page-harness 0.1.1 → 0.1.2

package/dist/cli.js

@@ -3,7 +3,7 @@
 // src/cli/index.ts
 import { existsSync as existsSync10, readFileSync as readFileSync9, realpathSync as realpathSync2, statSync as statSync6 } from "fs";
 import net from "net";
-import path15 from "path";
+import path16 from "path";
 import { spawn as spawn2 } from "child_process";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { parseArgs } from "util";
@@ -198,7 +198,10 @@ function stringifyOutput(v) {
   return JSON.stringify(v, null, 2);
 }
 function displayToolName(name) {
-  return name.replace(/^mcp__page[-_]harness__/, "").replace(/^page[-_]harness[.:/]/, "");
+  return name.replace(/^mcp__page[-_]harness__/, "").replace(/^page[-_]harness[.:/_]/, "");
+}
+function stripAnsi(s) {
+  return s.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "");
 }
 
 // src/agents/cursor.ts
@@ -444,8 +447,8 @@ function createCursorRunner(opts = {}) {
 
 // src/server/harness.ts
 import { existsSync as existsSync9, mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
-import os3 from "os";
-import path14 from "path";
+import os5 from "os";
+import path15 from "path";
 
 // src/agents/claude.ts
 import { readFileSync as readFileSync2 } from "fs";
@@ -645,7 +648,164 @@ function createClaudeRunner(opts = {}) {
   };
 }
 
+// src/agents/codebuddy.ts
+import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import os2 from "os";
+import path4 from "path";
+var INTERACTIVE_TOOLS = ["AskUserQuestion", "AskUserForStructuredInput"];
+var CodeBuddyParser = class extends ClaudeParser {
+  sawSession = false;
+  feed(o) {
+    if (!o || typeof o !== "object") return [];
+    if (o.type === "system" && o.subtype === "init") {
+      if (this.sawSession) return [];
+      this.sawSession = !!o.session_id;
+    }
+    if (o.type === "assistant" && isAuthNotice(o.message?.content)) return [];
+    if (o.type === "error") return [{ type: "error", message: friendlyError(String(o.error ?? o.message ?? "CodeBuddy reported an error")), sessionId: this.sessionId }];
+    if (o.type === "result" && (o.is_error || o.subtype && o.subtype !== "success") && !o.result) {
+      const errors = Array.isArray(o.errors) ? o.errors.filter(Boolean).map(String) : [];
+      if (errors.length) o = { ...o, result: errors.join("\n") };
+    }
+    return super.feed(o).map((ev) => ev.type === "error" ? { ...ev, message: friendlyError(ev.message) } : ev);
+  }
+};
+function isAuthNotice(content) {
+  return Array.isArray(content) && content.length > 0 && content.every((b) => b?.type === "text" && /^authentication required\b/i.test(String(b.text ?? "")));
+}
+function friendlyError(msg) {
+  if (/authentication required/i.test(msg)) return "CodeBuddy Code is not signed in. Run `codebuddy` in a terminal once and sign in with /login, then retry.";
+  return msg;
+}
+function codebuddyArgs(input, mcpConfigPath, extra = []) {
+  const args = [
+    "-p",
+    "--input-format",
+    "stream-json",
+    "--output-format",
+    "stream-json",
+    "--include-partial-messages",
+    "--verbose",
+    "--permission-mode",
+    "bypassPermissions",
+    "--mcp-config",
+    mcpConfigPath,
+    "--strict-mcp-config",
+    "--disallowedTools",
+    INTERACTIVE_TOOLS.join(",")
+  ];
+  if (input.system && process.platform !== "win32") args.push("--append-system-prompt", input.system);
+  if (input.model) args.push("--model", input.model);
+  if (input.resumeId) args.push("--resume", input.resumeId);
+  return [...args, ...extra];
+}
+function parseCodeBuddyHelp(help) {
+  const flat = help.replace(/\s+/g, " ");
+  const models = /--model <model>.*?Currently supported: \(([^)]*)\)/.exec(flat)?.[1];
+  if (!models) return [];
+  const ids = [...new Set(models.split(",").map((m) => m.trim()).filter((m) => /^[\w.:\-/]+$/.test(m)))];
+  return ids.map((id) => ({
+    id,
+    label: aliasLabel(id),
+    // A session started without --model reports `default-model`.
+    ...id === "default-model" ? { isDefault: true } : {}
+  }));
+}
+function aliasLabel(id) {
+  const m = /^(default|fast|balanced|primary|deep)-model$/.exec(id);
+  return m ? `${m[1][0].toUpperCase()}${m[1].slice(1)} model` : id;
+}
+function createCodeBuddyRunner(opts = {}) {
+  const bin = () => opts.bin ?? findExecutable(["codebuddy", "cbc"]);
+  let models;
+  return {
+    id: "codebuddy",
+    label: "CodeBuddy",
+    images: true,
+    async detect() {
+      const p = bin();
+      if (!p) return { ok: false, error: "codebuddy not found in PATH" };
+      const r = await runCapture(p, ["--version"], 15e3);
+      if (r.code !== 0) return { ok: false, path: p, error: r.stderr.trim() || "codebuddy --version failed" };
+      return { ok: true, path: p, version: r.stdout.trim().split("\n")[0] };
+    },
+    async listModels() {
+      if (models) return models;
+      const p = bin();
+      if (!p) return [];
+      const r = await runCapture(p, ["--help"], 15e3);
+      const found = r.code === 0 ? parseCodeBuddyHelp(r.stdout) : [];
+      if (found.length) models = found;
+      return found;
+    },
+    run(input, signal) {
+      const q = new EventQueue();
+      void (async () => {
+        const p = bin();
+        if (!p) {
+          q.push({ type: "error", message: "codebuddy not found in PATH" });
+          return q.end();
+        }
+        const dir = await mkdtemp2(path4.join(os2.tmpdir(), "ph-codebuddy-"));
+        let proc;
+        const onAbort = () => proc?.stop();
+        signal.addEventListener("abort", onAbort, { once: true });
+        const parser = new CodeBuddyParser();
+        try {
+          const cfg = path4.join(dir, "mcp.json");
+          await writeFile2(
+            cfg,
+            JSON.stringify({ mcpServers: { [input.mcp.name]: { type: "http", url: input.mcp.url, headers: { Authorization: `Bearer ${input.mcp.token}` } } } }),
+            { mode: 384 }
+          );
+          if (signal.aborted) {
+            q.push({ type: "error", message: "cancelled" });
+            return;
+          }
+          proc = spawnAgent(p, codebuddyArgs(input, cfg, opts.extraArgs), {
+            cwd: input.cwd,
+            stdin: true,
+            env: { MCP_TOOL_TIMEOUT: "1800000", MCP_TIMEOUT: "30000" }
+          });
+          const child = proc.child;
+          child.stdin?.on("error", () => {
+          });
+          child.stdin?.write(claudeUserMessage(input));
+          let finished = false;
+          for await (const line of proc.lines) {
+            for (const ev of parser.feed(parseJson(line))) {
+              q.push(ev);
+              if (ev.type === "done" || ev.type === "error") {
+                finished = true;
+                child.stdin?.end();
+              }
+            }
+          }
+          const code = await proc.exited;
+          if (!finished) {
