openwork-server 0.18.57 → 0.18.59

package/dist/opencode-plugins/openwork-provider-sync-v2.js

@@ -0,0 +1,3880 @@
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// ../../packages/opencode-plugin/src/den.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeBaseUrl(value) {
+  let end = value.length;
+  while (end > 0 && /\s/.test(value[end - 1] ?? ""))
+    end--;
+  while (end > 0 && value[end - 1] === "/")
+    end--;
+  return value.slice(0, end).trim();
+}
+function isAllowedApiBaseUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.username || url.password)
+    return false;
+  return url.protocol === "https:" || url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+}
+function assertAllowedApiBaseUrl(value) {
+  if (!isAllowedApiBaseUrl(value))
+    throw new DenUrlError(value);
+}
+async function readJson(response) {
+  const text = await response.text();
+  if (!text.trim())
+    return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+async function postPublic(fetcher, apiBaseUrl, path, body) {
+  assertAllowedApiBaseUrl(apiBaseUrl);
+  const response = await fetcher(`${normalizeBaseUrl(apiBaseUrl)}${path}`, {
+    method: "POST",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify(body),
+    redirect: "error",
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+  });
+  return { status: response.status, body: await readJson(response), retryAfter: response.headers.get("retry-after") };
+}
+async function denRequest(fetcher, session, path, init = {}) {
+  assertAllowedApiBaseUrl(session.apiBaseUrl);
+  const headers = {
+    accept: "application/json",
+    authorization: `Bearer ${session.token}`
+  };
+  if (session.orgId) {
+    headers["x-openwork-org-id"] = session.orgId;
+    headers["x-openwork-legacy-org-id"] = session.orgId;
+  }
+  if (init.body !== undefined)
+    headers["content-type"] = "application/json";
+  const response = await fetcher(`${normalizeBaseUrl(session.apiBaseUrl)}${path}`, {
+    method: init.method ?? "GET",
+    headers,
+    body: init.body === undefined ? undefined : JSON.stringify(init.body),
+    redirect: "error",
+    signal: init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]) : AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+  });
+  const body = await readJson(response);
+  if (response.status === 401)
+    throw new DenAuthError(response.status, path);
+  if (!response.ok)
+    throw new DenRequestError(response.status, path, body);
+  return body;
+}
+function readString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function readTime(value) {
+  const text = readString(value);
+  if (!text)
+    return null;
+  const time = Date.parse(text);
+  return Number.isFinite(time) ? time : null;
+}
+async function readMe(fetcher, session) {
+  const body = await denRequest(fetcher, session, "/v1/me");
+  if (!isRecord(body) || !isRecord(body.user))
+    throw new DenRequestError(200, "/v1/me", body);
+  const session_ = isRecord(body.session) ? body.session : {};
+  return {
+    userId: readString(body.user.id) ?? "",
+    email: readString(body.user.email) ?? "",
+    sessionExpiresAt: readTime(session_.expiresAt),
+    activeOrganizationId: readString(session_.activeOrganizationId)
+  };
+}
+async function readAccount(fetcher, session) {
+  const me = await readMe(fetcher, session);
+  const orgId = session.orgId ?? me.activeOrganizationId;
+  const orgs = await denRequest(fetcher, { ...session, orgId }, "/v1/me/orgs");
+  let org = null;
+  if (isRecord(orgs) && Array.isArray(orgs.orgs)) {
+    const list = orgs.orgs.filter(isRecord);
+    const activeId = readString(orgs.activeOrgId) ?? orgId;
+    org = list.find((entry) => entry.id === activeId) ?? list.find((entry) => entry.isActive === true) ?? null;
+  }
+  return {
+    userId: me.userId,
+    email: me.email,
+    sessionExpiresAt: me.sessionExpiresAt,
+    orgId: (org && readString(org.id)) ?? orgId,
+    orgName: org ? readString(org.name) ?? readString(org.slug) : null,
+    orgSlug: org ? readString(org.slug) : null
+  };
+}
+async function signOut(fetcher, apiBaseUrl, token) {
+  if (!isAllowedApiBaseUrl(apiBaseUrl))
+    return false;
+  try {
+    const response = await fetcher(`${normalizeBaseUrl(apiBaseUrl)}/api/auth/sign-out`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: "{}",
+      redirect: "error",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+var DenAuthError, DenRequestError, REQUEST_TIMEOUT_MS = 1e4, LOOPBACK_HOSTS, DenUrlError;
+var init_den = __esm(() => {
+  DenAuthError = class DenAuthError extends Error {
+    status;
+    constructor(status, path) {
+      super(`OpenWork rejected the sign-in (${status} on ${path}). Sign in again: opencode auth login openwork`);
+      this.name = "DenAuthError";
+      this.status = status;
+    }
+  };
+  DenRequestError = class DenRequestError extends Error {
+    status;
+    body;
+    constructor(status, path, body) {
+      super(`OpenWork request failed (${status} on ${path})`);
+      this.name = "DenRequestError";
+      this.status = status;
+      this.body = body;
+    }
+  };
+  LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]"]);
+  DenUrlError = class DenUrlError extends Error {
+    constructor(value) {
+      super(`Refusing to send the OpenWork sign-in to ${value}: use an https:// address.`);
+      this.name = "DenUrlError";
+    }
+  };
+});
+
+// ../../packages/opencode-plugin/src/device.ts
+function formatUserCode(value) {
+  const clean = value.replace(/[\s-]/g, "").toUpperCase();
+  return clean.length === 8 ? `${clean.slice(0, 4)}-${clean.slice(4)}` : clean;
+}
+function errorCode(body) {
+  return isRecord(body) && typeof body.error === "string" ? body.error : null;
+}
+async function startDeviceAuthorization(input) {
+  const now = input.now ?? Date.now;
+  const clientIds = input.clientIds ?? [DEVICE_CLIENT_ID, FALLBACK_DEVICE_CLIENT_ID];
+  let last = null;
+  for (const clientId of clientIds) {
+    const started = await postPublic(input.fetcher, input.apiBaseUrl, "/api/auth/device/code", { client_id: clientId });
+    last = started;
+    if (started.status === 400 && errorCode(started.body) === "invalid_client")
+      continue;
+    const body = started.body;
+    if (started.status !== 200 || !isRecord(body) || typeof body.device_code !== "string" || typeof body.user_code !== "string") {
+      break;
+    }
+    const verificationUri = typeof body.verification_uri === "string" ? body.verification_uri : `${normalizeBaseUrl(input.apiBaseUrl)}/device`;
+    const verificationUriComplete = typeof body.verification_uri_complete === "string" ? body.verification_uri_complete : `${verificationUri}?user_code=${encodeURIComponent(body.user_code)}`;
+    const interval = Number(body.interval);
+    const expiresIn = Number(body.expires_in);
+    return {
+      clientId,
+      deviceCode: body.device_code,
+      userCode: formatUserCode(body.user_code),
+      verificationUri,
+      verificationUriComplete,
+      intervalMs: Math.max(1, Number.isFinite(interval) ? interval : 5) * 1000,
+      expiresAt: now() + (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : 900) * 1000
+    };
+  }
+  throw new DeviceFlowError(`Could not start OpenWork sign-in (${last?.status ?? "no response"}${errorCode(last?.body) ? `: ${errorCode(last?.body)}` : ""}).`);
+}
+function timerWaker() {
+  let wake = null;
+  return {
+    wait(ms) {
+      return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+          wake = null;
+          resolve();
+        }, ms);
+        wake = () => {
+          clearTimeout(timer);
+          wake = null;
+          resolve();
+        };
+      });
+    },
+    wake() {
+      wake?.();
+    }
+  };
+}
+function retryAfterMs(value, now) {
+  if (!value)
+    return 0;
+  const trimmed = value.trim();
+  if (/^\d+$/.test(trimmed)) {
+    const milliseconds = Number(trimmed) * 1000;
+    return Number.isFinite(milliseconds) ? milliseconds : 0;
+  }
+  if (!/^(?:[A-Za-z]{3}, |[A-Za-z]+, \d{2}-|[A-Za-z]{3} [A-Za-z]{3} )/.test(trimmed))
+    return 0;
+  const date = Date.parse(/^[A-Za-z]{3} [A-Za-z]{3} /.test(trimmed) ? `${trimmed} GMT` : trimmed);
+  return Number.isFinite(date) ? Math.max(0, date - now) : 0;
+}
+async function pollDeviceToken(input) {
+  const now = input.now ?? Date.now;
+  const waker = input.waker ?? timerWaker();
+  let intervalMs = input.authorization.intervalMs;
+  let cooldownUntil = 0;
+  while (now() < input.authorization.expiresAt) {
+    await waker.wait(Math.min(Math.max(intervalMs, cooldownUntil - now()), Math.max(0, input.authorization.expiresAt - now())));
+    if (input.isCancelled?.())
+      throw new DeviceFlowError("Sign-in was cancelled.");
+    while (now() < cooldownUntil && now() < input.authorization.expiresAt) {
+      await waker.wait(Math.min(cooldownUntil, input.authorization.expiresAt) - now());
+      if (input.isCancelled?.())
+        throw new DeviceFlowError("Sign-in was cancelled.");
+    }
+    if (now() >= input.authorization.expiresAt)
+      break;
+    const polled = await postPublic(input.fetcher, input.apiBaseUrl, "/api/auth/device/token", {
+      grant_type: DEVICE_CODE_GRANT,
+      device_code: input.authorization.deviceCode,
+      client_id: input.authorization.clientId
+    });
+    if (polled.status === 200 && isRecord(polled.body) && typeof polled.body.access_token === "string") {
+      return polled.body.access_token;
+    }
+    const error = errorCode(polled.body);
+    if (error === "access_denied")
+      throw new DeviceFlowError("Sign-in was denied in the browser.");
+    if (error === "expired_token")
+      break;
+    if (polled.status === 429 || error === "slow_down") {
+      intervalMs += 5000;
+      if (polled.status === 429)
+        cooldownUntil = now() + Math.max(intervalMs, retryAfterMs(polled.retryAfter, now()));
+      continue;
+    }
+    if (error === "authorization_pending")
+      continue;
+    throw new DeviceFlowError(`OpenWork sign-in failed (${polled.status}${error ? `: ${error}` : ""}).`);
+  }
+  throw new DeviceFlowError("The sign-in code expired before it was approved. Run the sign-in again.");
+}
+var DEVICE_CLIENT_ID = "openwork-opencode-plugin", FALLBACK_DEVICE_CLIENT_ID = "openwork-cli", DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code", DeviceFlowError;
+var init_device = __esm(() => {
+  init_den();
+  DeviceFlowError = class DeviceFlowError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "DeviceFlowError";
+    }
+  };
+});
+
+// ../../packages/opencode-plugin/src/loopback.ts
+import { createServer } from "node:http";
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (char) => `&#${char.charCodeAt(0)};`);
+}
+function returnPageHtml(result) {
+  const title = result === "approved" ? "OpenCode is connected to OpenWork" : result === "denied" ? "Sign-in cancelled" : "Finish signing in";
+  const line = result === "approved" ? "You can close this tab and go back to OpenCode." : result === "denied" ? "OpenCode did not get access. You can close this tab." : "Approve the sign-in on the OpenWork page, then come back to OpenCode.";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { margin: 0; min-height: 100vh; display: grid; place-items: center; font: 15px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; background: Canvas; color: CanvasText; }
+  main { max-width: 420px; padding: 32px; text-align: center; }
+  h1 { font-size: 20px; line-height: 28px; font-weight: 600; margin: 0 0 8px; }
+  p { margin: 0; opacity: 0.72; }
+</style>
+</head>
+<body>
+<main>
+<h1>${escapeHtml(title)}</h1>
+<p>${escapeHtml(line)}</p>
+</main>
+</body>
+</html>`;
+}
+async function startReturnPage(onResult) {
+  const server = createServer((request, response) => {
+    const url = new URL(request.url ?? "/", "http://127.0.0.1");
+    if (request.method !== "GET" || url.pathname !== CALLBACK_PATH) {
+      response.writeHead(404, { "content-type": "text/plain; charset=utf-8" }).end("Not found");
+      return;
+    }
+    const raw = url.searchParams.get("result");
+    const result = raw === "approved" || raw === "denied" ? raw : null;
+    response.writeHead(200, {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store",
+      "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'",
+      "referrer-policy": "no-referrer"
+    }).end(returnPageHtml(result));
+    if (result)
+      onResult(result);
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve());
+  });
+  server.unref();
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : 0;
+  let closed = false;
+  return {
+    url: `http://127.0.0.1:${port}${CALLBACK_PATH}`,
+    close() {
+      if (closed)
+        return;
+      closed = true;
+      server.close();
+      server.closeAllConnections?.();
+    }
+  };
+}
+var CALLBACK_PATH = "/openwork/callback";
+var init_loopback = () => {};
+
+// ../../packages/opencode-plugin/src/auth.ts
+function readCredentialMetadata(credential, fallbackApiBaseUrl) {
+  const metadata = credential.metadata ?? {};
+  const text = (key) => typeof metadata[key] === "string" && metadata[key] ? String(metadata[key]) : null;
+  return {
+    apiBaseUrl: text("apiBaseUrl") ?? fallbackApiBaseUrl,
+    orgId: text("orgId"),
+    orgName: text("orgName"),
+    orgSlug: text("orgSlug"),
+    email: text("email") ?? "",
+    deviceClientId: text("deviceClientId") ?? ""
+  };
+}
+function credentialLabel(credential) {
+  const metadata = credential.metadata ?? {};
+  const email = typeof metadata.email === "string" ? metadata.email : "";
+  const org = typeof metadata.orgName === "string" ? metadata.orgName : "";
+  const label = [email, org].filter(Boolean).join(" · ");
+  return label || undefined;
+}
+async function finish(input) {
+  const token = await pollDeviceToken({
+    fetcher: input.fetcher,
+    apiBaseUrl: input.apiBaseUrl,
+    authorization: input.authorization,
+    waker: { wait: input.wait },
+    now: input.now
+  });
+  const account = await readAccount(input.fetcher, { apiBaseUrl: input.apiBaseUrl, token, orgId: null });
+  const metadata = {
+    apiBaseUrl: input.apiBaseUrl,
+    orgId: account.orgId,
+    orgName: account.orgName,
+    orgSlug: account.orgSlug,
+    email: account.email,
+    deviceClientId: input.authorization.clientId
+  };
+  return {
+    type: "oauth",
+    methodID: input.methodID,
+    access: token,
+    refresh: token,
+    expires: account.sessionExpiresAt ?? input.now() + FALLBACK_SESSION_MS,
+    metadata: { ...metadata }
+  };
+}
+function withReturnTo(verificationUriComplete, returnTo) {
+  const url = new URL(verificationUriComplete);
+  url.searchParams.set("return_to", returnTo);
+  return url.toString();
+}
+function signInMethods(input) {
+  const now = input.now ?? Date.now;
+  const refresh = async (credential) => {
+    const metadata = readCredentialMetadata(credential, input.apiBaseUrl());
+    try {
+      const me = await readMe(input.fetcher, { apiBaseUrl: metadata.apiBaseUrl, token: credential.access, orgId: metadata.orgId });
+      return { ...credential, expires: me.sessionExpiresAt ?? now() + FALLBACK_SESSION_MS };
+    } catch (error) {
+      if (error instanceof DenAuthError)
+        throw error;
+      return { ...credential, expires: now() + RETRY_REFRESH_MS };
+    }
+  };
+  const code = {
+    integrationID: INTEGRATION_ID,
+    method: { id: CODE_METHOD_ID, type: "oauth", label: "Code (SSH or headless)" },
+    async authorize() {
+      const apiBaseUrl = input.apiBaseUrl();
+      const authorization = await startDeviceAuthorization({ fetcher: input.fetcher, apiBaseUrl, now });
+      const waker = timerWaker();
+      return {
+        mode: "auto",
+        url: authorization.verificationUriComplete,
+        instructions: `Open the link and confirm the code ${authorization.userCode}`,
+        expiresAt: authorization.expiresAt,
+        callback: finish({ fetcher: input.fetcher, apiBaseUrl, methodID: CODE_METHOD_ID, authorization, wait: waker.wait, now })
+      };
+    },
+    refresh,
+    label: credentialLabel
+  };
+  const browser = {
+    integrationID: INTEGRATION_ID,
+    method: { id: BROWSER_METHOD_ID, type: "oauth", label: "Browser" },
+    async authorize() {
+      const apiBaseUrl = input.apiBaseUrl();
+      const authorization = await startDeviceAuthorization({ fetcher: input.fetcher, apiBaseUrl, now });
+      const waker = timerWaker();
+      const page = await startReturnPage(() => waker.wake());
+      const callback = finish({ fetcher: input.fetcher, apiBaseUrl, methodID: BROWSER_METHOD_ID, authorization, wait: waker.wait, now });
+      const closeLater = () => setTimeout(() => page.close(), 30000).unref();
+      callback.then(closeLater, closeLater);
+      return {
+        mode: "auto",
+        url: withReturnTo(authorization.verificationUriComplete, page.url),
+        instructions: `Sign in to OpenWork in your browser (code ${authorization.userCode})`,
+        expiresAt: authorization.expiresAt,
+        callback
+      };
+    },
+    refresh,
+    label: credentialLabel
+  };
+  return [browser, code];
+}
+var INTEGRATION_ID = "openwork", INTEGRATION_NAME = "OpenWork Cloud", BROWSER_METHOD_ID = "browser", CODE_METHOD_ID = "code", FALLBACK_SESSION_MS, RETRY_REFRESH_MS;
+var init_auth = __esm(() => {
+  init_den();
+  init_device();
+  init_loopback();
+  FALLBACK_SESSION_MS = 6 * 24 * 60 * 60 * 1000;
+  RETRY_REFRESH_MS = 15 * 60 * 1000;
+});
+
+// ../../packages/remote-sessions/src/types.ts
+function emptyJournal() {
+  return { version: 1, commands: [], requests: [] };
+}
+var MAX_COMMAND_ENTRIES = 256, MAX_REQUEST_ENTRIES = 256, REQUEST_RESULT_MAX_BYTES, DEFAULT_OPERATION_TIMEOUT_MS = 15000, SessionRunnerError;
+var init_types = __esm(() => {
+  REQUEST_RESULT_MAX_BYTES = 256 * 1024;
+  SessionRunnerError = class SessionRunnerError extends Error {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.name = "SessionRunnerError";
+      this.code = code;
+    }
+  };
+});
+
+// ../../packages/remote-sessions/src/protocol.ts
+function invalid() {
+  throw new SessionRunnerError("invalid_data", "Invalid remote-session protocol or journal data.");
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function object(value) {
+  if (!isObject(value))
+    return invalid();
+  return value;
+}
+function keys(value, names) {
+  if (Object.keys(value).some((key) => !names.includes(key)))
+    invalid();
+}
+function rawText(value, max, min = 1) {
+  if (typeof value !== "string" || value.length < min || value.length > max)
+    return invalid();
+  return value;
+}
+function text(value, max, min = 1) {
+  if (typeof value !== "string")
+    return invalid();
+  return rawText(min > 0 ? value.trim() : value, max, min);
+}
+function integer(value, min = 0, max = Number.MAX_SAFE_INTEGER) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < min || value > max)
+    return invalid();
+  return value;
+}
+function boolean(value) {
+  if (typeof value !== "boolean")
+    return invalid();
+  return value;
+}
+function nullable(value, parse) {
+  return value === null ? null : parse(value);
+}
+function array(value, max, parse) {
+  if (!Array.isArray(value) || value.length > max)
+    return invalid();
+  return value.map(parse);
+}
+function engine(value) {
+  if (value !== "v1" && value !== "v2")
+    return invalid();
+  return value;
+}
+function status(value) {
+  if (value !== "running" && value !== "waiting" && value !== "idle" && value !== "error")
+    return invalid();
+  return value;
+}
+function waiting(value) {
+  if (value !== null && value !== "permission" && value !== "question")
+    return invalid();
+  return value;
+}
+function direction(value) {
+  if (value !== "start" && value !== "end")
+    return invalid();
+  return value;
+}
+function messageId(value) {
+  const id = rawText(value, 160);
+  if (!/^msg_[a-zA-Z0-9]+$/.test(id))
+    return invalid();
+  return id;
+}
+function stableMessageId(id) {
+  return messageId(`msg_${id.replace(/[^a-zA-Z0-9]/g, "")}`);
+}
+function sessionIdForCommand(commandId) {
+  const id = `ses_${text(commandId, 160).replace(/[^a-zA-Z0-9]/g, "")}`;
+  if (!/^ses_[a-zA-Z0-9]+$/.test(id))
+    return invalid();
+  return id;
+}
+function parseError(value) {
+  const v = object(value);
+  keys(v, ["code", "message"]);
+  return { code: text(v.code, 60), message: text(v.message, 2000) };
+}
+function model(value) {
+  const v = object(value);
+  keys(v, ["providerId", "modelId", "variant"]);
+  return {
+    providerId: text(v.providerId, 160),
+    modelId: text(v.modelId, 160),
+    ...v.variant === undefined ? {} : { variant: nullable(v.variant, (value2) => text(value2, 60)) }
+  };
+}
+function parseCommand(value) {
+  const v = object(value);
+  keys(v, ["commandId", "kind", "title", "prompt", "model", "expiresAt", "workspaceId"]);
+  if (v.kind !== "remote_session_create")
+    return invalid();
+  const m = nullable(v.model, model);
+  if (m !== null && m.variant === undefined)
+    return invalid();
+  return {
+    commandId: text(v.commandId, 160),
+    kind: "remote_session_create",
+    title: text(v.title, 120),
+    prompt: nullable(v.prompt, (value2) => rawText(value2, 1e5)),
+    model: m === null ? null : { providerId: m.providerId, modelId: m.modelId, variant: m.variant ?? null },
+    expiresAt: integer(v.expiresAt),
+    ...v.workspaceId === undefined ? {} : { workspaceId: nullable(v.workspaceId, (value2) => text(value2, 240)) }
+  };
+}
+function parseReceipt(value) {
+  const v = object(value);
+  keys(v, ["sessionId", "workspaceId"]);
+  return { sessionId: text(v.sessionId, 240), workspaceId: text(v.workspaceId, 240) };
+}
+function parseProgress(value) {
+  const v = object(value);
+  keys(v, ["status", "waitingFor", "engine", "model", "finalText", "error", "messageCount", "observedAt"]);
+  return {
+    status: status(v.status),
+    observedAt: integer(v.observedAt),
