pybao-cli 1.5.51 → 1.5.52

package/dist/{chunk-5C3V4WBH.js → chunk-JGECWVPT.js}

@@ -2,17 +2,17 @@ import { createRequire as __pybCreateRequire } from "node:module";
 const require = __pybCreateRequire(import.meta.url);
 import {
   loadPybAgentSessionMessages
-} from "./chunk-YEUUN3PW.js";
+} from "./chunk-QEPBMPEE.js";
 import {
   appendSessionCustomTitleRecord,
   appendSessionJsonlFromMessage,
   appendSessionTagRecord,
   listPybAgentSessions
-} from "./chunk-I6GA6HKT.js";
+} from "./chunk-3I35GELX.js";
 import {
   formatValidationResult,
   validatePluginOrMarketplacePath
-} from "./chunk-EEOIMMFC.js";
+} from "./chunk-R64GVTIZ.js";
 import {
   ConversationTracker,
   appendFinishState,
@@ -20,13 +20,13 @@ import {
   getConversationTrackerForContext,
   isFinishComplete,
   mapFinishReason
-} from "./chunk-D2MHLZDN.js";
+} from "./chunk-2EQA5NLL.js";
 import {
   FileSystemConversationPersistence
-} from "./chunk-NXWVCWZU.js";
+} from "./chunk-QYVB7FJ4.js";
 import {
   beginReplSessionScope
-} from "./chunk-F4AXICO7.js";
+} from "./chunk-EXNV3ROJ.js";
 import {
   drainHookSystemPromptAdditions,
   getHookTranscriptPath,
@@ -38,7 +38,7 @@ import {
   runStopHooks,
   runUserPromptSubmitHooks,
   updateHookTranscriptForMessages
-} from "./chunk-WZDDUIIK.js";
+} from "./chunk-6QSG5OON.js";
 import {
   DEFAULT_OUTPUT_STYLE,
   getAvailableOutputStyles,
@@ -47,20 +47,20 @@ import {
   getOutputStyleSystemPromptAdditions,
   resolveOutputStyleName,
   setCurrentOutputStyle
-} from "./chunk-TZGJRTAC.js";
+} from "./chunk-UG7ZFONK.js";
 import {
   fetchCustomModels,
   getModelFeatures
-} from "./chunk-CLYWO4WT.js";
+} from "./chunk-ZWTGVUTI.js";
 import {
   getCurrentSessionId,
   getSessionState
-} from "./chunk-XKYHFZEC.js";
+} from "./chunk-U6BMHOQT.js";
 import {
   queryLLM,
   queryQuick,
   verifyApiKey
-} from "./chunk-CXWYHX64.js";
+} from "./chunk-4UQCXDKA.js";
 import {
   DEFAULT_TIMEOUT_MS,
   DESCRIPTION,
@@ -92,7 +92,7 @@ import {
   listMCPServers,
   loadMergedSettings,
   normalizeSandboxRuntimeConfigFromSettings
-} from "./chunk-A2QSQWOQ.js";
+} from "./chunk-33EYH7S3.js";
 import {
   addMarketplace,
   disableSkillPlugin,
@@ -105,29 +105,29 @@ import {
   refreshMarketplaceAsync,
   removeMarketplace,
   uninstallSkillPlugin
-} from "./chunk-OLQLK3UC.js";
+} from "./chunk-4MAX5UNY.js";
 import {
   loadToolPermissionContextFromDisk,
   persistToolPermissionUpdateToDisk
-} from "./chunk-HM2PO36Q.js";
+} from "./chunk-OEHXDSEI.js";
 import {
   applyToolPermissionContextUpdate,
   applyToolPermissionContextUpdates,
   createDefaultToolPermissionContext
-} from "./chunk-UNNVICVU.js";
+} from "./chunk-LG65MFKB.js";
 import {
   emitReminderEvent,
   generateSystemReminders,
   resetReminderSession,
   systemReminderService
-} from "./chunk-GZOD5652.js";
+} from "./chunk-PA5FTBIQ.js";
 import {
   clearAgentCache,
   getActiveAgents,
   getAgentByType,
   getAllAgents,
   getAvailableAgentTypes
-} from "./chunk-56FKUXNO.js";
+} from "./chunk-DPE2QUR4.js";
 import {
   API_ERROR_MESSAGE_PREFIX,
   CANCEL_MESSAGE,
@@ -162,16 +162,16 @@ import {
   reorderMessages,
   resetAutoCompactTelemetry,
   stripSystemMessages
-} from "./chunk-GUNRUYLP.js";
+} from "./chunk-UCNZU6OO.js";
 import {
   getRequestStatus,
   setRequestStatus,
   subscribeRequestStatus
-} from "./chunk-3DFBSQIT.js";
+} from "./chunk-XZG5WCDK.js";
 import {
   getPybAgentSessionId,
   setPybAgentSessionId
-} from "./chunk-B6IMQJZM.js";
+} from "./chunk-DRSLDSBY.js";
 import {
   formatDuration,
   formatNumber,
@@ -180,7 +180,7 @@ import {
   getTotalCost,
   getTotalDuration,
   wrapText
-} from "./chunk-OUXHGDLH.js";
+} from "./chunk-VEHLCRJN.js";
 import {
   addLineNumbers,
   detectFileEncoding,
@@ -194,13 +194,13 @@ import {
   normalizeFilePath,
   readTextContent,
   writeTextContent
-} from "./chunk-QHRHQ4TE.js";
+} from "./chunk-FNMZKMUC.js";
 import {
   parseBlockEdits
-} from "./chunk-QWIBSCDN.js";
+} from "./chunk-GEEDQS2I.js";
 import {
   toLspToolFallbackEvent
-} from "./chunk-2RXKUCFS.js";
+} from "./chunk-ISMRCABJ.js";
 import {
   LspAPI,
   LspFacade,
@@ -208,31 +208,31 @@ import {
   formatDiagnosticsPretty,
   initParser,
   loadLanguage
-} from "./chunk-UIKYSSZX.js";
+} from "./chunk-L2JZIHLB.js";
 import {
   emitTelemetryEvent,
   registerTelemetryListener
-} from "./chunk-TFHFYID3.js";
+} from "./chunk-TNCBVAVV.js";
 import {
   getSettingsFileCandidates,
   loadSettingsWithLegacyFallback,
   readSettingsFile
-} from "./chunk-UMOI4SIG.js";
+} from "./chunk-DYLRL3GG.js";
 import {
   getCustomCommandDirectories,
   hasCustomCommands,
   loadCustomCommands,
   reloadCustomCommands
-} from "./chunk-PWHPXHNR.js";
+} from "./chunk-I42N2MZA.js";
 import {
   getSessionPlugins
-} from "./chunk-BJSWTHRM.js";
+} from "./chunk-KNUG3M6O.js";
 import {
   ModelManager,
   buildModelProfileKey,
   getModelManager,
   isDefaultSlowAndCapableModel
-} from "./chunk-TKU3UJXS.js";
+} from "./chunk-AZF3LTDE.js";
 import {
   getCodeStyle,
   getContext,
@@ -240,16 +240,16 @@ import {
   getIsGit,
   getProjectDocs,
   getProjectStructureStatisticsBlock
-} from "./chunk-276WD5RN.js";
+} from "./chunk-RETS7G2B.js";
 import {
   getRipgrepPath,
   getRipgrepPolicyMode,
   resolveRipgrepPolicy,
   ripGrep
-} from "./chunk-RDDHG7KT.js";
+} from "./chunk-HSOB4XJ2.js";
 import {
   getTheme
-} from "./chunk-TGGCRPZR.js";
+} from "./chunk-SZS6SEDB.js";
 import {
   DEFAULT_GLOBAL_CONFIG,
   enableConfigs,
@@ -262,16 +262,16 @@ import {
   saveGlobalConfig,
   setAllPointersToModel,
   setModelPointer
-} from "./chunk-FTPQJIPL.js";
+} from "./chunk-KQBUAEA5.js";
 import {
   AbortError
-} from "./chunk-RQVLBMP7.js";
+} from "./chunk-PDH2QHLY.js";
 import {
   debug,
   getCurrentRequest,
   logUserFriendly,
   markPhase
-} from "./chunk-PGRCNKEQ.js";
+} from "./chunk-O6CVVWZV.js";
 import {
   ASCII_LOGO,
   BunShell,
@@ -315,13 +315,13 @@ import {
   setCwd,
   shouldApplyToolOutputTruncation,
   truncateToolOutput
-} from "./chunk-LG4DZXZE.js";
+} from "./chunk-KPZ4UMNV.js";
 import {
   MACRO
-} from "./chunk-X6MCOKYP.js";
+} from "./chunk-NQJAXQZX.js";
 import {
   __export
-} from "./chunk-I3J4JYES.js";
+} from "./chunk-OYT6EI36.js";
 
 // src/tools/system/BashTool/BashTool.tsx
 import { statSync as statSync16 } from "fs";
@@ -499,7 +499,7 @@ var getCommandSubcommandPrefix = memoize(
 var getCommandPrefix = memoize(