+            if (signal.aborted) q.push({ type: "error", message: "cancelled", sessionId: parser.sessionId });
+            else q.push({ type: "error", message: proc.stderrTail() || `codebuddy exited with code ${code}`, sessionId: parser.sessionId });
+          }
+        } catch (e) {
+          proc?.stop();
+          q.push({ type: "error", message: String(e?.message ?? e), sessionId: parser.sessionId });
+        } finally {
+          signal.removeEventListener("abort", onAbort);
+          await rm2(dir, { recursive: true, force: true }).catch(() => {
+          });
+          q.end();
+        }
+      })().catch((e) => {
+        q.push({ type: "error", message: String(e?.message ?? e) });
+        q.end();
+      });
+      return q;
+    }
+  };
+}
+
 // src/agents/codex.ts
+import os3 from "os";
 var CodexParser = class {
   deltaItems = /* @__PURE__ */ new Set();
   usage;
@@ -806,8 +966,69 @@ function answerServerRequest(method) {
       return { error: `unsupported request ${method}` };
   }
 }
+function parseCodexModels(result) {
+  return (result?.data ?? []).filter((m) => m?.id && !m.hidden).map((m) => {
+    const efforts = (m.supportedReasoningEfforts ?? []).map((e) => typeof e === "string" ? e : e?.reasoningEffort).filter((e) => typeof e === "string" && e);
+    const tier = (m.serviceTiers ?? []).find((s) => s?.id && /fast/i.test(String(s.name ?? s.id)));
+    return {
+      id: String(m.id),
+      label: String(m.displayName || m.id),
+      ...m.isDefault ? { isDefault: true } : {},
+      ...efforts.length ? { efforts } : {},
+      ...m.defaultReasoningEffort ? { defaultEffort: String(m.defaultReasoningEffort) } : {},
+      ...tier ? { fastTier: { id: String(tier.id), ...tier.description ? { description: String(tier.description) } : {} } } : {}
+    };
+  });
+}
+function codexErrorMessage(msg) {
+  try {
+    const j = JSON.parse(msg);
+    const inner = j?.error?.message ?? j?.message;
+    return typeof inner === "string" && inner ? inner : msg;
+  } catch {
+    return msg;
+  }
+}
+var INIT_PARAMS = { clientInfo: { name: "page-harness", title: "Page Harness", version: "0.1.0" }, capabilities: { experimentalApi: false, requestAttestation: false } };
+async function fetchCodexModels(bin, timeoutMs = 15e3) {
+  const proc = spawnAgent(bin, ["app-server", "--listen", "stdio://"], { cwd: os3.tmpdir(), stdin: true });
+  proc.child.stdin?.on("error", () => {
+  });
+  const rpc = new RpcClient((s) => proc.child.stdin?.write(s));
+  void (async () => {
+    for await (const line of proc.lines) {
+      const m = parseJson(line);
+      if (!m || rpc.handleResponse(m)) continue;
+      if (m.id !== void 0 && m.method) rpc.respondError(m.id, `unsupported request ${m.method}`);
+    }
+  })();
+  void proc.exited.then(() => rpc.failAll(new Error("codex exited")));
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error("codex model/list timed out")), timeoutMs);
+  });
+  try {
+    return await Promise.race([timeout, (async () => {
+      await rpc.request("initialize", INIT_PARAMS);
+      rpc.notify("initialized");
+      const models = [];
+      let cursor = null;
+      do {
+        const res = await rpc.request("model/list", cursor ? { cursor } : {});
+        models.push(...parseCodexModels(res));
+        cursor = res?.nextCursor ?? null;
+      } while (cursor);
+      return models;
+    })()]);
+  } finally {
+    clearTimeout(timer);
+    proc.child.stdin?.end();
+    proc.stop(1e3);
+  }
+}
 function createCodexRunner(opts = {}) {
   const bin = () => opts.bin ?? findExecutable(["codex"]);
+  let models;
   return {
     id: "codex",
     label: "Codex",
@@ -820,11 +1041,12 @@ function createCodexRunner(opts = {}) {
       return { ok: true, path: p, version: r.stdout.trim().split("\n")[0] };
     },
     async listModels() {
-      return [
-        { id: "gpt-5.5", label: "GPT-5.5" },
-        { id: "gpt-5.5-codex", label: "GPT-5.5 Codex" },
-        { id: "gpt-5.4-mini", label: "GPT-5.4 mini" }
-      ];
+      if (models) return models;
+      const p = bin();
+      const found = p ? await fetchCodexModels(p).catch(() => []) : [];
+      if (!found.length) return [{ id: "gpt-5.5", label: "GPT-5.5" }];
+      models = found;
+      return models;
     },
     run(input, signal) {
       const q = new EventQueue();
@@ -872,18 +1094,18 @@ function createCodexRunner(opts = {}) {
             for (const ev of parser.feed(m.method, params)) q.push(ev);
             if (m.method === "turn/started" && params.turn?.id) turnId = params.turn.id;
             if (m.method === "error" && params.willRetry === false) {
-              finish({ type: "error", message: params.error?.message ?? "codex error", sessionId: threadId });
+              finish({ type: "error", message: codexErrorMessage(params.error?.message ?? "codex error"), sessionId: threadId });
             }
             if (m.method === "turn/completed") {
               const t = params.turn ?? {};
               if (t.status === "completed") finish({ type: "done", sessionId: threadId, usage: parser.usage });
               else if (t.status === "interrupted") finish({ type: "error", message: "cancelled", sessionId: threadId });
-              else finish({ type: "error", message: t.error?.message ?? `turn ${t.status}`, sessionId: threadId });
+              else finish({ type: "error", message: codexErrorMessage(t.error?.message ?? `turn ${t.status}`), sessionId: threadId });
             }
           }
         })();
         try {
-          await rpc.request("initialize", { clientInfo: { name: "page-harness", title: "Page Harness", version: "0.1.0" }, capabilities: { experimentalApi: false, requestAttestation: false } });
+          await rpc.request("initialize", INIT_PARAMS);
           rpc.notify("initialized");
           const threadParams = {
             cwd: input.cwd,
@@ -906,7 +1128,10 @@ function createCodexRunner(opts = {}) {
           if (threadId) q.push({ type: "session", sessionId: threadId });
           const items = [{ type: "text", text: input.prompt, text_elements: [] }];
           for (const img of input.images) items.push({ type: "localImage", path: img.path });
-          const started = await rpc.request("turn/start", { threadId, input: items });
+          const model = models?.find((m) => input.model ? m.id === input.model : m.isDefault);
+          const effort = input.effort ?? model?.defaultEffort ?? null;
+          const serviceTier = input.fast && model?.fastTier ? model.fastTier.id : "default";
+          const started = await rpc.request("turn/start", { threadId, input: items, effort, serviceTier });
           turnId = started?.turn?.id ?? turnId;
         } catch (e) {
           finish({ type: "error", message: proc.stderrTail() || String(e?.message ?? e), sessionId: threadId });
@@ -928,7 +1153,7 @@ function createCodexRunner(opts = {}) {
 
