndex !== "number" || messageIndex < 0) {
       return res.status(400).json({ error: "messageIndex must be a non-negative number" });
     }
-    const { truncateSessionMessages } = await import("./events-FLWRLM6V.js");
+    const { truncateSessionMessages } = await import("./events-KNOZX7YG.js");
     truncateSessionMessages(sessionId, messageIndex);
     res.json({ success: true });
   });
@@ -5826,11 +6218,11 @@ async function createServerHandle(config3) {
     if (content !== void 0 && (typeof content !== "string" || !content.trim())) {
       return res.status(400).json({ error: "content must be a non-empty string if provided" });
     }
-    const { getEventStore: getEventStore2 } = await import("./events-FLWRLM6V.js");
-    const { buildMessagesFromStoredEvents } = await import("./folding-ONH3D4OK.js");
+    const { getEventStore: getEventStore2 } = await import("./events-KNOZX7YG.js");
+    const { buildMessagesFromStoredEvents } = await import("./folding-OPP2BVUB.js");
     const eventStore = getEventStore2();
     const events = eventStore.getEvents(sessionId);
-    const messages = buildMessagesFromStoredEvents(events);
+    const { messages } = buildMessagesFromStoredEvents(events);
     const msgIndex = messages.findIndex((m) => m.id === messageId);
     if (msgIndex === -1) {
       return res.status(400).json({ error: "Message not found" });
@@ -5839,7 +6231,7 @@ async function createServerHandle(config3) {
     if (msg.role !== "user" || msg.isSystemGenerated) {
       return res.status(400).json({ error: "Can only replay user messages" });
     }
-    const { truncateSessionMessages } = await import("./events-FLWRLM6V.js");
+    const { truncateSessionMessages } = await import("./events-KNOZX7YG.js");
     truncateSessionMessages(sessionId, msgIndex - 1);
     sessionManager.queueMessage(sessionId, "asap", content ?? msg.content, msg.attachments, msg.messageKind);
     res.json({ success: true });
@@ -5871,7 +6263,7 @@ async function createServerHandle(config3) {
     res.json({ accepted: true });
   });
   app.get("/api/settings", async (req, res) => {
-    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-7XDMSPIC.js");
+    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-6M55N4Q2.js");
     const keysParam = req.query["keys"];
     if (!keysParam) {
       return res.status(400).json({ error: "keys query parameter is required" });
@@ -5884,19 +6276,19 @@ async function createServerHandle(config3) {
     res.json(result);
   });
   app.get("/api/settings/:key", async (req, res) => {
-    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-7XDMSPIC.js");
+    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-6M55N4Q2.js");
     const key = req.params.key;
     const value = getSetting2(key) ?? SETTINGS_DEFAULTS[key] ?? null;
     res.json({ key, value });
   });
   app.get("/api/settings/:key", async (req, res) => {
-    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-7XDMSPIC.js");
+    const { getSetting: getSetting2, SETTINGS_DEFAULTS } = await import("./settings-6M55N4Q2.js");
     const key = req.params.key;
     const value = getSetting2(key) ?? SETTINGS_DEFAULTS[key] ?? null;
     res.json({ key, value });
   });
   app.put("/api/settings/:key", async (req, res) => {
-    const { setSetting: setSetting2 } = await import("./settings-7XDMSPIC.js");
+    const { setSetting: setSetting2 } = await import("./settings-6M55N4Q2.js");
     const key = req.params.key;
     const { value } = req.body;
     if (value === void 0) {
@@ -5908,14 +6300,14 @@ async function createServerHandle(config3) {
   app.get("/api/tools/rtk-check", async (_req, res) => {
     const { spawn: spawn3 } = await import("child_process");
     try {
-      const available = await new Promise((resolve8) => {
+      const available = await new Promise((resolve9) => {
         const proc = spawn3("rtk", ["--version"], { stdio: ["ignore", "pipe", "pipe"] });
         let out = "";
         proc.stdout?.on("data", (d) => {
           out += d.toString();
         });
-        proc.on("error", () => resolve8(false));
-        proc.on("close", (code) => resolve8(code === 0 && out.startsWith("rtk ")));
+        proc.on("error", () => resolve9(false));