   async (command4, abortSignal) => {
     const { systemPrompt, userPrompt } = buildBashCommandPrefixDetectionPrompt(command4);
-    const { API_ERROR_MESSAGE_PREFIX: API_ERROR_MESSAGE_PREFIX2, queryQuick: queryQuick2 } = await import("./llm-MRDYTVAB.js");
+    const { API_ERROR_MESSAGE_PREFIX: API_ERROR_MESSAGE_PREFIX2, queryQuick: queryQuick2 } = await import("./llm-CVILTZMI.js");
     const response = await queryQuick2({
       systemPrompt,
       userPrompt,
@@ -4301,7 +4301,7 @@ function formatParseError(error) {
   return error instanceof Error ? error.message : String(error);
 }
 async function defaultGateQuery(args) {
-  const { API_ERROR_MESSAGE_PREFIX: API_ERROR_MESSAGE_PREFIX2, queryLLM: queryLLM2 } = await import("./llm-MRDYTVAB.js");
+  const { API_ERROR_MESSAGE_PREFIX: API_ERROR_MESSAGE_PREFIX2, queryLLM: queryLLM2 } = await import("./llm-CVILTZMI.js");
   const queryLLMFn = args.queryLLMOverride ?? queryLLM2;
   const messages = [
     {
@@ -6793,14 +6793,14 @@ var FileEditTool = {
     }
     let editOperations = [];
     if (edits) {
-      const { parseBlockEdits: parseBlockEdits2 } = await import("./blockParser-QPLEX5NJ.js");
+      const { parseBlockEdits: parseBlockEdits2 } = await import("./blockParser-RZPICWAA.js");
       editOperations = parseBlockEdits2(edits);
     }
     let currentFileContent = fileExistsBun(fullFilePath) ? normalizeLineEndings(await readFileBun(fullFilePath) ?? "") : "";
     const originalFileContent = currentFileContent;
     let totalPatch = [];
-    const { SmartEdit } = await import("./smart-edit-AWHJDSU6.js");
-    const { findLspAnchor } = await import("./lspAnchor-XGTUMZDM.js");
+    const { SmartEdit } = await import("./smart-edit-EQBEMPKQ.js");
+    const { findLspAnchor } = await import("./lspAnchor-LUE27QI2.js");
     for (const op of editOperations) {
       const normalizedSearch = normalizeLineEndings(op.search);
       const normalizedReplace = normalizeLineEndings(op.replace);
@@ -12408,7 +12408,7 @@ async function createAndStoreApiKey(accessToken) {
       }
       saveGlobalConfig(config2);
       try {
-        const { resetAnthropicClient } = await import("./llm-MRDYTVAB.js");
+        const { resetAnthropicClient } = await import("./llm-CVILTZMI.js");
         resetAnthropicClient();
       } catch {
       }
@@ -16832,7 +16832,7 @@ async function refreshPluginRuntimeFromInstalls() {
   const existingRoots = getSessionPlugins().map((p) => p.rootDir);
   const dirs = Array.from(/* @__PURE__ */ new Set([...existingRoots, ...installedRoots]));
   if (dirs.length === 0) return [];
-  const { configureSessionPlugins } = await import("./pluginRuntime-TDH3JKLN.js");
+  const { configureSessionPlugins } = await import("./pluginRuntime-IWKORZEI.js");
   const { errors } = await configureSessionPlugins({ pluginDirs: dirs });
   return errors;
 }
@@ -17507,7 +17507,7 @@ async function call(onDone, context) {
     ModelConfig,
     {
       onClose: () => {
-        import("./model-ECABFXED.js").then(({ reloadModelManager: reloadModelManager2 }) => {
+        import("./model-3GE72U3P.js").then(({ reloadModelManager: reloadModelManager2 }) => {
           reloadModelManager2();
           triggerModelConfigChange();
           onDone();
@@ -18276,7 +18276,7 @@ var rename = {
 var rename_default = rename;
 
 // src/server/index.ts
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono10 } from "hono";
 import { cors } from "hono/cors";
 import { logger } from "hono/logger";
 import { streamSSE as streamSSE2 } from "hono/streaming";
@@ -26997,7 +26997,7 @@ async function analyzeOutputWithLsp(output, exitCode) {
   if (exitCode !== 0 || errorCount > 0 || warningCount > 0) {
     try {
       const { isAbsolute: isAbsolute11, resolve: resolve16 } = await import("path");
-      const { getSessionRoot: getSessionRoot2 } = await import("./state-GMP5BAO3.js");
+      const { getSessionRoot: getSessionRoot2 } = await import("./state-GWKESQ7O.js");
       const lines = output.split("\n");
       const uniqueFiles = /* @__PURE__ */ new Set();
       const lspSuggestions = [];
@@ -27399,7 +27399,7 @@ var DeleteTool = {
         }
         if (!force) {
           try {
-            const { LspFacade: LspFacade2 } = await import("./lsp-2TM75CW4.js");
+            const { LspFacade: LspFacade2 } = await import("./lsp-M5NJ7YC7.js");
             const referenceDetail = await LspFacade2.checkFileReferences(fullPath);
             if (referenceDetail) {
               failedItems.push(
@@ -31033,6 +31033,20 @@ var getReadOnlyTools = memoize4(async () => {
   return tools.filter((_, index) => isEnabled5[index]);
 });
 
+// src/server/bus/eventIdGenerator.ts
+var EventIdGenerator = class {
+  sequenceMap = /* @__PURE__ */ new Map();
+  nextId(sessionId) {
+    const next = (this.sequenceMap.get(sessionId) ?? 0) + 1;
+    this.sequenceMap.set(sessionId, next);
+    return `sess-${sessionId}-seq-${String(next).padStart(6, "0")}`;
+  }
+};
+function parseSessionIdFromEventId(eventId) {
+  const match = eventId.match(/^sess-(.+)-seq-(\d+)$/);
+  return match?.[1] ?? null;
+}
+
 // src/server/bus/index.ts
 var BusEvent;
 ((BusEvent2) => {
@@ -31053,9 +31067,12 @@ var Bus;
   const state = {
     subscriptions: /* @__PURE__ */ new Map()
   };
+  const eventIdGenerator = new EventIdGenerator();
   async function publish(def, properties) {
+    const sessionId = typeof properties.sessionId === "string" ? properties.sessionId : void 0;
     const payload = {
       type: def.type,
+      ...sessionId ? { id: eventIdGenerator.nextId(sessionId) } : {},
       properties
     };
     const pending = [];
@@ -31904,6 +31921,971 @@ function createMCPRoutes() {
   return router;
 }
 
+// src/server/routes/providers.ts
+import * as crypto2 from "crypto";
+import { Hono as Hono6 } from "hono";
+
+// src/server/modelPool/providerCatalog.ts
+function normalizeText(input) {
+  return String(input ?? "").trim();
+}
+function normalizeProviderID(input) {
+  return normalizeText(input).toLowerCase();
+}
+function rankSources(priority) {
+  const rank = /* @__PURE__ */ new Map();
+  priority.forEach((source, index) => {
+    rank.set(source, index);
+  });
+  return rank;
+}
+function composeProviderCatalog(sources, priority = ["env", "auth", "plugin", "config"]) {
+  const ranks = rankSources(priority);
+  const fallbackRank = priority.length + 1;
+  const sortedSources = [...sources].sort((a, b) => {