 // src/agents/fake.ts
 import { readdirSync as readdirSync3, readFileSync as readFileSync5, statSync as statSync2, writeFileSync as writeFileSync4, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
-import path6 from "path";
+import path7 from "path";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 
@@ -936,7 +1161,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { EventEmitter } from "events";
 import { execFile } from "child_process";
 import { existsSync as existsSync3, readFileSync as readFileSync4, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3, chmodSync } from "fs";
-import path5 from "path";
+import path6 from "path";
 import { promisify } from "util";
 
 // src/shared/protocol.ts
@@ -1018,9 +1243,9 @@ function truncate(s, n) {
 
 // src/server/store.ts
 import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync3, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import path4 from "path";
+import path5 from "path";
 function writeJsonAtomic(file, data) {
-  mkdirSync2(path4.dirname(file), { recursive: true });
+  mkdirSync2(path5.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.tmp`;
   writeFileSync2(tmp, JSON.stringify(data, null, 2));
   renameSync(tmp, file);
@@ -1035,31 +1260,31 @@ function readJson(file, fallback) {
 var ChatStore = class {
   root;
   constructor(dataDir) {
-    this.root = path4.join(dataDir, "chats");
+    this.root = path5.join(dataDir, "chats");
     mkdirSync2(this.root, { recursive: true });
   }
   dir(id) {
     if (!/^[\w-]+$/.test(id)) throw new Error("bad chat id");
-    return path4.join(this.root, id);
+    return path5.join(this.root, id);
   }
   listMetas() {
     const out = [];
     for (const name of readdirSync2(this.root)) {
-      const m = readJson(path4.join(this.root, name, "meta.json"), null);
+      const m = readJson(path5.join(this.root, name, "meta.json"), null);
       if (m && m.id === name) out.push(m);
     }
     return out.sort((a, b) => b.updatedAt - a.updatedAt);
   }
   saveMeta(meta) {
-    writeJsonAtomic(path4.join(this.dir(meta.id), "meta.json"), meta);
+    writeJsonAtomic(path5.join(this.dir(meta.id), "meta.json"), meta);
   }
   append(chatId, ev) {
     const d = this.dir(chatId);
     mkdirSync2(d, { recursive: true });
-    appendFileSync(path4.join(d, "events.jsonl"), JSON.stringify(ev) + "\n");
+    appendFileSync(path5.join(d, "events.jsonl"), JSON.stringify(ev) + "\n");
   }
   readEvents(chatId) {
-    const file = path4.join(this.dir(chatId), "events.jsonl");
+    const file = path5.join(this.dir(chatId), "events.jsonl");
     if (!existsSync2(file)) return [];
     const out = [];
     for (const line of readFileSync3(file, "utf8").split("\n")) {
@@ -1072,10 +1297,10 @@ var ChatStore = class {
     return out;
   }
   saveQueue(chatId, queue) {
-    writeJsonAtomic(path4.join(this.dir(chatId), "queue.json"), queue);
+    writeJsonAtomic(path5.join(this.dir(chatId), "queue.json"), queue);
   }
   loadQueue(chatId) {
-    return readJson(path4.join(this.dir(chatId), "queue.json"), []);
+    return readJson(path5.join(this.dir(chatId), "queue.json"), []);
   }
   delete(chatId) {
     rmSync(this.dir(chatId), { recursive: true, force: true });
@@ -1092,7 +1317,7 @@ var LiveManager = class extends EventEmitter {
   constructor(dataDir, patch = false) {
     super();
     this.patch = patch;
-    this.file = path5.join(dataDir, "live.json");
+    this.file = path6.join(dataDir, "live.json");
     for (const s of readJson(this.file, [])) {
       if (TRANSIENT.includes(s.status)) {
         s.status = "failed";
@@ -1414,11 +1639,11 @@ var MarkerGuard = class {
     return found.filter((f) => (counts.get(f.file) ?? 0) > (this.baseline?.get(f.file) ?? 0));
   }
   hookPath() {
-    return path5.join(this.cwd, ".git", "hooks", "pre-commit");
+    return path6.join(this.cwd, ".git", "hooks", "pre-commit");
   }
   /** Optional pre-commit hook that rejects staged Live markers. */
   async installHook() {
-    if (!await this.isGit() || !existsSync3(path5.join(this.cwd, ".git", "hooks"))) return false;
+    if (!await this.isGit() || !existsSync3(path6.join(this.cwd, ".git", "hooks"))) return false;
     const hook = this.hookPath();
     const orig = hook + ".page-harness-orig";
     if (existsSync3(hook) && !readFileSync4(hook, "utf8").includes("page-harness live guard")) renameSync2(hook, orig);
@@ -1478,7 +1703,7 @@ function findFiles(dir, depth = 3) {
   }
   for (const name of entries) {
     if (name.startsWith(".") || name === "node_modules" || name === "dist") continue;
-    const p = path6.join(dir, name);
+    const p = path7.join(dir, name);
     const st = statSync2(p);
     if (st.isDirectory() && depth > 0) out.push(...findFiles(p, depth - 1));
     else if (/\.(html|vue|jsx|tsx|svelte)$/.test(name)) out.push(p);
@@ -1487,7 +1712,7 @@ function findFiles(dir, depth = 3) {
 }
 function liveEdit(cwd, req) {
   const sid = req.sid;
-  const stash = path6.join(cwd, ".page-harness", `fake-live-${sid}.json`);
+  const stash = path7.join(cwd, ".page-harness", `fake-live-${sid}.json`);
   if (req.op === "generate" || req.op === "mount_failed") {
     if (req.op === "mount_failed" && existsSync4(stash)) {
       const { file: file3, original: original3, wrapper: wrapper3 } = JSON.parse(readFileSync5(stash, "utf8"));
@@ -1502,7 +1727,7 @@ function liveEdit(cwd, req) {
     const hide = (html, attrs) => html.replace(/^<([a-zA-Z0-9-]+)/, `<$1 ${attrs}`);
     const wrapper2 = `<div data-ph-live="${sid}" style="display:contents">` + hide(original2, 'data-ph-variant="0" hidden') + hide(original2, 'data-ph-variant="1" data-ph-variant-label="Bold" style="font-weight:800"') + hide(original2, `data-ph-variant="2" data-ph-variant-label="Soft" style="opacity:.7" hidden data-ph-params='[{"name":"gap","type":"range","min":0,"max":40,"step":4,"default":8,"unit":"px","label":"Gap"}]'`) + `</div>`;
     writeFileSync4(file2, readFileSync5(file2, "utf8").replace(original2, wrapper2));
-    mkdirSync3(path6.dirname(stash), { recursive: true });
+    mkdirSync3(path7.dirname(stash), { recursive: true });
     writeFileSync4(stash, JSON.stringify({ file: file2, original: original2, wrapper: wrapper2 }));
     return { ok: true, variants: [{ index: 1, label: "Bold" }, { index: 2, label: "Soft" }] };
   }
@@ -1534,7 +1759,7 @@ function createFakeRunner() {
       return [
         { id: "fake-auto", label: "Auto", isDefault: true },
         { id: "fake-small", label: "Fake Small" },
-        { id: "fake-large", label: "Fake Large" },
+        { id: "fake-large", label: "Fake Large", efforts: ["low", "high"], defaultEffort: "low", fastTier: { id: "priority", description: "1.5x speed, increased usage" } },
         { id: "claude-fake-4", label: "Claude Fake 4" },
         { id: "gpt-fake-5", label: "GPT Fake 5" }
       ];
@@ -1670,8 +1895,199 @@ function createFakeRunner() {
   };
 }
 