+    ...v.waitingFor === undefined ? {} : { waitingFor: waiting(v.waitingFor) },
+    ...v.engine === undefined ? {} : { engine: engine(v.engine) },
+    ...v.model === undefined ? {} : { model: nullable(v.model, model) },
+    ...v.finalText === undefined ? {} : { finalText: text(v.finalText, 20000, 0) },
+    ...v.error === undefined ? {} : { error: nullable(v.error, parseError) },
+    ...v.messageCount === undefined ? {} : { messageCount: integer(v.messageCount) }
+  };
+}
+function parseComplete(value) {
+  const v = object(value);
+  if (v.status === "delivered") {
+    keys(v, ["status", "sessionId", "workspaceId", "resultSummary"]);
+    return {
+      status: "delivered",
+      ...parseReceipt({ sessionId: v.sessionId, workspaceId: v.workspaceId }),
+      ...v.resultSummary === undefined ? {} : { resultSummary: text(v.resultSummary, 4096, 0) }
+    };
+  }
+  if (v.status !== "failed")
+    return invalid();
+  keys(v, ["status", "error", "resultSummary"]);
+  return {
+    status: "failed",
+    error: parseError(v.error),
+    ...v.resultSummary === undefined ? {} : { resultSummary: text(v.resultSummary, 4096, 0) }
+  };
+}
+function parseRequest(value) {
+  const v = object(value);
+  keys(v, ["requestId", "kind", "commandId", "sessionId", "workspaceId", "engine", "expiresAt", "action", "input"]);
+  if (v.kind !== "remote_session_request")
+    return invalid();
+  const base = {
+    requestId: text(v.requestId, 160),
+    kind: "remote_session_request",
+    commandId: text(v.commandId, 160),
+    sessionId: text(v.sessionId, 240),
+    workspaceId: text(v.workspaceId, 240),
+    engine: nullable(v.engine, engine),
+    expiresAt: integer(v.expiresAt)
+  };
+  const input = object(v.input);
+  if (v.action === "read") {
+    keys(input, ["from", "cursor", "limit"]);
+    return { ...base, action: "read", input: {
+      from: direction(input.from),
+      cursor: nullable(input.cursor, (value2) => text(value2, 160)),
+      limit: integer(input.limit, 1, 100)
+    } };
+  }
+  if (v.action === "send") {
+    keys(input, ["prompt", "messageId", "model"]);
+    return { ...base, action: "send", input: {
+      prompt: rawText(input.prompt, 1e5),
+      messageId: nullable(input.messageId, messageId),
+      model: nullable(input.model, model)
+    } };
+  }
+  if (v.action !== "stop")
+    return invalid();
+  keys(input, ["messageId"]);
+  return { ...base, action: "stop", input: { messageId: nullable(input.messageId, (value2) => text(value2, 160)) } };
+}
+function toolCall(value) {
+  const v = object(value);
+  keys(v, ["id", "name", "status", "input", "output", "error", "truncated"]);
+  return {
+    id: text(v.id, 240, 0),
+    name: text(v.name, 240, 0),
+    status: nullable(v.status, (value2) => text(value2, 60, 0)),
+    input: nullable(v.input, (value2) => text(value2, 2000, 0)),
+    output: nullable(v.output, (value2) => text(value2, 2000, 0)),
+    error: nullable(v.error, (value2) => text(value2, 2000, 0)),
+    truncated: boolean(v.truncated)
+  };
+}
+function message(value) {
+  const v = object(value);
+  keys(v, ["id", "role", "createdAt", "text", "truncated", "toolCalls", "error"]);
+  if (v.role !== "user" && v.role !== "assistant")
+    return invalid();
+  return {
+    id: text(v.id, 240, 0),
+    role: v.role,
+    createdAt: nullable(v.createdAt, integer),
+    text: text(v.text, 20000, 0),
+    truncated: boolean(v.truncated),
+    toolCalls: array(v.toolCalls, 200, toolCall),
+    error: nullable(v.error, parseError)
+  };
+}
+function parseReadResult(value) {
+  const v = object(value);
+  keys(v, ["title", "status", "waitingFor", "lastError", "messageCount", "from", "messages", "nextCursor", "historyScope"]);
+  if (v.historyScope !== undefined && v.historyScope !== "context" && v.historyScope !== "full")
+    return invalid();
+  return {
+    title: nullable(v.title, (value2) => text(value2, 240, 0)),
+    status: status(v.status),
+    waitingFor: waiting(v.waitingFor),
+    lastError: nullable(v.lastError, parseError),
+    messageCount: integer(v.messageCount),
+    from: direction(v.from),
+    messages: array(v.messages, 100, message),
+    nextCursor: nullable(v.nextCursor, (value2) => text(value2, 160, 0)),
+    ...v.historyScope === undefined ? {} : { historyScope: v.historyScope }
+  };
+}
+function parseSendResult(value) {
+  const v = object(value);
+  keys(v, ["messageId", "alreadyPresent"]);
+  return { messageId: nullable(v.messageId, (value2) => text(value2, 160, 0)), alreadyPresent: boolean(v.alreadyPresent) };
+}
+function parseStopResult(value) {
+  const v = object(value);
+  keys(v, ["stopped", "reason"]);
+  if (v.reason !== null && v.reason !== "different_turn")
+    return invalid();
+  return { stopped: boolean(v.stopped), reason: v.reason };
+}
+function parseRequestComplete(value) {
+  const v = object(value);
+  if (v.status === "failed") {
+    keys(v, ["status", "error"]);
+    return { status: "failed", error: parseError(v.error) };
+  }
+  if (v.status !== "done")
+    return invalid();
+  keys(v, ["status", "outcome"]);
+  const outcome = object(v.outcome);
+  keys(outcome, ["action", "result"]);
+  if (new TextEncoder().encode(JSON.stringify(outcome)).byteLength > REQUEST_RESULT_MAX_BYTES)
+    return invalid();
+  if (outcome.action === "read")
+    return { status: "done", outcome: { action: "read", result: parseReadResult(outcome.result) } };
+  if (outcome.action === "send")
+    return { status: "done", outcome: { action: "send", result: parseSendResult(outcome.result) } };
+  if (outcome.action === "stop")
+    return { status: "done", outcome: { action: "stop", result: parseStopResult(outcome.result) } };
+  return invalid();
+}
+function parseInventory2(value) {
+  const v = object(value);
+  keys(v, ["computer", "workspaces"]);
+  const c = object(v.computer);
+  keys(c, ["label", "platform", "appVersion"]);
+  if (c.platform !== "darwin" && c.platform !== "win32" && c.platform !== "linux")
+    return invalid();
+  return {
+    computer: { label: text(c.label, 120), platform: c.platform, appVersion: text(c.appVersion, 80) },
+    workspaces: array(v.workspaces, 50, (value2) => {
+      const w = object(value2);
+      keys(w, ["workspaceId", "name", "active", "engine", "defaultModel", "models"]);
+      const m = nullable(w.defaultModel, model);
+      if (m?.variant === null)
+        return invalid();
+      return {
+        workspaceId: text(w.workspaceId, 240),
+        name: text(w.name, 120),
+        active: boolean(w.active),
+        engine: engine(w.engine),
+        defaultModel: m === null ? null : {
+          providerId: m.providerId,
+          modelId: m.modelId,
+          ...m.variant === undefined ? {} : { variant: m.variant }
+        },
+        models: array(w.models, 200, (value3) => {
+          const m2 = object(value3);
+          keys(m2, ["providerId", "modelId", "name"]);
+          return { providerId: text(m2.providerId, 160), modelId: text(m2.modelId, 160), name: text(m2.name, 200) };
+        })
+      };
+    })
+  };
+}
+function parseTurn(value) {
+  const t = object(value);
+  keys(t, ["messageId", "baselineMessageCount", "seenActive"]);
+  return { messageId: messageId(t.messageId), baselineMessageCount: nullable(t.baselineMessageCount, integer), seenActive: boolean(t.seenActive) };
+}
+function parseJournal(value) {
+  const v = object(value);
+  keys(v, ["version", "commands", "requests"]);
+  if (v.version !== 1)
+    return invalid();
+  const journal = {
+    version: 1,
+    commands: array(v.commands, MAX_COMMAND_ENTRIES, (value2) => {
+      const e = object(value2);
+      keys(e, ["command", "creation", "sendReplay", "intendedSessionId", "lastObservedAt", "phase", "receipt", "promptMessageId", "turn", "lastMessageId", "completion", "completionAcknowledged", "progress", "reportedProgress"]);
+      if (e.phase !== "prepared" && e.phase !== "created" && e.phase !== "delivered" && e.phase !== "failed")
+        return invalid();
+      const command = parseCommand(e.command);
+      const legacyCreation = e.creation === undefined && e.intendedSessionId === undefined;
+      if (!legacyCreation && e.creation !== "idempotent" && e.creation !== "at_most_once")
+        return invalid();
+      const creation = e.creation === "idempotent" ? "idempotent" : "at_most_once";
+      if (e.sendReplay !== undefined && e.sendReplay !== "idempotent" && e.sendReplay !== "at_most_once")
+        return invalid();
+      const sendReplay = e.sendReplay === "idempotent" ? "idempotent" : "at_most_once";
+      const intendedSessionId = legacyCreation ? sessionIdForCommand(command.commandId) : text(e.intendedSessionId, 240);
+      if (intendedSessionId !== sessionIdForCommand(command.commandId))
+        return invalid();
+      const receipt = nullable(e.receipt, parseReceipt);
+      const completion = nullable(e.completion, parseComplete);
+      const acknowledged = boolean(e.completionAcknowledged);
+      const promptMessageId = nullable(e.promptMessageId, messageId);
+      const turn = nullable(e.turn, parseTurn);
+      const lastMessageId = nullable(e.lastMessageId, messageId);
+      const progress = nullable(e.progress, parseProgress);
+      const reportedProgress = nullable(e.reportedProgress, parseProgress);
+      const previousTimes = [progress?.observedAt, reportedProgress?.observedAt].filter((value3) => value3 !== undefined);
+      const lastObservedAt = e.lastObservedAt === undefined ? previousTimes.length === 0 ? null : Math.max(...previousTimes) : nullable(e.lastObservedAt, integer);
+      if ((progress || reportedProgress) && (lastObservedAt === null || previousTimes.some((time) => time > lastObservedAt)))
+        return invalid();
+      if (creation === "idempotent" && receipt && receipt.sessionId !== intendedSessionId)
+        return invalid();
+      if (promptMessageId !== (command.prompt === null ? null : stableMessageId(command.commandId)))
+        return invalid();
+      if (e.phase === "prepared" && receipt !== null || (e.phase === "created" || e.phase === "delivered") && receipt === null)
+        return invalid();
+      if (receipt && command.workspaceId && receipt.workspaceId !== command.workspaceId)
+        return invalid();
+      if (e.phase === "delivered" !== (completion?.status === "delivered") || e.phase === "failed" !== (completion?.status === "failed"))
+        return invalid();
+      if (acknowledged && completion === null)
+        return invalid();
+      if (completion?.status === "delivered" && (completion.sessionId !== receipt?.sessionId || completion.workspaceId !== receipt?.workspaceId))
+        return invalid();
+      if ((turn || lastMessageId) && !receipt)
+        return invalid();
+      if (turn === null !== (lastMessageId === null) || turn && turn.messageId !== lastMessageId)
+        return invalid();
+      if (e.phase === "created" && lastMessageId !== null && lastMessageId !== promptMessageId)
+        return invalid();
+      if (e.phase === "delivered" && command.prompt !== null && lastMessageId === null)
+        return invalid();
+      if ((progress || reportedProgress) && e.phase !== "delivered")
+        return invalid();
+      return {
+        command,
+        creation,
+        sendReplay,
+        intendedSessionId,
+        lastObservedAt,
+        phase: e.phase,
+        receipt,
+        promptMessageId,
+        turn,
+        lastMessageId,
+        completion,
+        completionAcknowledged: acknowledged,
+        progress,
+        reportedProgress
+      };
+    }),
+    requests: array(v.requests, MAX_REQUEST_ENTRIES, (value2) => {
+      const e = object(value2);
+      keys(e, ["request", "sendReplay", "messageId", "turn", "completion", "completionAcknowledged"]);
+      const request = parseRequest(e.request);
+      if (e.sendReplay !== undefined && e.sendReplay !== "idempotent" && e.sendReplay !== "at_most_once")
+        return invalid();
+      const sendReplay = e.sendReplay === "idempotent" ? "idempotent" : "at_most_once";
+      const id = nullable(e.messageId, (value3) => text(value3, 160));
+      const turn = nullable(e.turn, parseTurn);
+      if (turn && (request.action !== "send" || turn.messageId !== id))
+        return invalid();
+      const completion = nullable(e.completion, parseRequestComplete);
+      const acknowledged = boolean(e.completionAcknowledged);
+      if (acknowledged && !completion)
+        return invalid();
+      if (completion?.status === "done" && completion.outcome.action !== request.action)
+        return invalid();
+      if (request.action === "read" && id !== null)
+        return invalid();
+      if (request.action === "send" && id !== (request.input.messageId ?? stableMessageId(request.requestId)))
+        return invalid();
+      if (request.action === "stop" && request.input.messageId !== null && id !== request.input.messageId)
+        return invalid();
+      return { request, sendReplay, messageId: id, turn, completion, completionAcknowledged: acknowledged };
+    })
+  };
+  if (new Set(journal.commands.map((e) => e.command.commandId)).size !== journal.commands.length || new Set(journal.requests.map((e) => e.request.requestId)).size !== journal.requests.length)
+    return invalid();
+  const receipts = journal.commands.flatMap((e) => e.receipt ? [`${e.receipt.workspaceId}\x00${e.receipt.sessionId}`] : []);
+  if (new Set(receipts).size !== receipts.length)
+    return invalid();
+  const intendedIds = journal.commands.filter((e) => e.creation === "idempotent").map((e) => e.intendedSessionId);
+  if (new Set(intendedIds).size !== intendedIds.length)
+    return invalid();
+  for (const e of journal.requests) {
+    const c = journal.commands.find((c2) => c2.command.commandId === e.request.commandId);
+    if (e.completion?.status === "failed")
+      continue;
+    if (c?.phase !== "delivered" || c.receipt?.sessionId !== e.request.sessionId || c.receipt.workspaceId !== e.request.workspaceId)
+      return invalid();
+  }
+  return journal;
+}
+var init_protocol = __esm(() => {
+  init_types();
+});
+
+// ../../packages/remote-sessions/src/timeout.ts
+function throwIfAborted(signal) {
+  if (signal.aborted)
+    throw new DOMException("Remote-session operation cancelled.", "AbortError");
+}
+async function bounded(signal, timeoutMs, effect) {
+  throwIfAborted(signal);
+  const controller = new AbortController;
+  let timer;
+  let onAbort = () => {};
+  const interrupted = new Promise((_resolve, reject) => {
+    onAbort = () => {
+      controller.abort();
+      reject(new DOMException("Remote-session operation cancelled.", "AbortError"));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new SessionRunnerError("operation_timeout", "Remote-session operation timed out; its outcome may be uncertain."));
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([Promise.resolve().then(() => {
+      throwIfAborted(controller.signal);
+      return effect(controller.signal);
+    }), interrupted]);
+  } finally {
+    if (timer !== undefined)
+      clearTimeout(timer);
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+var init_timeout = __esm(() => {
+  init_types();
+});
+
+// ../../packages/remote-sessions/src/runner.ts
+function failure(code, message2) {
+  return { code, message: message2 };
+}
+function ambiguousSend(receipt) {
+  return failure("ambiguous_send", `Native send may have been accepted in session ${receipt.sessionId}, workspace ${receipt.workspaceId}. Inspect that local session; this send will never be retried automatically.`);
+}
+function definitive(error) {
+  if (!(error instanceof SessionRunnerError) || error.code === "operation_timeout" || error.code === "invalid_data")
+    return null;
+  return parseError({ code: error.code, message: error.message });
+}
+function same(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function sameProgress(a, b) {
+  if (!a)
+    return false;
+  const { observedAt: _a, ...left } = a;
+  const { observedAt: _b, ...right } = b;
+  return same(left, right);
+}
+function createSessionRunner(options) {
+  const { adapter, store, transport } = options;
+  const clock = options.now ?? Date.now;
+  const now = () => integer(clock());
+  const timeoutMs = integer(options.operationTimeoutMs ?? DEFAULT_OPERATION_TIMEOUT_MS, 1, 120000);
+  const creation = adapter.creation ?? "at_most_once";
+  if (creation !== "idempotent" && creation !== "at_most_once")
+    throw new SessionRunnerError("invalid_data", "Invalid adapter creation capability.");
+  const canReplayCreation = (entry) => entry.creation === "idempotent" && creation === "idempotent";
+  const sendReplay = adapter.sendReplay ?? "idempotent";
+  if (sendReplay !== "idempotent" && sendReplay !== "at_most_once")
+    throw new SessionRunnerError("invalid_data", "Invalid adapter send replay capability.");
+  const canReplaySend = (entry) => entry.sendReplay === "idempotent" && sendReplay === "idempotent";
+  let journal;
+  let poisoned = false;
+  let queue = Promise.resolve();
+  function state() {
+    if (!journal || poisoned)
+      throw new SessionRunnerError("journal_unavailable", "Reload the runner from a valid durable journal before continuing.");
+    return journal;
+  }
+  async function persist(next) {
+    const validated = parseJournal(next);
+    try {
+      await store.save(structuredClone(validated));
+    } catch (error) {
+      poisoned = true;
+      throw error;
+    }
+    journal = validated;
+  }
+  async function load() {
+    if (poisoned)
+      state();
+    if (journal)
+      return;
+    try {
+      journal = parseJournal(await store.load());
+    } catch (error) {
+      poisoned = true;
+      throw error;
+    }
+    if (journal.commands.some((e) => e.phase === "prepared" && !canReplayCreation(e))) {
+      await persist({ ...journal, commands: journal.commands.map((e) => e.phase !== "prepared" || canReplayCreation(e) ? e : {
+        ...e,
+        phase: "failed",
+        completion: { status: "failed", error: failure("ambiguous_creation", "Creation was interrupted before a receipt was saved. Inspect the native harness; this command will not create another session.") }
+      }) });
+    }
+    await recoverUnsafeSends();
+  }
+  async function recoverUnsafeSends() {
+    const current = state();
+    let changed = false;
+    let commands = current.commands.map((e) => {
+      if (e.phase !== "created" || !e.turn || !e.receipt || canReplaySend(e))
+        return e;
+      changed = true;
+      const completion = { status: "failed", error: ambiguousSend(e.receipt) };
+      const recovered = { ...e, phase: "failed", completion };
+      return recovered;
+    });
+    const requests = current.requests.map((e) => {
+      if (e.completion || e.request.action !== "send" || !e.turn || canReplaySend(e))
+        return e;
+      changed = true;
+      const completion = { status: "failed", error: ambiguousSend(e.request) };
+      commands = commands.map((c) => c.command.commandId === e.request.commandId && c.phase === "delivered" && c.lastMessageId !== e.messageId ? { ...c, turn: e.turn, lastMessageId: e.messageId, progress: null, reportedProgress: null } : c);
+      return { ...e, completion };
+    });
+    if (changed)
+      await persist({ ...current, commands, requests });
+  }
+  function serialized(operation) {
+    const task = queue.then(async () => {
+      await load();
+      return operation();
+    });
+    queue = task.then(() => {}, () => {});
+    return task;
+  }
+  function command(id) {
+    const entry = state().commands.find((e) => e.command.commandId === id);
+    if (!entry)
+      throw new SessionRunnerError("unknown_command", "The command is not in this account's local journal.");
+    return entry;
+  }
+  function request(id) {
+    const entry = state().requests.find((e) => e.request.requestId === id);
+    if (!entry)
+      throw new SessionRunnerError("unknown_request", "The request is not in this account's local journal.");
+    return entry;
+  }
+  async function saveCommand(entry) {
+    await persist({ ...state(), commands: state().commands.map((e) => e.command.commandId === entry.command.commandId ? entry : e) });
+  }
+  async function saveRequest(entry) {
+    await persist({ ...state(), requests: state().requests.map((e) => e.request.requestId === entry.request.requestId ? entry : e) });
+  }
+  function local(signal, effect) {
+    return bounded(signal, timeoutMs, effect);
+  }
+  async function flushCommand(id, signal) {
+    const e = command(id);
+    if (!e.completion || e.completionAcknowledged)
+      return;
+    await local(signal, (s) => transport.complete(id, structuredClone(e.completion), s));
+    await saveCommand({ ...command(id), completionAcknowledged: true });
+  }
+  async function flushRequest(id, signal) {
+    const e = request(id);
+    if (!e.completion || e.completionAcknowledged)
+      return;
+    await local(signal, (s) => transport.completeRequest(id, structuredClone(e.completion), s));
+    await saveRequest({ ...request(id), completionAcknowledged: true });
+  }
+  async function createPrepared(id, signal, firstAttempt = false) {
+    const entry = command(id);
+    if (entry.phase !== "prepared")
+      return;
+    if (!firstAttempt && !canReplayCreation(entry)) {
+      await saveCommand({ ...entry, phase: "failed", completion: { status: "failed", error: failure("ambiguous_creation", "Creation was interrupted before a receipt was saved. Inspect the native harness; this command will not create another session.") } });
+      return;
+    }
+    throwIfAborted(signal);
+    if (entry.command.expiresAt <= now()) {
+      await saveCommand({ ...entry, phase: "failed", completion: {
+        status: "failed",
+        error: failure("expired", "The command expired before creation could be attempted or safely replayed.")