+    const aRank = ranks.get(a.sourceType) ?? fallbackRank;
+    const bRank = ranks.get(b.sourceType) ?? fallbackRank;
+    return aRank - bRank;
+  });
+  const providerMap = /* @__PURE__ */ new Map();
+  for (const source of sortedSources) {
+    for (const provider of source.providers) {
+      const providerID = normalizeProviderID(provider?.providerID);
+      if (!providerID) continue;
+      const displayName = normalizeText(provider?.displayName) || providerID;
+      const connected2 = provider?.connected === true;
+      const existing = providerMap.get(providerID);
+      if (!existing) {
+        providerMap.set(providerID, {
+          providerID,
+          displayName,
+          connected: connected2
+        });
+        continue;
+      }
+      if (!existing.connected && connected2) {
+        existing.connected = true;
+      }
+    }
+  }
+  const all = [...providerMap.values()].sort(
+    (a, b) => a.providerID.localeCompare(b.providerID)
+  );
+  const connected = all.filter((item) => item.connected).map((item) => item.providerID);
+  let defaultModel = null;
+  for (const source of sortedSources) {
+    if (source.defaultModel) {
+      defaultModel = source.defaultModel;
+      break;
+    }
+  }
+  return {
+    all,
+    default: defaultModel,
+    connected
+  };
+}
+function buildProviderSourceFromProfiles(sourceType, profiles, defaultModel) {
+  const providerMap = /* @__PURE__ */ new Map();
+  for (const profile of profiles) {
+    if (profile?.isActive !== true) continue;
+    const providerID = normalizeProviderID(profile?.provider);
+    if (!providerID) continue;
+    const existing = providerMap.get(providerID);
+    const connected = normalizeText(profile?.apiKey).length > 0;
+    const displayName = normalizeText(profile?.provider) || providerID;
+    if (!existing) {
+      providerMap.set(providerID, {
+        providerID,
+        displayName,
+        connected
+      });
+      continue;
+    }
+    if (!existing.connected && connected) {
+      existing.connected = true;
+    }
+  }
+  return {
+    sourceType,
+    providers: [...providerMap.values()].sort(
+      (a, b) => a.providerID.localeCompare(b.providerID)
+    ),
+    defaultModel
+  };
+}
+
+// src/server/modelPool/authKernel.ts
+function parseTtlMs(input) {
+  const parsed = Number(input);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return 5 * 60 * 1e3;
+  }
+  return Math.floor(parsed);
+}
+var AuthKernel = class {
+  ttlMs;
+  pendingByProvider = /* @__PURE__ */ new Map();
+  consumedStatesByProvider = /* @__PURE__ */ new Map();
+  constructor(ttlMs = parseTtlMs(process.env.PYB_OAUTH_PENDING_TTL_MS)) {
+    this.ttlMs = ttlMs;
+  }
+  setOAuthPendingTtlMs(ttlMs) {
+    if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
+      throw new Error("ttlMs must be a positive number");
+    }
+    this.ttlMs = Math.floor(ttlMs);
+  }
+  beginOAuthSession(providerID, state, codeVerifier) {
+    const now = Date.now();
+    this.pruneConsumedStates(providerID, now);
+    this.pendingByProvider.set(providerID, {
+      state,
+      codeVerifier,
+      createdAt: now
+    });
+  }
+  consumeOAuthSession(providerID, state) {
+    const now = Date.now();
+    this.pruneConsumedStates(providerID, now);
+    const consumed = this.consumedStatesByProvider.get(providerID);
+    if (consumed?.has(state)) {
+      return { success: false, errorCode: "OAUTH_STATE_REPLAYED" };
+    }
+    const pending = this.pendingByProvider.get(providerID);
+    if (!pending || pending.state !== state) {
+      return { success: false, errorCode: "OAUTH_STATE_MISMATCH" };
+    }
+    if (now - pending.createdAt > this.ttlMs) {
+      this.pendingByProvider.delete(providerID);
+      return { success: false, errorCode: "OAUTH_STATE_EXPIRED" };
+    }
+    this.pendingByProvider.delete(providerID);
+    let nextConsumed = this.consumedStatesByProvider.get(providerID);
+    if (!nextConsumed) {
+      nextConsumed = /* @__PURE__ */ new Map();
+      this.consumedStatesByProvider.set(providerID, nextConsumed);
+    }
+    nextConsumed.set(state, now);
+    return {
+      success: true,
+      codeVerifier: pending.codeVerifier
+    };
+  }
+  pruneConsumedStates(providerID, now) {
+    const consumed = this.consumedStatesByProvider.get(providerID);
+    if (!consumed) return;
+    for (const [state, consumedAt] of consumed.entries()) {
+      if (now - consumedAt > this.ttlMs) {
+        consumed.delete(state);
+      }
+    }
+    if (consumed.size === 0) {
+      this.consumedStatesByProvider.delete(providerID);
+    }
+  }
+};
+
+// src/server/routes/providers.ts
+var authKernel = new AuthKernel();
+function normalizeText2(input) {
+  return String(input ?? "").trim();
+}
+function normalizeProviderID2(input) {
+  return normalizeText2(input).toLowerCase();
+}
+function getActiveProfiles(config2) {
+  const profiles = Array.isArray(config2?.modelProfiles) ? config2.modelProfiles : [];
+  return profiles.filter((profile) => profile?.isActive === true);
+}
+function hasProvider(config2, providerID) {
+  const profiles = Array.isArray(config2?.modelProfiles) ? config2.modelProfiles : [];
+  return profiles.some((profile) => normalizeProviderID2(profile?.provider) === providerID);
+}
+function setProviderApiKey(providerID, apiKey) {
+  const config2 = getGlobalConfig();
+  const profiles = Array.isArray(config2?.modelProfiles) ? config2.modelProfiles : [];
+  let updated = false;
+  const nextProfiles = profiles.map((profile) => {
+    if (normalizeProviderID2(profile?.provider) !== providerID) return profile;
+    updated = true;
+    return {
+      ...profile,
+      apiKey
+    };
+  });
+  if (!updated) return false;
+  saveGlobalConfig({
+    ...config2,
+    modelProfiles: nextProfiles
+  });
+  return true;
+}
+function setProviderAuthValue(providerIDRaw, apiKeyRaw) {
+  const providerID = normalizeProviderID2(providerIDRaw);
+  const apiKey = normalizeText2(apiKeyRaw);
+  if (!providerID) {
+    return {
+      success: false,
+      code: "INVALID_PROVIDER_ID",
+      message: "providerID is required"
+    };
+  }
+  if (!apiKey) {
+    return {
+      success: false,
+      code: "INVALID_AUTH_INPUT",
+      message: "apiKey is required"
+    };
+  }
+  const config2 = getGlobalConfig();
+  if (!hasProvider(config2, providerID)) {
+    return {
+      success: false,
+      code: "PROVIDER_NOT_FOUND",