+// src/agents/opencode.ts
+var OpenCodeParser = class {
+  sessionId;
+  error;
+  wrote = false;
+  usage = {};
+  feed(o) {
+    if (!o || typeof o !== "object") return [];
+    const out = [];
+    if (o.sessionID && !this.sessionId) {
+      this.sessionId = String(o.sessionID);
+      out.push({ type: "session", sessionId: this.sessionId });
+    }
+    const part = o.part ?? {};
+    switch (o.type) {
+      // Text and reasoning parts arrive whole, once they end.
+      case "text":
+        if (part.text) {
+          out.push({ type: "text", delta: (this.wrote ? "\n\n" : "") + part.text });
+          this.wrote = true;
+        }
+        break;
+      case "reasoning":
+        if (part.text) out.push({ type: "thinking", delta: part.text });
+        break;
+      // Tools are reported only when they finish, so a card opens and closes in one go.
+      case "tool_use": {
+        const st = part.state ?? {};
+        const id = String(part.callID ?? part.id ?? Math.random());
+        const name = displayToolName(String(part.tool ?? "tool"));
+        const files = changedFiles(String(part.tool ?? ""), st);
+        out.push({ type: "tool", id, name, input: st.input, status: "start", files });
+        out.push({ type: "tool", id, name, status: st.status === "error" ? "error" : "done", output: clip(String(st.status === "error" ? st.error ?? "failed" : st.output ?? "")) });
+        break;
+      }
+      case "step_finish": {
+        const t = part.tokens ?? {};
+        const add = (a, b) => typeof b === "number" ? (a ?? 0) + b : a;
+        this.usage = {
+          // Counted like Claude's input: fresh + cache reads + cache writes.
+          inputTokens: add(add(add(this.usage.inputTokens, t.input), t.cache?.read), t.cache?.write),
+          outputTokens: add(add(this.usage.outputTokens, t.output), t.reasoning),
+          cachedTokens: add(this.usage.cachedTokens, t.cache?.read),
+          costUsd: add(this.usage.costUsd, part.cost)
+        };
+        break;
+      }
+      case "error": {
+        const e = o.error ?? {};
+        const msg = String(e.data?.message ?? e.message ?? e.name ?? "opencode reported an error");
+        this.error = this.error ? `${this.error}
+${msg}` : msg;
+        break;
+      }
+    }
+    return out;
+  }
+  /** The CLI exits once the session is idle; there is no closing event. */
+  finish(code, stderr) {
+    if (this.error) return { type: "error", message: this.error, sessionId: this.sessionId };
+    if (code === 0) return { type: "done", sessionId: this.sessionId, usage: this.usage };
+    const tail = stripAnsi(stderr).trim().split("\n").filter((l) => !/^\s*(timestamp=|INFO|DEBUG)/.test(l)).slice(-6).join("\n");
+    return { type: "error", message: tail.replace(/^Error:\s*/, "") || `opencode exited with code ${code}`, sessionId: this.sessionId };
+  }
+};
+function changedFiles(tool, st) {
+  if (st.status === "error") return void 0;
+  if ((tool === "edit" || tool === "write") && st.input?.filePath) return [String(st.input.filePath)];
+  if (tool === "apply_patch" && Array.isArray(st.metadata?.files)) {
+    const files = st.metadata.files.map((f) => String(f.movePath ?? f.filePath ?? "")).filter(Boolean);
+    return files.length ? files : void 0;
+  }
+  return void 0;
+}
+function opencodeArgs(input, extra = []) {
+  const args = ["run", "--format", "json", "--thinking", "--auto"];
+  if (input.model) args.push("--model", input.model);
+  if (input.effort) args.push("--variant", input.effort);
+  if (input.resumeId) args.push("--session", input.resumeId);
+  const files = input.images.flatMap((img) => ["--file", img.path]);
+  return [...args, ...extra, ...files];
+}
+function opencodeConfig(input, existing = process.env.OPENCODE_CONFIG_CONTENT) {
+  let base = {};
+  try {
+    base = existing ? JSON.parse(existing) : {};
+  } catch {
+  }
+  if (!base || typeof base !== "object") base = {};
+  return JSON.stringify({
+    ...base,
+    mcp: {
+      ...base.mcp ?? {},
+      [input.mcp.name]: {
+        type: "remote",
+        url: input.mcp.url,
+        headers: { Authorization: "Bearer {env:PH_MCP_TOKEN}" },
+        oauth: false,
+        // Applies to tool calls too; page tools can wait on the user for a long time.
+        timeout: 18e5
+      }
+    }
+  });
+}
+function opencodePrompt(input) {
+  return [input.system ? `<instructions>
+${input.system}
+</instructions>` : "", input.prompt].filter(Boolean).join("\n\n");
+}
+function parseOpenCodeModels(out) {
+  const list = [];
+  const lines = stripAnsi(out).split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const id = lines[i].trim();
+    if (!/^[\w.@-]+\/\S+$/.test(id)) continue;
+    let label = id;
+    let efforts = [];
+    if (lines[i + 1]?.trim() === "{") {
+      let j = i + 1;
+      while (j < lines.length && lines[j] !== "}") j++;
+      try {
+        const m = JSON.parse(lines.slice(i + 1, j + 1).join("\n"));
+        if (m.name) label = String(m.name);
+        efforts = Object.keys(m.variants ?? {});
+      } catch {
+      }
+      i = j;
+    }
+    list.push({ id, label, ...efforts.length ? { efforts } : {} });
+  }
+  return list;
+}
+function createOpenCodeRunner(opts = {}) {
+  const bin = () => opts.bin ?? findExecutable(["opencode"]);
+  let models;
+  return {
+    id: "opencode",
+    label: "OpenCode",
+    images: true,
+    async detect() {
+      const p = bin();
+      if (!p) return { ok: false, error: "opencode not found in PATH" };
+      const r = await runCapture(p, ["--version"], 15e3);
+      if (r.code !== 0) return { ok: false, path: p, error: r.stderr.trim() || "opencode --version failed" };
+      return { ok: true, path: p, version: r.stdout.trim().split("\n")[0] };
+    },
+    async listModels() {
+      if (models) return models;
+      const p = bin();
+      if (!p) return [];
+      const r = await runCapture(p, ["models", "--verbose"], 2e4);
+      const found = r.code === 0 ? parseOpenCodeModels(r.stdout) : [];
+      if (found.length) models = found;
+      return found;
+    },
+    run(input, signal) {
+      const q = new EventQueue();
+      void (async () => {
+        const p = bin();
+        if (!p) {
+          q.push({ type: "error", message: "opencode not found in PATH" });
+          return q.end();
+        }
+        const proc = spawnAgent(p, opencodeArgs(input, opts.extraArgs), {
+          cwd: input.cwd,
+          stdin: true,
+          env: { PH_MCP_TOKEN: input.mcp.token, OPENCODE_CONFIG_CONTENT: opencodeConfig(input), OPENCODE_DISABLE_AUTOUPDATE: "1" }
+        });
+        proc.child.stdin?.on("error", () => {
+        });
+        proc.child.stdin?.end(opencodePrompt(input));
+        const onAbort = () => proc.stop();
+        signal.addEventListener("abort", onAbort, { once: true });
+        const parser = new OpenCodeParser();
+        try {
+          for await (const line of proc.lines) for (const ev of parser.feed(parseJson(line))) q.push(ev);
+          const code = await proc.exited;
+          q.push(signal.aborted ? { type: "error", message: "cancelled", sessionId: parser.sessionId } : parser.finish(code, proc.stderrTail()));
+        } finally {
+          signal.removeEventListener("abort", onAbort);
+          q.end();
+        }
+      })().catch((e) => {
+        q.push({ type: "error", message: String(e?.message ?? e) });
+        q.end();
+      });
+      return q;
+    }
+  };
+}
+
 // src/agents/index.ts
-var AGENT_ORDER = ["claude", "codex", "cursor"];
+var AGENT_ORDER = ["claude", "codex", "cursor", "codebuddy", "opencode"];
 var AgentRegistry = class {
   runners = /* @__PURE__ */ new Map();
   info = /* @__PURE__ */ new Map();
@@ -1680,6 +2096,8 @@ var AgentRegistry = class {
     this.runners.set("claude", createClaudeRunner(o("claude")));
     this.runners.set("codex", createCodexRunner(o("codex")));
     this.runners.set("cursor", createCursorRunner(o("cursor")));
+    this.runners.set("codebuddy", createCodeBuddyRunner(o("codebuddy")));
+    this.runners.set("opencode", createOpenCodeRunner(o("opencode")));
     if (process.env.PH_FAKE_AGENT === "1") this.runners.set("fake", createFakeRunner());
   }
   async detect() {
@@ -1718,7 +2136,7 @@ var AgentRegistry = class {
 // src/server/app.ts
 import { existsSync as existsSync8, readFileSync as readFileSync8, statSync as statSync5, createReadStream } from "fs";
 import http2 from "http";
-import path11 from "path";
+import path12 from "path";
 import { fileURLToPath } from "url";
 import { WebSocketServer } from "ws";
 
@@ -1858,7 +2276,7 @@ var log = {
 
 // src/server/mcp.ts
 import { existsSync as existsSync6, readFileSync as readFileSync7, realpathSync, statSync as statSync3 } from "fs";
-import path9 from "path";
+import path10 from "path";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { z } from "zod";
@@ -1866,7 +2284,7 @@ import { z } from "zod";
 // src/server/artifacts.ts
 import { EventEmitter as EventEmitter2 } from "events";
 import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import path7 from "path";
+import path8 from "path";
 var MAX_ARTIFACT_BYTES = 20 * 1024 * 1024;
 function validArtifactName(name) {
   return typeof name === "string" && name.length > 0 && name.length <= 120 && /^[\p{L}\p{N}][\p{L}\p{N} ._()\-+@]*$/u.test(name) && !name.includes("..") && !name.endsWith(".") && !name.endsWith(" ");
@@ -1877,8 +2295,8 @@ var ArtifactStore = class extends EventEmitter2 {
   index;
   constructor(dataDir) {
     super();
-    this.root = path7.join(dataDir, "artifacts");
-    this.indexFile = path7.join(this.root, "index.json");
+    this.root = path8.join(dataDir, "artifacts");
+    this.indexFile = path8.join(this.root, "index.json");
     mkdirSync4(this.root, { recursive: true });
     this.index = readJson(this.indexFile, { artifacts: [] });
   }
@@ -1901,9 +2319,9 @@ var ArtifactStore = class extends EventEmitter2 {
       this.index.artifacts.push(info);
     }
     const v = info.latest + 1;
-    const dir = path7.join(this.root, name);
+    const dir = path8.join(this.root, name);
     mkdirSync4(dir, { recursive: true });
-    writeFileSync5(path7.join(dir, `v${v}`), content);
+    writeFileSync5(path8.join(dir, `v${v}`), content);
     info.latest = v;
     info.updatedAt = now;
     info.size = content.length;
@@ -1916,7 +2334,7 @@ var ArtifactStore = class extends EventEmitter2 {
     const info = this.get(name);
     if (!info) return void 0;
     const v = version2 && info.versions.some((x) => x.v === version2) ? version2 : info.latest;
-    const file = path7.join(this.root, name, `v${v}`);
+    const file = path8.join(this.root, name, `v${v}`);
     if (!existsSync5(file)) return void 0;
     return { info, data: readFileSync6(file), version: v };
   }
@@ -1992,7 +2410,7 @@ function formatAnswer(spec, a) {
 // src/server/review.ts
 import { EventEmitter as EventEmitter3 } from "events";
 import { isIP } from "net";
-import path8 from "path";
+import path9 from "path";
 