+        proc.on("close", (code) => resolve9(code === 0 && out.startsWith("rtk ")));
       });
       res.json({ available });
     } catch {
@@ -5923,7 +6315,7 @@ async function createServerHandle(config3) {
     }
   });
   app.get("/api/tools/shells", async (_req, res) => {
-    const { listAvailableShells } = await import("./platform-QGXO3CNR.js");
+    const { listAvailableShells } = await import("./platform-VBNNMTR5.js");
     res.json({ shells: listAvailableShells() });
   });
   app.get("/api/config", async (_req, res) => {
@@ -5932,7 +6324,7 @@ async function createServerHandle(config3) {
     let visionFallback;
     let globalWorkdir;
     try {
-      const { loadGlobalConfig, getVisionFallback } = await import("./config-EUMVEFHU.js");
+      const { loadGlobalConfig, getVisionFallback } = await import("./config-MD74ETY5.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const fallback = getVisionFallback(globalConfig);
       if (fallback) {
@@ -6086,7 +6478,7 @@ async function createServerHandle(config3) {
     const backend = req.query["backend"];
     if (!url) return res.status(400).json({ error: "url is required" });
     try {
-      const { fetchModelsWithContext } = await import("./provider-manager-SQIELYLK.js");
+      const { fetchModelsWithContext } = await import("./provider-manager-PD3BXUHY.js");
       const { getModelProfile: getModelProfile2 } = await import("./profiles-5J7F4BML.js");
       const models = await fetchModelsWithContext(
         url,
@@ -6156,7 +6548,7 @@ async function createServerHandle(config3) {
       }
       const { getModelProfile: getModelProfile2 } = await import("./profiles-5J7F4BML.js");
       const { getBackendCapabilities } = await import("./backend-P3GHHLHJ.js");
-      const { buildNonStreamingCreateParams } = await import("./client-pure-NMLDKRDN.js");
+      const { buildNonStreamingCreateParams } = await import("./client-pure-5YE5WFJP.js");
       const { OpenAIHttpClient } = await import("./http-client-PIWB7BXK.js");
       const { ensureVersionPrefix } = await import("./url-utils-SAJP7AEX.js");
       const profile = getModelProfile2(model);
@@ -6226,7 +6618,7 @@ async function createServerHandle(config3) {
       return res.status(400).json({ error: "name, url, and backend are required" });
     }
     try {
-      const { loadGlobalConfig, saveGlobalConfig, addProvider, setDefaultModelSelection } = await import("./config-EUMVEFHU.js");
+      const { loadGlobalConfig, saveGlobalConfig, addProvider, setDefaultModelSelection } = await import("./config-MD74ETY5.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const providerBackend = backend;
       const providerModels = modelConfigs?.length ? buildModelConfigs(modelConfigs) : model ? [{ id: model, contextWindow: 2e5, source: "user" }] : [];
@@ -6266,7 +6658,7 @@ async function createServerHandle(config3) {
   app.post("/api/init/config", async (req, res) => {
     const { workdir, visionFallback } = req.body;
     try {
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-EUMVEFHU.js");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-MD74ETY5.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const updatedConfig = {
         ...globalConfig,
@@ -6305,7 +6697,7 @@ async function createServerHandle(config3) {
   });
   app.delete("/api/providers/:id", async (req, res) => {
     const { id } = req.params;
-    const { loadGlobalConfig, saveGlobalConfig, removeProvider } = await import("./config-EUMVEFHU.js");
+    const { loadGlobalConfig, saveGlobalConfig, removeProvider } = await import("./config-MD74ETY5.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = removeProvider(globalConfig, id);
     await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -6317,7 +6709,7 @@ async function createServerHandle(config3) {
     const { id } = req.params;
     const { isLocal } = req.body;
     try {
-      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-EUMVEFHU.js");
+      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-MD74ETY5.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const provider = globalConfig.providers.find((p) => p.id === id);
       if (!provider) {
@@ -6348,7 +6740,7 @@ async function createServerHandle(config3) {
       transportAdapter
     } = req.body;
     try {
-      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-EUMVEFHU.js");
+      const { loadGlobalConfig, saveGlobalConfig, updateProvider } = await import("./config-MD74ETY5.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const provider = globalConfig.providers.find((p) => p.id === id);
       if (!provider) {
@@ -6388,7 +6780,7 @@ async function createServerHandle(config3) {
       return res.status(400).json({ error: result.error });
     }
     const llmClient = getLLMClient();
-    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-EUMVEFHU.js");
+    const { loadGlobalConfig, saveGlobalConfig, setDefaultModelSelection } = await import("./config-MD74ETY5.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedConfig = setDefaultModelSelection(globalConfig, id, llmClient.getModel());
     await saveGlobalConfig(config3.mode ?? "production", updatedConfig, config3.globalConfigPath);
@@ -6415,7 +6807,7 @@ async function createServerHandle(config3) {
   });
   async function rebuildMcpTools() {
     const { createMcpTools: createMcpTools2 } = await import("./tool-adapter-MOGEI6TP.js");
-    const { setMcpTools: setMcpTools2 } = await import("./tools-JRCUWPJO.js");
+    const { setMcpTools: setMcpTools2 } = await import("./tools-HGKUD327.js");
     const mcpTools = createMcpTools2(mcpManager);
     setMcpTools2(mcpTools);
   }
@@ -6424,7 +6816,7 @@ async function createServerHandle(config3) {
     res.json({ servers });
   });
   app.post("/api/mcp/servers/test", async (req, res) => {
-    const { name, transport, command, args, env, url, headers } = req.body;
+    const { name, transport, command, args, env, url, headers, timeout } = req.body;
     if (transport !== void 0 && transport !== "stdio" && transport !== "http") {
       return res.status(400).json({ error: `Invalid transport '${transport}'. Must be 'stdio' or 'http'.` });
     }
@@ -6434,6 +6826,9 @@ async function createServerHandle(config3) {
     if (transport === "http" && !url) {
       return res.status(400).json({ error: "url is required for http transport" });
     }
+    if (timeout !== void 0 && (typeof timeout !== "number" || timeout <= 0)) {
+      return res.status(400).json({ error: "timeout must be a positive number" });
+    }
     try {
       const testManager = new McpManager();
       const resolvedTransport = transport === "http" ? "http" : "stdio";
@@ -6443,7 +6838,8 @@ async function createServerHandle(config3) {
         ...args && args.length > 0 ? { args } : {},
         ...env && Object.keys(env).length > 0 ? { env } : {},
         ...url ? { url } : {},
-        ...headers && Object.keys(headers).length > 0 ? { headers } : {}
+        ...headers && Object.keys(headers).length > 0 ? { headers } : {},
+        ...timeout !== void 0 ? { timeout } : {}
       };
       await testManager.addServer(name ?? "test", testConfig);
       const server = testManager.getServer(name ?? "test");
@@ -6458,13 +6854,16 @@ async function createServerHandle(config3) {
     }
   });
   app.post("/api/mcp/servers", async (req, res) => {
-    const { name, transport, command, args, env, url, headers } = req.body;
+    const { name, transport, command, args, env, url, headers, timeout } = req.body;
     if (!name) {
       return res.status(400).json({ error: "name is required" });
     }
     if (transport !== void 0 && transport !== "stdio" && transport !== "http") {
       return res.status(400).json({ error: `Invalid transport '${transport}'. Must be 'stdio' or 'http'.` });
     }
+    if (timeout !== void 0 && (typeof timeout !== "number" || timeout <= 0)) {
+      return res.status(400).json({ error: "timeout must be a positive number" });
+    }
     try {
       const resolvedTransport = transport === "http" ? "http" : "stdio";
       const serverCfg = {
@@ -6473,11 +6872,12 @@ async function createServerHandle(config3) {
         ...args && args.length > 0 ? { args } : {},
         ...env && Object.keys(env).length > 0 ? { env } : {},
         ...url ? { url } : {},
-        ...headers && Object.keys(headers).length > 0 ? { headers } : {}