+      message: `Provider '${providerID}' not found`
+    };
+  }
+  const updated = setProviderApiKey(providerID, apiKey);
+  if (!updated) {
+    return {
+      success: false,
+      code: "PROVIDER_AUTH_UPDATE_FAILED",
+      message: "Failed to update provider auth"
+    };
+  }
+  return { success: true };
+}
+function removeProviderAuthValue(providerIDRaw) {
+  const providerID = normalizeProviderID2(providerIDRaw);
+  if (!providerID) {
+    return {
+      success: false,
+      code: "INVALID_PROVIDER_ID",
+      message: "providerID is required"
+    };
+  }
+  const config2 = getGlobalConfig();
+  if (!hasProvider(config2, providerID)) {
+    return {
+      success: false,
+      code: "PROVIDER_NOT_FOUND",
+      message: `Provider '${providerID}' not found`
+    };
+  }
+  const updated = setProviderApiKey(providerID, "");
+  if (!updated) {
+    return {
+      success: false,
+      code: "PROVIDER_AUTH_REMOVE_FAILED",
+      message: "Failed to remove provider auth"
+    };
+  }
+  return { success: true };
+}
+function buildCodeVerifier() {
+  return crypto2.randomBytes(32).toString("base64url");
+}
+function buildCodeChallenge(verifier) {
+  return crypto2.createHash("sha256").update(verifier).digest("base64url");
+}
+function resolveDefaultModelRef(config2, activeProfiles) {
+  const pointer = normalizeText2(config2?.modelPointers?.main);
+  if (!pointer) return null;
+  const normalizedPointer = pointer.toLowerCase();
+  const profile = activeProfiles.find((item) => {
+    const providerID = normalizeProviderID2(item?.provider);
+    const modelID = normalizeText2(item?.modelName);
+    const profileName = normalizeText2(item?.name);
+    const providerQualifiedModel = `${providerID}:${modelID}`.toLowerCase();
+    const providerQualifiedName = `${providerID}:${profileName}`.toLowerCase();
+    return modelID === pointer || profileName === pointer || providerQualifiedModel === normalizedPointer || providerQualifiedName === normalizedPointer;
+  });
+  if (!profile) return null;
+  return {
+    providerID: normalizeProviderID2(profile.provider),
+    modelID: normalizeText2(profile.modelName),
+    displayName: normalizeText2(profile.name) || normalizeText2(profile.modelName),
+    capabilities: []
+  };
+}
+function createProviderListPayload(config2) {
+  const activeProfiles = getActiveProfiles(config2);
+  const defaultModel = resolveDefaultModelRef(config2, activeProfiles);
+  const configSource = buildProviderSourceFromProfiles(
+    "config",
+    activeProfiles,
+    defaultModel
+  );
+  return composeProviderCatalog([configSource], ["env", "auth", "plugin", "config"]);
+}
+function createProviderAuthMethods(providers2) {
+  return providers2.map((provider) => ({
+    providerID: provider.providerID,
+    type: "api",
+    label: "API Key",
+    scopes: []
+  }));
+}
+function createProvidersRoutes() {
+  const router = new Hono6();
+  router.get("/", (c) => {
+    const config2 = getGlobalConfig();
+    const data = createProviderListPayload(config2);
+    return c.json({
+      success: true,
+      data
+    });
+  });
+  router.get("/auth", (c) => {
+    const config2 = getGlobalConfig();
+    const data = createProviderListPayload(config2);
+    return c.json({
+      success: true,
+      data: createProviderAuthMethods(data.all)
+    });
+  });
+  router.post("/:providerID/oauth/authorize", async (c) => {
+    const providerID = normalizeProviderID2(c.req.param("providerID"));
+    const config2 = getGlobalConfig();
+    if (!hasProvider(config2, providerID)) {
+      return c.json(
+        {
+          success: false,
+          error: {
+            code: "PROVIDER_NOT_FOUND",
+            message: `Provider '${providerID}' not found`,
+            recoverable: true
+          }
+        },
+        404
+      );
+    }
+    const body = await c.req.json().catch(() => ({}));
+    const redirectUri = normalizeText2(body?.redirectUri) || `http://localhost:4096/v1/providers/${providerID}/oauth/callback`;
+    const scope = normalizeText2(body?.scope) || "default";
+    const state = crypto2.randomBytes(24).toString("base64url");
+    const codeVerifier = buildCodeVerifier();
+    const codeChallenge = buildCodeChallenge(codeVerifier);
+    authKernel.beginOAuthSession(providerID, state, codeVerifier);
+    const authorizationUrl = new URL(
+      `https://auth.${providerID || "provider"}.example.com/oauth/authorize`
+    );
+    authorizationUrl.searchParams.set("response_type", "code");
+    authorizationUrl.searchParams.set("client_id", "pyb-cli");
+    authorizationUrl.searchParams.set("redirect_uri", redirectUri);
+    authorizationUrl.searchParams.set("scope", scope);
+    authorizationUrl.searchParams.set("state", state);
+    authorizationUrl.searchParams.set("code_challenge", codeChallenge);
+    authorizationUrl.searchParams.set("code_challenge_method", "S256");
+    return c.json({
+      success: true,
+      data: {
+        providerID,
+        authorizationUrl: authorizationUrl.toString(),
+        state,
+        codeChallengeMethod: "S256"
+      }
+    });
+  });
+  router.post("/:providerID/oauth/callback", async (c) => {
+    const providerID = normalizeProviderID2(c.req.param("providerID"));
+    const config2 = getGlobalConfig();
+    if (!hasProvider(config2, providerID)) {
+      return c.json(
+        {
+          success: false,
+          error: {
+            code: "PROVIDER_NOT_FOUND",
+            message: `Provider '${providerID}' not found`,
+            recoverable: true
+          }
+        },
+        404
+      );
+    }
+    const body = await c.req.json().catch(() => ({}));
+    const state = normalizeText2(body?.state);
+    const code = normalizeText2(body?.code);
+    if (!state || !code) {
+      return c.json(
+        {
+          success: false,
+          error: {
+            code: "INVALID_OAUTH_CALLBACK",
+            message: "code and state are required",
+            recoverable: true
+          }
+        },
+        400
+      );
+    }
+    const consumed = authKernel.consumeOAuthSession(providerID, state);
+    if (consumed.success === false) {
+      const errorCode = consumed.errorCode;
+      const errorMap = {
+        OAUTH_STATE_MISMATCH: "Invalid oauth state",
+        OAUTH_STATE_EXPIRED: "OAuth state expired",
+        OAUTH_STATE_REPLAYED: "OAuth state already consumed"
+      };
+      return c.json(
