openpond 0.0.64 → 0.0.66

package/dist/chunks/{src-DQFVZZUR.js → src-S77UAM5T.js}

@@ -26,6 +26,7 @@ import {
   createCloudConnectedAppToolExecutor,
   createCrossSystemExpertBootstrapService,
   createEvidenceSnapshot,
+  createHostedSavedWork,
   createHostedTurnHelpers,
   createImproveLimit,
   createImproveTargetKind,
@@ -53,6 +54,7 @@ import {
   createWebFetchModelToolDefinition,
   createWebSearchExecutorFromEnv,
   createWebSearchModelToolDefinition,
+  deleteHostedSavedWork,
   ensureCapabilityToken,
   ensureLocalHarnessRunOverlay,
   ensureSelectedLocalHarnessWorkspace,
@@ -74,6 +76,7 @@ import {
   isBundledAuthoringSkillName,
   isOpenAiCompatibleProviderId,
   linkHarnessReviewTaskset,
+  listHostedSavedWork,
   listOpenAiCompatibleProviderModels,
   listSandboxIntegrationConnections,
   loadBundledAuthoringSkills,
@@ -107,7 +110,6 @@ import {
   readChatAttachmentTextFile,
   readTasksetAuthoringProfileSkill,
   recordLocalHarnessImprovementBoundary,
-  requestOpenPondPublicApi,
   requireQualifiedModelImprovement,
   resolveBenchmarkUpstreamModel,
   resolveContextCompactionAdapter,
@@ -121,6 +123,7 @@ import {
   retryableHostedError,
   reviewSelectedLocalHarnessEvaluation,
   runHostedContextCompaction,
+  runHostedSavedWork,
   runLocalHarnessEvaluationBaseline,
   runLocalHarnessRefinerWorker,
   safeChatAttachmentPathSegment,
@@ -135,6 +138,7 @@ import {
   stringValue,
   trimOutput,
   trustedProviderContextLimit,
+  updateHostedSavedWork,
   uploadLocalProjectCloudSource,
   upsertInternalSandboxProject,
   validateOpenAiCompatibleProvider,
@@ -143,7 +147,7 @@ import {
   workspaceHasHead,
   workspaceToolExperienceBlocker,
   writeWorkspaceFile
-} from "./chunk-HM6Z3PEC.js";
+} from "./chunk-KVUB7HLM.js";
 import {
   appWorkspacePaths,
   checkWorkspaceGitAvailability,
@@ -169,14 +173,14 @@ import {
   runCommand,
   startMacOSCommandLineToolsInstall,
   workspaceImageContentType
-} from "./chunk-57XKCMOZ.js";
+} from "./chunk-ZE7MWXEL.js";
 import {
   runOpenPondServerCli
-} from "./chunk-THYIAXOB.js";
+} from "./chunk-K37ACPJQ.js";
 import {
   createAppServer,
   runAgentCompaction
-} from "./chunk-OYWTQABY.js";
+} from "./chunk-CWCMYSX2.js";
 import {
   APP_PREFERENCES_CACHE_KEY,
   APP_PREFERENCES_CACHE_TYPE,
@@ -188,7 +192,7 @@ import {
   isCliEntrypoint,
   now,
   textFromUnknown
-} from "./chunk-C7TOCBGY.js";
+} from "./chunk-TRRJ6Z4L.js";
 import {
   createOpenPondRepoApp,
   getBundledRuntimeVersion,
@@ -202,7 +206,7 @@ import {
   streamOpenPondHostedChatTurn,
   switchOpenPondAccount,
   updateOpenPondAccountConfig
-} from "./chunk-BRLUAT6S.js";
+} from "./chunk-42WUHGKD.js";
 import {
   AccountStateSchema,
   AdapterValidationReceiptSchema,
@@ -256,7 +260,6 @@ import {
   GithubExtensionError,
   HarnessRunManifestContentSchema,
   HarnessRunManifestSchema,
-  HostedSavedWorkResponseSchema,
   HuggingFaceDatasetInspectionSchema,
   HuggingFaceDatasetLocatorSchema,
   HuggingFaceDatasetSourceRefSchema,
@@ -435,7 +438,7 @@ import {
   workFormatCapabilityForContentType,
   workspacePathFromLocalPathWorkspaceId,
   writeSourceUploadCache
-} from "./chunk-JMHOO2IG.js";
+} from "./chunk-BPII37IS.js";
 import "./chunk-QETF6ILG.js";
 import {
   ArtifactManifestSchema,
@@ -481,7 +484,7 @@ import {
   workEvidenceReceiptRef,
   workSourceOpaqueRef,
   workWorkspaceOpaqueRef
-} from "./chunk-6FZNXLVN.js";
+} from "./chunk-RN7MVPC6.js";
 import {
   external_exports,
   yaml
@@ -2734,7 +2737,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash17 } = __require("crypto");
+    var { randomBytes: randomBytes3, createHash: createHash17 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -3272,7 +3275,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes2(16).toString("base64");
+      const key = randomBytes3(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -14556,6 +14559,10 @@ function codexContextUsageRecord(input) {
     durationMs: 0,
     firstTokenMs: null,
     promptTokens: null,
+    cachedPromptTokens: null,
+    uncachedPromptTokens: null,
+    cacheWritePromptTokens: null,
+    cacheTelemetrySource: null,
     completionTokens: null,
     totalTokens: input.usageSnapshot.usedTokens,
     errorType: null,
@@ -16100,6 +16107,51 @@ function stringMetadata(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 
+// ../server/src/api/client-payload-projection.ts
+var MAX_INLINE_AVATAR_URL_CHARS = 8192;
+function avatarUrlForClient(value) {
+  if (!value?.startsWith("data:")) return value;
+  return value.length <= MAX_INLINE_AVATAR_URL_CHARS ? value : null;
+}
+function accountStateForClient(account) {
+  return {
+    ...account,
+    avatarUrl: avatarUrlForClient(account.avatarUrl),
+    accounts: account.accounts.map((candidate2) => ({
+      ...candidate2,
+      avatarUrl: avatarUrlForClient(candidate2.avatarUrl)
+    })),
+    profile: account.profile ? {
+      ...account.profile,
+      image: avatarUrlForClient(account.profile.image)
+    } : account.profile
+  };
+}
+function profileStateForClient(profile) {
+  return {
+    ...profile,
+    git: profile.git ? {
+      ...profile.git,
+      fileCount: profile.git.fileCount ?? profile.git.files.length,
+      files: []
+    } : null,
+    diff: {
+      ...profile.diff,
+      fileCount: profile.diff.fileCount ?? profile.diff.files.length,
+      files: []
+    }
+  };
+}
+function profileLibraryForClient(library) {
+  return {
+    ...library,
+    profiles: library.profiles.map((entry) => ({
+      ...entry,
+      state: profileStateForClient(entry.state)
+    }))
+  };
+}
+
 // ../server/src/openpond/provider-diagnostics.ts
 import { Buffer as Buffer2 } from "node:buffer";
 var ProviderDiagnosticsTracker = class {
@@ -22055,6 +22107,15 @@ async function buildPublicationPlan(request) {
   };
   if (manifestIndex >= 0) files[manifestIndex] = manifestFile;
   else files.push(manifestFile);
+  const gitignoreFile = {
+    sourcePath: null,
+    relativePath: ".gitignore",
+    contents: Buffer.from(profilePublicationGitignoreContents(profileRoot)),
+    category: "settings"
+  };
+  const gitignoreIndex = files.findIndex((file) => file.relativePath === ".gitignore");
+  if (gitignoreIndex >= 0) files[gitignoreIndex] = gitignoreFile;
+  else files.push(gitignoreFile);
   files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
   const existingTarget = await resolveExistingTarget(request);
   const sourceHash = createHash5("sha256");
@@ -22095,7 +22156,13 @@ async function resolveExistingTarget(request) {
   if (request.target.provider === "github") {
     const owner = request.target.owner?.trim() || await githubLogin();
     const fullName = `${owner}/${request.target.repository}`;
-    const result = await runCommand4("gh", ["repo", "view", fullName, "--json", "url,defaultBranchRef"]);
+    const result = await runCommand4("gh", [
+      "repo",
+      "view",
+      fullName,
+      "--json",
+      "url,defaultBranchRef,isPrivate"
+    ]);
     if (result.code !== 0) return null;
     const parsed = JSON.parse(result.stdout);
     return {
@@ -22103,7 +22170,8 @@ async function resolveExistingTarget(request) {
       repository: request.target.repository,
       remoteUrl: `${parsed.url ?? `https://github.com/${fullName}`}.git`,
       webUrl: parsed.url ?? `https://github.com/${fullName}`,
-      defaultBranch: parsed.defaultBranchRef?.name || "master"
+      defaultBranch: parsed.defaultBranchRef?.name || "master",
+      visibility: typeof parsed.isPrivate === "boolean" ? parsed.isPrivate ? "private" : "public" : void 0
     };
   }
   const apps = await loadOpenPondApps({ limit: 100 });
@@ -22141,14 +22209,9 @@ async function publishToGitHub(exportPath, request, existing) {
     await runRequired("gh", ["auth", "setup-git"]);
     await runRequired("git", ["remote", "add", "origin", existing.remoteUrl], exportPath);
     await runRequired("git", ["push", "--force", "origin", `HEAD:${existing.defaultBranch}`], exportPath);
-    await runRequired("gh", [
-      "repo",
-      "edit",
-      fullName,
-      "--visibility",
-      request.target.visibility,
-      "--accept-visibility-change-consequences"
-    ]);
+    if (existing.visibility !== request.target.visibility) {
+      await updateGitHubRepositoryVisibility(fullName, request.target.visibility);
+    }
   }
   return {
     owner,
@@ -22199,6 +22262,22 @@ async function githubLogin() {
   }
   return result.stdout.trim();
 }
+async function updateGitHubRepositoryVisibility(fullName, visibility) {
+  const args = [
+    "repo",
+    "edit",
+    fullName,
+    "--visibility",
+    visibility,
+    "--accept-visibility-change-consequences"
+  ];
+  const result = await runCommand4("gh", args);
+  if (result.code === 0) return;
+  if (!result.stderr.includes("unknown flag: --accept-visibility-change-consequences")) {
+    throw new Error(result.stderr.trim() || result.stdout.trim() || "gh repo edit failed.");
+  }
+  await runRequired("gh", args.filter((arg) => arg !== "--accept-visibility-change-consequences"));
+}
 function tokenizedRemote(remoteUrl, token) {
   const url = new URL(remoteUrl);
   url.username = "x-access-token";
@@ -22228,6 +22307,13 @@ function normalizePath(value) {
 function profilePublicationRelativePath(profileRoot, childPath) {
   return normalizePath(path18.posix.join(profileRoot || ".", normalizePath(childPath)));
 }
+function profilePublicationGitignoreContents(profileRoot) {
+  return [
+    "# Generated OpenPond runtime state is local to each installation.",
+    `${profilePublicationRelativePath(profileRoot, ".openpond")}/`,
+    ""
+  ].join("\n");
+}
 async function runRequired(command, args, cwd, env) {
   const result = await runCommand4(command, args, cwd, env);
   if (result.code !== 0) throw new Error(result.stderr.trim() || result.stdout.trim() || `${command} failed.`);
@@ -22347,21 +22433,24 @@ async function runGit(args) {
 function createProfilePayloads(deps) {
   const { appendRuntimeEvent } = deps;
   async function profileCurrentPayload() {
-    return loadOpenPondProfileState();
+    return profileStateForClient(await loadOpenPondProfileState());
   }
   async function profileCatalogPayload() {
-    return loadOpenPondProfileLibrary();
+    return profileLibraryForClient(await loadOpenPondProfileLibrary());
   }
   async function profileSelectPayload(payload) {
     const input = asRecord(payload);
     const ref = OpenPondProfileRefSchema.parse(input.ref ?? input);
     const profile = await selectOpenPondProfile(ref);
-    return { profile, library: await loadOpenPondProfileLibrary() };
+    return {
+      profile: profileStateForClient(profile),
+      library: profileLibraryForClient(await loadOpenPondProfileLibrary())
+    };
   }
   async function profileRemovePayload(payload) {
     const input = asRecord(payload);
     const ref = OpenPondProfileRefSchema.parse(input.ref ?? input);
-    return removeOpenPondProfile(ref);
+    return profileLibraryForClient(await removeOpenPondProfile(ref));
   }
   async function profilePublicationPreviewPayload(payload) {
     return previewOpenPondProfilePublication(payload);
@@ -22389,13 +22478,19 @@ function createProfilePayloads(deps) {
       url: stringValue(input.url),
       profile: stringValue(input.profile)
     });
-    return { profile: state, library: await loadOpenPondProfileLibrary() };
+    return {
+      profile: profileStateForClient(state),
+      library: profileLibraryForClient(await loadOpenPondProfileLibrary())
+    };
   }
   async function profileUpdatePayload(payload) {
     const input = asRecord(payload);
     const ref = OpenPondProfileRefSchema.parse(input.ref ?? input);
     const state = await updateInstalledOpenPondProfile(ref);
-    return { profile: state, library: await loadOpenPondProfileLibrary() };
+    return {
+      profile: profileStateForClient(state),
+      library: profileLibraryForClient(await loadOpenPondProfileLibrary())
+    };
   }
   async function profileInitPayload(payload) {
     const input = asRecord(payload);
@@ -22414,7 +22509,7 @@ function createProfilePayloads(deps) {
         output: `Initialized OpenPond profile ${state.activeProfile ?? "default"}.`
       })
     );
-    return state;
+    return profileStateForClient(state);
   }
   async function profileLoadPayload(payload) {
     const input = asRecord(payload);
@@ -22433,7 +22528,7 @@ function createProfilePayloads(deps) {
         output: `Loaded OpenPond profile ${state.activeProfile ?? "default"}.`
       })
     );
-    return state;
+    return profileStateForClient(state);
   }
   async function profileCheckPayload(payload) {
     const input = asRecord(payload);
@@ -22449,7 +22544,7 @@ function createProfilePayloads(deps) {
         output: `Profile check completed for ${kind}.`
       })
     );
-    return state;
+    return profileStateForClient(state);
   }
   async function profileRenameAgentPayload(agentId, payload) {
     const input = asRecord(payload);
@@ -22465,7 +22560,7 @@ function createProfilePayloads(deps) {
         output: `Renamed Profile agent ${agentId} to ${name.trim()}.`
       })
     );
-    return state;
+    return profileStateForClient(state);
   }
   async function profileCommitPayload(payload) {
     const input = asRecord(payload);
@@ -23667,7 +23762,7 @@ function createServerPayloads(deps) {
         version,
         runtimeVersion
       },
-      account: openPond.account,
+      account: accountStateForClient(openPond.account),
       codex,
       preferences,
       providers,
@@ -23675,8 +23770,8 @@ function createServerPayloads(deps) {
       apps: openPond.apps,
       localProjects: linkedLocalProjects,
       cloudProjects,
-      profile,
-      profileLibrary,
+      profile: profileStateForClient(profile),
+      profileLibrary: profileLibraryForClient(profileLibrary),
       codexPersonalSkills,
       extensionCatalog,
       codexHistorySessions: validBootstrapSessions(
@@ -24483,7 +24578,8 @@ async function usageSummaryPayload(input) {
     commands: commandBreakdowns(records),
     routes: routeBreakdowns(records),
     statuses: statusBreakdowns(records),
-    sources: sourceBreakdowns(records)
+    sources: sourceBreakdowns(records),
+    cohorts: cacheCohortBreakdowns(records)
   };
   return UsageSummaryResponseSchema.parse(response);
 }
@@ -24571,6 +24667,7 @@ function usageTotals(records, rangeEnd) {
     failedRequests,
     missingUsageRequests,
     promptTokens: nullableTokenTotal(totals.promptTokens, totals.promptTokenRows),
+    ...cacheTotals(totals),
     completionTokens: nullableTokenTotal(totals.completionTokens, totals.completionTokenRows),
     totalTokens: nullableTokenTotal(totals.totalTokens, totals.totalTokenRows),
     averageLatencyMs: average(totals.durations),
@@ -24751,11 +24848,53 @@ function sourceBreakdowns(records) {
     ...breakdownTotals(totals)
   })).sort(breakdownSort);
 }
+function cacheCohortBreakdowns(records) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const record11 of records) {
+    const cohort = cacheCohortForRequest(record11);
+    const totals = groups.get(cohort) ?? accumulator();
+    addRecord(totals, record11);
+    groups.set(cohort, totals);
+  }
+  return [...groups.entries()].map(([cohort, totals]) => ({
+    cohort,
+    ...breakdownTotals(totals)
+  })).sort(breakdownSort);
+}
+function cacheCohortForRequest(record11) {
+  switch (record11.requestKind) {
+    case "chat_turn":
+    case "slash_command":
+    case "create_improve_planner":
+      return "foreground";
+    case "tool_loop":
+      return "tool_loop";
+    case "context_compaction":
+      return "compaction";
+    case "subagent":
+      return "subagent";
+    case "harness_refiner":
+      return "refiner";
+    case "codex_context":
+    case "other":
+      return "other";
+  }
+}
 function accumulator() {
   return {
     requests: 0,
     promptTokens: 0,
     promptTokenRows: 0,
+    cacheTelemetryRequests: 0,
+    cacheHitRequests: 0,
+    cachedPromptTokens: 0,
+    cachedPromptTokenRows: 0,
+    uncachedPromptTokens: 0,
+    uncachedPromptTokenRows: 0,
+    cacheWritePromptTokens: 0,
+    cacheWritePromptTokenRows: 0,
+    cacheRateCachedTokens: 0,
+    cacheRatePromptTokens: 0,
     completionTokens: 0,
     completionTokenRows: 0,
     totalTokens: 0,
@@ -24773,6 +24912,26 @@ function addRecord(accumulator2, record11) {
     accumulator2.promptTokens += record11.promptTokens;
     accumulator2.promptTokenRows += 1;
   }
+  if (record11.cacheTelemetrySource !== null && record11.promptTokens !== null) {
+    accumulator2.cacheTelemetryRequests += 1;
+    if ((record11.cachedPromptTokens ?? 0) > 0) accumulator2.cacheHitRequests += 1;
+  }
+  if (record11.cachedPromptTokens !== null) {
+    accumulator2.cachedPromptTokens += record11.cachedPromptTokens;
+    accumulator2.cachedPromptTokenRows += 1;
+  }
+  if (record11.uncachedPromptTokens !== null) {
+    accumulator2.uncachedPromptTokens += record11.uncachedPromptTokens;
+    accumulator2.uncachedPromptTokenRows += 1;
+  }
+  if (record11.cacheWritePromptTokens !== null) {
+    accumulator2.cacheWritePromptTokens += record11.cacheWritePromptTokens;
+    accumulator2.cacheWritePromptTokenRows += 1;
+  }
+  if (record11.cachedPromptTokens !== null && record11.uncachedPromptTokens !== null) {
+    accumulator2.cacheRateCachedTokens += record11.cachedPromptTokens;
+    accumulator2.cacheRatePromptTokens += record11.cachedPromptTokens + record11.uncachedPromptTokens;
+  }
   if (record11.completionTokens !== null) {
     accumulator2.completionTokens += record11.completionTokens;
     accumulator2.completionTokenRows += 1;
@@ -24795,6 +24954,7 @@ function breakdownTotals(accumulator2) {
   return {
     requests: accumulator2.requests,
     promptTokens: nullableTokenTotal(accumulator2.promptTokens, accumulator2.promptTokenRows),
+    ...cacheTotals(accumulator2),
     completionTokens: nullableTokenTotal(accumulator2.completionTokens, accumulator2.completionTokenRows),
     totalTokens: nullableTokenTotal(accumulator2.totalTokens, accumulator2.totalTokenRows),
     averageLatencyMs: average(accumulator2.durations),
@@ -24807,10 +24967,47 @@ function breakdownTotals(accumulator2) {
     lastSeenAt: accumulator2.lastSeenAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
   };
 }
+function cacheTotals(accumulator2) {
+  return {
+    cacheTelemetryRequests: accumulator2.cacheTelemetryRequests,
+    cacheHitRequests: accumulator2.cacheHitRequests,
+    cachedPromptTokens: nullableTokenTotal(
+      accumulator2.cachedPromptTokens,
+      accumulator2.cachedPromptTokenRows
+    ),
+    uncachedPromptTokens: nullableTokenTotal(
+      accumulator2.uncachedPromptTokens,
+      accumulator2.uncachedPromptTokenRows
+    ),
+    cacheWritePromptTokens: nullableTokenTotal(
+      accumulator2.cacheWritePromptTokens,
+      accumulator2.cacheWritePromptTokenRows
+    ),
+    cacheHitRate: ratioOrNull(
+      accumulator2.cacheRateCachedTokens,
+      accumulator2.cacheRatePromptTokens
+    ),
+    cacheRequestHitRate: ratioOrNull(
+      accumulator2.cacheHitRequests,
+      accumulator2.cacheTelemetryRequests
+    ),
+    cacheTelemetryCoverage: ratioOrZero(
+      accumulator2.cacheTelemetryRequests,
+      accumulator2.promptTokenRows
+    )
+  };
+}
 function failureRate(failures, requests) {
   if (requests <= 0) return 0;
   return Number((failures / requests).toFixed(4));
 }
+function ratioOrNull(numerator, denominator) {
+  if (denominator <= 0) return null;
+  return Number((numerator / denominator).toFixed(4));
+}
+function ratioOrZero(numerator, denominator) {
+  return ratioOrNull(numerator, denominator) ?? 0;
+}
 function nullableTokenTotal(total, rows) {
   return rows > 0 ? total : null;
 }
@@ -28544,12 +28741,39 @@ function normalizeRoutePath(pathValue) {
 }
 
 // ../server/src/api/static-web.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
 import { createReadStream as createReadStream5 } from "node:fs";
 import { promises as fs12 } from "node:fs";
 import path24 from "node:path";
 var API_PATH_PREFIXES = ["/v1/"];
 var API_PATHS = /* @__PURE__ */ new Set(["/health"]);
 var ONE_YEAR_SECONDS = 31536e3;
+function staticSecurityHeaders() {
+  return {
+    "Referrer-Policy": "no-referrer",
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "DENY"
+  };
+}
+function indexSecurityHeaders(nonce) {
+  return {
+    ...staticSecurityHeaders(),
+    "Content-Security-Policy": [
+      "default-src 'self'",
+      `script-src 'self' 'nonce-${nonce}'`,
+      "style-src 'self' 'unsafe-inline'",
+      "img-src 'self' data: blob: https:",
+      "font-src 'self' data:",
+      "media-src 'self' data: blob: https:",
+      "connect-src 'self' http: https: ws: wss:",
+      "worker-src 'self' blob:",
+      "object-src 'none'",
+      "base-uri 'none'",
+      "frame-ancestors 'none'",
+      "form-action 'self'"
+    ].join("; ")
+  };
+}
 var MIME_TYPES = {
   ".css": "text/css; charset=utf-8",
   ".gif": "image/gif",
@@ -28604,6 +28828,7 @@ function cacheControl(filePath) {
 }
 function sendFile(request, response, filePath, stat7) {
   response.writeHead(200, {
+    ...staticSecurityHeaders(),
     "Content-Length": stat7.size,
     "Content-Type": contentType(filePath),
     "Cache-Control": cacheControl(filePath)
@@ -28628,8 +28853,9 @@ async function sendIndex({
   token
 }) {
   let html = await fs12.readFile(indexPath, "utf8");
+  const nonce = randomBytes2(18).toString("base64url");
   if (isLoopbackHost(requestUrl.hostname)) {
-    const connectionScript = `<script>window.__OPENPOND_WEB_CONNECTION__=${escapeScriptJson(
+    const connectionScript = `<script nonce="${nonce}">window.__OPENPOND_WEB_CONNECTION__=${escapeScriptJson(
       JSON.stringify({
         serverUrl: requestUrl.origin,
         token
@@ -28641,6 +28867,7 @@ ${html}`;
   }
   const body = Buffer.from(html, "utf8");
   response.writeHead(200, {
+    ...indexSecurityHeaders(nonce),
     "Content-Length": body.byteLength,
     "Content-Type": "text/html; charset=utf-8",
     "Cache-Control": "no-cache"
@@ -28653,6 +28880,7 @@ ${html}`;
 }
 function sendNotFound(response) {
   response.writeHead(404, {
+    ...staticSecurityHeaders(),
     "Content-Type": "text/plain; charset=utf-8",
     "Cache-Control": "no-cache"
   });
@@ -35717,60 +35945,6 @@ function createServerWorkspaceWorkflows(deps) {
   };
 }
 
-// ../server/src/openpond/saved-work.ts
-async function listHostedSavedWork() {
-  const payload = HostedSavedWorkResponseSchema.parse(
-    await requestOpenPondPublicApi({ path: "/saved-work" })
-  );
-  return {
-    ...payload,
-    webBaseUrl: hostedWebBaseUrl()
-  };
-}
-async function createHostedSavedWork(input) {
-  const body = CreateHostedSavedWorkRequestSchema.parse(input);
-  return requestOpenPondPublicApi({
-    path: "/saved-work",
-    method: "POST",
-    body
-  });
-}
-async function updateHostedSavedWork(scheduleId, input) {
-  const body = UpdateHostedSavedWorkRequestSchema.parse(input);
-  return requestOpenPondPublicApi({
-    path: `/saved-work/schedules/${encodeURIComponent(scheduleId)}`,
-    method: "PATCH",
-    body
-  });
-}
-async function deleteHostedSavedWork(scheduleId) {
-  return requestOpenPondPublicApi({
-    path: `/saved-work/schedules/${encodeURIComponent(scheduleId)}`,
-    method: "DELETE"
-  });
-}
-async function runHostedSavedWork(scheduleId, clientRequestId) {
-  return requestOpenPondPublicApi({
-    path: `/saved-work/schedules/${encodeURIComponent(scheduleId)}/run`,
-    method: "POST",
-    body: { clientRequestId }
-  });
-}
-function hostedWebBaseUrl(env = process.env) {
-  const configured = env.OPENPOND_HOSTED_WEB_URL?.trim() || env.OPENPOND_SANDBOX_BASE_URL?.trim() || env.OPENPOND_API_URL?.trim() || env.OPENPOND_SANDBOX_API_URL?.trim() || "https://api.openpond.ai";
-  const url = new URL(configured);
-  if (url.hostname === "staging-api.openpond.ai" || url.hostname.endsWith(".staging-api.openpond.ai")) {
-    return "https://staging.openpond.ai";
-  }
-  if (url.hostname === "api.openpond.ai" || url.hostname.endsWith(".api.openpond.ai")) {
-    return "https://openpond.ai";
-  }
-  url.pathname = "";
-  url.search = "";
-  url.hash = "";
-  return url.origin;
-}
-
 // ../server/src/remote-access/tailscale.ts
 import { execFile as execFile5 } from "node:child_process";
 import { existsSync as existsSync11 } from "node:fs";
@@ -53944,6 +54118,7 @@ async function createOpenPondServer(options = {}) {
         messages: input.messages,
         tools: input.tools,
         toolChoice: input.toolChoice,
+        maxOutputTokens: input.maxOutputTokens,
         requestId: input.requestId,
         signal: input.signal,
         saveChatGptSubscriptionCredential: async (providerId, credential) => {
@@ -54291,6 +54466,7 @@ async function createOpenPondServer(options = {}) {
             sourceEventCount: result.sourceEventCount,
             preservedEventCount: result.preservedEventCount,
             fileLedger: result.fileLedger,
+            continuationCapsule: result.continuationCapsule,
             inputTokensBefore: result.inputTokensBefore,
             inputTokensAfter: result.inputTokensAfter,
             maxContextTokens: result.maxContextTokens,