+      } });
+      return;
+    }
+    try {
+      const receipt = parseReceipt(await local(signal, (s) => adapter.create(structuredClone(entry.command), s)));
+      if (entry.command.workspaceId && receipt.workspaceId !== entry.command.workspaceId) {
+        throw new SessionRunnerError("invalid_data", "The adapter created a session in a different workspace.");
+      }
+      if (entry.creation === "idempotent" && receipt.sessionId !== entry.intendedSessionId) {
+        throw new SessionRunnerError("invalid_data", "Idempotent creation must return the journal's deterministic session ID.");
+      }
+      await saveCommand({ ...command(id), phase: "created", receipt });
+    } catch (error) {
+      if (signal.aborted)
+        throw error;
+      const proven = definitive(error);
+      if (!proven)
+        throw error;
+      await saveCommand({ ...command(id), phase: "failed", completion: { status: "failed", error: proven } });
+    }
+  }
+  async function deliver(id, signal) {
+    let e = command(id);
+    if (e.completion)
+      return e.completion;
+    if (e.turn && e.receipt && !canReplaySend(e)) {
+      const completion2 = { status: "failed", error: ambiguousSend(e.receipt) };
+      await saveCommand({ ...e, phase: "failed", completion: completion2 });
+      return completion2;
+    }
+    if (e.command.expiresAt <= now()) {
+      const completion2 = { status: "failed", error: failure("expired", "The command expired before its next native effect.") };
+      await saveCommand({ ...e, phase: "failed", completion: completion2 });
+      return completion2;
+    }
+    if (!e.receipt)
+      throw new SessionRunnerError("ambiguous_creation", "A missing creation receipt cannot be replayed.");
+    if (e.command.prompt !== null) {
+      if (!e.turn) {
+        const baseline = parseProgress(await local(signal, (s) => adapter.observe(structuredClone(e.receipt), s)));
+        throwIfAborted(signal);
+        await saveCommand({
+          ...e,
+          sendReplay: canReplaySend(e) ? "idempotent" : "at_most_once",
+          turn: { messageId: e.promptMessageId, baselineMessageCount: baseline.messageCount ?? null, seenActive: false },
+          lastMessageId: e.promptMessageId
+        });
+        e = command(id);
+      }
+      try {
+        throwIfAborted(signal);
+        if (e.command.expiresAt <= now())
+          return deliver(id, signal);
+        const result = parseSendResult(await local(signal, (s) => adapter.send(structuredClone(e.receipt), {
+          prompt: e.command.prompt,
+          messageId: e.promptMessageId,
+          model: structuredClone(e.command.model)
+        }, s)));
+        if (result.messageId !== null && result.messageId !== e.promptMessageId) {
+          throw new SessionRunnerError("invalid_data", "The adapter returned a different stable message ID.");
+        }
+      } catch (error) {
+        if (poisoned)
+          throw error;
+        const proven = definitive(error);
+        const uncertain = proven?.code === "ambiguous_send" || !canReplaySend(e) && (signal.aborted || !proven);
+        if (!uncertain && signal.aborted)
+          throw error;
+        if (!uncertain && !proven)
+          throw error;
+        const completion2 = { status: "failed", error: uncertain ? ambiguousSend(e.receipt) : proven };
+        await saveCommand({ ...command(id), phase: "failed", completion: completion2 });
+        throwIfAborted(signal);
+        return completion2;
+      }
+    }
+    const receipt = e.receipt;
+    if (!receipt)
+      throw new SessionRunnerError("invalid_data", "The delivered command has no receipt.");
+    const completion = { status: "delivered", sessionId: receipt.sessionId, workspaceId: receipt.workspaceId };
+    await saveCommand({ ...command(id), phase: "delivered", completion });
+    return completion;
+  }
+  function knownReceipt(e) {
+    return state().commands.find((c) => c.command.commandId === e.request.commandId && c.phase === "delivered" && c.receipt?.sessionId === e.request.sessionId && c.receipt.workspaceId === e.request.workspaceId);
+  }
+  async function performRequest(id, signal) {
+    let e = request(id);
+    if (e.completion)
+      return e.completion;
+    throwIfAborted(signal);
+    let completion;
+    let applyTurn = false;
+    const c = knownReceipt(e);
+    if (e.request.action === "send" && e.turn && !canReplaySend(e)) {
+      completion = { status: "failed", error: ambiguousSend(e.request) };
+      applyTurn = true;
+    } else if (e.request.expiresAt <= now()) {
+      completion = { status: "failed", error: failure("expired", "The request expired before its next native effect.") };
+      applyTurn = e.turn !== null;
+    } else if (!c?.receipt)
+      completion = { status: "failed", error: failure("unknown_receipt", "Only a session delivered by this account's local journal can be controlled.") };
+    else {
+      const earlier = state().requests.slice(0, state().requests.findIndex((r) => r.request.requestId === id)).some((r) => r.request.commandId === e.request.commandId && r.request.action !== "read" && r.completion === null);
+      if (earlier && e.request.action !== "read")
+        throw new SessionRunnerError("request_in_progress", "An earlier native control request must be reconciled first.");
+      try {
+        if (e.request.action === "read") {
+          const input = e.request.input;
+          const result = parseReadResult(await local(signal, (s) => adapter.read(structuredClone(c.receipt), structuredClone(input), s)));
+          completion = parseRequestComplete({ status: "done", outcome: { action: "read", result } });
+        } else if (e.request.action === "send") {
+          const input = e.request.input;
+          if (!e.turn) {
+            const baseline = parseProgress(await local(signal, (s) => adapter.observe(structuredClone(c.receipt), s)));
+            throwIfAborted(signal);
+            await saveRequest({
+              ...e,
+              sendReplay: canReplaySend(e) ? "idempotent" : "at_most_once",
+              turn: { messageId: e.messageId, baselineMessageCount: baseline.messageCount ?? null, seenActive: false }
+            });
+            e = request(id);
+          }
+          throwIfAborted(signal);
+          if (e.request.expiresAt <= now())
+            return performRequest(id, signal);
+          const result = parseSendResult(await local(signal, (s) => adapter.send(structuredClone(c.receipt), {
+            ...structuredClone(input),
+            messageId: e.messageId
+          }, s)));
+          if (result.messageId !== null && result.messageId !== e.messageId)
+            throw new SessionRunnerError("invalid_data", "The adapter returned a different stable message ID.");
+          completion = { status: "done", outcome: { action: "send", result } };
+          applyTurn = true;
+        } else if (e.request.input.messageId === null && e.messageId !== null && c.lastMessageId !== e.messageId) {
+          completion = { status: "done", outcome: { action: "stop", result: { stopped: false, reason: "different_turn" } } };
+        } else if (e.messageId === null) {
+          completion = { status: "done", outcome: { action: "stop", result: { stopped: false, reason: null } } };
+        } else {
+          const result = parseStopResult(await local(signal, (s) => adapter.stop(structuredClone(c.receipt), { messageId: e.messageId }, s)));
+          completion = { status: "done", outcome: { action: "stop", result } };
+        }
+      } catch (error) {
+        if (poisoned)
+          throw error;
+        const latest = request(id);
+        const proven = definitive(error);
+        const uncertainSend = latest.request.action === "send" && latest.turn !== null && (proven?.code === "ambiguous_send" || !canReplaySend(latest) && (signal.aborted || !proven));
+        if (uncertainSend) {
+          completion = { status: "failed", error: ambiguousSend(latest.request) };
+          applyTurn = true;
+        } else {
+          if (signal.aborted)
+            throw error;
+          if (!proven)
+            throw error;
+          completion = { status: "failed", error: proven };
+        }
+      }
+    }
+    e = request(id);
+    const updatedCommand = applyTurn && c && e.turn && c.lastMessageId !== e.messageId ? {
+      ...command(c.command.commandId),
+      turn: e.turn,
+      lastMessageId: e.messageId,
+      progress: null,
+      reportedProgress: null
+    } : null;
+    await persist({
+      ...state(),
+      requests: state().requests.map((r) => r.request.requestId === id ? { ...e, completion } : r),
+      commands: state().commands.map((c2) => updatedCommand && c2.command.commandId === updatedCommand.command.commandId ? updatedCommand : c2)
+    });
+    throwIfAborted(signal);
+    return completion;
+  }
+  async function flushProgress(id, progress, signal) {
+    try {
+      await local(signal, (s) => transport.report(id, structuredClone(progress), s));
+    } catch (error) {
+      if (signal.aborted)
+        throw error;
+      if (typeof error !== "object" || error === null || !("status" in error) || error.status !== 404 && error.status !== 409)
+        throw error;
+      await saveCommand({ ...command(id), progress: null, reportedProgress: null });
+      return false;
+    }
+    await saveCommand({ ...command(id), progress: null, reportedProgress: progress });
+    return true;
+  }
+  async function watch(id, signal) {
+    let e = command(id);
+    if (e.phase !== "delivered" || !e.receipt || !e.completionAcknowledged)
+      return;
+    if (state().requests.some((r) => r.request.commandId === id && r.request.action === "send" && r.completion === null))
+      return;
+    if (e.progress) {
+      if (!await flushProgress(id, e.progress, signal))
+        return;
+      e = command(id);
+    }
+    let progress = parseProgress(await local(signal, (s) => adapter.observe(structuredClone(e.receipt), s)));
+    let turn = e.turn;
+    if (turn) {
+      const active = progress.status === "running" || progress.status === "waiting";
+      if (active && !turn.seenActive)
+        turn = { ...turn, seenActive: true };
+      const knownCounts = turn.baselineMessageCount !== null && progress.messageCount !== undefined;
+      const newMessages = turn.baselineMessageCount !== null && progress.messageCount !== undefined && progress.messageCount >= turn.baselineMessageCount + 2;
+      if (!active && !turn.seenActive && !newMessages) {
+        progress = { ...progress, status: "running", waitingFor: null, finalText: "", error: null };
+      } else if (!active && knownCounts && !newMessages) {
+        progress = { ...progress, finalText: "" };
+      }
+    }
+    if (progress.status === "running" || progress.status === "waiting")
+      progress = { ...progress, finalText: "", error: null };
+    if (!sameProgress(e.reportedProgress, progress)) {
+      progress = { ...progress, observedAt: integer(Math.max(progress.observedAt, (e.lastObservedAt ?? -1) + 1)) };
+      await saveCommand({ ...e, turn, progress, lastObservedAt: progress.observedAt });
+      await flushProgress(id, progress, signal);
+    } else if (!same(turn, e.turn))
+      await saveCommand({ ...e, turn });
+  }
+  return {
+    accept(input, signal) {
+      return serialized(async () => {
+        throwIfAborted(signal);
+        const value = parseCommand(input);
+        const existing = state().commands.find((e) => e.command.commandId === value.commandId);
+        if (existing && !same(existing.command, value))
+          throw new SessionRunnerError("command_conflict", "A command ID cannot be reused with different input.");
+        if (!existing) {
+          if (state().commands.length >= MAX_COMMAND_ENTRIES)
+            throw new SessionRunnerError("journal_full", "Prune acknowledged commands before accepting more work.");
+          const expired = value.expiresAt <= now();
+          await persist({ ...state(), commands: [...state().commands, {
+            command: value,
+            creation,
+            sendReplay,
+            intendedSessionId: sessionIdForCommand(value.commandId),
+            lastObservedAt: null,
+            phase: expired ? "failed" : "prepared",
+            receipt: null,
+            promptMessageId: value.prompt === null ? null : stableMessageId(value.commandId),
+            turn: null,
+            lastMessageId: null,
+            completion: expired ? { status: "failed", error: failure("expired", "The command expired before creation.") } : null,
+            completionAcknowledged: false,
+            progress: null,
+            reportedProgress: null
+          }] });
+        }
+        await createPrepared(value.commandId, signal, !existing);
+        throwIfAborted(signal);
+        const completion = await deliver(value.commandId, signal);
+        await flushCommand(value.commandId, signal);
+        return structuredClone(completion);
+      });
+    },
+    execute(input, signal) {
+      return serialized(async () => {
+        throwIfAborted(signal);
+        const value = parseRequest(input);
+        const existing = state().requests.find((e) => e.request.requestId === value.requestId);
+        if (existing && !same(existing.request, value))
+          throw new SessionRunnerError("request_conflict", "A request ID cannot be reused with different input.");
+        if (!existing) {
+          if (state().requests.length >= MAX_REQUEST_ENTRIES)
+            throw new SessionRunnerError("journal_full", "Prune acknowledged requests before accepting more work.");
+          const c = state().commands.find((c2) => c2.command.commandId === value.commandId && c2.phase === "delivered" && c2.receipt?.sessionId === value.sessionId && c2.receipt.workspaceId === value.workspaceId);
+          let completion2 = !c ? { status: "failed", error: failure("unknown_receipt", "Only a session delivered by this account's local journal can be controlled.") } : null;
+          const id = value.action === "send" ? value.input.messageId ?? stableMessageId(value.requestId) : value.action === "stop" ? value.input.messageId ?? c?.lastMessageId ?? null : null;
+          if (c && value.action === "send") {
+            const prior = state().requests.find((r) => r.request.commandId === value.commandId && r.messageId === id && r.request.action === "send");
+            const original = c.promptMessageId === id ? { prompt: c.command.prompt, model: c.command.model } : null;
+            const fingerprint = original ?? (prior?.request.action === "send" ? prior.request.input : null);
+            if (fingerprint && !same({ prompt: fingerprint.prompt, model: fingerprint.model }, { prompt: value.input.prompt, model: value.input.model })) {
+              completion2 = { status: "failed", error: failure("message_conflict", "A stable message ID cannot be reused with different prompt or model input.") };
+            } else if (original || prior?.completion?.status === "done") {
+              completion2 = { status: "done", outcome: { action: "send", result: { messageId: id, alreadyPresent: true } } };
+            }
+          }
+          await persist({ ...state(), requests: [...state().requests, { request: value, sendReplay, messageId: id, turn: null, completion: completion2, completionAcknowledged: false }] });
+        }
+        const completion = await performRequest(value.requestId, signal);
+        await flushRequest(value.requestId, signal);
+        return structuredClone(completion);
+      });
+    },
+    reconcile(signal) {
+      return serialized(async () => {
+        throwIfAborted(signal);
+        let firstError;
+        const attempt = async (operation) => {
+          throwIfAborted(signal);
+          try {
+            await operation();
+          } catch (error) {
+            if (signal.aborted || poisoned)
+              throw error;
+            firstError ??= error;
+          }
+        };
+        for (const e of state().commands)
+          await attempt(async () => {
+            await createPrepared(e.command.commandId, signal);
+            await deliver(e.command.commandId, signal);
+            await flushCommand(e.command.commandId, signal);
+          });
+        for (const e of state().requests)
+          await attempt(async () => {
+            await performRequest(e.request.requestId, signal);
+            await flushRequest(e.request.requestId, signal);
+          });
+        for (const e of state().commands)
+          await attempt(() => watch(e.command.commandId, signal));
+        if (firstError !== undefined)
+          throw firstError;
+      });
+    },
+    inspect() {
+      return serialized(async () => structuredClone(state()));
+    },
+    prune(pruneOptions = {}) {
+      return serialized(async () => {
+        const retainCommands = integer(pruneOptions.retainCommands ?? 128, 0, MAX_COMMAND_ENTRIES);
+        const retainRequests = integer(pruneOptions.retainRequests ?? 128, 0, MAX_REQUEST_ENTRIES);
+        const requests = [...state().requests];
+        let toRemove = Math.max(0, requests.length - retainRequests);
+        const retainedRequests = requests.filter((e) => {
+          if (toRemove > 0 && e.completionAcknowledged && e.request.expiresAt <= now()) {
+            toRemove--;
+            return false;
+          }
+          return true;
+        });
+        toRemove = Math.max(0, state().commands.length - retainCommands);
+        const commands = state().commands.filter((e) => {
+          const terminal = e.phase === "failed" || e.reportedProgress?.status === "idle" || e.reportedProgress?.status === "error";
+          if (toRemove > 0 && terminal && e.completionAcknowledged && e.progress === null && e.command.expiresAt <= now() && !retainedRequests.some((r) => r.request.commandId === e.command.commandId)) {
+            toRemove--;
+            return false;
+          }
+          return true;
+        });
+        await persist({ ...state(), commands, requests: retainedRequests });
+        return structuredClone(state());
+      });
+    }
+  };
+}
+var init_runner = __esm(() => {
+  init_types();
+  init_protocol();
+  init_timeout();
+});
+
+// ../../packages/remote-sessions/src/remote-client.ts
+function safeBase(value) {
+  const url = new URL(value);
+  const loopback = url.hostname === "localhost" || url.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.search || url.hash) {
+    throw new SessionRunnerError("unsafe_url", "Use HTTPS (or HTTP on loopback), without credentials, query, or fragment.");
+  }
+  if (!url.pathname.endsWith("/"))
+    url.pathname += "/";
+  return url;
+}
+async function smallJson(response, signal) {
+  const length = response.headers.get("content-length");
+  if (length !== null && (!/^\d+$/.test(length) || Number(length) > MAX_RESPONSE_BYTES)) {
+    await response.body?.cancel();
+    throw new SessionRunnerError("invalid_response", "Remote-session response exceeds the size limit.");
+  }
+  if (!response.body)
+    throw new SessionRunnerError("invalid_response", "Remote-session response has no JSON body.");
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  let size = 0;
+  let body = "";
+  try {
+    for (;; ) {
+      throwIfAborted(signal);
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      size += chunk.value.byteLength;
+      if (size > MAX_RESPONSE_BYTES)
+        throw new SessionRunnerError("invalid_response", "Remote-session response exceeds the size limit.");
+      body += decoder.decode(chunk.value, { stream: true });
+    }
+    body += decoder.decode();
+    try {
+      return JSON.parse(body);
+    } catch {
+      throw new SessionRunnerError("invalid_response", "Remote-session response is not valid JSON.");
+    }
+  } finally {
+    await reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+function createRemoteSessionTransport(options) {
+  const base = safeBase(options.baseUrl);
+  const fetcher = options.fetch ?? globalThis.fetch;
+  const timeout = integer(options.timeoutMs ?? DEFAULT_OPERATION_TIMEOUT_MS, 1, 120000);
+  const id = (value) => {
+    const parsed = text(value, 160);
+    if (parsed === "." || parsed === "..")
+      throw new SessionRunnerError("invalid_data", "A route ID cannot be a dot segment.");
+    return encodeURIComponent(parsed);
+  };
+  async function call(path, method, body, signal) {
+    return bounded(signal, timeout, async (s) => {
+      const token = options.token();
+      if (!token || /[\r\n]/.test(token))
+        throw new SessionRunnerError("missing_token", "A current runner token is required.");
+      const response = await fetcher(new URL(path, base), {
+        method,
+        redirect: "error",
+        signal: s,
+        headers: { authorization: `Bearer ${token}`, accept: "application/json", ...body === undefined ? {} : { "content-type": "application/json" } },
+        ...body === undefined ? {} : { body: JSON.stringify(body) }
+      });
+      if (response.redirected || response.status >= 300 && response.status < 400) {
+        await response.body?.cancel();
+        throw new SessionRunnerError("redirect_refused", "Remote-session requests cannot follow redirects.");
+      }
+      if (!response.ok) {
+        await response.body?.cancel();
+        throw new RemoteSessionHttpError(response.status);
+      }
+      return smallJson(response, s);
+    });
+  }
+  return {
+    async complete(commandId, body, signal) {
+      const parsed = parseComplete(body);
+      const response = object(await call(`v1/remote-session-commands/${id(commandId)}/complete`, "POST", parsed, signal));
+      const c = object(response.command);
+      if (c.id !== commandId || c.status !== parsed.status || (parsed.status === "delivered" ? c.sessionId !== parsed.sessionId || c.workspaceId !== parsed.workspaceId : c.sessionId !== null || c.workspaceId !== null))
+        throw new SessionRunnerError("invalid_response", "Command acknowledgement does not match the submitted result.");
+    },
+    async report(commandId, progress, signal) {
+      const response = object(await call(`v1/remote-session-commands/${id(commandId)}/session`, "POST", parseProgress(progress), signal));
+      if (response.ok !== true)
+        throw new SessionRunnerError("invalid_response", "Progress acknowledgement is invalid.");
+    },
+    async completeRequest(requestId, body, signal) {
+      const parsed = parseRequestComplete(body);
+      const response = object(await call(`v1/remote-session-requests/${id(requestId)}/complete`, "POST", parsed, signal));
+      const r = object(response.request);
+      if (r.id !== requestId || r.status !== parsed.status)
+        throw new SessionRunnerError("invalid_response", "Request acknowledgement does not match the submitted result.");
+    },
+    async claimCommand(commandId, signal) {
+      const response = object(await call(`v1/remote-session-commands/${id(commandId)}/claim`, "POST", {}, signal));
+      const value = parseCommand(response.assignment);
+      if (value.commandId !== commandId)
+        throw new SessionRunnerError("invalid_response", "Claimed command ID does not match.");
+      return value;
+    },
+    async claimRequest(requestId, signal) {
+      const response = object(await call(`v1/remote-session-requests/${id(requestId)}/claim`, "POST", {}, signal));
+      const value = parseRequest(response.assignment);
+      if (value.requestId !== requestId)
+        throw new SessionRunnerError("invalid_response", "Claimed request ID does not match.");
+      return value;
+    },
+    async pendingRequests(signal) {
+      const response = object(await call("v1/remote-session-requests/pending", "GET", undefined, signal));
+      return array(response.items, 5, (value) => {
+        const item = object(value);
+        if (item.kind !== "remote_session_request")
+          throw new SessionRunnerError("invalid_response", "Unexpected pending work kind.");
+        return { kind: "remote_session_request", requestId: text(item.requestId, 160) };
+      });
+    },
+    async publishInventory(inventory, signal) {
+      const response = object(await call("v1/automation-runner/inventory", "PUT", parseInventory2(inventory), signal));
+      if (response.ok !== true)
+        throw new SessionRunnerError("invalid_response", "Inventory acknowledgement is invalid.");
+      integer(response.updatedAt);
+    }
+  };
+}
+var RemoteSessionHttpError, MAX_RESPONSE_BYTES;
+var init_remote_client = __esm(() => {
+  init_types();
+  init_protocol();
+  init_timeout();
+  RemoteSessionHttpError = class RemoteSessionHttpError extends Error {
+    status;
+    constructor(status2) {
+      super(`Remote-session HTTP request failed (${status2}).`);
+      this.name = "RemoteSessionHttpError";
+      this.status = status2;
+    }
+  };
+  MAX_RESPONSE_BYTES = 512 * 1024;
+});
+
+// ../../packages/remote-sessions/src/index.ts
+var init_src = __esm(() => {
+  init_protocol();
+  init_types();
+  init_runner();
+  init_remote_client();
+});
+
+// ../../packages/opencode-plugin/src/native-opencode.ts
+import { createHash as createHash4 } from "node:crypto";
+import { realpath } from "node:fs/promises";
+import { basename } from "node:path";
+function hasNativeSessionHost(ctx) {
+  return typeof ctx.session?.create === "function" && typeof ctx.session.get === "function" && typeof ctx.session.context === "function" && typeof ctx.session.prompt === "function" && typeof ctx.session.switchModel === "function" && typeof ctx.session.interrupt === "function" && typeof ctx.model?.list === "function" && typeof ctx.model.default === "function" && typeof ctx.permission?.list === "function";
+}
+function nativeModel(model2) {
+  return { providerID: model2.providerId, id: model2.modelId, ...model2.variant ? { variant: model2.variant } : {} };
+}
+function remoteModel(model2) {
+  return model2 ? { providerId: model2.providerID, modelId: model2.id, variant: model2.variant ?? null } : null;
+}
+function digest2(value) {
+  return createHash4("sha256").update(value).digest("hex").slice(0, 24);
+}
+function clipped(value, max) {
+  return value.slice(0, max);
+}
+function errorOf(error) {
+  return error ? { code: clipped(error.type || "native_error", 60), message: clipped(error.message || "OpenCode reported an error.", 2000) } : null;
+}
+function summary(value) {
+  return value === undefined ? null : clipped(JSON.stringify(value) ?? "", 2000);
+}
+function admission(value) {
+  if (!isRecord(value) || typeof value.messageId !== "string" || typeof value.admitted !== "boolean" || value.baselineIdle !== null && typeof value.baselineIdle !== "number")
+    return null;
+  return { messageId: value.messageId, baselineIdle: value.baselineIdle, admitted: value.admitted };
+}
+async function nativeWorkspace(ctx, workspaceId, signal) {
+  signal.throwIfAborted();
+  const [models, selected] = await Promise.all([
+    ctx.model.list(),
+    ctx.model.default()
+  ]);
+  signal.throwIfAborted();
+  if (await realpath(models.location.directory) !== await realpath(ctx.location.directory) || await realpath(selected.location.directory) !== await realpath(ctx.location.directory)) {
+    throw new SessionRunnerError("workspace_unavailable", "OpenCode returned models for a different Location.");
+  }
+  return {
+    workspaceId,
+    name: clipped(basename(ctx.location.directory) || "OpenCode", 120),
+    active: true,
+    engine: "v2",
+    defaultModel: selected.data ? { providerId: selected.data.providerID, modelId: selected.data.id } : null,
+    models: models.data.filter((model2) => model2.enabled).slice(0, 200).map((model2) => ({
+      providerId: clipped(model2.providerID, 160),
+      modelId: clipped(model2.id, 160),
+      name: clipped(model2.name, 200)
+    }))
+  };
+}
+function createNativeOpenCodeAdapter(input) {
+  const { ctx, directory, workspaceId } = input;
+  const now = input.now ?? Date.now;
+  const markerKey = (sessionId) => `${input.storagePrefix}/native/${digest2(sessionId)}`;
+  const load = async (receipt) => admission(await ctx.storage.get(markerKey(receipt.sessionId)));
+  const save = (receipt, value) => ctx.storage.set(markerKey(receipt.sessionId), { ...value });
+  async function owned(receipt, signal) {
+    signal.throwIfAborted();
+    if (receipt.workspaceId !== workspaceId)
+      throw new SessionRunnerError("workspace_unavailable", "This runner approves only its current OpenCode directory.");
+    const info = await ctx.session.get({ sessionID: receipt.sessionId }, { signal });
+    signal.throwIfAborted();
+    if (await realpath(info.location.directory) !== directory) {
+      throw new SessionRunnerError("workspace_unavailable", "The session has moved outside this runner's approved directory.");
+    }
+    return info;
+  }
+  async function snapshot(receipt, signal) {
+    const info = await owned(receipt, signal);
+    const [messages, permissions, marker] = await Promise.all([
+      ctx.session.context({ sessionID: receipt.sessionId }, { signal }),
+      ctx.permission.list({ sessionID: receipt.sessionId }, { signal }),
+      load(receipt)
+    ]);
+    signal.throwIfAborted();
+    const users = messages.filter((message2) => message2.type === "user");
+    const latestUser = users.at(-1);
+    const lastIdle = messages.findLast((message2) => message2.type === "idle");
+    const idleAt = Math.max(info.time.idle ?? -1, lastIdle?.time.created ?? -1);
+    const pending = marker !== null && !messages.some((message2) => message2.id === marker.messageId) && idleAt <= (marker.baselineIdle ?? -1);
+    const activityAt = messages.reduce((latest, message2) => message2.type === "assistant" || message2.type === "compaction" ? Math.max(latest, message2.time.created) : latest, latestUser?.time.created ?? -1);
+    const running = pending || activityAt > idleAt;
+    const waitingFor = permissions.length ? "permission" : messages.some((message2) => message2.type === "assistant" && message2.time.created > idleAt && message2.time.created >= (latestUser?.time.created ?? 0) && message2.content.some((part) => part.type === "tool" && part.name === "question" && part.state.status === "running")) ? "question" : null;
+    const assistantIndex = messages.findLastIndex((message2) => message2.type === "assistant");
+    const turnBoundary = Math.max(messages.findLastIndex((message2) => message2.type === "user"), messages.findLastIndex((message2) => message2.type === "compaction"));
+    const assistant = assistantIndex > turnBoundary ? messages[assistantIndex] : undefined;
+    const nativeError = assistant?.type === "assistant" ? errorOf(assistant.error) : null;
+    const status2 = waitingFor ? "waiting" : running ? "running" : info.outcome === "failed" ? "error" : "idle";
+    const finalText = !running && !waitingFor && assistant?.type === "assistant" ? clipped(assistant.content.filter((part) => part.type === "text").map((part) => part.text).join(`
+`), 20000) : "";
+    const progress = {
+      status: status2,
+      waitingFor,
+      engine: "v2",
+      model: remoteModel(info.model ?? (assistant?.type === "assistant" ? assistant.model : undefined)),
+      finalText,
+      error: status2 === "error" ? nativeError ?? { code: "native_error", message: "OpenCode's last execution failed." } : null,
+      messageCount: messages.length,
+      observedAt: now()
+    };
+    return { info, messages, latestUser, progress };
+  }
+  const adapter = {
+    creation: "idempotent",
+    sendReplay: "idempotent",
+    async create(command, signal) {
+      signal.throwIfAborted();
+      if (command.workspaceId && command.workspaceId !== workspaceId) {
+        throw new SessionRunnerError("workspace_unavailable", "The requested workspace is not this runner's approved directory.");
+      }
+      const id = sessionIdForCommand(command.commandId);
+      const created = await ctx.session.create({
+        id,
+        title: command.title,
+        location: { directory },
+        metadata: { openwork: { commandId: command.commandId } },
+        ...command.model ? { model: nativeModel(command.model) } : {}
+      }, { signal });
+      const owner = created.metadata?.openwork;
+      let actualDirectory = null;
+      try {
+        actualDirectory = await realpath(created.location.directory);
+      } catch {}
+      if (created.id !== id || actualDirectory !== directory || !isRecord(owner) || owner.commandId !== command.commandId) {
+        throw new SessionRunnerError("session_conflict", "The deterministic OpenCode session identity belongs to different work or a different Location.");
+      }
+      return { sessionId: created.id, workspaceId };
+    },
+    async send(receipt, prompt, signal) {
+      const info = await owned(receipt, signal);
+      const [messages, previous] = await Promise.all([
+        ctx.session.context({ sessionID: receipt.sessionId }, { signal }),
+        load(receipt)
+      ]);
+      signal.throwIfAborted();
+      if (messages.some((message2) => message2.id === prompt.messageId) || previous?.messageId === prompt.messageId && previous.admitted) {
+        return { messageId: prompt.messageId, alreadyPresent: true };
+      }
+      const marker = previous?.messageId === prompt.messageId ? previous : { messageId: prompt.messageId, baselineIdle: info.time.idle ?? null, admitted: false };
+      await save(receipt, marker);
+      signal.throwIfAborted();
+      if (prompt.model)
+        await ctx.session.switchModel({ sessionID: receipt.sessionId, model: nativeModel(prompt.model) }, { signal });
+      signal.throwIfAborted();
+      const admitted = await ctx.session.prompt({
+        sessionID: receipt.sessionId,
+        id: prompt.messageId,
+        text: prompt.prompt,
+        delivery: "queue",
+        resume: true
+      }, { signal });
+      if (admitted.id !== prompt.messageId || admitted.sessionID !== receipt.sessionId) {
+        throw new SessionRunnerError("invalid_data", "OpenCode returned a different prompt admission identity.");
+      }
+      await save(receipt, { ...marker, admitted: true });
+      return { messageId: admitted.id, alreadyPresent: false };
+    },
+    async observe(receipt, signal) {
+      return (await snapshot(receipt, signal)).progress;
+    },
+    async stop(receipt, guard, signal) {
+      const { latestUser, progress } = await snapshot(receipt, signal);
+      if (guard.messageId && latestUser?.id !== guard.messageId)
+        return { stopped: false, reason: "different_turn" };
+      if (progress.status === "idle" || progress.status === "error")
+        return { stopped: false, reason: null };
+      signal.throwIfAborted();
+      const result = await ctx.session.interrupt({ sessionID: receipt.sessionId, resume: false }, { signal });
+      return { stopped: result.interrupted, reason: null };
+    },
+    async read(receipt, page, signal) {
+      const { info, messages, progress } = await snapshot(receipt, signal);
+      const transcript = messages.filter((message2) => message2.type === "user" || message2.type === "assistant").map(transcriptMessage);
+      const epoch = digest2(messages.findLast((message2) => message2.type === "compaction")?.id ?? "initial");
+      let edge = page.from === "start" ? 0 : transcript.length;
+      if (page.cursor !== null) {
+        const match = /^oc2:(start|end):([a-f0-9]{24}):([a-f0-9]{24})$/.exec(page.cursor);
+        const anchor2 = match ? transcript.findIndex((message2) => digest2(message2.id) === match[3]) : -1;
+        if (!match || match[1] !== page.from || match[2] !== epoch || anchor2 < 0) {
+          throw new SessionRunnerError("cursor_unavailable", "This cursor is unknown or its messages were compacted. Read again without a cursor; only recent context is available.");
+        }
+        edge = page.from === "start" ? anchor2 + 1 : anchor2;
+      }
+      const start = page.from === "start" ? edge : Math.max(0, edge - page.limit);
+      const end = page.from === "start" ? Math.min(transcript.length, edge + page.limit) : edge;
+      const selected = transcript.slice(start, end);
+      boundTranscript(selected);
+      const anchor = page.from === "start" ? selected.at(-1) : selected[0];
+      const more = page.from === "start" ? end < transcript.length : start > 0;
+      return {
+        title: info.title ? clipped(info.title, 240) : null,
+        status: progress.status,
+        waitingFor: progress.waitingFor ?? null,
+        lastError: progress.error ?? null,
+        historyScope: "context",
+        messageCount: transcript.length,
+        from: page.from,
+        messages: selected,
+        nextCursor: more && anchor ? `oc2:${page.from}:${epoch}:${digest2(anchor.id)}` : null
+      };
+    }
+  };
+  return adapter;
+}
+function toolCall2(part) {
+  const state = part.state;
+  const rawInput = typeof state.input === "string" ? state.input : JSON.stringify(state.input);
+  const rawOutput = "content" in state ? JSON.stringify(state.content) : undefined;
+  const rawError = "error" in state ? state.error.message ?? state.error.type : undefined;
+  return {
+    id: clipped(part.id, 240),
+    name: clipped(part.name, 240),
+    status: state.status,
+    input: summary(state.input),
+    output: rawOutput === undefined ? null : clipped(rawOutput, 2000),
+    error: rawError === undefined ? null : clipped(rawError, 2000),
+    truncated: rawInput.length > 2000 || (rawOutput?.length ?? 0) > 2000 || (rawError?.length ?? 0) > 2000
+  };
+}
+function transcriptMessage(message2) {
+  const text2 = message2.type === "user" ? message2.text : message2.type === "assistant" ? message2.content.filter((part) => part.type === "text").map((part) => part.text).join(`
+`) : "";
+  const tools = message2.type === "assistant" ? message2.content.filter((part) => part.type === "tool").map(toolCall2) : [];
+  return {
+    id: clipped(message2.id, 240),
+    role: message2.type === "user" ? "user" : "assistant",
+    createdAt: message2.time.created,
+    text: clipped(text2, 20000),
+    truncated: text2.length > 20000 || tools.length > 200,
+    toolCalls: tools.slice(0, 200),
+    error: message2.type === "assistant" ? errorOf(message2.error) : null
+  };
+}
+function boundTranscript(messages) {
+  while (Buffer.byteLength(JSON.stringify(messages), "utf8") > 220000) {
+    let reduced = false;
+    for (const message2 of messages) {
+      if (message2.text.length > 256) {
+        message2.text = message2.text.slice(0, Math.floor(message2.text.length / 2));
+        message2.truncated = true;
+        reduced = true;
+      }
+      if (message2.toolCalls.length > 4) {
+        message2.toolCalls = message2.toolCalls.slice(0, Math.ceil(message2.toolCalls.length / 2));
+        message2.truncated = true;
+        reduced = true;
+      }
+      for (const tool of message2.toolCalls) {
+        for (const key of ["input", "output", "error"]) {
+          const value = tool[key];
+          if (value && value.length > 256) {
+            tool[key] = value.slice(0, Math.floor(value.length / 2));
+            tool.truncated = true;
+            reduced = true;
+          }
+        }
+      }
+    }
+    if (!reduced)
+      throw new SessionRunnerError("transcript_too_large", "The bounded recent context page is still too large. Request fewer messages.");
+  }
+}
+var init_native_opencode = __esm(() => {
+  init_src();
+  init_den();
+});
+
+// ../../packages/opencode-plugin/src/runner-ownership.ts
+import { createHash as createHash5, randomUUID } from "node:crypto";
+import { mkdir, readdir, readFile, rmdir, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return !(isRecord(error) && error.code === "ESRCH");
+  }
+}
+async function acquireRunnerOwnership(directory, root = join(homedir(), ".local", "share", "opencode", "openwork-session-runner-locks")) {
+  const key = createHash5("sha256").update(directory).digest("hex");
+  const owners = globalThis.__openworkNativeRunnerOwners ??= new Map;
+  if (owners.has(key))
+    return null;
+  const owner = Symbol(key);
+  owners.set(key, owner);
+  const lock = join(root, key);
+  const marker = `${process.pid}-${randomUUID()}.json`;
+  let acquired = false;
+  let ready = false;
+  try {
+    await mkdir(root, { recursive: true, mode: 448 });
+    for (let attempt = 0;attempt < 2; attempt++) {
+      try {
+        await mkdir(lock, { mode: 448 });
+        acquired = true;
+        break;
+      } catch (error) {
+        if (!isRecord(error) || error.code !== "EEXIST")
+          throw error;
+        const entries = await readdir(lock);
+        if (entries.length !== 1 || !/^\d+-[a-f0-9-]+\.json$/.test(entries[0] ?? ""))
+          return null;
+        const file = entries[0];
+        const value = JSON.parse(await readFile(join(lock, file), "utf8"));
+        if (!isRecord(value) || !Number.isSafeInteger(value.pid) || typeof value.pid !== "number" || value.pid < 1 || String(value.pid) !== file.split("-")[0] || alive(value.pid))
+          return null;
+        try {
+          await unlink(join(lock, file));
+          await rmdir(lock);
+        } catch {
+          return null;
+        }
+      }
+    }
+    if (!acquired)
+      return null;
+    await writeFile(join(lock, marker), JSON.stringify({ pid: process.pid }), { flag: "wx", mode: 384 });
+    ready = true;
+    let released = false;
+    return {
+      async release() {
+        if (released)
+          return;
+        released = true;
+        await unlink(join(lock, marker)).catch(() => {});
+        await rmdir(lock).catch(() => {});
+        if (owners.get(key) === owner)
+          owners.delete(key);
+      }
+    };
+  } finally {
+    if (!ready) {
+      if (acquired)
+        await rmdir(lock).catch(() => {});
+      if (owners.get(key) === owner)
+        owners.delete(key);
+    }
+  }
+}
+var init_runner_ownership = __esm(() => {
+  init_den();
+});
+
+// ../../packages/opencode-plugin/src/remote-runner.ts
+var exports_remote_runner = {};
+__export(exports_remote_runner, {
+  hasNativeSessionHost: () => hasNativeSessionHost,
+  createRemoteRunnerController: () => createRemoteRunnerController
+});
+import { createHash as createHash6, randomUUID as randomUUID2 } from "node:crypto";
+import { realpath as realpath2 } from "node:fs/promises";
+import { hostname } from "node:os";
+function hash(value) {
+  return createHash6("sha256").update(value).digest("hex").slice(0, 32);
+}
+function hostRead(read, signal) {
+  const bounded2 = AbortSignal.any([signal, AbortSignal.timeout(1e4)]);
+  bounded2.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(bounded2.reason);
+    bounded2.addEventListener("abort", abort, { once: true });
+    Promise.resolve().then(() => {
+      bounded2.throwIfAborted();
+      return read();
+    }).then(resolve, reject).finally(() => bounded2.removeEventListener("abort", abort));
+  });
+}
+function platform() {
+  if (process.platform !== "darwin" && process.platform !== "linux" && process.platform !== "win32") {
+    throw new Error("Remote OpenCode sessions require macOS, Linux, or Windows.");
+  }
+  return process.platform;
+}
+function createRemoteRunnerController(input) {
+  const { ctx } = input;
+  const now = input.now ?? Date.now;
+  const random = input.random ?? Math.random;
+  const fetcher = input.fetch ?? ((url, init) => fetch(url, init));
+  const schedule = input.schedule ?? ((callback, delay2) => {
+    const timer = setTimeout(callback, delay2);
+    timer.unref?.();
+    return () => clearTimeout(timer);
+  });
+  let disposed = false;
+  let started = false;
+  let active = null;
+  let verifiedMember = null;
+  let ownership = null;
+  let directory = null;
+  let cancelTimer = null;
+  let operation = null;
+  let flight = null;
+  let queued = false;
+  let failures = 0;
+  let phase = "credentials";
+  let status2 = { state: "waiting", phase, failures: 0, observedAt: now(), error: null };
+  const statusKey = `remoteSessions/status/${hash(ctx.location.directory)}`;
+  const recordStatus = async (state, error = null) => {
+    status2 = { state, phase, failures, observedAt: now(), error };
+    await hostRead(() => ctx.storage.set(statusKey, { ...status2 }), AbortSignal.timeout(1000)).catch(() => {});
+  };
+  async function account(signal) {
+    const connection = await hostRead(() => ctx.integration.connection.active(INTEGRATION_ID), signal);
+    signal.throwIfAborted();
+    if (!connection || connection.type !== "credential" || connection.status?.status === "needs_auth")
+      return null;
+    const credential = await hostRead(() => ctx.integration.connection.resolve(connection), signal);
+    signal.throwIfAborted();
+    if (!credential || credential.type !== "oauth" || !Number.isFinite(credential.expires) || credential.expires <= now())
+      return null;
+    const metadata = readCredentialMetadata(credential, input.apiBaseUrl);
+    if (!metadata.orgId || !isAllowedApiBaseUrl(metadata.apiBaseUrl))
+      return null;
+    const session = { apiBaseUrl: metadata.apiBaseUrl, orgId: metadata.orgId, token: credential.access };
+    const key = hash(JSON.stringify([session.apiBaseUrl, session.orgId, session.token]));
+    if (verifiedMember?.key !== key) {
+      verifiedMember = null;
+      const me = await hostRead(() => readMe((url, init) => fetcher(url, {
+        ...init,
+        signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal
+      }), session), signal);
+      signal.throwIfAborted();
+      if (!me.userId)
+        throw new Error("OpenWork returned an invalid authenticated member.");
+      verifiedMember = { key, userId: me.userId };
+    }
+    return {
+      identity: hash(JSON.stringify([session.apiBaseUrl, session.orgId, verifiedMember.userId, connection.id])),
+      session,
+      credentialExpiresAt: credential.expires
+    };
+  }
+  async function initialize(value, signal) {
+    directory ??= await realpath2(ctx.location.directory);
+    signal.throwIfAborted();
+    ownership ??= await (input.acquireOwnership ?? acquireRunnerOwnership)(directory);
+    if (!ownership)
+      return null;
+    signal.throwIfAborted();
+    const directoryKey = hash(directory);
+    let installation = await ctx.storage.get("remoteSessions/installation");
+    if (typeof installation !== "string" || !installation) {
+      installation = randomUUID2();
+      await ctx.storage.set("remoteSessions/installation", installation);
+    }
+    const identityKey = `remoteSessions/runner/${hash(JSON.stringify([directoryKey, value.identity]))}`;
+    let runnerId = await ctx.storage.get(identityKey);
+    if (typeof runnerId !== "string" || !/^oc_runner_[a-f0-9]{32}$/.test(runnerId)) {
+      runnerId = `oc_runner_${hash(JSON.stringify([installation, directory, value.identity]))}`;
+      await ctx.storage.set(identityKey, runnerId);
+    }
+    if (typeof runnerId !== "string")
+      throw new Error("Runner identity is unavailable.");
+    const workspaceId = `oc_workspace_${directoryKey}`;
+    const prefix = `remoteSessions/${hash(JSON.stringify([value.identity, runnerId, directory]))}`;
+    const journalKey = `${prefix}/journal`;
+    const native = createNativeOpenCodeAdapter({ ctx, directory, workspaceId, storagePrefix: prefix, now });
+    const state = {
+      account: value,
+      runnerId,
+      workspaceId,
+      runner: createSessionRunner({
+        adapter: native,
+        store: {
+          async load() {
+            const stored = await ctx.storage.get(journalKey);
+            return stored === undefined ? emptyJournal() : parseJournal(stored);
+          },
+          async save(journal) {
+            await ctx.storage.set(journalKey, JSON.parse(JSON.stringify(journal)));
+          }
+        },
+        transport: createRemoteSessionTransport({
+          baseUrl: value.session.apiBaseUrl,
+          token: () => disposed || active !== state || state.account.credentialExpiresAt <= now() || state.tokenExpiresAt <= now() ? null : state.token,
+          fetch: (url, init) => fetcher(String(url), init),
+          timeoutMs: 1e4
+        }),
+        now
+      }),
+      token: null,
+      tokenExpiresAt: 0,
+      registeredAt: 0,
+      inventoryAt: 0
+    };
+    await state.runner.inspect();
+    signal.throwIfAborted();
+    return state;
+  }
+  async function register(state, signal) {
+    const response = await hostRead(() => denRequest(fetcher, state.account.session, "/v1/session-runners/token", {
+      method: "POST",
+      signal,
+      body: {
+        runnerId: state.runnerId,
+        protocolVersion: 1,
+        supportedExecutionTargets: ["desktop"],
+        capabilities: CAPABILITIES,
+        platform: platform(),
+        appVersion: ctx.app.version,
+        concurrency: 1
+      }
+    }), signal);
+    signal.throwIfAborted();
+    if (!isRecord(response) || typeof response.token !== "string" || response.token.length < 32 || response.token.length > 512 || /[\r\n]/.test(response.token) || typeof response.expiresAt !== "number" || !Number.isFinite(response.expiresAt) || response.expiresAt <= now()) {
+      throw new Error("OpenWork returned an invalid session-runner registration.");
+    }
+    state.token = response.token;
+    state.tokenExpiresAt = response.expiresAt;
+    state.registeredAt = now();
+    state.inventoryAt = 0;
+  }
+  async function runnerRequest(state, path, signal, body) {
+    const token = state.token;
+    if (!token || state.tokenExpiresAt <= now())
+      throw new RemoteSessionHttpError(401);
+    return hostRead(() => denRequest(fetcher, { ...state.account.session, token }, path, { signal, ...body === undefined ? {} : { method: "PUT", body } }), signal);
+  }
+  async function cycle(signal) {
+    phase = "credentials";
+    let value;
+    try {
+      value = await account(signal);
+    } catch (error) {
+      if (!signal.aborted)
+        active = null;
+      throw error;
+    }
+    if (!value) {
+      active = null;
+      return;
+    }
+    signal = AbortSignal.any([signal, AbortSignal.timeout(Math.max(1, Math.min(2147483647, value.credentialExpiresAt - now())))]);
+    if (active && active.account.identity !== value.identity)
+      active = null;
+    if (!active)
+      active = await initialize(value, signal);
+    const state = active;
+    if (!state)
+      return;
+    state.account = value;
+    signal.throwIfAborted();
+    if (!state.token || state.tokenExpiresAt <= now() + 2 * 60000 || now() - state.registeredAt >= RENEW_MS) {
+      phase = "registration";
+      await register(state, signal);
+    }
+    const transport = createRemoteSessionTransport({
+      baseUrl: value.session.apiBaseUrl,
+      token: () => state.token,
+      fetch: (url, init) => fetcher(String(url), init),
+      timeoutMs: 1e4
+    });
+    if (state.inventoryAt === 0 || now() - state.inventoryAt >= INVENTORY_MS) {
+      phase = "inventory";
+      const workspace = await hostRead(() => nativeWorkspace(ctx, state.workspaceId, signal), signal);
+      const published = await runnerRequest(state, "/v1/session-runners/inventory", signal, {
+        computer: { label: (input.label?.trim() || hostname() || "OpenCode").slice(0, 120), platform: platform(), appVersion: ctx.app.version },
+        workspaces: [workspace]
+      });
+      signal.throwIfAborted();
+      if (!isRecord(published) || published.ok !== true || typeof published.updatedAt !== "number" || !Number.isFinite(published.updatedAt)) {
+        throw new Error("OpenWork returned an invalid inventory acknowledgement.");
+      }
+      state.inventoryAt = now();
+    }
+    phase = "recovery";
+    await state.runner.reconcile(signal);
+    const journal = await state.runner.inspect();
+    if (journal.commands.length >= 200 || journal.requests.length >= 200) {
+      await state.runner.prune({ retainCommands: 128, retainRequests: 128 });
+    }
+    phase = "work";
+    const response = await runnerRequest(state, "/v1/session-runners/work", signal);
+    signal.throwIfAborted();
+    if (!isRecord(response) || !Array.isArray(response.items) || response.items.length > 10)
+      throw new Error("Invalid session-runner work response.");
+    for (const item of response.items) {
+      signal.throwIfAborted();
+      if (!isRecord(item))
+        throw new Error("Invalid session-runner work item.");
+      try {
+        if (item.kind === "remote_session_create" && typeof item.commandId === "string") {
+          await state.runner.accept(await transport.claimCommand(item.commandId, signal), signal);
+        } else if (item.kind === "remote_session_request" && typeof item.requestId === "string") {
+          await state.runner.execute(await transport.claimRequest(item.requestId, signal), signal);
+        } else {
+          throw new Error("Unexpected session-runner work kind.");
+        }
+      } catch (error) {
+        if (error instanceof RemoteSessionHttpError && error.status === 409)
+          continue;
+        throw error;
+      }
+    }
+    await state.runner.reconcile(signal);
+  }
+  function poll() {
+    if (disposed)
+      return Promise.resolve();
+    if (flight) {
+      queued = true;
+      return flight;
+    }
+    cancelTimer?.();
+    cancelTimer = null;
+    const controller = new AbortController;
+    operation = controller;
+    flight = cycle(controller.signal).then(async () => {
+      failures = 0;
+      await recordStatus(active ? "connected" : "waiting");
+    }).catch(async (error) => {
+      if (!controller.signal.aborted) {
+        failures++;
+        if (error instanceof DenAuthError || error instanceof RemoteSessionHttpError && (error.status === 401 || error.status === 403) || error instanceof DenRequestError && (error.status === 403 || error.status === 404))
+          active = null;
+        await recordStatus("retrying", `${phase}_failed`);
+      }
+    }).finally(() => {
+      flight = null;
+      if (operation === controller)
+        operation = null;
+      if (disposed || !started)
+        return;
+      const delay2 = queued ? 0 : Math.round((failures ? Math.min(30000, POLL_MS * 2 ** Math.min(failures, 4)) : POLL_MS) * (0.8 + random() * 0.4));
+      queued = false;
+      cancelTimer = schedule(() => {
+        poll();
+      }, delay2);
+    });
+    return flight;
+  }
+  return {
+    inspectStatus() {
+      return { ...status2 };
+    },
+    start() {
+      if (started || disposed)
+        return;
+      started = true;
+      poll();
+    },
+    poll,
+    credentialsChanged() {
+      if (disposed)
+        return;
+      operation?.abort(new Error("OpenWork credentials changed."));
+      queued = true;
+      if (!flight)
+        poll();
+    },
+    async close() {
+      if (disposed)
+        return;
+      disposed = true;
+      started = false;
+      cancelTimer?.();
+      operation?.abort(new Error("The OpenWork plugin unloaded."));
+      await flight;
+      active = null;
+      await ownership?.release();
+      ownership = null;
+      await recordStatus("closed");
+    }
+  };
+}
+var CAPABILITIES, RENEW_MS, INVENTORY_MS = 60000, POLL_MS = 3000;
+var init_remote_runner = __esm(() => {
+  init_src();
+  init_auth();
+  init_den();
+  init_native_opencode();
+  init_native_opencode();
+  init_runner_ownership();
+  CAPABILITIES = ["remote_session_v1", "remote_session_control_v1", "remote_session_only_v1", "remote_session_recovery_v1"];
+  RENEW_MS = 30 * 60000;
+});
+
+// ../../packages/opencode-plugin/src/plugin.ts
+import { createHash as createHash7 } from "node:crypto";
+
+// ../../packages/opencode-plugin/src/desktop.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// ../../packages/opencode-plugin/src/desktop-credential-channel.ts
+import { createRequire } from "node:module";
+function isBroker(value) {
+  return typeof value === "object" && value !== null && "initialize" in value && typeof value.initialize === "function" && "fetchSession" in value && typeof value.fetchSession === "function" && "fetchInventory" in value && typeof value.fetchInventory === "function";
+}
+var filename = process.env.OPENWORK_PROVIDER_SESSION_BROKER;
+var loaded = filename ? createRequire(import.meta.url)(filename) : null;
+if (loaded !== null && !isBroker(loaded))
+  throw new Error("Invalid desktop credential broker");
+var broker = isBroker(loaded) ? loaded : null;
+async function initializeDesktopCredentialChannel() {
+  await broker?.initialize();
+}
+async function fetchDesktopSession(fetcher, endpoint, signal) {
+  return broker ? broker.fetchSession(fetcher, endpoint, signal) : null;
+}
+async function fetchDesktopInventory(fetcher, endpoint, path, identity, signal) {
+  return broker ? broker.fetchInventory(fetcher, endpoint, path, identity, signal) : null;
+}
+
+// ../../packages/opencode-plugin/src/desktop.ts
+init_den();
+
+// ../../packages/opencode-plugin/src/inventory-events.ts
+init_den();
+import { setTimeout as delay } from "node:timers/promises";
+import { createHash } from "node:crypto";
+var INVENTORY_EVENTS_PATH = "/v1/inference-providers/inventory/events";
+function inventorySessionKey(session) {
+  return createHash("sha256").update(JSON.stringify([normalizeBaseUrl(session.apiBaseUrl), session.orgId, session.token])).digest("hex");
+}
+function joinSharedInventory(shared, options) {
+  if (options.signal.aborted)
+    return Promise.resolve();
+  const key = inventorySessionKey(options.identity);
+  let entry = shared.get(key);
+  const first = !entry;
+  if (!entry) {
+    entry = { controller: new AbortController, listeners: new Map, received: false, denied: null };
+    shared.set(key, entry);
+  }
+  const current = entry;
+  const id = Symbol();
+  current.listeners.set(id, options);
+  const result = new Promise((resolve) => {
+    const release = () => {
+      options.signal.removeEventListener("abort", release);
+      current.listeners.delete(id);
+      if (!current.listeners.size) {
+        if (shared.get(key) === current)
+          shared.delete(key);
+        current.controller.abort();
+      }
+      resolve();
+    };
+    options.signal.addEventListener("abort", release, { once: true });
+  });
+  if (first) {
+    subscribeInventory({
+      fetch: options.fetch,
+      heartbeatMs: options.heartbeatMs,
+      retryMs: options.retryMs,
+      signal: current.controller.signal,
+      session: async () => {
+        for (const listener of current.listeners.values()) {
+          if (listener.signal.aborted)
+            continue;
+          const session = await listener.session().catch(() => null);
+          if (!listener.signal.aborted && session && inventorySessionKey(session) === key)
+            return session;
+        }
+        return null;
+      },
+      unauthorized: () => {
+        current.received = false;
+        current.denied = "session";
+        for (const listener of current.listeners.values()) {
+          if (!listener.signal.aborted) {
+            try {
+              listener.unauthorized?.();
+            } catch {}
+          }
+        }
+      },
+      revoked: () => {
+        current.received = false;
+        current.denied = "organization";
+        for (const listener of current.listeners.values()) {
+          if (!listener.signal.aborted) {
+            try {
+              (listener.revoked ?? listener.unauthorized)?.();
+            } catch {}
+          }
+        }
+      },
+      changed: () => {
+        current.denied = null;
+        current.received = true;
+        for (const listener of current.listeners.values()) {
+          if (!listener.signal.aborted) {
+            try {
+              listener.changed();
+            } catch {}
+          }
+        }
+      }
+    });
+  } else {
+    queueMicrotask(() => {
+      if (options.signal.aborted)
+        return;
+      if (current.denied === "organization")
+        (options.revoked ?? options.unauthorized)?.();
+      else if (current.denied === "session")
+        options.unauthorized?.();
+      else if (current.received)
+        options.changed();
+    });
+  }
+  return result;
+}
+function createInventoryHub() {
+  const shared = new Map;
+  const join = (options) => joinSharedInventory(shared, options);
+  return Object.freeze({ join: Object.freeze(join) });
+}
+function subscribeSharedInventory(options) {
+  if (options.signal.aborted)
+    return Promise.resolve();
+  let hub = globalThis.__openworkInventorySubscriptions;
+  if (!hub) {
+    hub = createInventoryHub();
+    Object.defineProperty(globalThis, "__openworkInventorySubscriptions", {
+      value: hub,
+      writable: false,
+      configurable: false,
+      enumerable: false
+    });
+  }
+  return hub.join(options);
+}
+
+class SseParser {
+  buffer = "";
+  event = "";
+  data = [];
+  receive;
+  constructor(receive) {
+    this.receive = receive;
+  }
+  push(text) {
+    this.buffer += text;
+    if (this.buffer.length > 1024 * 1024)
+      throw new Error("SSE frame too large");
+    while (true) {
+      const match = /[\r\n]/.exec(this.buffer);
+      if (!match)
+        return;
+      const index = match.index;
+      const ending = this.buffer[index];
+      if (ending === "\r" && index === this.buffer.length - 1)
+        return;
+      const line = this.buffer.slice(0, index);
+      this.buffer = this.buffer.slice(index + (ending === "\r" && this.buffer[index + 1] === `
+` ? 2 : 1));
+      if (!line) {
+        if (this.data.length)
+          this.receive({ event: this.event || "message", data: this.data.join(`
+`) });
+        this.event = "";
+        this.data = [];
+      } else if (!line.startsWith(":")) {
+        const colon = line.indexOf(":");
+        const field = colon < 0 ? line : line.slice(0, colon);
+        let value = colon < 0 ? "" : line.slice(colon + 1);
+        if (value.startsWith(" "))
+          value = value.slice(1);
+        if (field === "event")
+          this.event = value;
+        if (field === "data")
+          this.data.push(value);
+        if (this.data.reduce((size, entry) => size + entry.length, 0) > 1024 * 1024)
+          throw new Error("SSE event too large");
+      }
+    }
+  }
+}
+async function organizationNotFound(response, signal) {
+  if (!response.body)
+    return false;
+  const reader = response.body.getReader();
+  const cancel = () => {
+    reader.cancel().catch(() => {});
+  };
+  signal.addEventListener("abort", cancel, { once: true });
+  try {
+    const decoder = new TextDecoder;
+    let text = "";
+    let size = 0;
+    while (!signal.aborted) {
+      const chunk = await reader.read();
+      if (chunk.done) {
+        text += decoder.decode();
+        const value = JSON.parse(text);
+        return isRecord(value) && value.error === "organization_not_found";
+      }
+      size += chunk.value.byteLength;
+      if (size > 16 * 1024)
+        return false;
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    return false;
+  } catch {
+    return false;
+  } finally {
+    signal.removeEventListener("abort", cancel);
+    await reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+function subscribeInventory(options) {
+  return (async () => {
+    let failures = 0;
+    while (!options.signal.aborted) {
+      const connection = new AbortController;
+      const signal = AbortSignal.any([options.signal, connection.signal]);
+      let watchdog;
+      const touch = () => {
+        clearTimeout(watchdog);
+        watchdog = setTimeout(() => connection.abort(), options.heartbeatMs ?? 45000);
+        watchdog.unref?.();
+      };
+      try {
+        const session = await options.session();
+        if (!session || signal.aborted)
+          return;
+        if (!isAllowedApiBaseUrl(session.apiBaseUrl))
+          return;
+        touch();
+        const response = await options.fetch(`${normalizeBaseUrl(session.apiBaseUrl)}${INVENTORY_EVENTS_PATH}`, {
+          headers: {
+            accept: "text/event-stream",
+            authorization: `Bearer ${session.token}`,
+            ...session.orgId ? { "x-openwork-org-id": session.orgId, "x-openwork-legacy-org-id": session.orgId } : {}
+          },
+          redirect: "error",
+          signal
+        });
+        if (response.status === 404) {
+          if (!await organizationNotFound(response, signal))
+            return;
+          if (signal.aborted)
+            return;
+          const revoked = options.revoked ?? options.unauthorized;
+          revoked?.();
+          throw new Error("Inventory organization access revoked");
+        }
+        if (response.status === 401) {
+          await response.body?.cancel().catch(() => {});
+          if (!signal.aborted)
+            options.unauthorized?.();
+          return;
+        }
+        if (response.status === 403) {
+          await response.body?.cancel().catch(() => {});
+          if (signal.aborted)
+            return;
+          const revoked = options.revoked ?? options.unauthorized;
+          revoked?.();
+          throw new Error("Inventory organization access revoked");
+        }
+        if (!response.ok || !response.body || !response.headers.get("content-type")?.includes("text/event-stream")) {
+          await response.body?.cancel();
+          throw new Error("Inventory subscription unavailable");
+        }
+        options.changed();
+        const parser = new SseParser(({ event }) => {
+          if (event === "inventory.changed")
+            options.changed();
+        });
+        const reader = response.body.getReader();
+        const cancel = () => {
+          reader.cancel().catch(() => {});
+        };
+        signal.addEventListener("abort", cancel, { once: true });
+        try {
+          const decoder = new TextDecoder;
+          while (!signal.aborted) {
+            const chunk = await reader.read();
+            if (chunk.done)
+              break;
+            touch();
+            failures = 0;
+            parser.push(decoder.decode(chunk.value, { stream: true }));
+          }
+        } finally {
+          signal.removeEventListener("abort", cancel);
+          await reader.cancel().catch(() => {});
+          reader.releaseLock();
+        }
+      } catch {} finally {
+        clearTimeout(watchdog);
+        connection.abort();
+      }
+      if (options.signal.aborted)
+        return;
+      const base = options.retryMs ?? 1000;
+      const backoff = Math.min(30000, base * 2 ** Math.min(failures++, 5));
+      await delay(backoff, undefined, { signal: options.signal, ref: false }).catch(() => {});
+    }
+  })();
+}
+
+// ../../packages/opencode-plugin/src/inventory-retry.ts
+function inventoryRetry(retry, baseMs = 1000) {
+  let timer;
+  let failures = 0;
+  const cancel = () => {
+    clearTimeout(timer);
+    timer = undefined;
+  };
+  return {
+    cancel,
+    reset() {
+      cancel();
+      failures = 0;
+    },
+    schedule() {
+      if (timer)
+        return;
+      const timeout = Math.min(30000, baseMs * 2 ** Math.min(failures++, 5));
+      timer = setTimeout(() => {
+        timer = undefined;
+        retry();
+      }, timeout);
+      timer.unref?.();
+    }
+  };
+}
+
+// ../../packages/opencode-plugin/src/providers.ts
+init_den();
+function readString2(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function parseModel(value) {
+  if (!isRecord(value))
+    return null;
+  const id = readString2(value.id);
+  const name = readString2(value.name);
+  if (!id || !name || !isRecord(value.config))
+    return null;
+  return {
+    id,
+    name,
+    config: value.config,
+    upstreamModelId: readString2(value.upstreamModelId),
+    modelGroupName: readString2(value.modelGroupName),
+    credentialSetName: readString2(value.credentialSetName)
+  };
+}
+function parseGatewayProvider(value) {
+  if (!isRecord(value))
+    return null;
+  const id = readString2(value.id);
+  const providerId = readString2(value.providerId);
+  const name = readString2(value.name);
+  if (!id || !/^ipr_/.test(id) || !providerId || !name || !Array.isArray(value.models))
+    return null;
+  const models = [];
+  for (const entry of value.models) {
+    const model = parseModel(entry);
+    if (model)
+      models.push(model);
+  }
+  return {
+    id,
+    providerId,
+    name,
+    credentialStatus: readString2(value.credentialStatus) ?? "ready",
+    providerConfig: isRecord(value.providerConfig) ? value.providerConfig : {},
+    models
+  };
+}
+async function fetchGatewayInventory(fetcher, session, signal, credentialScope = "den") {
+  return fetchGatewayInventoryOnce(fetcher, session, signal, false, credentialScope);
+}
+async function fetchGatewayInventoryOnce(fetcher, session, signal, relisted, credentialScope) {
+  let listed;
+  try {
+    listed = await denRequest(fetcher, session, "/v1/inference-providers?scope=usable", { signal });
+  } catch (error) {
+    if (error instanceof DenRequestError && error.status === 403)
+      throw new DenAuthError(403, "/v1/inference-providers");
+    if (error instanceof DenRequestError && [404, 405, 501].includes(error.status)) {
+      return { providers: [], apiKey: null, skipped: [] };
+    }
+    throw error;
+  }
+  const rows = isRecord(listed) && Array.isArray(listed.inferenceProviders) ? listed.inferenceProviders : [];
+  const providers = [];
+  const skipped = [];
+  let apiKey = null;
+  for (const row of rows) {
+    const provider = parseGatewayProvider(row);
+    if (!provider)
+      continue;
+    if (provider.models.length === 0) {
+      skipped.push({
+        id: provider.id,
+        name: provider.name,
+        reason: provider.credentialStatus === "member_auth_required" || provider.credentialStatus === "org_credential_missing" ? provider.credentialStatus : "no_accessible_models"
+      });
+      continue;
+    }
+    let connected;
+    try {
+      connected = await denRequest(fetcher, session, `/v1/inference-providers/${encodeURIComponent(provider.id)}/connect`, { signal });
+    } catch (error) {
+      if (!(error instanceof DenRequestError) || error.status !== 403)
+        throw error;
+      if (!relisted)
+        return fetchGatewayInventoryOnce(fetcher, session, signal, true, credentialScope);
+      skipped.push({ id: provider.id, name: provider.name, reason: "missing_credentials" });
+      continue;
+    }
+    const detail = isRecord(connected) ? connected.inferenceProvider : null;
+    const key = isRecord(detail) ? readString2(detail.apiKey) : null;
+    const parsed = parseGatewayProvider(detail) ?? provider;
+    const allowedKey = credentialScope === "desktop" ? key === "ow_local_catalog" : key?.startsWith("ow_gw_");
+    if (!key || !allowedKey || parsed.id !== provider.id) {
+      skipped.push({ id: provider.id, name: provider.name, reason: "missing_credentials" });
+      continue;
+    }
+    apiKey = key;
+    providers.push(parsed);
+  }
+  providers.sort((left, right) => left.id.localeCompare(right.id));
+  return { providers, apiKey, skipped };
+}
+var NATIVE_PACKAGES = {
+  "@ai-sdk/amazon-bedrock": "@opencode/ai/providers/amazon-bedrock",
+  "@ai-sdk/anthropic": "@opencode/ai/providers/anthropic",
+  "@ai-sdk/azure": "@opencode/ai/providers/azure/responses",
+  "@ai-sdk/google": "@opencode/ai/providers/google",
+  "@ai-sdk/google-vertex": "@opencode/ai/providers/google-vertex",
+  "@ai-sdk/google-vertex/anthropic": "@opencode/ai/providers/google-vertex/messages",
+  "@ai-sdk/mistral": "@opencode/ai/providers/mistral",
+  "@ai-sdk/openai": "@opencode/ai/providers/openai",
+  "@ai-sdk/openai-compatible": "@opencode/ai/providers/openai-compatible",
+  "@ai-sdk/xai": "@opencode/ai/providers/xai",
+  "@openrouter/ai-sdk-provider": "@opencode/ai/providers/openrouter"
+};
+function providerPackage(npm) {
+  if (!npm)
+    return "@opencode/ai/providers/openai-compatible";
+  return NATIVE_PACKAGES[npm] ?? `aisdk:${npm}`;
+}
+function stringRecord(value) {
+  if (!isRecord(value))
+    return;
+  const entries = Object.entries(value).filter((entry) => typeof entry[1] === "string");
+  return entries.length ? Object.fromEntries(entries) : undefined;
+}
+function finite(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+}
+function int(value, fallback) {
+  return Math.max(0, Math.trunc(finite(value, fallback)));
+}
+function costs(value) {
+  if (!isRecord(value))
+    return [];
+  const base = {
+    input: finite(value.input, 0),
+    output: finite(value.output, 0),
+    cache: { read: finite(value.cache_read, 0), write: finite(value.cache_write, 0) }
+  };
+  const result = [base];
+  const over = value.context_over_200k;
+  if (isRecord(over)) {
+    result.push({
+      tier: { type: "context", size: 200000 },
+      input: finite(over.input, base.input),
+      output: finite(over.output, base.output),
+      cache: { read: finite(over.cache_read, base.cache.read), write: finite(over.cache_write, base.cache.write) }
+    });
+  }
+  return result;
+}
+function stringList(value, fallback) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string") ? [...value] : [...fallback];
+}
+function reasoningEfforts(config) {
+  const options = Array.isArray(config.reasoning_options) ? config.reasoning_options : [];
+  const values = options.flatMap((option) => isRecord(option) && option.type === "effort" && Array.isArray(option.values) ? option.values.filter((value) => typeof value === "string" && value !== "null") : []);
+  return [...new Set(values)];
+}
+function manualClaude(upstreamModelId) {
+  const id = upstreamModelId ?? "";
+  const familyFirst = /(?:claude-)?(opus|sonnet|haiku)-(\d+)(?:[.-](\d+))?/i.exec(id);
+  const versionFirst = /claude-(\d+)(?:[.-](\d+))?-(opus|sonnet|haiku)/i.exec(id);
+  const major = Number(familyFirst?.[2] ?? versionFirst?.[1]);
+  const minor = Number(familyFirst?.[3] ?? versionFirst?.[2] ?? 0);
+  return major === 3 && minor === 7 || major === 4 && minor < 6;
+}
+function reasoningVariants(pkg, config, upstreamModelId) {
+  if (config.reasoning === false)
+    return [];
+  const efforts = reasoningEfforts(config);
+  if (!efforts.length)
+    return [];
+  const spell = (settings) => efforts.map((effort) => ({ id: effort, settings: settings(effort) }));
+  switch (pkg) {
+    case "@opencode/ai/providers/openai":
+    case "@opencode/ai/providers/azure/responses":
+    case "@opencode/ai/providers/xai":
+      return spell((effort) => ({ reasoningEffort: effort, reasoningSummary: "auto", include: ["reasoning.encrypted_content"] }));
+    case "@opencode/ai/providers/openai-compatible":
+      return spell((effort) => ({ reasoningEffort: effort }));
+    case "@opencode/ai/providers/anthropic":
+    case "@opencode/ai/providers/google-vertex/messages":
+      if (manualClaude(upstreamModelId))
+        return [];
+      return spell((effort) => effort === "none" ? { thinking: { type: "disabled" } } : { thinking: { type: "adaptive", display: "summarized" }, effort });
+    case "@opencode/ai/providers/google":
+    case "@opencode/ai/providers/google-vertex":
+      return spell((effort) => ({ thinkingConfig: { includeThoughts: true, thinkingLevel: effort } }));
+    case "@opencode/ai/providers/openrouter":
+      return spell((effort) => ({ reasoning: { effort } }));
+    default:
+      return [];
+  }
+}
+var FAST_VARIANT_PREFIX = "__openwork_fast_v1/";
+var FAST_DEFAULT_VARIANT = `${FAST_VARIANT_PREFIX}default`;
+function fastVariantId(effort) {
+  return `${FAST_VARIANT_PREFIX}variant/${encodeURIComponent(effort)}`;
+}
+function catalogOffersFast(providerNpm, config) {
+  const modelProvider = isRecord(config.provider) ? config.provider : {};
+  if (providerNpm !== "@ai-sdk/openai")
+    return false;
+  if (modelProvider.npm !== undefined && modelProvider.npm !== providerNpm)
+    return false;
+  const variants = isRecord(config.variants) ? config.variants : {};
+  if (Object.keys(variants).some((id) => id.startsWith(FAST_VARIANT_PREFIX)))
+    return false;
+  const experimental = isRecord(config.experimental) ? config.experimental : {};
+  const modes = isRecord(experimental.modes) ? experimental.modes : {};
+  const fast = isRecord(modes.fast) ? modes.fast : null;
+  if (!fast || Object.keys(fast).some((key) => key !== "provider" && key !== "cost"))
+    return false;
+  const provider = isRecord(fast.provider) ? fast.provider : null;
+  const body = provider && isRecord(provider.body) ? provider.body : null;
+  return Boolean(provider && Object.keys(provider).length === 1 && body && Object.keys(body).length === 1 && body.service_tier === "priority");
+}
+function fastVariants(providerNpm, pkg, config, efforts) {
+  if (pkg !== "@opencode/ai/providers/openai" || !catalogOffersFast(providerNpm, config))
+    return [];
+  return [
+    { id: FAST_DEFAULT_VARIANT, settings: { serviceTier: "priority" } },
+    ...efforts.map((variant) => ({ id: fastVariantId(variant.id), settings: { ...variant.settings, serviceTier: "priority" } }))
+  ];
+}
+function displayName(model) {
+  const selection = model.modelGroupName && model.credentialSetName ? ` (${model.modelGroupName} / ${model.credentialSetName})` : "";
+  return selection && model.name.endsWith(selection) ? model.name.slice(0, -selection.length) : model.name;
+}
+var STATUSES = new Set(["alpha", "beta", "deprecated", "active"]);
+function toModelInfo(provider, model, providerPkg) {
+  const config = model.config;
+  const modelProvider = isRecord(config.provider) ? config.provider : {};
+  const modelNpm = readString2(modelProvider.npm);
+  const pkg = modelNpm ? providerPackage(modelNpm) : providerPkg;
+  const modalities = isRecord(config.modalities) ? config.modalities : {};
+  const limit = isRecord(config.limit) ? config.limit : {};
+  const status = readString2(config.status);
+  const released = Date.parse(readString2(config.release_date) ?? "");
+  const settings = isRecord(config.options) ? { ...config.options } : undefined;
+  const efforts = reasoningVariants(pkg, config, model.upstreamModelId);
+  const providerNpm = readString2(provider.providerConfig.npm);
+  return {
+    id: model.id,
+    modelID: readString2(config.id) ?? model.id,
+    providerID: provider.id,
+    name: displayName(model),
+    ...readString2(config.family) ? { family: readString2(config.family) ?? undefined } : {},
+    ...pkg !== providerPkg ? { package: pkg } : {},
+    ...settings && Object.keys(settings).length ? { settings } : {},
+    ...stringRecord(config.headers) ? { headers: stringRecord(config.headers) } : {},
+    capabilities: {
+      tools: typeof config.tool_call === "boolean" ? config.tool_call : true,
+      input: stringList(modalities.input, ["text", "image"]),
+      output: stringList(modalities.output, ["text"])
+    },
+    variants: [...efforts, ...fastVariants(providerNpm, pkg, config, efforts)],
+    time: { released: Number.isFinite(released) ? released : 0 },
+    cost: costs(config.cost),
+    status: status && STATUSES.has(status) ? status : "active",
+    enabled: status !== "deprecated",
+    limit: {
+      context: int(limit.context, 200000),
+      ...typeof limit.input === "number" ? { input: int(limit.input, 0) } : {},
+      output: int(limit.output, 32000)
+    }
+  };
+}
+var GATEWAY_INTEGRATION_ID = "openwork-gateway";
+function toProviderRecord(provider, apiKey) {
+  const config = provider.providerConfig;
+  const pkg = providerPackage(readString2(config.npm));
+  const options = isRecord(config.options) ? config.options : {};
+  const { headers, body, ...optionSettings } = options;
+  const baseURL = readString2(config.api) ?? readString2(options.baseURL);
+  const info = {
+    id: provider.id,
+    name: provider.name,
+    activation: "enabled",
+    integrationID: GATEWAY_INTEGRATION_ID,
+    package: pkg,
+    settings: {
+      ...optionSettings,
+      ...baseURL ? { baseURL } : {},
+      ...pkg === "@opencode/ai/providers/openai-compatible" ? { provider: provider.id } : {},
+      apiKey
+    },
+    ...stringRecord(headers) ? { headers: stringRecord(headers) } : {},
+    ...isRecord(body) ? { body: { ...body } } : {}
+  };
+  const models = [...provider.models].sort((left, right) => left.id.localeCompare(right.id)).map((model) => toModelInfo(provider, model, pkg));
+  return { info, models };
+}
+
+// ../../packages/opencode-plugin/src/desktop.ts
+var CACHE_KEY = "desktop/provider-inventory";
+var digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
+function isDesktopSessionEndpoint(value) {
+  if (typeof value !== "string")
+    return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" && ["127.0.0.1", "[::1]"].includes(url.hostname) && !url.username && !url.password && !url.hash;
+  } catch {
+    return false;
+  }
+}
+function inventorySession(value) {
+  return { apiBaseUrl: value.apiBaseUrl, token: value.identity, orgId: value.orgId };
+}
+async function readDesktopSession(fetcher, endpoint, capability, signal) {
+  if (!isDesktopSessionEndpoint(endpoint) || !capability)
+    return null;
+  const response = await fetcher(endpoint, {
+    headers: { accept: "application/json", authorization: `Bearer ${capability}` },
+    redirect: "error",
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(1500)]) : AbortSignal.timeout(1500)
+  });
+  return parseDesktopSession(response, endpoint);
+}
+async function parseDesktopSession(response, endpoint) {
+  if (!response)
+    return null;
+  if (!response.ok)
+    throw new Error("Desktop session unavailable");
+  const value = await response.json();
+  if (value === null)
+    return null;
+  if (!isRecord(value) || typeof value.apiBaseUrl !== "string" || !isAllowedApiBaseUrl(value.apiBaseUrl) || "token" in value || typeof value.identity !== "string" || !/^[a-f0-9]{64}$/.test(value.identity) || !(value.orgId === null || typeof value.orgId === "string") || typeof value.inferenceOrigin !== "string" || value.inferenceOrigin !== new URL(endpoint).origin || typeof value.inferenceKey !== "string" || !/^ow_local_[a-f0-9]{64}$/.test(value.inferenceKey)) {
+    throw new Error("Invalid desktop session");
+  }
+  return {
+    apiBaseUrl: normalizeBaseUrl(value.apiBaseUrl),
+    identity: value.identity,
+    orgId: value.orgId,
+    inferenceOrigin: value.inferenceOrigin,
+    inferenceKey: value.inferenceKey
+  };
+}
+function createDesktopProviderPlugin(deps = {}) {
+  const fetcher = deps.fetch ?? fetch;
+  const now = deps.now ?? Date.now;
+  return {
+    id: "openwork",
+    async setup(ctx) {
+      if (ctx.options.liveProviderSync !== true)
+        return;
+      const endpoint = ctx.options.desktopSession;
+      const capability = deps.capability?.();
+      if (!isDesktopSessionEndpoint(endpoint))
+        return;
+      if (typeof ctx.provider?.transform !== "function" || typeof ctx.provider?.reload !== "function" || typeof ctx.storage?.get !== "function") {
+        throw new Error("OpenWork provider sync needs OpenCode V2 provider and storage APIs");
+      }
+      const options = { ...readOptions(ctx.options), mcp: false };
+      const inventoryFetch = (source) => async (input, init) => {
+        const base = normalizeBaseUrl(source.apiBaseUrl);
+        if (!input.startsWith(`${base}/`) || (init?.method ?? "GET") !== "GET" || init?.body != null)
+          return new Response(null, { status: 404 });
+        const path = input.slice(base.length);
+        if (path !== "/v1/inference-providers?scope=usable" && path !== "/v1/inference-providers/inventory/events" && !/^\/v1\/inference-providers\/ipr_[a-z0-9_]{1,128}\/connect$/.test(path))
+          return new Response(null, { status: 404 });
+        const signal = init?.signal ?? undefined;
+        const response = capability ? await fetcher(new URL(endpoint).origin + path, {
+          method: "GET",
+          redirect: "error",
+          signal,
+          headers: {
+            accept: path.endsWith("/inventory/events") ? "text/event-stream" : "application/json",
+            authorization: `Bearer ${capability}`,
+            "x-openwork-provider-identity": source.identity
+          }
+        }) : await fetchDesktopInventory(fetcher, endpoint, path, source.identity, signal);
+        return response ?? new Response(null, { status: 503 });
+      };
+      const lifetime = new AbortController;
+      let session = null;
+      let key = "";
+      let epoch = 0;
+      let stream = null;
+      let refreshController = new AbortController;
+      let providers = [];
+      let applied = digest(providers);
+      let polling = false;
+      let running = null;
+      let queued = false;
+      let inventory = null;
+      const retry = inventoryRetry(() => {
+        refresh();
+      }, deps.retryMs);
+      await ctx.provider.transform((editor) => {
+        for (const provider of providers)
+          editor.add(provider);
+      });
+      const publish = async (next) => {
+        providers = next;
+        const fingerprint = digest(next);
+        if (fingerprint === applied)
+          return;
+        await ctx.provider.reload();
+        if (providers === next)
+          applied = fingerprint;
+      };
+      const safeHeaders = (headers) => headers ? Object.fromEntries(Object.entries(headers).filter(([name]) => !["authorization", "x-api-key", "api-key", "x-goog-api-key", "cookie", "host"].includes(name.toLowerCase()))) : undefined;
+      const records = (value) => {
+        if (!session || value?.gateway?.apiKey !== "ow_local_catalog")
+          return [];
+        const source = session;
+        return snapshotFrom(value, options, { type: "env", name: "openwork-desktop" }).providers.map((provider) => {
+          const baseURL = `${source.inferenceOrigin}/api/v1/providers/${provider.info.id}`;
+          return {
+            info: { ...provider.info, settings: { ...provider.info.settings, baseURL, apiKey: source.inferenceKey }, headers: safeHeaders(provider.info.headers) },
+            models: provider.models.map((model) => ({ ...model, settings: { ...model.settings, baseURL, apiKey: source.inferenceKey }, headers: safeHeaders(model.headers) }))
+          };
+        });
+      };
+      const revoked = () => {
+        epoch++;
+        retry.reset();
+        refreshController.abort();
+        refreshController = new AbortController;
+        inventory = null;
+        queued = false;
+        ctx.storage.remove(CACHE_KEY).catch(() => {});
+        publish([]).catch(() => {});
+      };
+      const unauthorized = () => {
+        epoch++;
+        retry.reset();
+        refreshController.abort();
+        stream?.abort();
+        stream = null;
+        session = null;
+        inventory = null;
+        queued = false;
+        ctx.storage.remove(CACHE_KEY).catch(() => {});
+        publish([]).catch(() => {});
+      };
+      const refresh = () => {
+        if (lifetime.signal.aborted || !session)
+          return Promise.resolve();
+        if (running) {
+          queued = true;
+          return running;
+        }
+        retry.cancel();
+        const source = session;
+        const accountKey = key;
+        const generation = epoch;
+        const current = () => !lifetime.signal.aborted && generation === epoch;
+        running = (async () => {
+          try {
+            const gateway = await fetchGatewayInventory(inventoryFetch(source), inventorySession(source), refreshController.signal, "desktop");
+            if (!current())
+              return;
+            const next = { version: 1, connectionKey: accountKey, apiBaseUrl: source.apiBaseUrl, fetchedAt: now(), gateway, mcp: null };
+            inventory = next;
+            const json = JSON.parse(JSON.stringify(next));
+            await ctx.storage.set(CACHE_KEY, json).catch(() => {});
+            if (!current())
+              return;
+            await publish(records(next));
+            if (current())
+              retry.reset();
+          } catch (error) {
+            if (!current())
+              return;
+            if (error instanceof DenAuthError) {
+              if (error.status === 403)
+                revoked();
+              else
+                unauthorized();
+            } else {
+              retry.schedule();
+              await publish(records(inventory));
+            }
+          }
+        })().catch(() => {}).finally(() => {
+          running = null;
+          if (queued) {
+            queued = false;
+            refresh();
+          }
+        });
+        return running;
+      };
+      const pollSession = async () => {
+        if (polling || lifetime.signal.aborted)
+          return;
+        polling = true;
+        try {
+          const next = await (capability ? readDesktopSession(fetcher, endpoint, capability, lifetime.signal) : fetchDesktopSession(fetcher, endpoint, lifetime.signal).then((response) => parseDesktopSession(response, endpoint))).catch(() => null);
+          if (lifetime.signal.aborted)
+            return;
+          const nextKey = next ? digest({ apiBaseUrl: next.apiBaseUrl, identity: next.identity, orgId: next.orgId }) : "";
+          if (nextKey === key) {
+            if (session)
+              session = next;
+            await publish(records(inventory)).catch(() => {});
+            return;
+          }
+          epoch++;
+          retry.reset();
+          refreshController.abort();
+          refreshController = new AbortController;
+          stream?.abort();
+          stream = null;
+          session = next;
+          key = nextKey;
+          inventory = null;
+          await publish([]).catch(() => {});
+          if (!next) {
+            await ctx.storage.remove(CACHE_KEY).catch(() => {});
+            return;
+          }
+          const cached = parseInventory(await ctx.storage.get(CACHE_KEY).catch(() => {
+            return;
+          }));
+          if (cached?.connectionKey === key && cached.gateway?.apiKey === "ow_local_catalog" && !lifetime.signal.aborted) {
+            inventory = cached;
+            await publish(records(cached)).catch(() => {});
+          }
+          if (lifetime.signal.aborted)
+            return;
+          const controller = new AbortController;
+          stream = controller;
+          subscribeSharedInventory({
+            identity: inventorySession(next),
+            unauthorized,
+            revoked,
+            fetch: inventoryFetch(next),
+            signal: AbortSignal.any([lifetime.signal, controller.signal]),
+            session: async () => {
+              await pollSession();
+              return controller.signal.aborted || !session ? null : inventorySession(session);
+            },
+            changed: () => {
+              refresh();
+            }
+          });
+          refresh();
+        } finally {
+          polling = false;
+        }
+      };
+      pollSession();
+      const timer = setInterval(() => {
+        pollSession().catch(() => {});
+      }, deps.sessionIntervalMs ?? 1000);
+      timer.unref?.();
+      return () => {
+        epoch++;
+        retry.reset();
+        lifetime.abort();
+        refreshController.abort();
+        stream?.abort();
+        clearInterval(timer);
+      };
+    }
+  };
+}
+var desktop_default = createDesktopProviderPlugin();
+
+// ../../packages/opencode-plugin/src/plugin.ts
+init_auth();
+init_den();
+
+// ../../packages/opencode-plugin/src/mcp.ts
+init_den();
+import { createHash as createHash3 } from "node:crypto";
+var CLOUD_SERVER_NAME = "openwork-cloud";
+var DIRECT_SERVER_PREFIX = "openwork-direct-";
+var SERVER_INDEX_URI = "openwork://connect/mcp-servers/index.json";
+var SERVER_INDEX_SCHEMA = "openwork.connect/mcp-servers/1";
+var MCP_TOKEN_REFRESH_MARGIN_MS = 24 * 60 * 60 * 1000;
+async function mintMcpToken(fetcher, session) {
+  const body = await denRequest(fetcher, session, "/v1/mcp/token", {
+    method: "POST",
+    body: { scopes: ["mcp:read", "mcp:write"] }
+  });
+  const token = isRecord(body) && typeof body.token === "string" ? body.token : null;
+  const expiresAt = isRecord(body) && typeof body.expiresAt === "string" ? Date.parse(body.expiresAt) : Number.NaN;
+  if (!token || !Number.isFinite(expiresAt))
+    throw new Error("OpenWork returned an unusable MCP token.");
+  return { token, expiresAt };
+}
+function mcpTokenNeedsRenewal(token, now) {
+  return !token || token.expiresAt - now <= MCP_TOKEN_REFRESH_MARGIN_MS;
+}
+function agentUrl(apiBaseUrl) {
+  return `${normalizeBaseUrl(apiBaseUrl)}/mcp/agent`;
+}
+function directServerName(server) {
+  const slug = server.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
+  const digest2 = createHash3("sha256").update(server.connectionId).digest("hex").slice(0, 6);
+  return `${DIRECT_SERVER_PREFIX}${slug ? `${slug}-` : ""}${digest2}`;
+}
+function mcpServerEntries(input) {
+  if (!isAllowedApiBaseUrl(input.apiBaseUrl))
+    return {};
+  const headers = { Authorization: `Bearer ${input.token}` };
+  const entries = {
+    [CLOUD_SERVER_NAME]: { type: "remote", url: agentUrl(input.apiBaseUrl), headers, oauth: false }
+  };
+  for (const server of input.servers) {
+    entries[directServerName(server)] = { type: "remote", url: server.url, headers, oauth: false };
+  }
+  return entries;
+}
+function parseJsonOrText(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return raw;
+  }
+}
+async function readMcpPayload(response, requestId) {
+  const matches = (payload) => requestId === undefined || isRecord(payload) && payload.jsonrpc === "2.0" && payload.id === requestId && (payload.result !== undefined || payload.error !== undefined);
+  if (!response.headers.get("content-type")?.toLowerCase().includes("text/event-stream")) {
+    const raw = await response.text();
+    const payload = raw.trim() ? parseJsonOrText(raw) : null;
+    return matches(payload) ? payload : null;
+  }
+  if (!response.body)
+    return null;
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder;
+  let pending = "";
+  let data = [];
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        return null;
+      pending += decoder.decode(chunk.value, { stream: true });
+      let end = pending.search(/\r\n|\r|\n/);
+      while (end !== -1) {
+        const line = pending.slice(0, end);
+        pending = pending.slice(end + (pending.startsWith(`\r
+`, end) ? 2 : 1));
+        if (line === "") {
+          if (data.length) {
+            const payload = parseJsonOrText(data.join(`
+`));
+            data = [];
+            if (matches(payload))
+              return payload;
+          }
+        } else if (line === "data" || line.startsWith("data:")) {
+          data.push(line.slice(5).replace(/^ /, ""));
+        }
+        end = pending.search(/\r\n|\r|\n/);
+      }
+    }
+  } finally {
+    reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+function jsonRpcResult(payload) {
+  const record = Array.isArray(payload) ? payload.find(isRecord) : payload;
+  if (!isRecord(record) || record.error !== undefined || !isRecord(record.result))
+    return null;
+  return record.result;
+}
+async function mcpPost(fetcher, url, headers, body) {
+  const response = await fetcher(url, {
+    method: "POST",
+    headers: { accept: "application/json, text/event-stream", "content-type": "application/json", ...headers },
+    body: JSON.stringify(body),
+    redirect: "error",
+    signal: AbortSignal.timeout(1e4)
+  });
+  const id = typeof body.id === "number" ? body.id : undefined;
+  return { response, payload: await readMcpPayload(response, id) };
+}
+
+class McpIndexError extends Error {
+  status;
+  constructor(message, status = null) {
+    super(message);
+    this.name = "McpIndexError";
+    this.status = status;
+  }
+}
+async function readResourceText(fetcher, url, token, uri) {
+  const base = { authorization: `Bearer ${token}` };
+  const initialized = await mcpPost(fetcher, url, base, {
+    id: 1,
+    jsonrpc: "2.0",
+    method: "initialize",
+    params: {
+      capabilities: {},
+      clientInfo: { name: "opencode-openwork", version: "0.1.0" },
+      protocolVersion: "2025-06-18"
+    }
+  });
+  if (!initialized.response.ok)
+    throw new McpIndexError("OpenWork MCP rejected the session.", initialized.response.status);
+  const protocolVersion = jsonRpcResult(initialized.payload)?.protocolVersion;
+  if (protocolVersion !== "2025-06-18" && protocolVersion !== "2025-03-26") {
+    throw new McpIndexError(`Unsupported MCP protocol version ${String(protocolVersion)}.`);
+  }
+  const sessionId = initialized.response.headers.get("mcp-session-id");
+  const headers = {
+    ...base,
+    ...sessionId ? { "mcp-session-id": sessionId } : {},
+    "mcp-protocol-version": protocolVersion
+  };
+  const notified = await mcpPost(fetcher, url, headers, { jsonrpc: "2.0", method: "notifications/initialized", params: {} });
+  if (notified.response.status >= 400)
+    throw new McpIndexError("OpenWork MCP rejected the session.", notified.response.status);
+  const read = await mcpPost(fetcher, url, headers, { id: 2, jsonrpc: "2.0", method: "resources/read", params: { uri } });
+  if (!read.response.ok)
+    throw new McpIndexError("OpenWork MCP could not list connections.", read.response.status);
+  const contents = jsonRpcResult(read.payload)?.contents;
+  const text = Array.isArray(contents) ? contents.find((item) => isRecord(item) && item.uri === uri && typeof item.text === "string") : undefined;
+  if (!isRecord(text) || typeof text.text !== "string")
+    throw new McpIndexError("OpenWork MCP returned no connection list.");
+  return text.text;
+}
+function parseServerIndex(text, apiBaseUrl) {
+  const value = parseJsonOrText(text);
+  if (!isRecord(value) || value.schemaVersion !== SERVER_INDEX_SCHEMA || !Array.isArray(value.servers)) {
+    throw new McpIndexError("OpenWork returned an unrecognized connection list.");
+  }
+  const origin = new URL(normalizeBaseUrl(apiBaseUrl)).origin;
+  const servers = [];
+  for (const entry of value.servers) {
+    if (!isRecord(entry) || entry.exposeDirectly !== true)
+      continue;
+    const connectionId = typeof entry.connectionId === "string" ? entry.connectionId : "";
+    const name = typeof entry.name === "string" ? entry.name : "";
+    const url = typeof entry.url === "string" ? entry.url : "";
+    if (!connectionId || !name || !url)
+      continue;
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      continue;
+    }
+    if (parsed.origin !== origin || !parsed.pathname.startsWith("/mcp/agent/connections/"))
+      continue;
+    servers.push({ connectionId, name, url: parsed.toString() });
+  }
+  return servers.sort((left, right) => left.name.localeCompare(right.name) || left.connectionId.localeCompare(right.connectionId));
+}
+async function fetchDirectServers(fetcher, apiBaseUrl, token) {
+  if (!isAllowedApiBaseUrl(apiBaseUrl))
+    throw new DenUrlError(apiBaseUrl);
+  const text = await readResourceText(fetcher, agentUrl(apiBaseUrl), token, SERVER_INDEX_URI);
+  return parseServerIndex(text, apiBaseUrl);
+}
+
+// ../../packages/opencode-plugin/src/plugin.ts
+var PLUGIN_ID = "openwork";
+var DEFAULT_API_BASE_URL = "https://api.openworklabs.com";
+var DEFAULT_REFRESH_INTERVAL_MS = 5 * 60 * 1000;
+var MIN_REFRESH_INTERVAL_MS = 60 * 1000;
+var FRESH_MS = 30 * 1000;
+var INVENTORY_KEY = "inventory";
+var SESSIONS_KEY = "sessions";
+function readOptions(options) {
+  const apiBaseUrl = typeof options.apiBaseUrl === "string" && isAllowedApiBaseUrl(normalizeBaseUrl(options.apiBaseUrl)) ? normalizeBaseUrl(options.apiBaseUrl) : DEFAULT_API_BASE_URL;
+  const interval = typeof options.refreshIntervalMs === "number" && Number.isFinite(options.refreshIntervalMs) ? Math.max(MIN_REFRESH_INTERVAL_MS, options.refreshIntervalMs) : DEFAULT_REFRESH_INTERVAL_MS;
+  return {
+    apiBaseUrl,
+    providers: options.providers !== false,
+    mcp: options.mcp !== false,
+    remoteSessions: options.remoteSessions === true,
+    ...typeof options.label === "string" && options.label.trim() ? { label: options.label.trim().slice(0, 120) } : {},
+    refreshIntervalMs: interval
+  };
+}
+function parseInventory(value) {
+  if (!isRecord(value) || value.version !== 1 || typeof value.connectionKey !== "string" || typeof value.fetchedAt !== "number") {
+    return null;
+  }
+  return value;
+}
+function toJson(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+function hash2(value) {
+  return createHash7("sha256").update(value).digest("hex").slice(0, 16);
+}
+function connectionId(connection) {
+  return connection.type === "credential" ? connection.id : connection.name;
+}
+function connectionKey(connection, token) {
+  return `${connectionId(connection)}:${hash2(token)}`;
+}
+var EMPTY = { providers: [], mcp: {}, sourceConnection: undefined };
+function snapshotFrom(inventory, options, connection) {
+  if (!inventory || !connection)
+    return EMPTY;
+  const providers = options.providers && inventory.gateway?.apiKey ? inventory.gateway.providers.map((provider) => toProviderRecord(provider, inventory.gateway?.apiKey ?? "")) : [];
+  const mcp = options.mcp && inventory.mcp ? mcpServerEntries({ apiBaseUrl: inventory.apiBaseUrl, token: inventory.mcp.token.token, servers: inventory.mcp.servers }) : {};
+  return { providers, mcp, sourceConnection: connection };
+}
+function fingerprint(value) {
+  return hash2(JSON.stringify(value));
+}
+function readIntegrationConnections(value) {
+  const info = isRecord(value) && isRecord(value.data) ? value.data : value;
+  return isRecord(info) && Array.isArray(info.connections) ? info.connections : [];
+}
+function isCredentialEvent(event) {
+  return isRecord(event) && typeof event.type === "string" && event.type.startsWith("credential.");
+}
+function createPlugin(deps = {}) {
+  const fetcher = deps.fetch ?? ((input, init) => fetch(input, init));
+  const now = deps.now ?? Date.now;
+  return {
+    id: PLUGIN_ID,
+    async setup(ctx) {
+      if (ctx.options.desktopSession !== undefined) {
+        return await createDesktopProviderPlugin({ fetch: fetcher, now, retryMs: deps.retryMs }).setup(ctx) ?? (() => {});
+      }
+      if (typeof ctx.integration?.transform !== "function" || typeof ctx.integration?.connection?.active !== "function" || typeof ctx.provider?.transform !== "function" || typeof ctx.provider?.reload !== "function" || typeof ctx.mcp?.transform !== "function" || typeof ctx.mcp?.reload !== "function" || typeof ctx.storage?.get !== "function" || typeof ctx.event?.subscribe !== "function") {
+        throw new Error("OpenWork needs OpenCode V2 with the integration, provider and MCP plugin APIs (tested with 2.0.26). The plugin does not install or upgrade OpenCode.");
+      }
+      const options = readOptions(ctx.options);
+      const remote = { current: null };
+      let remoteLoading = null;
+      let snapshot = EMPTY;
+      let applied = { providers: "", mcp: "" };
+      let reportedNeedsAuth = false;
+      let disposed = false;
+      let generation = 0;
+      let refreshController = new AbortController;
+      let stream = null;
+      let streamKey = "";
+      let revokedIdentity = "";
+      let unauthorizedIdentity = "";
+      const stopStream = () => {
+        stream?.abort();
+        stream = null;
+        streamKey = "";
+      };
+      await ctx.integration.transform((editor) => {
+        editor.update(INTEGRATION_ID, (integration) => {
+          integration.name = INTEGRATION_NAME;
+        });
+        for (const method of signInMethods({ fetcher, apiBaseUrl: () => options.apiBaseUrl, now })) {
+          editor.method.update(method);
+        }
+      });
+      const initialConnection = await ctx.integration.connection.active(INTEGRATION_ID).catch(() => {
+        return;
+      });
+      const initialCredential = initialConnection ? await ctx.integration.connection.resolve(initialConnection).catch(() => {
+        return;
+      }) : undefined;
+      const initialMetadata = initialCredential?.type === "oauth" ? readCredentialMetadata(initialCredential, options.apiBaseUrl) : null;
+      const initialKey = initialConnection && initialCredential?.type === "oauth" && initialMetadata ? `${connectionKey(initialConnection, initialCredential.access)}:${hash2(`${initialMetadata.apiBaseUrl}:${initialMetadata.orgId}`)}` : null;
+      const candidate = parseInventory(await ctx.storage.get(INVENTORY_KEY).catch(() => {
+        return;
+      }));
+      const cachedInventory = candidate?.connectionKey === initialKey ? candidate : null;
+      snapshot = snapshotFrom(cachedInventory, options, initialConnection);
+      applied = { providers: fingerprint([snapshot.providers, snapshot.sourceConnection]), mcp: fingerprint(snapshot.mcp) };
+      await ctx.provider.transform((editor) => {
+        for (const record of snapshot.providers) {
+          editor.add({ info: record.info, models: record.models });
+        }
+      });
+      await ctx.mcp.transform((editor) => {
+        for (const [name, config] of Object.entries(snapshot.mcp))
+          editor.set(name, config);
+      });
+      const publish = async (next) => {
+        snapshot = next;
+        const providers = fingerprint([next.providers, next.sourceConnection]);
+        const mcp = fingerprint(next.mcp);
+        const reloads = [];
+        if (providers !== applied.providers)
+          reloads.push(ctx.provider.reload().then(() => {
+            if (snapshot === next)
+              applied.providers = providers;
+          }));
+        if (mcp !== applied.mcp)
+          reloads.push(ctx.mcp.reload().then(() => {
+            if (snapshot === next)
+              applied.mcp = mcp;
+          }));
+        await Promise.all(reloads);
+      };
+      const setNeedsAuth = async (connection, message2) => {
+        if (message2 === null && !reportedNeedsAuth)
+          return;
+        reportedNeedsAuth = message2 !== null;
+        await ctx.integration.connection.status({
+          integrationID: INTEGRATION_ID,
+          connection,
+          status: message2 === null ? undefined : { status: "needs_auth", message: message2 }
+        }).catch(() => {});
+      };
+      const reconcileSessions = async (active) => {
+        const stored = await ctx.storage.get(SESSIONS_KEY).catch(() => {
+          return;
+        });
+        const sessions = isRecord(stored) ? stored : {};
+        const integration = await ctx.integration.get({ integrationID: INTEGRATION_ID }).catch(() => null);
+        if (integration === null)
+          return;
+        const live = new Set(readIntegrationConnections(integration).flatMap((connection) => connection.type === "credential" ? [connection.id] : []));
+        let changed = false;
+        for (const [id, session] of Object.entries(sessions)) {
+          if (live.has(id))
+            continue;
+          await signOut(fetcher, session.apiBaseUrl, session.token);
+          delete sessions[id];
+          changed = true;
+        }
+        if (active && sessions[active.id]?.token !== active.token) {
+          sessions[active.id] = { token: active.token, apiBaseUrl: active.apiBaseUrl };
+          changed = true;
+        }
+        if (changed)
+          await ctx.storage.set(SESSIONS_KEY, toJson(sessions)).catch(() => {});
+      };
+      let running = null;
+      let queued = false;
+      let forceQueued = false;
+      const retry = inventoryRetry(() => {
+        refresh(true);
+      }, deps.retryMs);
+      const revokeAuthority = (identity) => {
+        revokedIdentity = identity;
+        generation++;
+        retry.reset();
+        refreshController.abort();
+        refreshController = new AbortController;
+        queued = false;
+        forceQueued = false;
+        ctx.storage.remove(INVENTORY_KEY).catch(() => {});
+        publish(EMPTY).catch(() => {});
+      };
+      const authorizedFeatureState = async (session) => {
+        try {
+          const body = await denRequest(fetcher, session, "/v1/org");
+          return isRecord(body) && isRecord(body.features) ? body.features.liveProviderSync === true : null;
+        } catch {
+          return null;
+        }
+      };
+      const featureEnabled = async (session) => await authorizedFeatureState(session) === true;
+      const syncStream = (session, enabled) => {
+        const key = fingerprint(session);
+        if (!enabled || !options.providers) {
+          stopStream();
+          return;
+        }
+        if (streamKey === key)
+          return;
+        stopStream();
+        streamKey = key;
+        const controller = new AbortController;
+        stream = controller;
+        subscribeSharedInventory({
+          identity: session,
+          revoked: () => {
+            if (controller.signal.aborted || disposed)
+              return;
+            revokeAuthority(key);
+          },
+          unauthorized: () => {
+            if (controller.signal.aborted || disposed)
+              return;
+            unauthorizedIdentity = key;
+            generation++;
+            retry.reset();
+            refreshController.abort();
+            refreshController = new AbortController;
+            queued = false;
+            forceQueued = false;
+            stopStream();
+            ctx.storage.remove(INVENTORY_KEY).catch(() => {});
+            publish(EMPTY).catch(() => {});
+          },
+          fetch: fetcher,
+          signal: controller.signal,
+          session: async () => {
+            const current = await ctx.integration.connection.active(INTEGRATION_ID).catch(() => {
+              return;
+            });
+            const value = current ? await ctx.integration.connection.resolve(current).catch(() => {
+              return;
+            }) : undefined;
+            if (!value || value.type !== "oauth" || controller.signal.aborted)
+              return null;
+            const metadata = readCredentialMetadata(value, options.apiBaseUrl);
+            const next = { apiBaseUrl: metadata.apiBaseUrl, token: value.access, orgId: metadata.orgId };
+            return controller.signal.aborted ? null : next;
+          },
+          changed: () => {
+            if (controller.signal.aborted || disposed)
+              return;
+            if (revokedIdentity === key)
+              revokedIdentity = "";
+            refresh(true);
+          }
+        }).finally(() => {
+          if (stream === controller) {
+            stream = null;
+            streamKey = "";
+          }
+        });
+      };
+      const refreshOnce = async (force) => {
+        const epoch = generation;
+        const current = () => !disposed && epoch === generation;
+        const connection = await ctx.integration.connection.active(INTEGRATION_ID).catch(() => {
+          return;
+        });
+        if (!current())
+          return;
+        if (!connection) {
+          stopStream();
+          await reconcileSessions(null);
+          if (!current())
+            return;
+          await ctx.storage.remove(INVENTORY_KEY).catch(() => {});
+          await publish(EMPTY);
+          return;
+        }
+        let credential;
+        try {
+          const value = await ctx.integration.connection.resolve(connection);
+          if (!value || value.type !== "oauth") {
+            await publish(EMPTY);
+            return;
+          }
+          if (!current())
+            return;
+          credential = value;
+        } catch {
+          if (!current())
+            return;
+          await setNeedsAuth(connection, "Your OpenWork sign-in expired. Run: opencode auth login openwork");
+          await publish(snapshotFrom(null, options, connection));
+          return;
+        }
+        const metadata = readCredentialMetadata(credential, options.apiBaseUrl);
+        const session = { apiBaseUrl: metadata.apiBaseUrl, token: credential.access, orgId: metadata.orgId };
+        const identity = fingerprint(session);
+        if (identity === unauthorizedIdentity) {
+          await publish(EMPTY);
+          return;
+        }
+        if (identity === revokedIdentity) {
+          const feature = await authorizedFeatureState(session);
+          if (!current())
+            return;
+          if (feature === false) {
+            revokedIdentity = "";
+            stopStream();
+          } else {
+            syncStream(session, true);
+            await publish(EMPTY);
+            return;
+          }
+        }
+        if (revokedIdentity !== identity)
+          revokedIdentity = "";
+        if (unauthorizedIdentity !== identity)
+          unauthorizedIdentity = "";
+        const key = `${connectionKey(connection, credential.access)}:${hash2(`${session.apiBaseUrl}:${session.orgId}`)}`;
+        if (connection.type === "credential") {
+          await reconcileSessions({ id: connection.id, token: credential.access, apiBaseUrl: metadata.apiBaseUrl });
+        }
+        const cached = parseInventory(await ctx.storage.get(INVENTORY_KEY).catch(() => {
+          return;
+        }));
+        if (!current())
+          return;
+        const sameAccount = cached?.connectionKey === key ? cached : null;
+        if (!sameAccount)
+          await publish(EMPTY);
+        if (!current())
+          return;
+        if (!force && sameAccount && now() - sameAccount.fetchedAt < FRESH_MS) {
+          syncStream(session, sameAccount.liveProviderSync === true);
+          await publish(snapshotFrom(sameAccount, options, connection));
+          return;
+        }
+        try {
+          const liveProviderSync = await featureEnabled(session);
+          if (!current())
+            return;
+          syncStream(session, liveProviderSync);
+          const [gateway, mcp] = await Promise.all([
+            options.providers ? fetchGatewayInventory(fetcher, session, refreshController.signal).then((inventory2) => ({ providers: inventory2.providers, apiKey: inventory2.apiKey })) : Promise.resolve(null),
+            options.mcp ? (async () => {
+              const previous = sameAccount?.mcp?.token ?? null;
+              const token = previous && !mcpTokenNeedsRenewal(previous, now()) ? previous : await mintMcpToken(fetcher, session);
+              try {
+                return { token, servers: await fetchDirectServers(fetcher, session.apiBaseUrl, token.token) };
+              } catch {
+                return { token, servers: sameAccount?.mcp?.servers ?? [] };
+              }
+            })() : Promise.resolve(null)
+          ]);
+          if (!current())
+            return;
+          const inventory = {
+            version: 1,
+            liveProviderSync,
+            connectionKey: key,
+            apiBaseUrl: session.apiBaseUrl,
+            fetchedAt: now(),
+            gateway,
+            mcp
+          };
+          await ctx.storage.set(INVENTORY_KEY, toJson(inventory)).catch(() => {});
+          if (!current())
+            return;
+          await setNeedsAuth(connection, null);
+          if (!current())
+            return;
+          await publish(snapshotFrom(inventory, options, connection));
+          if (current())
+            retry.reset();
+        } catch (error) {
+          if (!current())
+            return;
+          if (error instanceof DenAuthError) {
+            if (error.status === 403 && streamKey) {
+              revokeAuthority(fingerprint(session));
+              return;
+            }
+            retry.reset();
+            queued = false;
+            forceQueued = false;
+            stopStream();
+            await ctx.storage.remove(INVENTORY_KEY).catch(() => {});
+            if (!current())
+              return;
+            await setNeedsAuth(connection, "OpenWork rejected your sign-in. Run: opencode auth login openwork");
+            await publish(EMPTY);
+            return;
+          }
+          if (force || streamKey)
+            retry.schedule();
+          await publish(snapshotFrom(sameAccount, options, connection));
+        }
+      };
+      const refresh = (force = false) => {
+        if (disposed)
+          return Promise.resolve();
+        if (running) {
+          queued = true;
+          forceQueued ||= force;
+          return running;
+        }
+        retry.cancel();
+        running = refreshOnce(force).catch(() => {}).finally(() => {
+          running = null;
+          if (queued && !disposed) {
+            queued = false;
+            const force2 = forceQueued;
+            forceQueued = false;
+            refresh(force2);
+          }
+        });
+        return running;
+      };
+      if (options.remoteSessions) {
+        remoteLoading = Promise.resolve().then(() => (init_remote_runner(), exports_remote_runner)).then(async (module) => {
+          if (disposed)
+            return;
+          if (!module.hasNativeSessionHost(ctx))
+            throw new Error("native_host_unavailable");
+          remote.current = module.createRemoteRunnerController({ ctx, apiBaseUrl: options.apiBaseUrl, label: options.label, fetch: fetcher, now });
+          await ctx.storage.set("remoteSessions/status", { status: "enabled", directory: ctx.location.directory });
+          if (!disposed)
+            remote.current.start();
+        }).catch(async () => {
+          if (disposed)
+            return;
+          const message2 = "Remote sessions could not start. Use OpenCode 2.0.26 or newer with native session APIs. For Git installs, run sparse-checkout set packages/opencode-plugin packages/remote-sessions and reload. Ordinary OpenWork sign-in, models, and MCP remain available.";
+          await ctx.storage.set("remoteSessions/status", { status: "unavailable", directory: ctx.location.directory, message: message2 }).catch(() => {});
+          console.warn(`[OpenWork] ${message2}`);
+        });
+      }
+      refresh();
+      const events = new AbortController;
+      (async () => {
+        try {
+          for await (const event of ctx.event.subscribe({ signal: events.signal })) {
+            if (isCredentialEvent(event)) {
+              generation++;
+              retry.reset();
+              refreshController.abort();
+              refreshController = new AbortController;
+              stopStream();
+              publish(EMPTY).catch(() => {});
+              remote.current?.credentialsChanged();
+              refresh(true);
+            }
+          }
+        } catch {}
+      })();
+      const timer = setInterval(() => void refresh(), options.refreshIntervalMs);
+      timer.unref?.();
+      return async () => {
+        disposed = true;
+        generation++;
+        retry.reset();
+        refreshController.abort();
+        stopStream();
+        clearInterval(timer);
+        events.abort();
+        await remoteLoading;
+        await remote.current?.close();
+      };
+    }
+  };
+}
+
+// ../../packages/opencode-plugin/src/server.ts
+await initializeDesktopCredentialChannel();
+var server_default = createPlugin();
+export {
+  server_default as default
+};