+        {
+          success: false,
+          error: {
+            code: errorCode,
+            message: errorMap[errorCode],
+            recoverable: true
+          }
+        },
+        400
+      );
+    }
+    const synthesizedApiKey = crypto2.createHash("sha256").update(`${providerID}:${code}:${consumed.codeVerifier}:${state}`).digest("hex").slice(0, 40);
+    const result = setProviderAuthValue(providerID, `oauth_${synthesizedApiKey}`);
+    if (!result.success) {
+      return c.json(
+        {
+          success: false,
+          error: {
+            code: result.code ?? "PROVIDER_AUTH_UPDATE_FAILED",
+            message: result.message ?? "Failed to update provider auth",
+            recoverable: true
+          }
+        },
+        400
+      );
+    }
+    return c.json({
+      success: true,
+      data: {
+        providerID,
+        connected: true,
+        method: "oauth"
+      }
+    });
+  });
+  return router;
+}
+
+// src/server/routes/auth.ts
+import { Hono as Hono7 } from "hono";
+function isNotFound(code) {
+  return code === "PROVIDER_NOT_FOUND";
+}
+function createAuthRoutes() {
+  const router = new Hono7();
+  router.put("/:providerID", async (c) => {
+    const providerID = c.req.param("providerID");
+    const body = await c.req.json().catch(() => ({}));
+    const result = setProviderAuthValue(providerID, body?.apiKey);
+    if (!result.success) {
+      return c.json(
+        {
+          success: false,
+          error: {
+            code: result.code ?? "PROVIDER_AUTH_UPDATE_FAILED",
+            message: result.message ?? "Failed to update provider auth",
+            recoverable: true
+          }
+        },
+        isNotFound(result.code) ? 404 : 400
+      );
+    }
+    return c.json({
+      success: true,
+      data: {
+        providerID: providerID.toLowerCase(),
+        connected: true,
+        method: "api"
+      }
+    });
+  });
+  router.delete("/:providerID", (c) => {
+    const providerID = c.req.param("providerID");
+    const result = removeProviderAuthValue(providerID);
+    if (!result.success) {
+      return c.json(
+        {
+          success: false,
+          error: {
+            code: result.code ?? "PROVIDER_AUTH_REMOVE_FAILED",
+            message: result.message ?? "Failed to remove provider auth",
+            recoverable: true
+          }
+        },
+        isNotFound(result.code) ? 404 : 400
+      );
+    }
+    return c.json({
+      success: true,
+      data: {
+        providerID: providerID.toLowerCase(),
+        removed: true
+      }
+    });
+  });
+  return router;
+}
+
+// src/server/routes/model.ts
+import { Hono as Hono8 } from "hono";
+
+// src/server/modelPool/modelCatalog.ts
+function normalizeText3(input) {
+  return String(input ?? "").trim();
+}
+function normalizeProviderID3(input) {
+  return normalizeText3(input).toLowerCase();
+}
+function isActiveProfile(profile) {
+  return profile?.isActive === true;
+}
+function resolveModelSelection(profiles, providerID, modelID) {
+  const providerProfiles = profiles.filter(
+    (profile) => normalizeProviderID3(profile?.provider) === providerID
+  );
+  if (providerProfiles.length === 0) {
+    return {
+      success: false,
+      errorCode: "PROVIDER_NOT_FOUND",
+      message: `Provider '${providerID}' not found`,
+      status: 404
+    };
+  }
+  const matchingProfiles = providerProfiles.filter(
+    (profile) => normalizeText3(profile?.modelName) === modelID
+  );
+  if (matchingProfiles.length === 0) {
+    return {
+      success: false,
+      errorCode: "MODEL_NOT_FOUND",
+      message: `Model '${modelID}' not found under provider '${providerID}'`,
+      status: 404
+    };
+  }
+  const enabledProfile = matchingProfiles.find(isActiveProfile);
+  if (!enabledProfile) {
+    return {
+      success: false,
+      errorCode: "MODEL_DISABLED",
+      message: `Model '${modelID}' is disabled under provider '${providerID}'`,
+      status: 409
+    };
+  }
+  return {
+    success: true,
+    current: {
+      providerID,
+      modelID,
+      displayName: normalizeText3(enabledProfile?.name) || modelID,
+      capabilities: []
+    }
+  };
+}
+
+// src/server/modelPool/policyEngine.ts
+function normalizeText4(input) {
+  return String(input ?? "").trim();
+}
+function normalizeProviderID4(input) {
+  return normalizeText4(input).toLowerCase();
+}
+function readBlockedModelRules() {
+  const raw = process.env.PYB_POLICY_BLOCKED_MODELS ?? "";
+  const entries = raw.split(",").map((item) => item.trim().toLowerCase()).filter(Boolean);
+  return new Set(entries);
+}
+function evaluateDefaultModelPolicy(input) {
+  const providerID = normalizeProviderID4(input.providerID);
+  const modelID = normalizeText4(input.modelID).toLowerCase();
+  const blocked = readBlockedModelRules();
+  const exactKey = `${providerID}:${modelID}`;
+  const wildcardProviderKey = `${providerID}:*`;
+  const wildcardGlobalKey = `*:${modelID}`;
+  const fullWildcardKey = "*:*";
+  if (blocked.has(exactKey) || blocked.has(wildcardProviderKey) || blocked.has(wildcardGlobalKey) || blocked.has(fullWildcardKey)) {
+    return {
+      allowed: false,
+      errorCode: "POLICY_REJECTED",
+      message: `Policy rejected model '${modelID}' under provider '${providerID}'`,
+      status: 403
+    };
+  }
+  return { allowed: true };
+}
+
+// src/server/routes/model.ts
+function normalizeText5(input) {
+  return String(input ?? "").trim();
+}
+function normalizeProviderID5(input) {
+  return normalizeText5(input).toLowerCase();
+}
+function isSupportedScope(input) {
+  return input === "global" || input === "workspace";
+}
+function resolveScope(input) {
+  const scope = normalizeText5(input).toLowerCase();
+  if (!scope) return "global";
+  if (isSupportedScope(scope)) return scope;
+  throw new Error("INVALID_SCOPE");
+}
+function createModelRoutes() {
+  const router = new Hono8();
+  router.put("/default", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const providerID = normalizeProviderID5(body?.providerID);
+    const modelID = normalizeText5(body?.modelID);
+    if (!providerID || !modelID) {
+      return c.json(
+        {
+          success: false,
+          error: {
+            code: "INVALID_MODEL_REF",
+            message: "providerID and modelID are required",
+            recoverable: true
+          }
+        },
+        400
+      );
+    }