 // src/shared/paths.ts
 var TRACKING = /^(utm_[a-z]+|gclid|fbclid|msclkid|spm|from|ref|_ga|mc_[a-z]+)$/i;
@@ -2003,10 +2421,10 @@ function normalizePath(url) {
   } catch {
     return "/";
   }
-  const path16 = u.pathname.length > 1 ? u.pathname.replace(/\/+$/, "") : u.pathname;
+  const path17 = u.pathname.length > 1 ? u.pathname.replace(/\/+$/, "") : u.pathname;
   const params = [...u.searchParams].filter(([k]) => !TRACKING.test(k) && !k.startsWith("ph-")).sort(([a], [b]) => a.localeCompare(b));
   const search = new URLSearchParams(params).toString();
-  return (path16 || "/") + (search ? `?${search}` : "");
+  return (path17 || "/") + (search ? `?${search}` : "");
 }
 
 // src/shared/review-read.ts
@@ -2216,8 +2634,8 @@ function rampGroups(patches) {
 function readerEntries(items) {
   const paths = [...new Set(items.map((i) => i.path))];
   const out = [];
-  for (const path16 of paths) {
-    const here = items.filter((i) => i.path === path16);
+  for (const path17 of paths) {
+    const here = items.filter((i) => i.path === path17);
     const notes = here.filter((i) => i.kind !== "patch" || !i.patch);
     const patches = here.filter((i) => i.kind === "patch" && i.patch);
     const ramps = rampGroups(patches);
@@ -2389,7 +2807,7 @@ var ReviewStore = class extends EventEmitter3 {
   nextN;
   constructor(dataDir) {
     super();
-    this.file = path8.join(dataDir, "review.json");
+    this.file = path9.join(dataDir, "review.json");
     this.state = migrate(readJson(this.file, []));
     this.nextN = this.state.items.reduce((m, i) => Math.max(m, i.n), 0) + 1;
   }
@@ -2543,12 +2961,12 @@ ${s.content}`);
 }
 function projectFile(project, p) {
   const root = realpathSync(project);
-  const abs = path9.resolve(root, p);
+  const abs = path10.resolve(root, p);
   if (!existsSync6(abs)) throw new Error(`file not found: ${p}`);
   const real = realpathSync(abs);
-  if (real !== root && !real.startsWith(root + path9.sep)) throw new Error("file must be inside the project directory");
-  const data = path9.join(root, ".page-harness") + path9.sep;
-  if (real.startsWith(data) && !real.startsWith(path9.join(data, "uploads") + path9.sep)) throw new Error("files under .page-harness/ are internal (only chat uploads can be used)");
+  if (real !== root && !real.startsWith(root + path10.sep)) throw new Error("file must be inside the project directory");
+  const data = path10.join(root, ".page-harness") + path10.sep;
+  if (real.startsWith(data) && !real.startsWith(path10.join(data, "uploads") + path10.sep)) throw new Error("files under .page-harness/ are internal (only chat uploads can be used)");
   if (!statSync3(real).isFile()) throw new Error(`not a file: ${p}`);
   return real;
 }
@@ -2778,9 +3196,9 @@ function registerReviewTools(server, host, scope, guard, mode) {
     const probe = await host.probe(scope, input.selector);
     if (probe && probe.count < 0) return fail(`"${input.selector}" is not a valid CSS selector.`);
     if (probe && probe.count === 0) return fail(`No element on the user's page (${probe.url}) matches "${input.selector}". Use a selector from <picked-elements> or page_state.`);
-    const path16 = normalizePath(probe?.url || host.pageUrl(scope) || "/");
-    const item = host.review.add({ ...input, path: path16, label: probe?.label, anchor: probe?.anchor, author: AGENT_AUTHOR, chatId: scope.chatId, turnId: scope.turnId });
-    const where = probe ? `on ${path16}${probe.count > 1 ? ` (selector matches ${probe.count} elements; the first one is used)` : ""}` : `for ${path16} (the page did not answer, so the selector is unchecked)`;
+    const path17 = normalizePath(probe?.url || host.pageUrl(scope) || "/");
+    const item = host.review.add({ ...input, path: path17, label: probe?.label, anchor: probe?.anchor, author: AGENT_AUTHOR, chatId: scope.chatId, turnId: scope.turnId });
+    const where = probe ? `on ${path17}${probe.count > 1 ? ` (selector matches ${probe.count} elements; the first one is used)` : ""}` : `for ${path17} (the page did not answer, so the selector is unchecked)`;
     return ok(`${item.kind === "patch" ? "Change" : "Note"} #${item.n} is ${item.kind === "patch" ? "applied" : "pinned"} ${where}.`);
   };
   const selector = z.string().describe("CSS selector of the element, preferably from <picked-elements> or page_state");
@@ -2885,9 +3303,6 @@ var HOP_HEADERS = /* @__PURE__ */ new Set([
 ]);
 var RELAY_PREFIX = "/__ph/relay/";
 var MAX_HTML_BYTES = 20 << 20;
-function appOrigin(req) {
-  return `http://${req.headers.host}`;
-}
 var SECOND_LEVEL = /^(com|net|org|gov|edu|co|ac|ne|or)$/;
 function relaySite(target) {
   const host = target.hostname;
@@ -2961,6 +3376,8 @@ function decompress(body, encoding) {
 }
 function createProxy(opts) {
   const { target } = opts;
+  const scheme = opts.scheme ?? "http";
+  const appOrigin = (req) => `${scheme}://${req.headers.host}`;
   const secure = target.protocol === "https:";
   const agent = secure ? new https.Agent({ keepAlive: true }) : new http.Agent({ keepAlive: true });
   const warned = /* @__PURE__ */ new Set();
@@ -2988,7 +3405,7 @@ function createProxy(opts) {
     for (const k of Object.keys(headers)) if (k.startsWith("x-forwarded-") || k === "forwarded") delete headers[k];
     if (local && !relay2) {
       headers["x-forwarded-host"] = req.headers.host ?? "";
-      headers["x-forwarded-proto"] = "http";
+      headers["x-forwarded-proto"] = scheme;
     }
     return headers;
   }
@@ -3003,7 +3420,7 @@ function createProxy(opts) {
     const out = {};
     for (const [k, v] of Object.entries(res.headers)) {
       if (v === void 0 || HOP_HEADERS.has(k)) continue;
-      if (k === "set-cookie") out[k] = v.map((c2) => rewriteSetCookie(c2, secure || relay2?.protocol === "https:"));
+      if (k === "set-cookie") out[k] = v.map((c2) => rewriteSetCookie(c2, scheme === "http" && (secure || relay2?.protocol === "https:")));
       else if (k === "location") out[k] = rewriteLocation(String(v), req, relay2);
       else if (k === "strict-transport-security") continue;
       else out[k] = v;
@@ -3155,33 +3572,33 @@ function escapeHtml(s) {
 
 // src/server/uploads.ts
 import { existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync as readdirSync4, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
-import path10 from "path";
+import path11 from "path";
 var MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 function safeName(name) {
-  const base = path10.basename(name || "file").replace(/[^\p{L}\p{N}._\-() ]+/gu, "_").replace(/^\.+/, "");
+  const base = path11.basename(name || "file").replace(/[^\p{L}\p{N}._\-() ]+/gu, "_").replace(/^\.+/, "");
   return base.slice(-100) || "file";
 }
 var Uploads = class {
   root;
   constructor(dataDir) {
-    this.root = path10.join(dataDir, "uploads");
+    this.root = path11.join(dataDir, "uploads");
     mkdirSync5(this.root, { recursive: true });
   }
   save(name, mime, data) {
     if (data.length > MAX_UPLOAD_BYTES) throw new Error("file too large (max 25 MB)");
     const id = newId("u_");
     const file = safeName(name);
-    mkdirSync5(path10.join(this.root, id), { recursive: true });
-    writeFileSync6(path10.join(this.root, id, file), data);
+    mkdirSync5(path11.join(this.root, id), { recursive: true });
+    writeFileSync6(path11.join(this.root, id, file), data);
     const cleanMime = /^[\w.+-]+\/[\w.+-]+$/.test(mime) ? mime : "application/octet-stream";
     return { id, name: file, mime: cleanMime, size: data.length, kind: cleanMime.startsWith("image/") ? "image" : "file" };
   }
   path(id) {
     if (!/^u_[a-z0-9]+$/i.test(id)) return void 0;
-    const dir = path10.join(this.root, id);
+    const dir = path11.join(this.root, id);
     if (!existsSync7(dir)) return void 0;
-    const name = readdirSync4(dir).find((n) => statSync4(path10.join(dir, n)).isFile());
-    return name ? path10.join(dir, name) : void 0;
+    const name = readdirSync4(dir).find((n) => statSync4(path11.join(dir, n)).isFile());
+    return name ? path11.join(dir, name) : void 0;
   }
 };
 
@@ -3208,9 +3625,9 @@ var MIME = {
   ".map": "application/json"
 };
 function clientDir() {
-  const here = path11.dirname(fileURLToPath(import.meta.url));
-  const candidates = [path11.join(here, "client"), path11.join(here, "..", "client"), path11.join(here, "..", "..", "dist", "client")];
-  return candidates.find((d) => existsSync8(path11.join(d, "page", "overlay.js"))) ?? candidates[0];
+  const here = path12.dirname(fileURLToPath(import.meta.url));
+  const candidates = [path12.join(here, "client"), path12.join(here, "..", "client"), path12.join(here, "..", "..", "dist", "client")];
+  return candidates.find((d) => existsSync8(path12.join(d, "page", "overlay.js"))) ?? candidates[0];
 }
 var HttpError = class extends Error {
   constructor(status, message) {
@@ -3260,7 +3677,7 @@ async function readJsonBody(req, limit = 1 << 20) {
 function serveFile(res, file, extra = {}, cache = "no-cache") {
   if (!existsSync8(file) || !statSync5(file).isFile()) return send(res, 404, "not found");
   res.writeHead(200, {
-    "Content-Type": MIME[path11.extname(file)] ?? "application/octet-stream",
+    "Content-Type": MIME[path12.extname(file)] ?? "application/octet-stream",
     "Cache-Control": cache,
     "X-Content-Type-Options": "nosniff",
     ...extra
@@ -3269,11 +3686,11 @@ function serveFile(res, file, extra = {}, cache = "no-cache") {
 }
 async function startServers(o) {
   const dir = clientDir();
-  const pageDir = path11.join(dir, "page");
-  const appDir = path11.join(dir, "app");
-  const controlOrigin = (req) => `http://${hostname(req)}:${o.controlPort}`;
-  const appOrigin2 = (req) => `http://${hostname(req)}:${o.appPort}`;
-  const proxy = createProxy({ target: o.target, cookieName: o.auth.cookieName, controlOrigin, keepHost: o.keepHost });
+  const pageDir = path12.join(dir, "page");
+  const appDir = path12.join(dir, "app");
+  const controlOrigin = (req) => o.auth.origin(hostname(req), o.controlPort);
+  const appOrigin = (req) => o.auth.origin(hostname(req), o.appPort);
+  const proxy = createProxy({ target: o.target, cookieName: o.auth.cookieName, controlOrigin, keepHost: o.keepHost, scheme: o.auth.scheme });
   const pageScripts = {
     [OVERLAY_PATH]: "overlay.js",
     "/__ph/page-control.js": "page-control.js",
@@ -3299,7 +3716,7 @@ async function startServers(o) {
       }
       const file = pageScripts[url.pathname];
       if (!file || req.method !== "GET") return send(res, 404, "not found");
-      const p = path11.join(pageDir, file);
+      const p = path12.join(pageDir, file);
       if (!existsSync8(p)) return send(res, 503, `/* page-harness: ${file} missing, run npm run build */`, "text/javascript");
       let body = readFileSync8(p, "utf8");
       if (file === "overlay.js") body = `window.__PH_CONFIG=${JSON.stringify({ controlOrigin: controlOrigin(req), appPort: o.appPort, target: o.target.host, relay: proxy.site })};
@@ -3325,7 +3742,7 @@ async function startServers(o) {
     "style-src 'self' 'unsafe-inline'",
     "img-src 'self' data: blob:",
     "font-src 'self' data:",
-    `connect-src 'self' ws://${req.headers.host}`,
+    `connect-src 'self' ${o.auth.scheme === "https" ? "wss" : "ws"}://${req.headers.host}`,
     "frame-src 'self' blob: data:",
     "worker-src 'self' blob:",
     "object-src 'none'",
@@ -3337,14 +3754,14 @@ async function startServers(o) {
     "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'"
   });
   const servePage = (req, res, page) => {
-    const file = path11.join(appDir, `${page}.html`);
+    const file = path12.join(appDir, `${page}.html`);
     const who = o.auth.issuePageSession(req, res);
     if (!who) return noAccess(res, "Open this page with the invite link from the person running Page Harness.<br>\u8BF7\u4F7F\u7528 Page Harness \u53D1\u8D77\u4EBA\u5206\u4EAB\u7684\u9080\u8BF7\u94FE\u63A5\u6253\u5F00\u3002");
     if (page === "history" && who.access !== "owner") return noAccess(res, "Chat history is only available to the person running Page Harness.<br>\u5BF9\u8BDD\u8BB0\u5F55\u4EC5\u53D1\u8D77\u4EBA\u53EF\u89C1\u3002");
     if (!existsSync8(file)) return send(res, 503, "page-harness: client build missing, run npm run build");
-    const html = readFileSync8(file, "utf8").replace("<html", `<html data-app-origin="${appOrigin2(req)}"`);
+    const html = readFileSync8(file, "utf8").replace("<html", `<html data-app-origin="${appOrigin(req)}"`);
     send(res, 200, html, "text/html; charset=utf-8", {
-      "Content-Security-Policy": panelCsp(req, page === "panel" ? appOrigin2(req) : "'none'"),
+      "Content-Security-Policy": panelCsp(req, page === "panel" ? appOrigin(req) : "'none'"),
       "Referrer-Policy": "no-referrer",
       "Cross-Origin-Opener-Policy": page === "history" ? "same-origin" : "unsafe-none"
     });
@@ -3368,15 +3785,15 @@ async function startServers(o) {
       if (p === "/__ph/join" && req.method === "GET") {
         const who = o.auth.joinWithInvite(req, res, url.searchParams.get("t") ?? "");
         if (!who) return noAccess(res, "This invite link is not valid (sharing may be off).<br>\u9080\u8BF7\u94FE\u63A5\u65E0\u6548\uFF0C\u53EF\u80FD\u5BF9\u65B9\u5DF2\u5173\u95ED\u5206\u4EAB\u3002");
-        res.writeHead(302, { Location: `${appOrigin2(req)}/`, "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+        res.writeHead(302, { Location: `${appOrigin(req)}/`, "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
         return res.end();
       }
       if (p === "/__ph/ui" && req.method === "GET") return servePage(req, res, "panel");
       if (p === "/__ph/history" && req.method === "GET") return servePage(req, res, "history");
       if (p.startsWith("/__ph/app/") && req.method === "GET") {
         const rel = decodeURIComponent(p.slice("/__ph/app/".length));
-        const file = path11.resolve(appDir, rel);
-        if (!file.startsWith(appDir + path11.sep) || rel.endsWith(".html")) return send(res, 404, "not found");
+        const file = path12.resolve(appDir, rel);
+        if (!file.startsWith(appDir + path12.sep) || rel.endsWith(".html")) return send(res, 404, "not found");
         return serveFile(res, file, {}, rel.startsWith("assets/") ? "public, max-age=31536000, immutable" : "no-cache");
       }
       if (p.startsWith("/__ph/api/")) {
@@ -3554,7 +3971,7 @@ function createApi(o) {
 
 // src/server/auth.ts
 import { randomBytes, timingSafeEqual } from "crypto";
-import os2 from "os";
+import os4 from "os";
 function randomToken(bytes = 32) {
   return randomBytes(bytes).toString("base64url");
 }
@@ -3586,13 +4003,14 @@ function isLoopback(req) {
 var Auth = class {
   constructor(opts) {
     this.opts = opts;
+    this.scheme = opts.publicScheme ?? "http";
     this.cookieName = `__ph_${opts.controlPort}`;
     this.appCookieName = `${this.cookieName}_app`;
     const names = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
     if (opts.host && opts.host !== "0.0.0.0" && opts.host !== "::") names.add(opts.host);
     if (opts.host === "0.0.0.0" || opts.host === "::") {
-      names.add(os2.hostname().toLowerCase());
-      for (const list of Object.values(os2.networkInterfaces())) {
+      names.add(os4.hostname().toLowerCase());
+      for (const list of Object.values(os4.networkInterfaces())) {
         for (const a of list ?? []) names.add(a.family === "IPv6" ? `[${a.address}]` : a.address);
       }
     }
@@ -3605,20 +4023,28 @@ var Auth = class {
   cookieName;
   /** Reviewer pass for the app port, so other machines only see the page through the invite. */
   appCookieName;
+  scheme;
   hostnames;
   /** Host header must name this machine and the port the request arrived on. */
   checkHost(req, port) {
     const host = (req.headers.host ?? "").toLowerCase();
     const m = /^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(host);
     if (!m) return false;
-    const p = m[2] ? Number(m[2]) : 80;
+    const p = m[2] ? Number(m[2]) : this.scheme === "https" ? 443 : 80;
     return this.hostnames.has(m[1]) && p === port;
   }
+  /** Origin of a port as the browser sees it. */
+  origin(hostname2, port) {
+    return `${this.scheme}://${hostname2}:${port}`;
+  }
+  get secureAttr() {
+    return this.scheme === "https" ? "; Secure" : "";
+  }
   get sharing() {
     return !!this.opts.team?.enabled;
   }
   setCookie(res, value) {
-    res.appendHeader("Set-Cookie", `${this.cookieName}=${value}; Path=/__ph; HttpOnly; SameSite=Strict${value === this.uiSecret ? "" : "; Max-Age=31536000"}`);
+    res.appendHeader("Set-Cookie", `${this.cookieName}=${value}; Path=/__ph; HttpOnly; SameSite=Strict${this.secureAttr}${value === this.uiSecret ? "" : "; Max-Age=31536000"}`);
   }
   /**
    * Called when a panel page is served. Keeps an existing session; otherwise local requests get
@@ -3639,7 +4065,7 @@ var Auth = class {
     if (cur?.access === "owner") return cur;
     const id = cur?.access === "reviewer" && cur.id ? cur.id : team.join();
     if (id !== cur?.id) this.setCookie(res, team.sign(id));
-    res.appendHeader("Set-Cookie", `${this.appCookieName}=${team.sign(id)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000`);
+    res.appendHeader("Set-Cookie", `${this.appCookieName}=${team.sign(id)}; Path=/; HttpOnly; SameSite=Lax${this.secureAttr}; Max-Age=31536000`);
     return { access: "reviewer", id };
   }
   /** App port: open locally; while sharing, other machines need the pass from the invite link. */
@@ -3657,7 +4083,7 @@ var Auth = class {
   }
   sameOrigin(req) {
     const origin = req.headers.origin;
-    return typeof origin === "string" && origin === `http://${req.headers.host}`;
+    return typeof origin === "string" && origin === `${this.scheme}://${req.headers.host}`;
   }
   /** Browser API calls on the control origin. Returns an error string, or null when allowed. */
   checkUi(req) {
@@ -3888,7 +4314,7 @@ function turnText(turn) {
 }
 
 // src/server/prompt.ts
-import path12 from "path";
+import path13 from "path";
 var esc = (s) => s.replace(/</g, "&lt;");
 function buildPrompt(msg, opts) {
   const parts = [];
@@ -3917,7 +4343,7 @@ ${lines.join("\n")}
     for (const a of msg.attachments) {
       const p = opts.uploads.path(a.id);
       if (!p) continue;
-      const shown = path12.relative(opts.project, p).startsWith("..") ? p : path12.relative(opts.project, p);
+      const shown = path13.relative(opts.project, p).startsWith("..") ? p : path13.relative(opts.project, p);
       if (a.kind === "image" && opts.nativeImages) {
         images.push({ path: p, mime: a.mime });
         lines.push(`- ${a.name} (image, attached; also at ${shown})`);
@@ -4045,6 +4471,15 @@ var Gateway = class {
     this.chats.set(meta.id, new Chat(this.store, meta, false).load());
     return meta;
   }
+  /**
+   * The effort to send, only when the chat's model lists it among two or more levels. Agents and models without
+   * selectable effort (Claude, Cursor, CodeBuddy, most OpenCode models) never get the flag, even if a stale
+   * value is stored on the chat.
+   */
+  async effortFor(agent, model, effort) {
+    if (!effort) return void 0;
+    return supportedEffort(await this.o.registry.models(agent).catch(() => []), model, effort);
+  }
   updateChat(id, patch) {
     const c2 = this.chat(id);
     if (!c2) throw new Error("no such chat");
@@ -4054,11 +4489,18 @@ var Gateway = class {
       c2.meta.agent = patch.agent;
       c2.meta.agentSessionId = void 0;
       c2.meta.model = void 0;
+      c2.meta.effort = void 0;
+      c2.meta.fast = void 0;
     }
     if (patch.model !== void 0) {
-      if ((patch.model ?? void 0) !== c2.meta.model) c2.meta.agentSessionId = c2.meta.agent === "codex" ? c2.meta.agentSessionId : void 0;
+      if ((patch.model ?? void 0) !== c2.meta.model) {
+        c2.meta.agentSessionId = c2.meta.agent === "codex" || c2.meta.agent === "opencode" ? c2.meta.agentSessionId : void 0;
+        c2.meta.effort = void 0;
+      }
       c2.meta.model = patch.model || void 0;
     }
+    if (patch.effort !== void 0) c2.meta.effort = patch.effort || void 0;
+    if (patch.fast !== void 0) c2.meta.fast = patch.fast === true || void 0;
     if (c2.persisted) c2.persist();
     this.broadcastState(c2);
     this.broadcastChats();
@@ -4325,6 +4767,8 @@ var Gateway = class {
         images: built.images,
         cwd: this.o.project,
         model: c2.meta.model,
+        effort: await this.effortFor(c2.meta.agent, c2.meta.model, c2.meta.effort),
+        fast: c2.meta.fast,
         resumeId: c2.meta.agentSessionId,
         mcp: { name: MCP_SERVER_NAME, url: this.o.mcpUrl, token }
       };
@@ -4584,6 +5028,11 @@ var Gateway = class {
     for (const c2 of this.chats.values()) c2.flush();
   }
 };
+function supportedEffort(models, model, effort) {
+  if (!effort) return void 0;
+  const m = model ? models.find((x) => x.id === model) : models.find((x) => x.isDefault);
+  return m?.efforts && m.efforts.length > 1 && m.efforts.includes(effort) ? effort : void 0;
+}
 
 // src/server/pageBridge.ts
 var PAGE_MESSAGES = {
@@ -4779,11 +5228,11 @@ var PageBridge = class {
 // src/server/team.ts
 import { createHmac } from "crypto";
 import { chmodSync as chmodSync2 } from "fs";
-import path13 from "path";
+import path14 from "path";
 var Team = class {
   constructor(dataDir, enabled) {
     this.enabled = enabled;
-    this.file = path13.join(dataDir, "team.json");
+    this.file = path14.join(dataDir, "team.json");
     const d = readJson(this.file, {});
     this.data = { invite: d.invite || randomToken(18), key: d.key || randomToken(), ownerName: d.ownerName, reviewers: d.reviewers ?? {} };
     if (!d.invite || !d.key) this.save();
@@ -4835,25 +5284,25 @@ var Team = class {
 
 // src/server/harness.ts
 async function startHarness(o) {
-  const dataDir = path14.join(o.project, ".page-harness");
+  const dataDir = path15.join(o.project, ".page-harness");
   mkdirSync6(dataDir, { recursive: true });
-  if (!existsSync9(path14.join(dataDir, ".gitignore"))) writeFileSync7(path14.join(dataDir, ".gitignore"), "*\n");
+  if (!existsSync9(path15.join(dataDir, ".gitignore"))) writeFileSync7(path15.join(dataDir, ".gitignore"), "*\n");
   if (recoverCursorMcp(o.project)) log.warn("restored .cursor/mcp.json left behind by a previous run");
   const registry = new AgentRegistry({ paths: o.agentPaths });
   const agents = await registry.detect();
   let defaultAgent = o.agent;
   if (defaultAgent) {
-    if (!registry.get(defaultAgent)) throw new Error(`unknown agent "${defaultAgent}"; use claude, codex or cursor`);
+    if (!registry.get(defaultAgent)) throw new Error(`unknown agent "${defaultAgent}"; use ${AGENT_ORDER.join(", ")}`);
     if (!registry.available(defaultAgent)) log.warn(`${defaultAgent} CLI not found; chats will fail until it is installed (or pass --${defaultAgent}-path)`);
   } else {
     defaultAgent = registry.firstAvailable();
     if (!defaultAgent) {
-      log.warn("no agent CLI found (claude, codex or cursor-agent). The panel will open, but chats cannot run until one is installed.");
+      log.warn("no agent CLI found (claude, codex, cursor-agent, codebuddy or opencode). The panel will open, but chats cannot run until one is installed.");
       defaultAgent = "claude";
     }
   }
   const team = new Team(dataDir, !!o.share);
-  const auth = new Auth({ host: o.host, appPort: o.appPort, controlPort: o.controlPort, extraHosts: o.allowHosts, team });
+  const auth = new Auth({ host: o.host, appPort: o.appPort, controlPort: o.controlPort, extraHosts: o.allowHosts, team, publicScheme: o.publicScheme });
   const artifacts = new ArtifactStore(dataDir);
   const uploads = new Uploads(dataDir);
   const mode = o.mode ?? detectMode(o.target);
@@ -4862,9 +5311,9 @@ async function startHarness(o) {
   const bridge = new PageBridge();
   const review = new ReviewStore(dataDir);
   const shownHost = o.host === "0.0.0.0" || o.host === "::" || o.host === "127.0.0.1" ? "localhost" : o.host;
-  const appUrl = `http://${shownHost}:${o.appPort}`;
+  const appUrl = auth.origin(shownHost, o.appPort);
   const shareHost = o.host === "0.0.0.0" || o.host === "::" ? lanAddress() ?? shownHost : shownHost;
-  const shareUrl = o.share ? `http://${shareHost}:${o.controlPort}/__ph/join?t=${team.invite}` : void 0;
+  const shareUrl = o.share ? `${auth.origin(shareHost, o.controlPort)}/__ph/join?t=${team.invite}` : void 0;
   const gateway = new Gateway({
     project: o.project,
     dataDir,
@@ -4903,7 +5352,7 @@ async function startHarness(o) {
   let closed = false;
   return {
     appUrl,
-    controlUrl: `http://${shownHost}:${o.controlPort}`,
+    controlUrl: auth.origin(shownHost, o.controlPort),
     agents,
     defaultAgent,
     mode,
@@ -4927,7 +5376,7 @@ function mcpHost(host) {
   return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
 }
 function lanAddress() {
-  for (const list of Object.values(os3.networkInterfaces()))
+  for (const list of Object.values(os5.networkInterfaces()))
     for (const a of list ?? []) if (a.family === "IPv4" && !a.internal) return a.address;
   return void 0;
 }
@@ -4944,15 +5393,17 @@ Examples
 
 Options
   --project <dir>        Project the agent works in (default: current directory)
-  --agent <id>           claude | codex | cursor (default: first one installed)
+  --agent <id>           claude | codex | cursor | codebuddy | opencode (default: first one installed)
   --model <name>         Default model for new chats
   --port <n>             App port: the proxied frontend (default 17990)
   --control-port <n>     Panel / API port (default: app port + 1)
   --host <addr>          Listen address (default 127.0.0.1)
   --allow-host <name>    Extra Host header to accept (repeatable), e.g. a LAN name
   --keep-host            Forward the browser's Host header to the target
+  --public-scheme <s>    http | https: scheme browsers use to reach both ports (default http).
+                         Use https behind a load balancer that terminates TLS on the same ports
   --open                 Open the browser
-  --claude-path <bin>    Path to the claude CLI   (also --codex-path, --cursor-path)
+  --claude-path <bin>    Path to the claude CLI   (also --codex-path, --cursor-path, --codebuddy-path, --opencode-path)
   --live-guard-hook      Install a git pre-commit hook that rejects Live candidate markers
   --review               No source for this page: the agent leaves notes and page changes instead of editing files
                          (default for public sites; --source forces source mode)
@@ -4963,8 +5414,8 @@ Options
   -h, --help
 `;
 function version() {
-  const here = path15.dirname(fileURLToPath2(import.meta.url));
-  for (const p of [path15.join(here, "..", "package.json"), path15.join(here, "..", "..", "package.json")]) {
+  const here = path16.dirname(fileURLToPath2(import.meta.url));
+  for (const p of [path16.join(here, "..", "package.json"), path16.join(here, "..", "..", "package.json")]) {
     try {
       const pkg = JSON.parse(readFileSync9(p, "utf8"));
       if (pkg.name === "page-harness") return pkg.version;
@@ -5024,10 +5475,13 @@ async function main(argv = process.argv.slice(2)) {
       host: { type: "string" },
       "allow-host": { type: "string", multiple: true },
       "keep-host": { type: "boolean" },
+      "public-scheme": { type: "string" },
       open: { type: "boolean" },
       "claude-path": { type: "string" },
       "codex-path": { type: "string" },
       "cursor-path": { type: "string" },
+      "codebuddy-path": { type: "string" },
+      "opencode-path": { type: "string" },
       "live-guard-hook": { type: "boolean" },
       review: { type: "boolean" },
       source: { type: "boolean" },
@@ -5050,12 +5504,14 @@ async function main(argv = process.argv.slice(2)) {
   if (values.verbose) log.setVerbose(true);
   if (values.quiet) log.setQuiet(true);
   const target = normalizeTarget(positionals[0]);
-  const project = path15.resolve(values.project ?? process.cwd());
+  const project = path16.resolve(values.project ?? process.cwd());
   if (!existsSync10(project) || !statSync6(project).isDirectory()) throw new Error(`project directory not found: ${project}`);
   const host = values.host ?? (values.share ? "0.0.0.0" : "127.0.0.1");
   const [appPort, controlPort] = await pickPorts(host, intOpt(values.port, "port"), intOpt(values["control-port"], "control-port"));
   if (appPort === controlPort) throw new Error("--port and --control-port must differ");
   if (values.review && values.source) throw new Error("use either --review or --source");
+  const publicScheme = values["public-scheme"] ?? "http";
+  if (publicScheme !== "http" && publicScheme !== "https") throw new Error("--public-scheme must be http or https");
   const h = await startHarness({
     target,
     project,
@@ -5066,7 +5522,14 @@ async function main(argv = process.argv.slice(2)) {
     model: values.model,
     allowHosts: values["allow-host"],
     keepHost: values["keep-host"],
-    agentPaths: { claude: values["claude-path"], codex: values["codex-path"], cursor: values["cursor-path"] },
+    publicScheme,
+    agentPaths: {
+      claude: values["claude-path"],
+      codex: values["codex-path"],
+      cursor: values["cursor-path"],
+      codebuddy: values["codebuddy-path"],
+      opencode: values["opencode-path"]
+    },
     liveGuardHook: values["live-guard-hook"],
     mode: values.review ? "review" : values.source ? "source" : void 0,
     share: values.share