+        ...headers && Object.keys(headers).length > 0 ? { headers } : {},
+        ...timeout !== void 0 ? { timeout } : {}
       };
       await mcpManager.addServer(name, serverCfg);
       const server = mcpManager.getServer(name);
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-EUMVEFHU.js");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-MD74ETY5.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const updatedMcpServers = { ...globalConfig.mcpServers ?? {}, [name]: serverCfg };
       await saveGlobalConfig(
@@ -6507,7 +6907,7 @@ async function createServerHandle(config3) {
       return res.status(404).json({ error: `MCP server '${name}' not found` });
     }
     const body = req.body;
-    const { transport: rawTransport, command, args, env, url, headers } = body;
+    const { transport: rawTransport, command, args, env, url, headers, timeout } = body;
     if (rawTransport !== void 0 && rawTransport !== "stdio" && rawTransport !== "http") {
       return res.status(400).json({ error: `Invalid transport '${String(rawTransport)}'. Must be 'stdio' or 'http'.` });
     }
@@ -6526,9 +6926,12 @@ async function createServerHandle(config3) {
     if (headers !== void 0 && (typeof headers !== "object" || headers === null || Array.isArray(headers) || Object.values(headers).some((v) => typeof v !== "string"))) {
       return res.status(400).json({ error: "headers must be a string/string object" });
     }
+    if (timeout !== void 0 && (typeof timeout !== "number" || timeout <= 0)) {
+      return res.status(400).json({ error: "timeout must be a positive number" });
+    }
     try {
-      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-EUMVEFHU.js");
-      const { applyMcpServerUpdate } = await import("./update-server-4MTM7M5P.js");
+      const { loadGlobalConfig, saveGlobalConfig } = await import("./config-MD74ETY5.js");
+      const { applyMcpServerUpdate } = await import("./update-server-V6GJ43WH.js");
       const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
       const mcpServers2 = { ...globalConfig.mcpServers ?? {} };
       const patch = {
@@ -6537,7 +6940,8 @@ async function createServerHandle(config3) {
         ...args !== void 0 ? { args } : {},
         ...env !== void 0 ? { env } : {},
         ...url !== void 0 ? { url } : {},
-        ...headers !== void 0 ? { headers } : {}
+        ...headers !== void 0 ? { headers } : {},
+        ...timeout !== void 0 ? { timeout } : {}
       };
       const { error: updateError } = await applyMcpServerUpdate({
         name,
@@ -6570,7 +6974,7 @@ async function createServerHandle(config3) {
       return res.status(404).json({ error: `MCP server '${name}' not found` });
     }
     mcpManager.removeServer(name);
-    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-EUMVEFHU.js");
+    const { loadGlobalConfig, saveGlobalConfig } = await import("./config-MD74ETY5.js");
     const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
     const updatedMcpServers = { ...globalConfig.mcpServers ?? {} };
     delete updatedMcpServers[name];
@@ -6599,7 +7003,7 @@ async function createServerHandle(config3) {
       await mcpManager.setToolEnabled(name, toolName, enabled);
       const server = mcpManager.getServer(name);
       if (server) {
-        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-EUMVEFHU.js");
+        const { loadGlobalConfig, saveGlobalConfig } = await import("./config-MD74ETY5.js");
         const globalConfig = await loadGlobalConfig(config3.mode ?? "production", config3.globalConfigPath);
         const mcpServers2 = { ...globalConfig.mcpServers ?? {} };
         const serverCfg = mcpServers2[name];
@@ -6650,13 +7054,13 @@ async function createServerHandle(config3) {
     })
   );
   app.get("/api/sessions/:id/background-processes", async (req, res) => {
-    const { getSessionProcesses } = await import("./manager-OPMCSYN2.js");
+    const { getSessionProcesses } = await import("./manager-ATWZUL3O.js");
     const sessionId = req.params.id;
     const processes = getSessionProcesses(sessionId);
     res.json({ processes });
   });
   app.post("/api/sessions/:id/background-process/:processId/stop", async (req, res) => {
-    const { stopProcess } = await import("./manager-OPMCSYN2.js");
+    const { stopProcess } = await import("./manager-ATWZUL3O.js");
     const sessionId = req.params.id;
     const processId = req.params.processId;
     const session = sessionManager.getSession(sessionId);
@@ -6676,14 +7080,14 @@ async function createServerHandle(config3) {
   });
   app.use("/api/directories", createDirectoryRoutes());
   app.use("/api/files", createFileSearchRoutes());
-  const webDir = resolve7(__dirname3, "../../web");
+  const webDir = resolve8(__dirname3, "../../web");
   const isDev = config3.mode === "development";
   let viteServer;
   if (isDev) {
     logger.info("Dev mode: using Vite middleware");
     viteServer = await createViteServer({
       root: webDir,
-      configFile: resolve7(__dirname3, "../../web/vite.config.ts"),
+      configFile: resolve8(__dirname3, "../../web/vite.config.ts"),
       server: { middlewareMode: true },
       appType: "spa",
       logLevel: "warn"
@@ -6703,7 +7107,7 @@ async function createServerHandle(config3) {
       }
     });
     app.get("/fox.svg", (_req, res) => {
-      readFile4(join9(webDir, "fox.svg")).then((content) => {
+      readFile4(join10(webDir, "fox.svg")).then((content) => {
         res.set("Content-Type", "image/svg+xml");
         res.send(content);
       }).catch(() => {
@@ -6712,7 +7116,7 @@ async function createServerHandle(config3) {
     });
     app.use(
       "/sounds",
-      express.static(join9(webDir, "public", "sounds"), {
+      express.static(join10(webDir, "public", "sounds"), {
         setHeaders: (res) => {
           res.set("Content-Type", "audio/mpeg");
         }
@@ -6721,13 +7125,13 @@ async function createServerHandle(config3) {
     app.use("/__inspect__.js", (_req, res) => {
       res.set("Access-Control-Allow-Origin", "*");
       res.set("Content-Type", "application/javascript");
-      readFile4(join9(webDir, "public", "__inspect__.js")).then((content) => res.send(content)).catch(() => res.status(404).send("Not found"));
+      readFile4(join10(webDir, "public", "__inspect__.js")).then((content) => res.send(content)).catch(() => res.status(404).send("Not found"));
     });
     app.get("/*path", (req, res) => {
       if (req.path.startsWith("/api/")) {
         return;
       }
-      readFile4(join9(webDir, "index.html"), "utf-8").then((indexHtml) => viteServer.transformIndexHtml(req.originalUrl, indexHtml)).then((transformed) => res.send(transformed)).catch((err) => {
+      readFile4(join10(webDir, "index.html"), "utf-8").then((indexHtml) => viteServer.transformIndexHtml(req.originalUrl, indexHtml)).then((transformed) => res.send(transformed)).catch((err) => {
         logger.error("Error serving index.html", { error: err });
         res.status(500).send("Server error");
       });
@@ -6735,10 +7139,10 @@ async function createServerHandle(config3) {
     logger.info("Vite middleware ready", { port: config3.server.port });
   }
   if (!isDev) {
-    const distWebDir = resolve7(__dirname3, "web");
+    const distWebDir = resolve8(__dirname3, "web");
     app.use(
       "/assets",
-      express.static(join9(distWebDir, "assets"), {
+      express.static(join10(distWebDir, "assets"), {
         setHeaders: (res, filepath) => {
           if (filepath.endsWith(".css")) {
             res.set("Content-Type", "text/css");
@@ -6746,11 +7150,11 @@ async function createServerHandle(config3) {
         }
       })
     );
-    app.use("/manifest.webmanifest", express.static(join9(distWebDir, "manifest.webmanifest")));
-    app.use("/registerSW.js", express.static(join9(distWebDir, "registerSW.js")));
-    app.use("/sw.js", express.static(join9(distWebDir, "sw.js")));
+    app.use("/manifest.webmanifest", express.static(join10(distWebDir, "manifest.webmanifest")));
+    app.use("/registerSW.js", express.static(join10(distWebDir, "registerSW.js")));
+    app.use("/sw.js", express.static(join10(distWebDir, "sw.js")));
     app.get("/fox.svg", (_req, res) => {
-      readFile4(join9(distWebDir, "fox.svg")).then((content) => {
+      readFile4(join10(distWebDir, "fox.svg")).then((content) => {
         res.set("Content-Type", "image/svg+xml");
         res.send(content);
       }).catch(() => {
@@ -6759,7 +7163,7 @@ async function createServerHandle(config3) {
     });
     app.use(
       "/sounds",
-      express.static(join9(distWebDir, "sounds"), {
+      express.static(join10(distWebDir, "sounds"), {
         setHeaders: (res) => {
           res.set("Content-Type", "audio/mpeg");
         }
@@ -6768,10 +7172,10 @@ async function createServerHandle(config3) {
     app.use("/__inspect__.js", (_req, res) => {
       res.set("Access-Control-Allow-Origin", "*");
       res.set("Content-Type", "application/javascript");
-      readFile4(join9(distWebDir, "__inspect__.js")).then((content) => res.send(content)).catch(() => res.status(404).send("Not found"));
+      readFile4(join10(distWebDir, "__inspect__.js")).then((content) => res.send(content)).catch(() => res.status(404).send("Not found"));
     });
     app.get("/", (_req, res) => {
-      readFile4(join9(distWebDir, "index.html"), "utf-8").then((content) => res.send(content)).catch(() => {
+      readFile4(join10(distWebDir, "index.html"), "utf-8").then((content) => res.send(content)).catch(() => {
         res.status(404).send("Web UI not built. Run `npm run build:web`");
       });
     });
@@ -6779,7 +7183,7 @@ async function createServerHandle(config3) {
       if (req.path.startsWith("/api/") || req.path.startsWith("/assets/") || req.path.startsWith("/sounds/") || req.path.startsWith("/manifest.webmanifest") || req.path.startsWith("/registerSW.js") || req.path.startsWith("/sw.js") || req.path === "/fox.svg") {
         return;
       }
-      readFile4(join9(distWebDir, "index.html"), "utf-8").then((content) => res.send(content)).catch(() => {
+      readFile4(join10(distWebDir, "index.html"), "utf-8").then((content) => res.send(content)).catch(() => {
         res.status(404).send("Web UI not built");
       });
     });
@@ -6799,7 +7203,7 @@ async function createServerHandle(config3) {
     const state = sessionManager.getContextState(sessionId);
     wssExports.broadcastForSession(sessionId, createContextStateMessage(state));
   });
-  const { QueueProcessor } = await import("./processor-3R4GS6VB.js");
+  const { QueueProcessor } = await import("./processor-UQX5KL56.js");
   const queueProcessor = new QueueProcessor({
     sessionManager,
     providerManager,
@@ -6822,7 +7226,7 @@ async function createServerHandle(config3) {
   return {
     httpServer,
     ctx: { config: config3, sessionManager, llmClient: getLLMClient(), toolRegistry, providerManager },
-    start: (port) => new Promise((resolve8, reject) => {
+    start: (port) => new Promise((resolve9, reject) => {
       const listenPort = port ?? config3.server.port;
       const host = config3.server.host;
       httpServer.listen(listenPort, host, () => {
@@ -6832,16 +7236,16 @@ async function createServerHandle(config3) {
         logger.info(`OpenFox server running at http://${host}:${actualPort}`);
         logger.info(`WebSocket available at ws://${host}:${actualPort}/ws`);
         logger.info(`LLM backend: ${client.getBackend()}, model: ${client.getModel()}, url: ${config3.llm.baseUrl}`);
-        resolve8({ port: actualPort });
+        resolve9({ port: actualPort });
       });
       httpServer.on("error", reject);
     }),
-    close: () => new Promise((resolve8) => {
+    close: () => new Promise((resolve9) => {
       logger.info("Shutting down...");
       void (async () => {
         await devServerManager.stopAll();
         await mcpManager.disconnectAll();
-        const { stopAllInspectProxies } = await import("./inspect-proxy-JHZV34QR.js");
+        const { stopAllInspectProxies } = await import("./inspect-proxy-DRYIIH4O.js");
         stopAllInspectProxies();
         const { cleanupAllProcesses } = await import("./store-SARB6V2N.js");
         cleanupAllProcesses();
@@ -6855,7 +7259,7 @@ async function createServerHandle(config3) {
           client.terminate();
         }
         wss.close();
-        httpServer.close(() => resolve8());
+        httpServer.close(() => resolve9());
       })();
     })
   };
@@ -6879,4 +7283,4 @@ export {
   createServerHandle,
   createServer
 };
-//# sourceMappingURL=chunk-J7VCI5EX.js.map
+//# sourceMappingURL=chunk-UMX7MMNW.js.map