+    let requestedScope;
+    try {
+      requestedScope = resolveScope(body?.scope);
+    } catch {
+      return c.json(
+        {
+          success: false,
+          error: {
+            code: "INVALID_SCOPE",
+            message: "scope must be global or workspace",
+            recoverable: true
+          }
+        },
+        400
+      );
+    }
+    const globalConfig = getGlobalConfig();
+    const profiles = Array.isArray(globalConfig.modelProfiles) ? globalConfig.modelProfiles : [];
+    const selection = resolveModelSelection(profiles, providerID, modelID);
+    if (selection.success === false) {
+      return c.json(
+        {
+          success: false,
+          error: {
+            code: selection.errorCode,
+            message: selection.message,
+            recoverable: true
+          }
+        },
+        selection.status
+      );
+    }
+    const policy = evaluateDefaultModelPolicy({
+      providerID,
+      modelID,
+      scope: requestedScope
+    });
+    if (policy.allowed === false) {
+      return c.json(
+        {
+          success: false,
+          error: {
+            code: policy.errorCode,
+            message: policy.message,
+            recoverable: true
+          }
+        },
+        policy.status
+      );
+    }
+    const appliedScope = "global";
+    const fallbackReason = requestedScope === "workspace" ? "workspace_scope_not_supported" : null;
+    const currentPointers = globalConfig.modelPointers ?? {};
+    const nextPointers = {
+      ...currentPointers,
+      main: modelID,
+      task: currentPointers.task ?? modelID,
+      compact: currentPointers.compact ?? modelID,
+      quick: currentPointers.quick ?? modelID
+    };
+    saveGlobalConfig({
+      ...globalConfig,
+      modelPointers: nextPointers
+    });
+    return c.json({
+      success: true,
+      data: {
+        scope: appliedScope,
+        requestedScope,
+        applied: true,
+        fallbackReason,
+        current: selection.current
+      }
+    });
+  });
+  return router;
+}
+
+// src/server/routes/modelPools.ts
+import { Hono as Hono9 } from "hono";
+
+// src/server/modelPool/sourceResolver.ts
+function normalize2(input) {
+  return input.trim();
+}
+function normalizeID(input) {
+  return normalize2(input).toLowerCase();
+}
+function parseGitHubRepo(spec) {
+  const ssh = spec.match(/^git@github\.com:([^/]+\/[^/]+?)(?:\.git)?$/i);
+  if (ssh?.[1]) return normalizeID(ssh[1]);
+  const https = spec.match(/^https?:\/\/github\.com\/([^/]+\/[^/]+?)(?:\.git)?(?:#.*)?$/i);
+  if (https?.[1]) return normalizeID(https[1]);
+  return null;
+}
+function extractLocalPluginID(spec) {
+  try {
+    const url2 = new URL(spec);
+    const path6 = decodeURIComponent(url2.pathname);
+    const segments = path6.split("/").filter(Boolean);
+    const tail = segments[segments.length - 1] ?? "local-plugin";
+    return normalizeID(tail.replace(/\.(tgz|tar\.gz|zip)$/i, ""));
+  } catch {
+    return "local-plugin";
+  }
+}
+function parseMarketplaceSpec(spec) {
+  const trimmed = normalize2(spec);
+  const parts = trimmed.split("@");
+  if (parts.length !== 2) return null;
+  if (trimmed.startsWith("@")) return null;
+  const plugin2 = normalize2(parts[0] ?? "");
+  const marketplace = normalize2(parts[1] ?? "");
+  if (!plugin2 || !marketplace) return null;
+  if (marketplace.includes("/")) return null;
+  return {
+    pluginID: normalizeID(plugin2),
+    marketplace: normalizeID(marketplace)
+  };
+}
+function stripNpmVersion(spec) {
+  const trimmed = normalize2(spec);
+  if (!trimmed) throw new Error("pluginSpec is required");
+  if (trimmed.startsWith("@")) {
+    const slash = trimmed.indexOf("/");
+    const lastAt = trimmed.lastIndexOf("@");
+    if (slash > 0 && lastAt > slash) {
+      return normalizeID(trimmed.slice(0, lastAt));
+    }
+    return normalizeID(trimmed);
+  }
+  const at = trimmed.lastIndexOf("@");
+  if (at > 0) {
+    return normalizeID(trimmed.slice(0, at));
+  }
+  return normalizeID(trimmed);
+}
+function resolvePluginSourceRecord(pluginSpecRaw) {
+  const pluginSpec = normalize2(pluginSpecRaw);
+  if (!pluginSpec) throw new Error("pluginSpec is required");
+  if (pluginSpec.startsWith("file://")) {
+    const pluginID2 = extractLocalPluginID(pluginSpec);
+    return {
+      pluginSpec,
+      pluginID: pluginID2,
+      sourceID: `local:${pluginSpec}`,
+      sourceType: "local"
+    };
+  }
+  const githubRepo = parseGitHubRepo(pluginSpec);
+  if (githubRepo) {
+    return {
+      pluginSpec,
+      pluginID: githubRepo,
+      sourceID: `github:${githubRepo}`,
+      sourceType: "github"
+    };
+  }
+  const marketplace = parseMarketplaceSpec(pluginSpec);
+  if (marketplace) {
+    return {
+      pluginSpec,
+      pluginID: marketplace.pluginID,
+      sourceID: `marketplace:${marketplace.marketplace}`,
+      sourceType: "marketplace"
+    };
+  }
+  const pluginID = stripNpmVersion(pluginSpec);
+  return {
+    pluginSpec,
+    pluginID,
+    sourceID: "npm:registry",
+    sourceType: "npm"
+  };
+}
+function dedupeSourceRecordsByPluginID(records, sourcePriority = ["marketplace", "github", "npm", "local"]) {
+  const priority = /* @__PURE__ */ new Map();
+  sourcePriority.forEach((source, index) => {
+    priority.set(source, index);
+  });
+  const fallbackRank = sourcePriority.length + 1;
+  const deduped = /* @__PURE__ */ new Map();
+  for (const record of records) {
+    const key = normalizeID(record.pluginID);
+    const current = deduped.get(key);
+    if (!current) {
+      deduped.set(key, { ...record, pluginID: key });
+      continue;
+    }
+    const currentRank = priority.get(current.sourceType) ?? fallbackRank;
+    const nextRank = priority.get(record.sourceType) ?? fallbackRank;
+    if (nextRank < currentRank) {
+      deduped.set(key, { ...record, pluginID: key });
+    }
+  }
+  return Array.from(deduped.values());
+}
+var ModelPoolRegistry = class {
+  pools = /* @__PURE__ */ new Map();
+  register(definition) {
+    const modelPoolID = normalizeID(definition.modelPoolID);
+    if (!modelPoolID) throw new Error("modelPoolID is required");
+    if (this.pools.has(modelPoolID)) {
+      throw new Error(`model pool already exists: ${modelPoolID}`);
+    }
+    this.pools.set(modelPoolID, {
+      definition: {
+        modelPoolID,
+        pluginSpecs: definition.pluginSpecs.map(normalize2).filter(Boolean),
+        metadata: definition.metadata ?? {}
+      },
+      state: "registered"
+    });
+  }
+  activate(modelPoolIDRaw) {
+    const modelPoolID = normalizeID(modelPoolIDRaw);
+    const record = this.pools.get(modelPoolID);
+    if (!record) throw new Error(`model pool not found: ${modelPoolID}`);
+    record.state = "active";
+  }
+  deactivate(modelPoolIDRaw) {
+    const modelPoolID = normalizeID(modelPoolIDRaw);
+    const record = this.pools.get(modelPoolID);
+    if (!record) throw new Error(`model pool not found: ${modelPoolID}`);
+    record.state = "inactive";
+  }
+  getStatus() {
+    const pools = Array.from(this.pools.values()).map((record) => {
+      const resolved = record.definition.pluginSpecs.map(resolvePluginSourceRecord);
+      const deduped = dedupeSourceRecordsByPluginID(resolved);
+      return {
+        modelPoolID: record.definition.modelPoolID,
+        state: record.state,
+        pluginCount: deduped.length,
+        sourceRecords: deduped,
+        metadata: record.definition.metadata ?? {}
+      };
+    });
+    const active2 = pools.filter((item) => item.state === "active").length;
+    return {
+      total: pools.length,
+      active: active2,
+      pools
+    };
+  }
+};
+
+// src/server/routes/modelPools.ts
+function normalizeProviderID6(input) {
+  return String(input ?? "").trim().toLowerCase();
+}
+function buildPluginSpecsFromProfiles(profiles) {
+  const specs = /* @__PURE__ */ new Set();
+  for (const profile of profiles) {
+    if (profile?.isActive !== true) continue;
+    const providerID = normalizeProviderID6(profile?.provider);
+    if (!providerID) continue;
+    specs.add(`${providerID}@config`);
+  }
+  return [...specs];
+}
+function createModelPoolRoutes() {
+  const router = new Hono9();
+  router.get("/status", async (c) => {
+    const globalConfig = getGlobalConfig();
+    const profiles = Array.isArray(globalConfig.modelProfiles) ? globalConfig.modelProfiles : [];
+    const pluginSpecs = buildPluginSpecsFromProfiles(profiles);
+    const registry = new ModelPoolRegistry();
+    const modelPoolID = "default";
+    registry.register({
+      modelPoolID,
+      pluginSpecs,
+      metadata: {
+        source: "config"
+      }
+    });
+    registry.activate(modelPoolID);
+    return c.json({
+      success: true,
+      data: registry.getStatus()
+    });
+  });
+  return router;
+}
+
+// src/server/events/eventBuffer.ts
+var SessionEventRingBuffer = class {
+  buffers = /* @__PURE__ */ new Map();
+  touchedAt = /* @__PURE__ */ new Map();
+  maxSize;
+  ttlMs;
+  constructor(maxSize = 100, ttlMs = 15 * 60 * 1e3) {
+    this.maxSize = maxSize;
+    this.ttlMs = ttlMs;
+  }
+  push(sessionId, event) {
+    this.pruneExpired(Date.now());
+    const buffer = this.buffers.get(sessionId) ?? [];
+    buffer.push(event);
+    if (buffer.length > this.maxSize) {
+      buffer.shift();
+    }
+    this.buffers.set(sessionId, buffer);
+    this.touchedAt.set(sessionId, Date.now());
+  }
+  replayAfter(sessionId, lastEventId) {
+    const buffer = this.buffers.get(sessionId);
+    if (!buffer || buffer.length === 0) {
+      return { kind: "gap", reason: "last_event_not_found" };
+    }
+    const index = buffer.findIndex((item) => item.id === lastEventId);
+    if (index === -1) {
+      return { kind: "gap", reason: "buffer_evicted" };
+    }
+    return { kind: "ok", events: buffer.slice(index + 1) };
+  }
+  clear(sessionId) {
+    this.buffers.delete(sessionId);
+    this.touchedAt.delete(sessionId);
+  }
+  getStats(sessionId) {
+    const buffer = this.buffers.get(sessionId) ?? [];
+    return {
+      count: buffer.length,
+      oldestId: buffer[0]?.id,
+      newestId: buffer[buffer.length - 1]?.id
+    };
+  }
+  pruneExpired(now) {
+    for (const [sessionId, touchedAt] of this.touchedAt.entries()) {
+      if (now - touchedAt > this.ttlMs) {
+        this.clear(sessionId);
+      }
+    }
+  }
+};
+
 // src/server/version.ts
 import { readFileSync as readFileSync14 } from "fs";
 import { resolve as resolve12 } from "path";
@@ -31921,17 +32903,66 @@ function resolveServerVersion() {
 var SERVER_VERSION = resolveServerVersion();
 
 // src/server/index.ts
+var DEFAULT_HEARTBEAT_INTERVAL_MS = 5e3;
+var MIN_HEARTBEAT_INTERVAL_MS = 3e3;
+var MAX_HEARTBEAT_INTERVAL_MS = 5e3;
 function toPublicSSEEvent(event) {
   const sessionId = typeof event.properties.sessionId === "string" ? event.properties.sessionId : void 0;
   return {
     type: event.type,
+    ...typeof event.id === "string" ? { id: event.id } : {},
     timestamp: Date.now(),
     ...sessionId ? { sessionId } : {},
     data: event.properties
   };
 }
+function resolveIdleTimeoutSeconds(value) {
+  if (value === void 0 || value === "0") return 0;
+  const ms = Number(value);
+  if (!Number.isFinite(ms) || ms < 0) return 0;
+  return ms >= 6e4 ? Math.floor(ms / 1e3) : 0;
+}
+function resolveHeartbeatIntervalMs(value) {
+  if (value === void 0) return DEFAULT_HEARTBEAT_INTERVAL_MS;
+  const ms = Number(value);
+  if (!Number.isFinite(ms) || ms < MIN_HEARTBEAT_INTERVAL_MS || ms > MAX_HEARTBEAT_INTERVAL_MS) {
+    return DEFAULT_HEARTBEAT_INTERVAL_MS;
+  }
+  return ms;
+}
+function resolveIdleTimeoutSecondsFromOptions(input) {
+  const override = input.idleTimeoutMs;
+  if (override !== void 0) {
+    return resolveIdleTimeoutSeconds(String(override));
+  }
+  return resolveIdleTimeoutSeconds(input.env.PYB_SSE_IDLE_TIMEOUT_MS);
+}
+function resolveHeartbeatIntervalMsFromOptions(input) {
+  const override = input.heartbeatIntervalMs;
+  if (override !== void 0) {
+    return resolveHeartbeatIntervalMs(String(override));
+  }
+  return resolveHeartbeatIntervalMs(input.env.PYB_SSE_HEARTBEAT_INTERVAL_MS);
+}
+function resolveSSEServerRuntimeConfig(env2 = process.env, options = {}) {
+  return {
+    idleTimeoutSeconds: resolveIdleTimeoutSecondsFromOptions({
+      env: env2,
+      idleTimeoutMs: options.idleTimeoutMs
+    }),
+    heartbeatIntervalMs: resolveHeartbeatIntervalMsFromOptions({
+      env: env2,
+      heartbeatIntervalMs: options.heartbeatIntervalMs
+    })
+  };
+}
 function createServer2(options = {}) {
-  const app = new Hono6();
+  const app = new Hono10();
+  const sseRuntimeConfig = resolveSSEServerRuntimeConfig(process.env, {
+    heartbeatIntervalMs: options.heartbeatIntervalMs,
+    idleTimeoutMs: options.idleTimeoutMs
+  });
+  const eventBuffer = new SessionEventRingBuffer();
   app.use("*", cors());
   app.use("*", logger());
   app.get("/v1/health", (c) => {
@@ -31951,9 +32982,15 @@ function createServer2(options = {}) {
   app.route("/v1/permissions", createPermissionRoutes());
   app.route("/v1/config", createConfigRoutes());
   app.route("/v1/mcp", createMCPRoutes());
+  app.route("/v1/providers", createProvidersRoutes());
+  app.route("/v1/auth", createAuthRoutes());
+  app.route("/v1/models", createModelRoutes());
+  app.route("/v1/model-pools", createModelPoolRoutes());
   app.get("/v1/events", (c) => {
     c.header("X-Accel-Buffering", "no");
     c.header("X-Content-Type-Options", "nosniff");
+    const requestedLastEventId = c.req.query("lastEventId") ?? c.req.header("Last-Event-ID");
+    const replaySessionId = typeof requestedLastEventId === "string" ? parseSessionIdFromEventId(requestedLastEventId) : null;
     return streamSSE2(c, async (stream) => {
       await stream.writeSSE({
         event: "server.connected",
@@ -31967,22 +33004,75 @@ function createServer2(options = {}) {
           }
         })
       });
+      if (requestedLastEventId && replaySessionId) {
+        const replayResult = eventBuffer.replayAfter(replaySessionId, requestedLastEventId);
+        if (replayResult.kind === "ok") {
+          for (const replayEvent of replayResult.events) {
+            await stream.writeSSE({
+              event: replayEvent.type,
+              data: JSON.stringify(replayEvent.data)
+            });
+          }
+        } else {
+          await stream.writeSSE({
+            event: "sse.replay_gap",
+            data: JSON.stringify({
+              type: "sse.replay_gap",
+              timestamp: Date.now(),
+              data: {
+                lastEventId: requestedLastEventId,
+                reason: replayResult.reason
+              }
+            })
+          });
+        }
+        await stream.writeSSE({
+          event: "sse.replay",
+          data: JSON.stringify({
+            type: "sse.replay",
+            timestamp: Date.now(),
+            data: {
+              replayCount: replayResult.kind === "ok" ? replayResult.events.length : 0,
+              replayGapCount: replayResult.kind === "gap" ? 1 : 0,
+              lastEventId: requestedLastEventId,
+              firstReplayId: replayResult.kind === "ok" ? replayResult.events[0]?.id ?? null : null,
+              lastReplayId: replayResult.kind === "ok" ? replayResult.events[replayResult.events.length - 1]?.id ?? null : null
+            }
+          })
+        });
+      }
       const unsubscribe = Bus.subscribeAll(async (event) => {
+        const publicEvent = toPublicSSEEvent(event);
+        if (typeof publicEvent.sessionId === "string" && typeof publicEvent.id === "string") {
+          eventBuffer.push(publicEvent.sessionId, {
+            id: publicEvent.id,
+            type: event.type,
+            timestamp: publicEvent.timestamp,
+            data: publicEvent
+          });
+        }
+        if (event.type === "session.deleted" && typeof publicEvent.sessionId === "string") {
+          eventBuffer.clear(publicEvent.sessionId);
+        }
         await stream.writeSSE({
           event: event.type,
-          data: JSON.stringify(toPublicSSEEvent(event))
+          data: JSON.stringify(publicEvent)
         });
       });
       const heartbeatInterval = setInterval(async () => {
-        await stream.writeSSE({
-          event: "server.heartbeat",
-          data: JSON.stringify({
-            type: "server.heartbeat",
-            timestamp: Date.now(),
-            data: { timestamp: Date.now() }
-          })
-        });
-      }, 1e4);
+        try {
+          await stream.writeSSE({
+            event: "server.heartbeat",
+            data: JSON.stringify({
+              type: "server.heartbeat",
+              timestamp: Date.now(),
+              data: { timestamp: Date.now() }
+            })
+          });
+        } catch (error) {
+          console.error("[pyb-sse-heartbeat] write failed", error);
+        }
+      }, sseRuntimeConfig.heartbeatIntervalMs);
       await new Promise((resolve16) => {
         stream.onAbort(() => {
           clearInterval(heartbeatInterval);
@@ -31998,13 +33088,18 @@ async function startServer(options = {}) {
   const port = options.port ?? 4096;
   const host = options.host ?? "localhost";
   const app = createServer2(options);
+  const sseRuntimeConfig = resolveSSEServerRuntimeConfig(process.env, {
+    heartbeatIntervalMs: options.heartbeatIntervalMs,
+    idleTimeoutMs: options.idleTimeoutMs
+  });
   if (typeof Bun === "undefined" || typeof Bun.serve !== "function") {
     throw new Error("Bun runtime is required to start the web server");
   }
   const server = Bun.serve({
     fetch: app.fetch,
     hostname: host,
-    port
+    port,
+    idleTimeout: sseRuntimeConfig.idleTimeoutSeconds
   });
   console.log(`PYB-CLI Web Server starting on http://${host}:${port}`);
   return {
@@ -38309,7 +39404,7 @@ function useStatusLine() {
 // src/ui/components/PromptInput.tsx
 async function interpretHashCommand(input) {
   try {
-    const { queryQuick: queryQuick2 } = await import("./llm-MRDYTVAB.js");
+    const { queryQuick: queryQuick2 } = await import("./llm-CVILTZMI.js");
     const systemPrompt = [
       "You're helping the user structure notes that will be added to their PYB.md file.",
       "Format the user's input into a well-structured note that will be useful for later reference.",
@@ -38622,7 +39717,7 @@ function PromptInput({
     if (messages2.length) {
       if (mode === "bash") {
         onQuery(messages2, newAbortController).then(async () => {
-          const { getCwd: getCwd2 } = await import("./state-GMP5BAO3.js");
+          const { getCwd: getCwd2 } = await import("./state-GWKESQ7O.js");
           setCurrentPwd(getCwd2());
         });
       } else {
@@ -40252,7 +41347,7 @@ import { homedir as homedir8 } from "os";
 // src/commands/agents/generation.ts
 import { randomUUID as randomUUID9 } from "crypto";
 async function generateAgentWithClaude(prompt) {
-  const { queryModel } = await import("./llm-MRDYTVAB.js");
+  const { queryModel } = await import("./llm-CVILTZMI.js");
   const systemPrompt = `You are an expert at creating AI agent configurations. Based on the user's description, generate a specialized agent configuration.
 
 Return your response as a JSON object with exactly these fields: