tandem-editor 0.6.3 → 0.7.0

package/dist/server/index.js

@@ -40,7 +40,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/shared/constants.ts
-var DEFAULT_WS_PORT, DEFAULT_MCP_PORT, SUPPORTED_EXTENSIONS, MAX_FILE_SIZE, MAX_WS_PAYLOAD, IDLE_TIMEOUT, SESSION_MAX_AGE, TANDEM_MODE_DEFAULT, SELECTION_DWELL_DEFAULT_MS, SELECTION_DWELL_MIN_MS, SELECTION_DWELL_MAX_MS, CHARS_PER_PAGE, LARGE_FILE_PAGE_THRESHOLD, VERY_LARGE_FILE_PAGE_THRESHOLD, CTRL_ROOM, Y_MAP_ANNOTATIONS, Y_MAP_AWARENESS, Y_MAP_USER_AWARENESS, Y_MAP_MODE, Y_MAP_DWELL_MS, Y_MAP_CHAT, Y_MAP_DOCUMENT_META, Y_MAP_ANNOTATION_REPLIES, Y_MAP_SAVED_AT_VERSION, Y_MAP_AUTHORSHIP, NOTIFICATION_BUFFER_SIZE, TUTORIAL_ANNOTATION_PREFIX, CHANNEL_EVENT_BUFFER_SIZE, CHANNEL_EVENT_BUFFER_AGE_MS, CHANNEL_SSE_KEEPALIVE_MS, TAURI_HOSTNAME;
+var DEFAULT_WS_PORT, DEFAULT_MCP_PORT, SUPPORTED_EXTENSIONS, MAX_FILE_SIZE, MAX_WS_PAYLOAD, IDLE_TIMEOUT, SESSION_MAX_AGE, TANDEM_MODE_DEFAULT, SELECTION_DWELL_DEFAULT_MS, SELECTION_DWELL_MIN_MS, SELECTION_DWELL_MAX_MS, CHARS_PER_PAGE, LARGE_FILE_PAGE_THRESHOLD, VERY_LARGE_FILE_PAGE_THRESHOLD, CTRL_ROOM, Y_MAP_ANNOTATIONS, Y_MAP_AWARENESS, Y_MAP_USER_AWARENESS, Y_MAP_MODE, Y_MAP_DWELL_MS, Y_MAP_CHAT, Y_MAP_DOCUMENT_META, Y_MAP_ANNOTATION_REPLIES, Y_MAP_SAVED_AT_VERSION, Y_MAP_AUTHORSHIP, NOTIFICATION_BUFFER_SIZE, TUTORIAL_ANNOTATION_PREFIX, CHANNEL_EVENT_BUFFER_SIZE, CHANNEL_EVENT_BUFFER_AGE_MS, CHANNEL_SSE_KEEPALIVE_MS, TOKEN_FILE_NAME, DEFAULT_BIND_HOST, TANDEM_ALLOW_UNAUTHENTICATED_LAN_ENV, TAURI_HOSTNAME;
 var init_constants = __esm({
   "src/shared/constants.ts"() {
     "use strict";
@@ -74,6 +74,9 @@ var init_constants = __esm({
     CHANNEL_EVENT_BUFFER_SIZE = 200;
     CHANNEL_EVENT_BUFFER_AGE_MS = 6e4;
     CHANNEL_SSE_KEEPALIVE_MS = 15e3;
+    TOKEN_FILE_NAME = "auth-token";
+    DEFAULT_BIND_HOST = "127.0.0.1";
+    TANDEM_ALLOW_UNAUTHENTICATED_LAN_ENV = "TANDEM_ALLOW_UNAUTHENTICATED_LAN";
     TAURI_HOSTNAME = "tauri.localhost";
   }
 });
@@ -1066,14 +1069,14 @@ var callAll, id, isOneOf;
 var init_function = __esm({
   "node_modules/lib0/function.js"() {
     "use strict";
-    callAll = (fs10, args2, i = 0) => {
+    callAll = (fs11, args2, i = 0) => {
       try {
-        for (; i < fs10.length; i++) {
-          fs10[i](...args2);
+        for (; i < fs11.length; i++) {
+          fs11[i](...args2);
         }
       } finally {
-        if (i < fs10.length) {
-          callAll(fs10, args2, i + 1);
+        if (i < fs11.length) {
+          callAll(fs11, args2, i + 1);
         }
       }
     };
@@ -3098,15 +3101,15 @@ var init_yjs = __esm({
           sortAndMergeDeleteSet(ds);
           transaction.afterState = getStateVector(transaction.doc.store);
           doc.emit("beforeObserverCalls", [transaction, doc]);
-          const fs10 = [];
+          const fs11 = [];
           transaction.changed.forEach(
-            (subs, itemtype) => fs10.push(() => {
+            (subs, itemtype) => fs11.push(() => {
               if (itemtype._item === null || !itemtype._item.deleted) {
                 itemtype._callObserver(transaction, subs);
               }
             })
           );
-          fs10.push(() => {
+          fs11.push(() => {
             transaction.changedParentTypes.forEach((events, type2) => {
               if (type2._dEH.l.length > 0 && (type2._item === null || !type2._item.deleted)) {
                 events = events.filter(
@@ -3117,19 +3120,19 @@ var init_yjs = __esm({
                   event._path = null;
                 });
                 events.sort((event1, event2) => event1.path.length - event2.path.length);
-                fs10.push(() => {
+                fs11.push(() => {
                   callEventHandlerListeners(type2._dEH, events, transaction);
                 });
               }
             });
-            fs10.push(() => doc.emit("afterTransaction", [transaction, doc]));
-            fs10.push(() => {
+            fs11.push(() => doc.emit("afterTransaction", [transaction, doc]));
+            fs11.push(() => {
               if (transaction._needFormattingCleanup) {
                 cleanupYTextAfterTransaction(transaction);
               }
             });
           });
-          callAll(fs10, []);
+          callAll(fs11, []);
         } finally {
           if (doc.gc) {
             tryGcDeleteSet(ds, store, doc.gcFilter);
@@ -3670,10 +3673,10 @@ var init_yjs = __esm({
       }
     };
     getPathTo = (parent, child) => {
-      const path15 = [];
+      const path16 = [];
       while (child._item !== null && child !== parent) {
         if (child._item.parentSub !== null) {
-          path15.unshift(child._item.parentSub);
+          path16.unshift(child._item.parentSub);
         } else {
           let i = 0;
           let c = (
@@ -3686,12 +3689,12 @@ var init_yjs = __esm({
             }
             c = c.right;
           }
-          path15.unshift(i);
+          path16.unshift(i);
         }
         child = /** @type {AbstractType<any>} */
         child._item.parent;
       }
-      return path15;
+      return path16;
     };
     warnPrematureAccess = () => {
       warn("Invalid access: Add Yjs type to a document before reading data.");
@@ -8459,7 +8462,7 @@ function transformGfmAutolinkLiterals(tree) {
     { ignore: ["link", "linkReference"] }
   );
 }
-function findUrl(_3, protocol, domain2, path15, match) {
+function findUrl(_3, protocol, domain2, path16, match) {
   let prefix = "";
   if (!previous(match)) {
     return false;
@@ -8472,7 +8475,7 @@ function findUrl(_3, protocol, domain2, path15, match) {
   if (!isCorrectDomain(domain2)) {
     return false;
   }
-  const parts = splitUrl(domain2 + path15);
+  const parts = splitUrl(domain2 + path16);
   if (!parts[0]) return false;
   const result2 = {
     type: "link",
@@ -20278,8 +20281,8 @@ function assertNonEmpty(part, name2) {
     throw new Error("`" + name2 + "` cannot be empty");
   }
 }
-function assertPath(path15, name2) {
-  if (!path15) {
+function assertPath(path16, name2) {
+  if (!path16) {
     throw new Error("Setting `" + name2 + "` requires `path` to be set too");
   }
 }
@@ -20465,13 +20468,13 @@ var init_lib21 = __esm({
        * @returns {undefined}
        *   Nothing.
        */
-      set path(path15) {
-        if (isUrl(path15)) {
-          path15 = fileURLToPath(path15);
+      set path(path16) {
+        if (isUrl(path16)) {
+          path16 = fileURLToPath(path16);
         }
-        assertNonEmpty(path15, "path");
-        if (this.path !== path15) {
-          this.history.push(path15);
+        assertNonEmpty(path16, "path");
+        if (this.path !== path16) {
+          this.history.push(path16);
         }
       }
       /**
@@ -22826,8 +22829,8 @@ var init_tap = __esm({
 });
 
 // node_modules/underscore/modules/toPath.js
-function toPath(path15) {
-  return isArray_default(path15) ? path15 : [path15];
+function toPath(path16) {
+  return isArray_default(path16) ? path16 : [path16];
 }
 var init_toPath = __esm({
   "node_modules/underscore/modules/toPath.js"() {
@@ -22839,8 +22842,8 @@ var init_toPath = __esm({
 });
 
 // node_modules/underscore/modules/_toPath.js
-function toPath2(path15) {
-  return _.toPath(path15);
+function toPath2(path16) {
+  return _.toPath(path16);
 }
 var init_toPath2 = __esm({
   "node_modules/underscore/modules/_toPath.js"() {
@@ -22851,11 +22854,11 @@ var init_toPath2 = __esm({
 });
 
 // node_modules/underscore/modules/_deepGet.js
-function deepGet(obj2, path15) {
-  var length3 = path15.length;
+function deepGet(obj2, path16) {
+  var length3 = path16.length;
   for (var i = 0; i < length3; i++) {
     if (obj2 == null) return void 0;
-    obj2 = obj2[path15[i]];
+    obj2 = obj2[path16[i]];
   }
   return length3 ? obj2 : void 0;
 }
@@ -22866,8 +22869,8 @@ var init_deepGet = __esm({
 });
 
 // node_modules/underscore/modules/get.js
-function get(object4, path15, defaultValue) {
-  var value = deepGet(object4, toPath2(path15));
+function get(object4, path16, defaultValue) {
+  var value = deepGet(object4, toPath2(path16));
   return isUndefined(value) ? defaultValue : value;
 }
 var init_get = __esm({
@@ -22880,11 +22883,11 @@ var init_get = __esm({
 });
 
 // node_modules/underscore/modules/has.js
-function has2(obj2, path15) {
-  path15 = toPath2(path15);
-  var length3 = path15.length;
+function has2(obj2, path16) {
+  path16 = toPath2(path16);
+  var length3 = path16.length;
   for (var i = 0; i < length3; i++) {
-    var key = path15[i];
+    var key = path16[i];
     if (!has(obj2, key)) return false;
     obj2 = obj2[key];
   }
@@ -22924,10 +22927,10 @@ var init_matcher = __esm({
 });
 
 // node_modules/underscore/modules/property.js
-function property(path15) {
-  path15 = toPath2(path15);
+function property(path16) {
+  path16 = toPath2(path16);
   return function(obj2) {
-    return deepGet(obj2, path15);
+    return deepGet(obj2, path16);
   };
 }
 var init_property = __esm({
@@ -23043,8 +23046,8 @@ var init_noop = __esm({
 // node_modules/underscore/modules/propertyOf.js
 function propertyOf(obj2) {
   if (obj2 == null) return noop;
-  return function(path15) {
-    return get(obj2, path15);
+  return function(path16) {
+    return get(obj2, path16);
   };
 }
 var init_propertyOf = __esm({
@@ -23249,14 +23252,14 @@ var init_template = __esm({
 });
 
 // node_modules/underscore/modules/result.js
-function result(obj2, path15, fallback) {
-  path15 = toPath2(path15);
-  var length3 = path15.length;
+function result(obj2, path16, fallback) {
+  path16 = toPath2(path16);
+  var length3 = path16.length;
   if (!length3) {
     return isFunction_default(fallback) ? fallback.call(obj2) : fallback;
   }
   for (var i = 0; i < length3; i++) {
-    var prop = obj2 == null ? void 0 : obj2[path15[i]];
+    var prop = obj2 == null ? void 0 : obj2[path16[i]];
     if (prop === void 0) {
       prop = fallback;
       i = length3;
@@ -23980,14 +23983,14 @@ var init_invoke = __esm({
     init_map2();
     init_deepGet();
     init_toPath2();
-    invoke_default = restArguments(function(obj2, path15, args2) {
+    invoke_default = restArguments(function(obj2, path16, args2) {
       var contextPath, func;
-      if (isFunction_default(path15)) {
-        func = path15;
+      if (isFunction_default(path16)) {
+        func = path16;
       } else {
-        path15 = toPath2(path15);
-        contextPath = path15.slice(0, -1);
-        path15 = path15[path15.length - 1];
+        path16 = toPath2(path16);
+        contextPath = path16.slice(0, -1);
+        path16 = path16[path16.length - 1];
       }
       return map4(obj2, function(context) {
         var method = func;
@@ -23996,7 +23999,7 @@ var init_invoke = __esm({
             context = deepGet(context, contextPath);
           }
           if (context == null) return void 0;
-          method = context[path15];
+          method = context[path16];
         }
         return method == null ? method : method.apply(context, args2);
       });
@@ -33514,8 +33517,8 @@ var require_utils = __commonJS({
       var result2 = transform2[inputType][outputType](input);
       return result2;
     };
-    exports3.resolve = function(path15) {
-      var parts = path15.split("/");
+    exports3.resolve = function(path16) {
+      var parts = path16.split("/");
       var result2 = [];
       for (var index2 = 0; index2 < parts.length; index2++) {
         var part = parts[index2];
@@ -39368,18 +39371,18 @@ var require_object = __commonJS({
       var object4 = new ZipObject(name2, zipObjectContent, o);
       this.files[name2] = object4;
     };
-    var parentFolder = function(path15) {
-      if (path15.slice(-1) === "/") {
-        path15 = path15.substring(0, path15.length - 1);
+    var parentFolder = function(path16) {
+      if (path16.slice(-1) === "/") {
+        path16 = path16.substring(0, path16.length - 1);
       }
-      var lastSlash = path15.lastIndexOf("/");
-      return lastSlash > 0 ? path15.substring(0, lastSlash) : "";
+      var lastSlash = path16.lastIndexOf("/");
+      return lastSlash > 0 ? path16.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path15) {
-      if (path15.slice(-1) !== "/") {
-        path15 += "/";
+    var forceTrailingSlash = function(path16) {
+      if (path16.slice(-1) !== "/") {
+        path16 += "/";
       }
-      return path15;
+      return path16;
     };
     var folderAdd = function(name2, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -40418,27 +40421,27 @@ var require_zipfile = __commonJS({
         };
       });
     }
-    function splitPath(path15) {
-      var lastIndex = path15.lastIndexOf("/");
+    function splitPath(path16) {
+      var lastIndex = path16.lastIndexOf("/");
       if (lastIndex === -1) {
-        return { dirname: "", basename: path15 };
+        return { dirname: "", basename: path16 };
       } else {
         return {
-          dirname: path15.substring(0, lastIndex),
-          basename: path15.substring(lastIndex + 1)
+          dirname: path16.substring(0, lastIndex),
+          basename: path16.substring(lastIndex + 1)
         };
       }
     }
     function joinPath() {
-      var nonEmptyPaths = Array.prototype.filter.call(arguments, function(path15) {
-        return path15;
+      var nonEmptyPaths = Array.prototype.filter.call(arguments, function(path16) {
+        return path16;
       });
       var relevantPaths = [];
-      nonEmptyPaths.forEach(function(path15) {
-        if (/^\//.test(path15)) {
-          relevantPaths = [path15];
+      nonEmptyPaths.forEach(function(path16) {
+        if (/^\//.test(path16)) {
+          relevantPaths = [path16];
         } else {
-          relevantPaths.push(path15);
+          relevantPaths.push(path16);
         }
       });
       return relevantPaths.join("/");
@@ -47762,9 +47765,9 @@ var require_office_xml_reader = __commonJS({
         return collapseAlternateContent(document4)[0];
       });
     }
-    function readXmlFromZipFile(docxFile, path15) {
-      if (docxFile.exists(path15)) {
-        return docxFile.read(path15, "utf-8").then(stripUtf8Bom).then(read);
+    function readXmlFromZipFile(docxFile, path16) {
+      if (docxFile.exists(path16)) {
+        return docxFile.read(path16, "utf-8").then(stripUtf8Bom).then(read);
       } else {
         return promises.resolve(null);
       }
@@ -49531,10 +49534,10 @@ var require_body_reader = __commonJS({
         }
       }
       function findEmbeddedImageFile(relationshipId) {
-        var path15 = uris.uriToZipEntryName("word", relationships.findTargetByRelationshipId(relationshipId));
+        var path16 = uris.uriToZipEntryName("word", relationships.findTargetByRelationshipId(relationshipId));
         return {
-          path: path15,
-          read: docxFile.read.bind(docxFile, path15)
+          path: path16,
+          read: docxFile.read.bind(docxFile, path16)
         };
       }
       function readImage(imageFile, altText) {
@@ -49774,12 +49777,12 @@ var require_content_types_reader = __commonJS({
     }
     function contentTypes(overrides, extensionDefaults) {
       return {
-        findContentType: function(path15) {
-          var overrideContentType = overrides[path15];
+        findContentType: function(path16) {
+          var overrideContentType = overrides[path16];
           if (overrideContentType) {
             return overrideContentType;
           } else {
-            var pathParts = path15.split(".");
+            var pathParts = path16.split(".");
             var extension2 = pathParts[pathParts.length - 1];
             if (extensionDefaults.hasOwnProperty(extension2)) {
               return extensionDefaults[extension2];
@@ -50026,12 +50029,12 @@ var require_comments_reader = __commonJS({
 var require_path_is_absolute = __commonJS({
   "node_modules/path-is-absolute/index.js"(exports3, module3) {
     "use strict";
-    function posix(path15) {
-      return path15.charAt(0) === "/";
+    function posix(path16) {
+      return path16.charAt(0) === "/";
     }
-    function win32(path15) {
+    function win32(path16) {
       var splitDeviceRe = /^([a-zA-Z]:|[\\\/]{2}[^\\\/]+[\\\/]+[^\\\/]+)?([\\\/])?([\s\S]*?)$/;
-      var result2 = splitDeviceRe.exec(path15);
+      var result2 = splitDeviceRe.exec(path16);
       var device = result2[1] || "";
       var isUnc = Boolean(device && device.charAt(1) !== ":");
       return Boolean(result2[2] || isUnc);
@@ -50046,7 +50049,7 @@ var require_path_is_absolute = __commonJS({
 var require_files = __commonJS({
   "node_modules/mammoth/lib/docx/files.js"(exports3) {
     "use strict";
-    var fs10 = __require("fs");
+    var fs11 = __require("fs");
     var url = __require("url");
     var os2 = __require("os");
     var dirname4 = __require("path").dirname;
@@ -50066,19 +50069,19 @@ var require_files = __commonJS({
       }
       var base = options.relativeToFile ? dirname4(options.relativeToFile) : null;
       function read(uri, encoding) {
-        return resolveUri(uri).then(function(path15) {
-          return readFile(path15, encoding).caught(function(error2) {
+        return resolveUri(uri).then(function(path16) {
+          return readFile(path16, encoding).caught(function(error2) {
             var message = "could not open external image: '" + uri + "' (document directory: '" + base + "')\n" + error2.message;
             return promises.reject(new Error(message));
           });
         });
       }
       function resolveUri(uri) {
-        var path15 = uriToPath(uri);
-        if (isAbsolutePath(path15)) {
-          return promises.resolve(path15);
+        var path16 = uriToPath(uri);
+        if (isAbsolutePath(path16)) {
+          return promises.resolve(path16);
         } else if (base) {
-          return promises.resolve(resolvePath(base, path15));
+          return promises.resolve(resolvePath(base, path16));
         } else {
           return promises.reject(new Error("could not find external image '" + uri + "', path of input document is unknown"));
         }
@@ -50087,18 +50090,18 @@ var require_files = __commonJS({
         read
       };
     }
-    var readFile = promises.promisify(fs10.readFile.bind(fs10));
+    var readFile = promises.promisify(fs11.readFile.bind(fs11));
     function uriToPath(uriString, platform) {
       if (!platform) {
         platform = os2.platform();
       }
       var uri = url.parse(uriString);
       if (isLocalFileUri(uri) || isRelativeUri(uri)) {
-        var path15 = decodeURIComponent(uri.path);
-        if (platform === "win32" && /^\/[a-z]:/i.test(path15)) {
-          return path15.slice(1);
+        var path16 = decodeURIComponent(uri.path);
+        if (platform === "win32" && /^\/[a-z]:/i.test(path16)) {
+          return path16.slice(1);
         } else {
-          return path15;
+          return path16;
         }
       } else {
         throw new Error("Could not convert URI to path: " + uriString);
@@ -50299,18 +50302,18 @@ var require_docx_reader = __commonJS({
       readElement: contentTypesReader.readContentTypesFromXml,
       defaultValue: contentTypesReader.defaultContentTypes
     });
-    function readNumberingFromZipFile(zipFile, path15, styles) {
+    function readNumberingFromZipFile(zipFile, path16, styles) {
       return xmlFileReader({
-        filename: path15,
+        filename: path16,
         readElement: function(element) {
           return numberingXml.readNumberingXml(element, { styles });
         },
         defaultValue: numberingXml.defaultNumbering
       })(zipFile);
     }
-    function readStylesFromZipFile(zipFile, path15) {
+    function readStylesFromZipFile(zipFile, path16) {
       return xmlFileReader({
-        filename: path15,
+        filename: path16,
         readElement: stylesReader.readStylesXml,
         defaultValue: stylesReader.defaultStyles
       })(zipFile);
@@ -50342,10 +50345,10 @@ var require_style_map = __commonJS({
       });
     }
     function updateRelationships(docxFile) {
-      var path15 = "word/_rels/document.xml.rels";
+      var path16 = "word/_rels/document.xml.rels";
       var relationshipsUri = "http://schemas.openxmlformats.org/package/2006/relationships";
       var relationshipElementName = "{" + relationshipsUri + "}Relationship";
-      return docxFile.read(path15, "utf8").then(xml.readString).then(function(relationshipsContainer) {
+      return docxFile.read(path16, "utf8").then(xml.readString).then(function(relationshipsContainer) {
         var relationships = relationshipsContainer.children;
         addOrUpdateElement(relationships, relationshipElementName, "Id", {
           "Id": "rMammothStyleMap",
@@ -50353,21 +50356,21 @@ var require_style_map = __commonJS({
           "Target": styleMapAbsolutePath
         });
         var namespaces = { "": relationshipsUri };
-        return docxFile.write(path15, xml.writeString(relationshipsContainer, namespaces));
+        return docxFile.write(path16, xml.writeString(relationshipsContainer, namespaces));
       });
     }
     function updateContentTypes(docxFile) {
-      var path15 = "[Content_Types].xml";
+      var path16 = "[Content_Types].xml";
       var contentTypesUri = "http://schemas.openxmlformats.org/package/2006/content-types";
       var overrideName = "{" + contentTypesUri + "}Override";
-      return docxFile.read(path15, "utf8").then(xml.readString).then(function(typesElement) {
+      return docxFile.read(path16, "utf8").then(xml.readString).then(function(typesElement) {
         var children = typesElement.children;
         addOrUpdateElement(children, overrideName, "PartName", {
           "PartName": styleMapAbsolutePath,
           "ContentType": "text/prs.mammoth.style-map"
         });
         var namespaces = { "": contentTypesUri };
-        return docxFile.write(path15, xml.writeString(typesElement, namespaces));
+        return docxFile.write(path16, xml.writeString(typesElement, namespaces));
       });
     }
     function addOrUpdateElement(elements, name2, identifyingAttribute, attributes) {
@@ -51064,9 +51067,9 @@ var require_document_to_html = __commonJS({
         };
         var paths = [];
         if (run2.highlight !== null) {
-          var path15 = findHtmlPath({ type: "highlight", color: run2.highlight });
-          if (path15) {
-            paths.push(path15);
+          var path16 = findHtmlPath({ type: "highlight", color: run2.highlight });
+          if (path16) {
+            paths.push(path16);
           }
         }
         if (run2.isSmallCaps) {
@@ -51101,15 +51104,15 @@ var require_document_to_html = __commonJS({
           messages.push(unrecognisedStyleWarning("run", run2));
         }
         paths.push(stylePath);
-        paths.forEach(function(path16) {
-          nodes = path16.wrap.bind(path16, nodes);
+        paths.forEach(function(path17) {
+          nodes = path17.wrap.bind(path17, nodes);
         });
         return nodes();
       }
       function findHtmlPathForRunProperty(elementType, defaultTagName) {
-        var path15 = findHtmlPath({ type: elementType });
-        if (path15) {
-          return path15;
+        var path16 = findHtmlPath({ type: elementType });
+        if (path16) {
+          return path16;
         } else if (defaultTagName) {
           return htmlPaths.element(defaultTagName, {}, { fresh: false });
         } else {
@@ -52829,11 +52832,11 @@ var require_options_reader = __commonJS({
 var require_unzip = __commonJS({
   "node_modules/mammoth/lib/unzip.js"(exports3) {
     "use strict";
-    var fs10 = __require("fs");
+    var fs11 = __require("fs");
     var promises = require_promises();
     var zipfile = require_zipfile();
     exports3.openZip = openZip;
-    var readFile = promises.promisify(fs10.readFile);
+    var readFile = promises.promisify(fs11.readFile);
     function openZip(options) {
       if (options.path) {
         return readFile(options.path).then(zipfile.openArrayBuffer);
@@ -56705,8 +56708,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params2) => {
-      const { data, path: path15, errorMaps, issueData } = params2;
-      const fullPath = [...path15, ...issueData.path || []];
+      const { data, path: path16, errorMaps, issueData } = params2;
+      const fullPath = [...path16, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -57017,11 +57020,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path15, key) {
+      constructor(parent, value, path16, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path15;
+        this._path = path16;
         this._key = key;
       }
       get path() {
@@ -63865,7 +63868,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net2 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash3 } = __require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash4 } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -64525,7 +64528,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -64892,7 +64895,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash3 } = __require("crypto");
+    var { createHash: createHash4 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -65193,7 +65196,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -67443,6 +67446,8 @@ function getOrCreateDocument(name2) {
 async function startHocuspocus(port) {
   hocuspocusInstance = new Hocuspocus({
     port,
+    // Hocuspocus always binds loopback — the MCP bind-host env var does not apply here.
+    // WebSocket collaboration traffic stays local-only per the Cowork architecture.
     address: "127.0.0.1",
     quiet: true,
     // stdout is the MCP wire — suppress the startup banner
@@ -86643,11 +86648,11 @@ var require_mime_types = __commonJS({
       }
       return exts[0];
     }
-    function lookup(path15) {
-      if (!path15 || typeof path15 !== "string") {
+    function lookup(path16) {
+      if (!path16 || typeof path16 !== "string") {
         return false;
       }
-      var extension3 = extname("x." + path15).toLowerCase().slice(1);
+      var extension3 = extname("x." + path16).toLowerCase().slice(1);
       if (!extension3) {
         return false;
       }
@@ -90121,13 +90126,13 @@ var require_view = __commonJS({
   "node_modules/express/lib/view.js"(exports3, module3) {
     "use strict";
     var debug = require_src()("express:view");
-    var path15 = __require("path");
-    var fs10 = __require("fs");
-    var dirname4 = path15.dirname;
-    var basename2 = path15.basename;
-    var extname = path15.extname;
-    var join4 = path15.join;
-    var resolve4 = path15.resolve;
+    var path16 = __require("path");
+    var fs11 = __require("fs");
+    var dirname4 = path16.dirname;
+    var basename2 = path16.basename;
+    var extname = path16.extname;
+    var join4 = path16.join;
+    var resolve4 = path16.resolve;
     module3.exports = View;
     function View(name2, options) {
       var opts = options || {};
@@ -90156,17 +90161,17 @@ var require_view = __commonJS({
       this.path = this.lookup(fileName);
     }
     View.prototype.lookup = function lookup(name2) {
-      var path16;
+      var path17;
       var roots = [].concat(this.root);
       debug('lookup "%s"', name2);
-      for (var i = 0; i < roots.length && !path16; i++) {
+      for (var i = 0; i < roots.length && !path17; i++) {
         var root3 = roots[i];
         var loc = resolve4(root3, name2);
         var dir = dirname4(loc);
         var file = basename2(loc);
-        path16 = this.resolve(dir, file);
+        path17 = this.resolve(dir, file);
       }
-      return path16;
+      return path17;
     };
     View.prototype.render = function render2(options, callback) {
       var sync = true;
@@ -90188,21 +90193,21 @@ var require_view = __commonJS({
     };
     View.prototype.resolve = function resolve5(dir, file) {
       var ext = this.ext;
-      var path16 = join4(dir, file);
-      var stat = tryStat(path16);
+      var path17 = join4(dir, file);
+      var stat = tryStat(path17);
       if (stat && stat.isFile()) {
-        return path16;
+        return path17;
       }
-      path16 = join4(dir, basename2(file, ext), "index" + ext);
-      stat = tryStat(path16);
+      path17 = join4(dir, basename2(file, ext), "index" + ext);
+      stat = tryStat(path17);
       if (stat && stat.isFile()) {
-        return path16;
+        return path17;
       }
     };
-    function tryStat(path16) {
-      debug('stat "%s"', path16);
+    function tryStat(path17) {
+      debug('stat "%s"', path17);
       try {
-        return fs10.statSync(path16);
+        return fs11.statSync(path17);
       } catch (e) {
         return void 0;
       }
@@ -90215,14 +90220,14 @@ var require_etag = __commonJS({
   "node_modules/etag/index.js"(exports3, module3) {
     "use strict";
     module3.exports = etag;
-    var crypto7 = __require("crypto");
+    var crypto8 = __require("crypto");
     var Stats = __require("fs").Stats;
     var toString3 = Object.prototype.toString;
     function entitytag(entity) {
       if (entity.length === 0) {
         return '"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"';
       }
-      var hash = crypto7.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
+      var hash = crypto8.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
       var len = typeof entity === "string" ? Buffer.byteLength(entity, "utf8") : entity.length;
       return '"' + len.toString(16) + "-" + hash + '"';
     }
@@ -91392,15 +91397,15 @@ var require_dist2 = __commonJS({
           if (token.type === endType)
             break;
           if (token.type === "char" || token.type === "escape") {
-            let path15 = token.value;
+            let path16 = token.value;
             let cur = tokens[pos];
             while (cur.type === "char" || cur.type === "escape") {
-              path15 += cur.value;
+              path16 += cur.value;
               cur = tokens[++pos];
             }
             output.push({
               type: "text",
-              value: encodePath(path15)
+              value: encodePath(path16)
             });
             continue;
           }
@@ -91424,16 +91429,16 @@ var require_dist2 = __commonJS({
       }
       return new TokenData(consumeUntil("end"), str);
     }
-    function compile(path15, options = {}) {
+    function compile(path16, options = {}) {
       const { encode = encodeURIComponent, delimiter = DEFAULT_DELIMITER } = options;
-      const data = typeof path15 === "object" ? path15 : parse4(path15, options);
+      const data = typeof path16 === "object" ? path16 : parse4(path16, options);
       const fn = tokensToFunction(data.tokens, delimiter, encode);
-      return function path16(params2 = {}) {
-        const [path17, ...missing] = fn(params2);
+      return function path17(params2 = {}) {
+        const [path18, ...missing] = fn(params2);
         if (missing.length) {
           throw new TypeError(`Missing parameters: ${missing.join(", ")}`);
         }
-        return path17;
+        return path18;
       };
     }
     function tokensToFunction(tokens, delimiter, encode) {
@@ -91489,9 +91494,9 @@ var require_dist2 = __commonJS({
         return [encodeValue(value)];
       };
     }
-    function match(path15, options = {}) {
+    function match(path16, options = {}) {
       const { decode: decode2 = decodeURIComponent, delimiter = DEFAULT_DELIMITER } = options;
-      const { regexp, keys: keys4 } = pathToRegexp(path15, options);
+      const { regexp, keys: keys4 } = pathToRegexp(path16, options);
       const decoders = keys4.map((key) => {
         if (decode2 === false)
           return NOOP_VALUE;
@@ -91503,7 +91508,7 @@ var require_dist2 = __commonJS({
         const m = regexp.exec(input);
         if (!m)
           return false;
-        const path16 = m[0];
+        const path17 = m[0];
         const params2 = /* @__PURE__ */ Object.create(null);
         for (let i = 1; i < m.length; i++) {
           if (m[i] === void 0)
@@ -91512,21 +91517,21 @@ var require_dist2 = __commonJS({
           const decoder = decoders[i - 1];
           params2[key.name] = decoder(m[i]);
         }
-        return { path: path16, params: params2 };
+        return { path: path17, params: params2 };
       };
     }
-    function pathToRegexp(path15, options = {}) {
+    function pathToRegexp(path16, options = {}) {
       const { delimiter = DEFAULT_DELIMITER, end = true, sensitive = false, trailing = true } = options;
       const root3 = new SourceNode("^");
-      const paths = [path15];
+      const paths = [path16];
       let combinations = 0;
       while (paths.length) {
-        const path16 = paths.shift();
-        if (Array.isArray(path16)) {
-          paths.push(...path16);
+        const path17 = paths.shift();
+        if (Array.isArray(path17)) {
+          paths.push(...path17);
           continue;
         }
-        const data = typeof path16 === "object" ? path16 : parse4(path16, options);
+        const data = typeof path17 === "object" ? path17 : parse4(path17, options);
         flatten3(data.tokens, 0, [], (tokens) => {
           if (combinations++ >= 256) {
             throw new PathError("Too many path combinations", data.originalPath);
@@ -91700,18 +91705,18 @@ var require_layer = __commonJS({
     var TRAILING_SLASH_REGEXP = /\/+$/;
     var MATCHING_GROUP_REGEXP = /\((?:\?<(.*?)>)?(?!\?)/g;
     module3.exports = Layer;
-    function Layer(path15, options, fn) {
+    function Layer(path16, options, fn) {
       if (!(this instanceof Layer)) {
-        return new Layer(path15, options, fn);
+        return new Layer(path16, options, fn);
       }
-      debug("new %o", path15);
+      debug("new %o", path16);
       const opts = options || {};
       this.handle = fn;
       this.keys = [];
       this.name = fn.name || "<anonymous>";
       this.params = void 0;
       this.path = void 0;
-      this.slash = path15 === "/" && opts.end === false;
+      this.slash = path16 === "/" && opts.end === false;
       function matcher2(_path) {
         if (_path instanceof RegExp) {
           const keys4 = [];
@@ -91750,7 +91755,7 @@ var require_layer = __commonJS({
           decode: decodeParam
         });
       }
-      this.matchers = Array.isArray(path15) ? path15.map(matcher2) : [matcher2(path15)];
+      this.matchers = Array.isArray(path16) ? path16.map(matcher2) : [matcher2(path16)];
     }
     Layer.prototype.handleError = function handleError(error2, req, res, next) {
       const fn = this.handle;
@@ -91790,9 +91795,9 @@ var require_layer = __commonJS({
         next(err);
       }
     };
-    Layer.prototype.match = function match(path15) {
+    Layer.prototype.match = function match(path16) {
       let match2;
-      if (path15 != null) {
+      if (path16 != null) {
         if (this.slash) {
           this.params = {};
           this.path = "";
@@ -91800,7 +91805,7 @@ var require_layer = __commonJS({
         }
         let i = 0;
         while (!match2 && i < this.matchers.length) {
-          match2 = this.matchers[i](path15);
+          match2 = this.matchers[i](path16);
           i++;
         }
       }
@@ -91828,13 +91833,13 @@ var require_layer = __commonJS({
         throw err;
       }
     }
-    function loosen(path15) {
-      if (path15 instanceof RegExp || path15 === "/") {
-        return path15;
+    function loosen(path16) {
+      if (path16 instanceof RegExp || path16 === "/") {
+        return path16;
       }
-      return Array.isArray(path15) ? path15.map(function(p) {
+      return Array.isArray(path16) ? path16.map(function(p) {
         return loosen(p);
-      }) : String(path15).replace(TRAILING_SLASH_REGEXP, "");
+      }) : String(path16).replace(TRAILING_SLASH_REGEXP, "");
     }
   }
 });
@@ -91850,9 +91855,9 @@ var require_route = __commonJS({
     var flatten3 = Array.prototype.flat;
     var methods = METHODS.map((method) => method.toLowerCase());
     module3.exports = Route;
-    function Route(path15) {
-      debug("new %o", path15);
-      this.path = path15;
+    function Route(path16) {
+      debug("new %o", path16);
+      this.path = path16;
       this.stack = [];
       this.methods = /* @__PURE__ */ Object.create(null);
     }
@@ -92060,8 +92065,8 @@ var require_router = __commonJS({
         if (++sync > 100) {
           return setImmediate(next, err);
         }
-        const path15 = getPathname(req);
-        if (path15 == null) {
+        const path16 = getPathname(req);
+        if (path16 == null) {
           return done(layerError);
         }
         let layer;
@@ -92069,7 +92074,7 @@ var require_router = __commonJS({
         let route;
         while (match !== true && idx < stack.length) {
           layer = stack[idx++];
-          match = matchLayer(layer, path15);
+          match = matchLayer(layer, path16);
           route = layer.route;
           if (typeof match !== "boolean") {
             layerError = layerError || match;
@@ -92107,18 +92112,18 @@ var require_router = __commonJS({
           } else if (route) {
             layer.handleRequest(req, res, next);
           } else {
-            trimPrefix(layer, layerError, layerPath, path15);
+            trimPrefix(layer, layerError, layerPath, path16);
           }
           sync = 0;
         });
       }
-      function trimPrefix(layer, layerError, layerPath, path15) {
+      function trimPrefix(layer, layerError, layerPath, path16) {
         if (layerPath.length !== 0) {
-          if (layerPath !== path15.substring(0, layerPath.length)) {
+          if (layerPath !== path16.substring(0, layerPath.length)) {
             next(layerError);
             return;
           }
-          const c = path15[layerPath.length];
+          const c = path16[layerPath.length];
           if (c && c !== "/") {
             next(layerError);
             return;
@@ -92142,7 +92147,7 @@ var require_router = __commonJS({
     };
     Router.prototype.use = function use(handler) {
       let offset = 0;
-      let path15 = "/";
+      let path16 = "/";
       if (typeof handler !== "function") {
         let arg = handler;
         while (Array.isArray(arg) && arg.length !== 0) {
@@ -92150,7 +92155,7 @@ var require_router = __commonJS({
         }
         if (typeof arg !== "function") {
           offset = 1;
-          path15 = handler;
+          path16 = handler;
         }
       }
       const callbacks = flatten3.call(slice2.call(arguments, offset), Infinity);
@@ -92162,8 +92167,8 @@ var require_router = __commonJS({
         if (typeof fn !== "function") {
           throw new TypeError("argument handler must be a function");
         }
-        debug("use %o %s", path15, fn.name || "<anonymous>");
-        const layer = new Layer(path15, {
+        debug("use %o %s", path16, fn.name || "<anonymous>");
+        const layer = new Layer(path16, {
           sensitive: this.caseSensitive,
           strict: false,
           end: false
@@ -92173,9 +92178,9 @@ var require_router = __commonJS({
       }
       return this;
     };
-    Router.prototype.route = function route(path15) {
-      const route2 = new Route(path15);
-      const layer = new Layer(path15, {
+    Router.prototype.route = function route(path16) {
+      const route2 = new Route(path16);
+      const layer = new Layer(path16, {
         sensitive: this.caseSensitive,
         strict: this.strict,
         end: true
@@ -92188,8 +92193,8 @@ var require_router = __commonJS({
       return route2;
     };
     methods.concat("all").forEach(function(method) {
-      Router.prototype[method] = function(path15) {
-        const route = this.route(path15);
+      Router.prototype[method] = function(path16) {
+        const route = this.route(path16);
         route[method].apply(route, slice2.call(arguments, 1));
         return this;
       };
@@ -92218,9 +92223,9 @@ var require_router = __commonJS({
       const fqdnIndex = url.substring(0, pathLength).indexOf("://");
       return fqdnIndex !== -1 ? url.substring(0, url.indexOf("/", 3 + fqdnIndex)) : void 0;
     }
-    function matchLayer(layer, path15) {
+    function matchLayer(layer, path16) {
       try {
-        return layer.match(path15);
+        return layer.match(path16);
       } catch (err) {
         return err;
       }
@@ -92448,7 +92453,7 @@ var require_application = __commonJS({
     };
     app.use = function use(fn) {
       var offset = 0;
-      var path15 = "/";
+      var path16 = "/";
       if (typeof fn !== "function") {
         var arg = fn;
         while (Array.isArray(arg) && arg.length !== 0) {
@@ -92456,7 +92461,7 @@ var require_application = __commonJS({
         }
         if (typeof arg !== "function") {
           offset = 1;
-          path15 = fn;
+          path16 = fn;
         }
       }
       var fns = flatten3.call(slice2.call(arguments, offset), Infinity);
@@ -92466,12 +92471,12 @@ var require_application = __commonJS({
       var router = this.router;
       fns.forEach(function(fn2) {
         if (!fn2 || !fn2.handle || !fn2.set) {
-          return router.use(path15, fn2);
+          return router.use(path16, fn2);
         }
-        debug(".use app under %s", path15);
-        fn2.mountpath = path15;
+        debug(".use app under %s", path16);
+        fn2.mountpath = path16;
         fn2.parent = this;
-        router.use(path15, function mounted_app(req, res, next) {
+        router.use(path16, function mounted_app(req, res, next) {
           var orig = req.app;
           fn2.handle(req, res, function(err) {
             Object.setPrototypeOf(req, orig.request);
@@ -92483,8 +92488,8 @@ var require_application = __commonJS({
       }, this);
       return this;
     };
-    app.route = function route(path15) {
-      return this.router.route(path15);
+    app.route = function route(path16) {
+      return this.router.route(path16);
     };
     app.engine = function engine(ext, fn) {
       if (typeof fn !== "function") {
@@ -92527,7 +92532,7 @@ var require_application = __commonJS({
       }
       return this;
     };
-    app.path = function path15() {
+    app.path = function path16() {
       return this.parent ? this.parent.path() + this.mountpath : "";
     };
     app.enabled = function enabled(setting) {
@@ -92543,17 +92548,17 @@ var require_application = __commonJS({
       return this.set(setting, false);
     };
     methods.forEach(function(method) {
-      app[method] = function(path15) {
+      app[method] = function(path16) {
         if (method === "get" && arguments.length === 1) {
-          return this.set(path15);
+          return this.set(path16);
         }
-        var route = this.route(path15);
+        var route = this.route(path16);
         route[method].apply(route, slice2.call(arguments, 1));
         return this;
       };
     });
-    app.all = function all3(path15) {
-      var route = this.route(path15);
+    app.all = function all3(path16) {
+      var route = this.route(path16);
       var args2 = slice2.call(arguments, 1);
       for (var i = 0; i < methods.length; i++) {
         route[methods[i]].apply(route, args2);
@@ -93370,7 +93375,7 @@ var require_request = __commonJS({
   "node_modules/express/lib/request.js"(exports3, module3) {
     "use strict";
     var accepts = require_accepts();
-    var isIP = __require("net").isIP;
+    var isIP2 = __require("net").isIP;
     var typeis = require_type_is();
     var http = __require("http");
     var fresh = require_fresh();
@@ -93460,10 +93465,10 @@ var require_request = __commonJS({
       var hostname2 = this.hostname;
       if (!hostname2) return [];
       var offset = this.app.get("subdomain offset");
-      var subdomains2 = !isIP(hostname2) ? hostname2.split(".").reverse() : [hostname2];
+      var subdomains2 = !isIP2(hostname2) ? hostname2.split(".").reverse() : [hostname2];
       return subdomains2.slice(offset);
     });
-    defineGetter(req, "path", function path15() {
+    defineGetter(req, "path", function path16() {
       return parse4(this).pathname;
     });
     defineGetter(req, "host", function host() {
@@ -93680,17 +93685,17 @@ var require_content_disposition = __commonJS({
 var require_cookie_signature = __commonJS({
   "node_modules/cookie-signature/index.js"(exports3) {
     "use strict";
-    var crypto7 = __require("crypto");
+    var crypto8 = __require("crypto");
     exports3.sign = function(val, secret) {
       if ("string" != typeof val) throw new TypeError("Cookie value must be provided as a string.");
       if (null == secret) throw new TypeError("Secret key must be provided.");
-      return val + "." + crypto7.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
+      return val + "." + crypto8.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
     };
     exports3.unsign = function(input, secret) {
       if ("string" != typeof input) throw new TypeError("Signed cookie string must be provided.");
       if (null == secret) throw new TypeError("Secret key must be provided.");
       var tentativeValue = input.slice(0, input.lastIndexOf(".")), expectedInput = exports3.sign(tentativeValue, secret), expectedBuffer = Buffer.from(expectedInput), inputBuffer = Buffer.from(input);
-      return expectedBuffer.length === inputBuffer.length && crypto7.timingSafeEqual(expectedBuffer, inputBuffer) ? tentativeValue : false;
+      return expectedBuffer.length === inputBuffer.length && crypto8.timingSafeEqual(expectedBuffer, inputBuffer) ? tentativeValue : false;
     };
   }
 });
@@ -93871,32 +93876,32 @@ var require_send = __commonJS({
     var escapeHtml = require_escape_html();
     var etag = require_etag();
     var fresh = require_fresh();
-    var fs10 = __require("fs");
+    var fs11 = __require("fs");
     var mime = require_mime_types();
     var ms = require_ms();
     var onFinished = require_on_finished();
     var parseRange = require_range_parser();
-    var path15 = __require("path");
+    var path16 = __require("path");
     var statuses = require_statuses();
     var Stream = __require("stream");
     var util2 = __require("util");
-    var extname = path15.extname;
-    var join4 = path15.join;
-    var normalize = path15.normalize;
-    var resolve4 = path15.resolve;
-    var sep = path15.sep;
+    var extname = path16.extname;
+    var join4 = path16.join;
+    var normalize = path16.normalize;
+    var resolve4 = path16.resolve;
+    var sep = path16.sep;
     var BYTES_RANGE_REGEXP = /^ *bytes=/;
     var MAX_MAXAGE = 60 * 60 * 24 * 365 * 1e3;
     var UP_PATH_REGEXP = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
     module3.exports = send;
-    function send(req, path16, options) {
-      return new SendStream(req, path16, options);
+    function send(req, path17, options) {
+      return new SendStream(req, path17, options);
     }
-    function SendStream(req, path16, options) {
+    function SendStream(req, path17, options) {
       Stream.call(this);
       var opts = options || {};
       this.options = opts;
-      this.path = path16;
+      this.path = path17;
       this.req = req;
       this._acceptRanges = opts.acceptRanges !== void 0 ? Boolean(opts.acceptRanges) : true;
       this._cacheControl = opts.cacheControl !== void 0 ? Boolean(opts.cacheControl) : true;
@@ -94010,10 +94015,10 @@ var require_send = __commonJS({
       var lastModified = this.res.getHeader("Last-Modified");
       return parseHttpDate(lastModified) <= parseHttpDate(ifRange);
     };
-    SendStream.prototype.redirect = function redirect(path16) {
+    SendStream.prototype.redirect = function redirect(path17) {
       var res = this.res;
       if (hasListeners(this, "directory")) {
-        this.emit("directory", res, path16);
+        this.emit("directory", res, path17);
         return;
       }
       if (this.hasTrailingSlash()) {
@@ -94033,38 +94038,38 @@ var require_send = __commonJS({
     SendStream.prototype.pipe = function pipe2(res) {
       var root3 = this._root;
       this.res = res;
-      var path16 = decode2(this.path);
-      if (path16 === -1) {
+      var path17 = decode2(this.path);
+      if (path17 === -1) {
         this.error(400);
         return res;
       }
-      if (~path16.indexOf("\0")) {
+      if (~path17.indexOf("\0")) {
         this.error(400);
         return res;
       }
       var parts;
       if (root3 !== null) {
-        if (path16) {
-          path16 = normalize("." + sep + path16);
+        if (path17) {
+          path17 = normalize("." + sep + path17);
         }
-        if (UP_PATH_REGEXP.test(path16)) {
-          debug('malicious path "%s"', path16);
+        if (UP_PATH_REGEXP.test(path17)) {
+          debug('malicious path "%s"', path17);
           this.error(403);
           return res;
         }
-        parts = path16.split(sep);
-        path16 = normalize(join4(root3, path16));
+        parts = path17.split(sep);
+        path17 = normalize(join4(root3, path17));
       } else {
-        if (UP_PATH_REGEXP.test(path16)) {
-          debug('malicious path "%s"', path16);
+        if (UP_PATH_REGEXP.test(path17)) {
+          debug('malicious path "%s"', path17);
           this.error(403);
           return res;
         }
-        parts = normalize(path16).split(sep);
-        path16 = resolve4(path16);
+        parts = normalize(path17).split(sep);
+        path17 = resolve4(path17);
       }
       if (containsDotFile(parts)) {
-        debug('%s dotfile "%s"', this._dotfiles, path16);
+        debug('%s dotfile "%s"', this._dotfiles, path17);
         switch (this._dotfiles) {
           case "allow":
             break;
@@ -94078,13 +94083,13 @@ var require_send = __commonJS({
         }
       }
       if (this._index.length && this.hasTrailingSlash()) {
-        this.sendIndex(path16);
+        this.sendIndex(path17);
         return res;
       }
-      this.sendFile(path16);
+      this.sendFile(path17);
       return res;
     };
-    SendStream.prototype.send = function send2(path16, stat) {
+    SendStream.prototype.send = function send2(path17, stat) {
       var len = stat.size;
       var options = this.options;
       var opts = {};
@@ -94096,9 +94101,9 @@ var require_send = __commonJS({
         this.headersAlreadySent();
         return;
       }
-      debug('pipe "%s"', path16);
-      this.setHeader(path16, stat);
-      this.type(path16);
+      debug('pipe "%s"', path17);
+      this.setHeader(path17, stat);
+      this.type(path17);
       if (this.isConditionalGET()) {
         if (this.isPreconditionFailure()) {
           this.error(412);
@@ -94147,30 +94152,30 @@ var require_send = __commonJS({
         res.end();
         return;
       }
-      this.stream(path16, opts);
+      this.stream(path17, opts);
     };
-    SendStream.prototype.sendFile = function sendFile(path16) {
+    SendStream.prototype.sendFile = function sendFile(path17) {
       var i = 0;
       var self2 = this;
-      debug('stat "%s"', path16);
-      fs10.stat(path16, function onstat(err, stat) {
-        var pathEndsWithSep = path16[path16.length - 1] === sep;
-        if (err && err.code === "ENOENT" && !extname(path16) && !pathEndsWithSep) {
+      debug('stat "%s"', path17);
+      fs11.stat(path17, function onstat(err, stat) {
+        var pathEndsWithSep = path17[path17.length - 1] === sep;
+        if (err && err.code === "ENOENT" && !extname(path17) && !pathEndsWithSep) {
           return next(err);
         }
         if (err) return self2.onStatError(err);
-        if (stat.isDirectory()) return self2.redirect(path16);
+        if (stat.isDirectory()) return self2.redirect(path17);
         if (pathEndsWithSep) return self2.error(404);
-        self2.emit("file", path16, stat);
-        self2.send(path16, stat);
+        self2.emit("file", path17, stat);
+        self2.send(path17, stat);
       });
       function next(err) {
         if (self2._extensions.length <= i) {
           return err ? self2.onStatError(err) : self2.error(404);
         }
-        var p = path16 + "." + self2._extensions[i++];
+        var p = path17 + "." + self2._extensions[i++];
         debug('stat "%s"', p);
-        fs10.stat(p, function(err2, stat) {
+        fs11.stat(p, function(err2, stat) {
           if (err2) return next(err2);
           if (stat.isDirectory()) return next();
           self2.emit("file", p, stat);
@@ -94178,7 +94183,7 @@ var require_send = __commonJS({
         });
       }
     };
-    SendStream.prototype.sendIndex = function sendIndex(path16) {
+    SendStream.prototype.sendIndex = function sendIndex(path17) {
       var i = -1;
       var self2 = this;
       function next(err) {
@@ -94186,9 +94191,9 @@ var require_send = __commonJS({
           if (err) return self2.onStatError(err);
           return self2.error(404);
         }
-        var p = join4(path16, self2._index[i]);
+        var p = join4(path17, self2._index[i]);
         debug('stat "%s"', p);
-        fs10.stat(p, function(err2, stat) {
+        fs11.stat(p, function(err2, stat) {
           if (err2) return next(err2);
           if (stat.isDirectory()) return next();
           self2.emit("file", p, stat);
@@ -94197,10 +94202,10 @@ var require_send = __commonJS({
       }
       next();
     };
-    SendStream.prototype.stream = function stream(path16, options) {
+    SendStream.prototype.stream = function stream(path17, options) {
       var self2 = this;
       var res = this.res;
-      var stream2 = fs10.createReadStream(path16, options);
+      var stream2 = fs11.createReadStream(path17, options);
       this.emit("stream", stream2);
       stream2.pipe(res);
       function cleanup() {
@@ -94215,17 +94220,17 @@ var require_send = __commonJS({
         self2.emit("end");
       });
     };
-    SendStream.prototype.type = function type2(path16) {
+    SendStream.prototype.type = function type2(path17) {
       var res = this.res;
       if (res.getHeader("Content-Type")) return;
-      var ext = extname(path16);
+      var ext = extname(path17);
       var type3 = mime.contentType(ext) || "application/octet-stream";
       debug("content-type %s", type3);
       res.setHeader("Content-Type", type3);
     };
-    SendStream.prototype.setHeader = function setHeader(path16, stat) {
+    SendStream.prototype.setHeader = function setHeader(path17, stat) {
       var res = this.res;
-      this.emit("headers", res, path16, stat);
+      this.emit("headers", res, path17, stat);
       if (this._acceptRanges && !res.getHeader("Accept-Ranges")) {
         debug("accept ranges");
         res.setHeader("Accept-Ranges", "bytes");
@@ -94283,9 +94288,9 @@ var require_send = __commonJS({
       }
       return err instanceof Error ? createError(status, err, { expose: false }) : createError(status, err);
     }
-    function decode2(path16) {
+    function decode2(path17) {
       try {
-        return decodeURIComponent(path16);
+        return decodeURIComponent(path17);
       } catch (err) {
         return -1;
       }
@@ -94429,7 +94434,7 @@ var require_response = __commonJS({
     var http = __require("http");
     var onFinished = require_on_finished();
     var mime = require_mime_types();
-    var path15 = __require("path");
+    var path16 = __require("path");
     var pathIsAbsolute = __require("path").isAbsolute;
     var statuses = require_statuses();
     var sign = require_cookie_signature().sign;
@@ -94438,8 +94443,8 @@ var require_response = __commonJS({
     var setCharset = require_utils4().setCharset;
     var cookie = require_cookie();
     var send = require_send();
-    var extname = path15.extname;
-    var resolve4 = path15.resolve;
+    var extname = path16.extname;
+    var resolve4 = path16.resolve;
     var vary = require_vary();
     var { Buffer: Buffer2 } = __require("buffer");
     var res = Object.create(http.ServerResponse.prototype);
@@ -94585,26 +94590,26 @@ var require_response = __commonJS({
       this.type("txt");
       return this.send(body);
     };
-    res.sendFile = function sendFile(path16, options, callback) {
+    res.sendFile = function sendFile(path17, options, callback) {
       var done = callback;
       var req = this.req;
       var res2 = this;
       var next = req.next;
       var opts = options || {};
-      if (!path16) {
+      if (!path17) {
         throw new TypeError("path argument is required to res.sendFile");
       }
-      if (typeof path16 !== "string") {
+      if (typeof path17 !== "string") {
         throw new TypeError("path must be a string to res.sendFile");
       }
       if (typeof options === "function") {
         done = options;
         opts = {};
       }
-      if (!opts.root && !pathIsAbsolute(path16)) {
+      if (!opts.root && !pathIsAbsolute(path17)) {
         throw new TypeError("path must be absolute or specify root to res.sendFile");
       }
-      var pathname = encodeURI(path16);
+      var pathname = encodeURI(path17);
       opts.etag = this.app.enabled("etag");
       var file = send(req, pathname, opts);
       sendfile(res2, file, opts, function(err) {
@@ -94615,7 +94620,7 @@ var require_response = __commonJS({
         }
       });
     };
-    res.download = function download(path16, filename, options, callback) {
+    res.download = function download(path17, filename, options, callback) {
       var done = callback;
       var name2 = filename;
       var opts = options || null;
@@ -94632,7 +94637,7 @@ var require_response = __commonJS({
         opts = filename;
       }
       var headers = {
-        "Content-Disposition": contentDisposition(name2 || path16)
+        "Content-Disposition": contentDisposition(name2 || path17)
       };
       if (opts && opts.headers) {
         var keys4 = Object.keys(opts.headers);
@@ -94645,7 +94650,7 @@ var require_response = __commonJS({
       }
       opts = Object.create(opts);
       opts.headers = headers;
-      var fullPath = !opts.root ? resolve4(path16) : path16;
+      var fullPath = !opts.root ? resolve4(path17) : path17;
       return this.sendFile(fullPath, opts, done);
     };
     res.contentType = res.type = function contentType(type2) {
@@ -94928,11 +94933,11 @@ var require_serve_static = __commonJS({
         }
         var forwardError = !fallthrough;
         var originalUrl = parseUrl.original(req);
-        var path15 = parseUrl(req).pathname;
-        if (path15 === "/" && originalUrl.pathname.substr(-1) !== "/") {
-          path15 = "";
+        var path16 = parseUrl(req).pathname;
+        if (path16 === "/" && originalUrl.pathname.substr(-1) !== "/") {
+          path16 = "";
         }
-        var stream = send(req, path15, opts);
+        var stream = send(req, path16, opts);
         stream.on("directory", onDirectory);
         if (setHeaders) {
           stream.on("headers", setHeaders);
@@ -98232,8 +98237,8 @@ var require_utils5 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path15) {
-      let input = path15;
+    function removeDotSegments(path16) {
+      let input = path16;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -98432,8 +98437,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path15, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path15 && path15 !== "/" ? path15 : void 0;
+        const [path16, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path16 && path16 !== "/" ? path16 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -98740,7 +98745,7 @@ var require_fast_uri = __commonJS({
         query: void 0,
         fragment: void 0
       };
-      let isIP = false;
+      let isIP2 = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
           uri = options.scheme + ":" + uri;
@@ -98765,9 +98770,9 @@ var require_fast_uri = __commonJS({
           if (ipv4result === false) {
             const ipv6result = normalizeIPv6(parsed.host);
             parsed.host = ipv6result.host.toLowerCase();
-            isIP = ipv6result.isIPV6;
+            isIP2 = ipv6result.isIPV6;
           } else {
-            isIP = true;
+            isIP2 = true;
           }
         }
         if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
@@ -98784,7 +98789,7 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed.host)) {
             try {
               parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
             } catch (e) {
@@ -101795,12 +101800,12 @@ var require_dist3 = __commonJS({
         throw new Error(`Unknown format "${name2}"`);
       return f;
     };
-    function addFormats(ajv, list4, fs10, exportName) {
+    function addFormats(ajv, list4, fs11, exportName) {
       var _a;
       var _b;
       (_a = (_b = ajv.opts.code).formats) !== null && _a !== void 0 ? _a : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list4)
-        ajv.addFormat(f, fs10[f]);
+        ajv.addFormat(f, fs11[f]);
     }
     module3.exports = exports3 = formatsPlugin;
     Object.defineProperty(exports3, "__esModule", { value: true });
@@ -101900,9 +101905,159 @@ var init_launcher = __esm({
 // src/server/index.ts
 init_constants();
 init_store();
-import path14 from "path";
+import { isIP } from "net";
+import path15 from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
+// src/server/auth/token-store.ts
+init_env_paths();
+init_constants();
+import crypto6 from "crypto";
+import fs8 from "fs";
+import path12 from "path";
+function getTokenFilePath() {
+  return path12.join(envPaths("tandem", { suffix: "" }).data, TOKEN_FILE_NAME);
+}
+async function readTokenFromFile() {
+  const filePath = getTokenFilePath();
+  try {
+    const content3 = await fs8.promises.readFile(filePath, "utf8");
+    if (process.platform !== "win32") {
+      try {
+        const stat = await fs8.promises.stat(filePath);
+        if ((stat.mode & 63) !== 0) {
+          console.error("[tandem] auth token file has insecure permissions; attempting chmod 0600");
+          await fs8.promises.chmod(filePath, 384);
+        }
+      } catch {
+      }
+    }
+    const trimmed = content3.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+async function writeTokenToFile(token) {
+  const filePath = getTokenFilePath();
+  const dir = path12.dirname(filePath);
+  await fs8.promises.mkdir(dir, { recursive: true });
+  if (process.platform === "win32") {
+    const localAppData = process.env.LOCALAPPDATA;
+    if (localAppData) {
+      const normalizedDir = path12.resolve(dir).toLowerCase();
+      const normalizedLocal = path12.resolve(localAppData).toLowerCase();
+      if (!normalizedDir.startsWith(normalizedLocal)) {
+        console.warn(
+          `[Tandem] auth token dir is outside %LOCALAPPDATA% (${dir}); NTFS ACL inheritance may not restrict access to current user`
+        );
+      }
+    }
+  }
+  let fh;
+  try {
+    fh = await fs8.promises.open(filePath, "wx", 384);
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      const existing = await readTokenFromFile();
+      if (existing) return existing;
+      fh = await fs8.promises.open(filePath, "w");
+    } else {
+      throw err;
+    }
+  }
+  try {
+    await fh.writeFile(token, "utf8");
+  } finally {
+    await fh.close();
+  }
+  if (process.platform !== "win32") {
+    await fs8.promises.chmod(filePath, 384);
+  }
+  return token;
+}
+async function loadOrCreateToken() {
+  const envToken = process.env.TANDEM_AUTH_TOKEN;
+  if (envToken && envToken.trim().length > 0) {
+    console.error("[Tandem] auth token loaded from env");
+    return envToken.trim();
+  }
+  const existing = await readTokenFromFile();
+  if (existing) {
+    console.error("[Tandem] auth token loaded from file");
+    return existing;
+  }
+  let raw;
+  try {
+    raw = crypto6.randomBytes(32);
+  } catch (err) {
+    console.error("[Tandem] FATAL: crypto.randomBytes failed:", err);
+    process.exit(1);
+  }
+  const token = raw.toString("base64url");
+  try {
+    const written = await writeTokenToFile(token);
+    console.error("[Tandem] auth token written to file");
+    return written;
+  } catch (err) {
+    console.error("[Tandem] FATAL: cannot write auth token:", err);
+    process.exit(1);
+  }
+}
+
+// src/server/bind-check.ts
+import { networkInterfaces as osNetworkInterfaces } from "os";
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1"]);
+function isNonLoopback(bindHost) {
+  return !LOOPBACK_HOSTS.has(bindHost);
+}
+function checkBindConfig(opts) {
+  const { bindHost, port, authToken, allowUnauthLAN, lanIP } = opts;
+  if (!isNonLoopback(bindHost)) {
+    return { ok: true };
+  }
+  if (!authToken && !allowUnauthLAN) {
+    return {
+      ok: false,
+      exitCode: 1,
+      stderrMessage: `[tandem] Refusing to bind on ${bindHost}:${port} without an auth token.
+Set TANDEM_ALLOW_UNAUTHENTICATED_LAN=1 to explicitly opt in to insecure mode,
+or run \`tandem setup\` (CLI) / launch Tauri once to provision a token.
+`
+    };
+  }
+  const isWildcard = bindHost === "0.0.0.0" || bindHost === "::";
+  const getInterfaces = opts.networkInterfaces ?? osNetworkInterfaces;
+  let detectedIPs = [];
+  let resolvedLanIP;
+  if (isWildcard) {
+    const ifaceMap = getInterfaces();
+    detectedIPs = Object.values(ifaceMap).flat().filter(
+      (iface) => !!iface && iface.family === "IPv4" && !iface.internal
+    ).map((i) => i.address);
+    if (detectedIPs.length > 1 && !lanIP) {
+      return {
+        ok: false,
+        exitCode: 1,
+        stderrMessage: `[tandem] Multiple non-internal IPv4 addresses detected: ${detectedIPs.join(", ")}.
+Set TANDEM_LAN_IP=<address> to specify which address to advertise.
+`,
+        detectedIPs
+      };
+    }
+    resolvedLanIP = lanIP ?? detectedIPs[0];
+  } else {
+    resolvedLanIP = bindHost;
+  }
+  let lanWarning;
+  if (authToken) {
+    lanWarning = `[tandem] WARNING: Tandem is listening on ${bindHost}:${port}. Tokens and document content transit unencrypted; do not use on untrusted networks (public Wi-Fi, shared LAN).
+`;
+  }
+  return { ok: true, lanWarning, resolvedLanIP, detectedIPs };
+}
+
 // src/server/error-filter.ts
 function isKnownHocuspocusError(err) {
   if (!(err instanceof Error)) return false;
@@ -102195,10 +102350,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj2, path15) {
-  if (!path15)
+function getElementAtPath(obj2, path16) {
+  if (!path16)
     return obj2;
-  return path15.reduce((acc, key) => acc?.[key], obj2);
+  return path16.reduce((acc, key) => acc?.[key], obj2);
 }
 function promiseAllObject(promisesObj) {
   const keys4 = Object.keys(promisesObj);
@@ -102518,11 +102673,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path15, issues) {
+function prefixIssues(path16, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path15);
+    iss.path.unshift(path16);
     return iss;
   });
 }
@@ -112153,7 +112308,7 @@ var StdioServerTransport = class {
 import { Http2ServerRequest as Http2ServerRequest2, constants as h2constants } from "http2";
 import { Http2ServerRequest } from "http2";
 import { Readable } from "stream";
-import crypto6 from "crypto";
+import crypto7 from "crypto";
 var RequestError = class extends Error {
   constructor(message, options) {
     super(message, options);
@@ -112470,7 +112625,7 @@ var buildOutgoingHttpHeaders = (headers) => {
 };
 var X_ALREADY_SENT = "x-hono-already-sent";
 if (typeof global.crypto === "undefined") {
-  global.crypto = crypto6;
+  global.crypto = crypto7;
 }
 var outgoingEnded = /* @__PURE__ */ Symbol("outgoingEnded");
 var incomingDraining = /* @__PURE__ */ Symbol("incomingDraining");
@@ -113453,9 +113608,149 @@ var StreamableHTTPServerTransport = class {
 };
 
 // src/server/mcp/server.ts
+init_constants();
 import { randomUUID as randomUUID6 } from "crypto";
 import { createRequire } from "module";
 
+// src/server/auth/middleware.ts
+import { createHash as createHash3, timingSafeEqual } from "crypto";
+var _previousToken;
+function setPreviousToken(token, ttlMs = 6e4) {
+  _previousToken = { value: token, expiresAt: Date.now() + ttlMs };
+}
+function getPreviousToken() {
+  if (!_previousToken) return void 0;
+  if (Date.now() >= _previousToken.expiresAt) {
+    _previousToken = void 0;
+    return void 0;
+  }
+  return _previousToken;
+}
+var RATE_LIMIT_WINDOW_MS = 10 * 60 * 1e3;
+var RATE_LIMIT_MAX_FAILURES = 5;
+var RATE_LIMIT_MAX_ENTRIES = 1e3;
+function rateLimitKey(addr) {
+  if (!addr.includes(":")) return addr;
+  const bare = addr.split("%")[0];
+  const v4mapped = bare.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+  if (v4mapped) return v4mapped[1];
+  if (bare.includes("::")) {
+    const [left, right] = bare.split("::");
+    const head = left ? left.split(":") : [];
+    const tail = right ? right.split(":") : [];
+    const fill = Array(8 - head.length - tail.length).fill("0");
+    const full = [...head, ...fill, ...tail];
+    return full.slice(0, 4).join(":");
+  }
+  return addr.split(":").slice(0, 4).join(":");
+}
+var RateLimiter = class {
+  failures = /* @__PURE__ */ new Map();
+  /** Returns true if the address is over the rate limit. Always call before the token compare. */
+  isOverLimit(addr) {
+    const key = rateLimitKey(addr);
+    const now = Date.now();
+    const entry = this.failures.get(key);
+    if (!entry) return false;
+    if (now - entry.windowStart > RATE_LIMIT_WINDOW_MS) {
+      this.failures.delete(key);
+      return false;
+    }
+    return entry.count >= RATE_LIMIT_MAX_FAILURES;
+  }
+  /** Record a failure for the given address. */
+  recordFailure(addr) {
+    const key = rateLimitKey(addr);
+    const now = Date.now();
+    const existing = this.failures.get(key);
+    if (existing && now - existing.windowStart <= RATE_LIMIT_WINDOW_MS) {
+      existing.count += 1;
+    } else {
+      if (this.failures.size >= RATE_LIMIT_MAX_ENTRIES) {
+        const firstKey = this.failures.keys().next().value;
+        if (firstKey !== void 0) this.failures.delete(firstKey);
+      }
+      this.failures.set(key, { count: 1, windowStart: now });
+    }
+  }
+  /** Reset failures on successful auth. */
+  reset(addr) {
+    this.failures.delete(rateLimitKey(addr));
+  }
+};
+function normalizeAddress(addr) {
+  if (addr === "::1") return "127.0.0.1";
+  if (addr === "::ffff:127.0.0.1") return "127.0.0.1";
+  return addr;
+}
+function isLoopback(remoteAddress) {
+  if (remoteAddress === void 0) return false;
+  return normalizeAddress(remoteAddress) === "127.0.0.1";
+}
+function sha256(s) {
+  return createHash3("sha256").update(s, "utf8").digest();
+}
+function createAuthMiddleware(getToken) {
+  const limiter = new RateLimiter();
+  return (req, res, next) => {
+    const addr = req.socket.remoteAddress;
+    if (isLoopback(addr)) {
+      next();
+      return;
+    }
+    const normalizedAddr = addr !== void 0 ? normalizeAddress(addr) : "<unknown>";
+    if (limiter.isOverLimit(normalizedAddr)) {
+      res.status(429).json({ error: "Too Many Requests" });
+      return;
+    }
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+      limiter.recordFailure(normalizedAddr);
+      console.error(`[tandem] auth: rejected request from ${normalizedAddr} (no/bad token header)`);
+      res.status(401).json({ error: "Unauthorized" });
+      return;
+    }
+    const presented = authHeader.slice("Bearer ".length);
+    if (!presented) {
+      limiter.recordFailure(normalizedAddr);
+      console.error(`[tandem] auth: rejected request from ${normalizedAddr} (no/bad token header)`);
+      res.status(401).json({ error: "Unauthorized" });
+      return;
+    }
+    const storedToken = getToken();
+    if (!storedToken) {
+      limiter.recordFailure(normalizedAddr);
+      console.error(`[tandem] auth: rejected request from ${normalizedAddr} (no server token)`);
+      res.status(401).json({ error: "Unauthorized" });
+      return;
+    }
+    const presentedDigest = sha256(presented);
+    function digestsMatch(candidate) {
+      const candidateDigest = sha256(candidate);
+      try {
+        return timingSafeEqual(candidateDigest, presentedDigest);
+      } catch {
+        return false;
+      }
+    }
+    let match = digestsMatch(storedToken);
+    if (!match) {
+      const prev = getPreviousToken();
+      if (prev) {
+        match = digestsMatch(prev.value);
+      }
+    }
+    if (!match) {
+      limiter.recordFailure(normalizedAddr);
+      console.error(`[tandem] auth: rejected request from ${normalizedAddr} (invalid token)`);
+      res.status(401).json({ error: "Unauthorized" });
+      return;
+    }
+    limiter.reset(normalizedAddr);
+    next();
+  };
+}
+
 // src/server/open-browser.ts
 import { execFile } from "child_process";
 function openBrowser(url) {
@@ -113505,14 +113800,20 @@ var PACKAGE_ROOT = resolve3(__dirname2, "../..");
 var CHANNEL_DIST = resolve3(PACKAGE_ROOT, "dist/channel/index.js");
 var MCP_URL = `http://localhost:${DEFAULT_MCP_PORT}`;
 function buildMcpEntries(channelPath, opts = {}) {
-  const entries = {
-    tandem: { type: "http", url: `${MCP_URL}/mcp` }
-  };
+  const tandemEntry = { type: "http", url: `${MCP_URL}/mcp` };
+  if (opts.token) {
+    tandemEntry.headers = { Authorization: `Bearer ${opts.token}` };
+  }
+  const entries = { tandem: tandemEntry };
   if (opts.withChannelShim) {
+    const shimEnv = { TANDEM_URL: MCP_URL };
+    if (opts.token) {
+      shimEnv.TANDEM_AUTH_TOKEN = opts.token;
+    }
     entries["tandem-channel"] = {
       command: opts.nodeBinary ?? "node",
       args: [channelPath],
-      env: { TANDEM_URL: MCP_URL }
+      env: shimEnv
     };
   }
   return entries;
@@ -113626,8 +113927,8 @@ init_annotations();
 init_document_model();
 init_document_service();
 init_response();
-import fs8 from "fs/promises";
-import path12 from "path";
+import fs9 from "fs/promises";
+import path13 from "path";
 async function applyChangesCore(documentId, author, backupPath) {
   const r = requireDocument(documentId);
   if (!r) throw Object.assign(new Error("No document is open."), { code: "NO_DOCUMENT" });
@@ -113646,7 +113947,7 @@ async function applyChangesCore(documentId, author, backupPath) {
     });
   }
   if (backupPath) {
-    const resolvedBp = path12.resolve(backupPath);
+    const resolvedBp = path13.resolve(backupPath);
     if (process.platform === "win32" && (resolvedBp.startsWith("\\\\") || resolvedBp.startsWith("//"))) {
       throw Object.assign(new Error("UNC paths are not supported for security reasons."), {
         code: "INVALID_PATH"
@@ -113702,21 +114003,21 @@ async function applyChangesCore(documentId, author, backupPath) {
     throw Object.assign(new Error("No accepted suggestions to apply."), { code: "NO_SUGGESTIONS" });
   }
   const ydocFlatText = extractText(ydoc);
-  const buffer3 = await fs8.readFile(filePath);
+  const buffer3 = await fs9.readFile(filePath);
   const result2 = await applyTrackedChanges(buffer3, suggestions, {
     author: author ?? "Tandem Review",
     ydocFlatText
   });
   let resolvedBackup = backupPath ?? filePath.replace(/\.docx$/i, ".backup.docx");
   try {
-    await fs8.access(resolvedBackup);
-    const ext = path12.extname(resolvedBackup);
+    await fs9.access(resolvedBackup);
+    const ext = path13.extname(resolvedBackup);
     const base = resolvedBackup.slice(0, -ext.length);
     resolvedBackup = `${base}-${Date.now()}${ext}`;
   } catch {
   }
-  await fs8.copyFile(filePath, resolvedBackup);
-  const [origStat, backupStat] = await Promise.all([fs8.stat(filePath), fs8.stat(resolvedBackup)]);
+  await fs9.copyFile(filePath, resolvedBackup);
+  const [origStat, backupStat] = await Promise.all([fs9.stat(filePath), fs9.stat(resolvedBackup)]);
   if (origStat.size !== backupStat.size) {
     throw Object.assign(new Error("Backup verification failed: file sizes do not match."), {
       code: "BACKUP_FAILED"
@@ -113771,23 +114072,23 @@ function registerApplyTools(server) {
       const { filePath } = r;
       const backupPath = filePath.replace(/\.docx$/i, ".backup.docx");
       try {
-        await fs8.access(backupPath);
+        await fs9.access(backupPath);
       } catch (err) {
         if (err.code === "ENOENT") {
           return mcpError("FILE_NOT_FOUND", `No backup file found at ${backupPath}`);
         }
         throw err;
       }
-      await fs8.copyFile(backupPath, filePath);
+      await fs9.copyFile(backupPath, filePath);
       const [backupStat, restoredStat] = await Promise.all([
-        fs8.stat(backupPath),
-        fs8.stat(filePath)
+        fs9.stat(backupPath),
+        fs9.stat(filePath)
       ]);
       if (backupStat.size !== restoredStat.size) {
         throw new Error("Restore verification failed: file sizes do not match.");
       }
       return mcpSuccess({
-        message: `Restored ${path12.basename(filePath)} from backup.`,
+        message: `Restored ${path13.basename(filePath)} from backup.`,
         restoredFrom: backupPath
       });
     })
@@ -113796,9 +114097,12 @@ function registerApplyTools(server) {
 
 // src/server/mcp/api-routes.ts
 init_file_opener();
-function isHostAllowed(host) {
+function isHostAllowed(host, extraHosts = []) {
   const reqHost = (host ?? "").split(":")[0];
-  return reqHost === "localhost" || reqHost === "127.0.0.1" || reqHost === TAURI_HOSTNAME;
+  if (reqHost === "localhost" || reqHost === "127.0.0.1" || reqHost === TAURI_HOSTNAME) {
+    return true;
+  }
+  return extraHosts.includes(reqHost);
 }
 function escapeRegExp2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -113829,7 +114133,7 @@ function isValidChannelPath(channelPath) {
   if (hasUncPrefix(channelPath)) return false;
   return true;
 }
-async function runSetupHandler(input, homeOverride) {
+async function runSetupHandler(input, homeOverride, token) {
   const { nodeBinary, channelPath } = input;
   if (!nodeBinary || typeof nodeBinary !== "string") {
     return { status: 400, body: { error: "BAD_REQUEST", message: "nodeBinary is required" } };
@@ -113853,7 +114157,7 @@ async function runSetupHandler(input, homeOverride) {
     };
   }
   const targets = detectTargets({ homeOverride });
-  const entries = buildMcpEntries(channelPath, { withChannelShim: true, nodeBinary });
+  const entries = buildMcpEntries(channelPath, { withChannelShim: true, nodeBinary, token });
   const configured = [];
   const errors = [];
   for (const target of targets) {
@@ -113908,21 +114212,24 @@ function errorCodeToHttpStatus(code3) {
       return 500;
   }
 }
-function apiMiddleware(req, res, next) {
-  if (!isHostAllowed(req.headers.host)) {
-    res.status(403).json({ error: "FORBIDDEN", message: "Host not allowed." });
-    return;
-  }
-  const origin = req.headers.origin;
-  res.header("Access-Control-Allow-Origin", isLocalhostOrigin(origin) ? origin : "null");
-  res.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-  res.header("Access-Control-Allow-Headers", "Content-Type");
-  if (req.method === "OPTIONS") {
-    res.sendStatus(204);
-    return;
-  }
-  next();
+function createApiMiddleware(extraHosts = []) {
+  return function apiMiddlewareFn(req, res, next) {
+    if (!isHostAllowed(req.headers.host, extraHosts)) {
+      res.status(403).json({ error: "FORBIDDEN", message: "Host not allowed." });
+      return;
+    }
+    const origin = req.headers.origin;
+    res.header("Access-Control-Allow-Origin", isLocalhostOrigin(origin) ? origin : "null");
+    res.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.header("Access-Control-Allow-Headers", "Content-Type");
+    if (req.method === "OPTIONS") {
+      res.sendStatus(204);
+      return;
+    }
+    next();
+  };
 }
+var apiMiddleware = createApiMiddleware();
 function errorCodeToLabel(code3) {
   switch (code3) {
     case "ENOENT":
@@ -113997,10 +114304,11 @@ function notifyStreamHandler(req, res) {
   });
   console.error("[NotifyStream] Client connected to /api/notify-stream");
 }
-function registerApiRoutes(app, largeBody) {
-  app.get("/api/notify-stream", apiMiddleware, notifyStreamHandler);
-  app.options("/api/open", apiMiddleware);
-  app.post("/api/open", apiMiddleware, largeBody, async (req, res) => {
+function registerApiRoutes(app, largeBody, token, mw = apiMiddleware, setCurrentToken = () => {
+}, getCurrentToken = () => null) {
+  app.get("/api/notify-stream", mw, notifyStreamHandler);
+  app.options("/api/open", mw);
+  app.post("/api/open", mw, largeBody, async (req, res) => {
     const { filePath, force } = req.body ?? {};
     if (!filePath || typeof filePath !== "string") {
       res.status(400).json({ error: "BAD_REQUEST", message: "filePath is required" });
@@ -114013,8 +114321,8 @@ function registerApiRoutes(app, largeBody) {
       sendApiError(res, err);
     }
   });
-  app.options("/api/close", apiMiddleware);
-  app.post("/api/close", apiMiddleware, largeBody, async (req, res) => {
+  app.options("/api/close", mw);
+  app.post("/api/close", mw, largeBody, async (req, res) => {
     const { documentId } = req.body ?? {};
     if (!documentId || typeof documentId !== "string") {
       res.status(400).json({ error: "BAD_REQUEST", message: "documentId is required" });
@@ -114033,8 +114341,8 @@ function registerApiRoutes(app, largeBody) {
       sendApiError(res, err);
     }
   });
-  app.options("/api/save", apiMiddleware);
-  app.post("/api/save", apiMiddleware, largeBody, async (req, res) => {
+  app.options("/api/save", mw);
+  app.post("/api/save", mw, largeBody, async (req, res) => {
     const { documentId } = req.body ?? {};
     if (documentId !== void 0 && typeof documentId !== "string") {
       res.status(400).json({ error: "BAD_REQUEST", message: "documentId must be a string" });
@@ -114052,8 +114360,8 @@ function registerApiRoutes(app, largeBody) {
       sendApiError(res, err);
     }
   });
-  app.options("/api/upload", apiMiddleware);
-  app.post("/api/upload", apiMiddleware, largeBody, async (req, res) => {
+  app.options("/api/upload", mw);
+  app.post("/api/upload", mw, largeBody, async (req, res) => {
     const { fileName, content: content3 } = req.body ?? {};
     if (!fileName || typeof fileName !== "string") {
       res.status(400).json({ error: "BAD_REQUEST", message: "fileName is required" });
@@ -114076,8 +114384,8 @@ function registerApiRoutes(app, largeBody) {
       sendApiError(res, err);
     }
   });
-  app.options("/api/convert", apiMiddleware);
-  app.post("/api/convert", apiMiddleware, largeBody, async (req, res) => {
+  app.options("/api/convert", mw);
+  app.post("/api/convert", mw, largeBody, async (req, res) => {
     const { documentId, outputPath } = req.body ?? {};
     if (documentId !== void 0 && typeof documentId !== "string") {
       res.status(400).json({ error: "BAD_REQUEST", message: "documentId must be a string" });
@@ -114097,14 +114405,14 @@ function registerApiRoutes(app, largeBody) {
       sendApiError(res, err);
     }
   });
-  app.get("/api/mode", apiMiddleware, (_req, res) => {
+  app.get("/api/mode", mw, (_req, res) => {
     const ctrlDoc = getOrCreateDocument(CTRL_ROOM);
     const awareness = ctrlDoc.getMap(Y_MAP_USER_AWARENESS);
     const mode = TandemModeSchema.catch(TANDEM_MODE_DEFAULT).parse(awareness.get(Y_MAP_MODE));
     res.json({ mode });
   });
-  app.options("/api/apply-changes", apiMiddleware);
-  app.post("/api/apply-changes", apiMiddleware, largeBody, async (req, res) => {
+  app.options("/api/apply-changes", mw);
+  app.post("/api/apply-changes", mw, largeBody, async (req, res) => {
     const { documentId, author, backupPath } = req.body ?? {};
     if (documentId !== void 0 && typeof documentId !== "string") {
       res.status(400).json({ error: "BAD_REQUEST", message: "documentId must be a string" });
@@ -114129,10 +114437,14 @@ function registerApiRoutes(app, largeBody) {
       sendApiError(res, err);
     }
   });
-  app.options("/api/setup", apiMiddleware);
-  app.post("/api/setup", apiMiddleware, largeBody, async (req, res) => {
+  app.options("/api/setup", mw);
+  app.post("/api/setup", mw, largeBody, async (req, res) => {
     try {
-      const result2 = await runSetupHandler(req.body ?? {});
+      const result2 = await runSetupHandler(
+        req.body ?? {},
+        void 0,
+        token
+      );
       res.status(result2.status).json(result2.body);
     } catch (err) {
       console.error("[Tandem] Setup handler threw:", err);
@@ -114142,8 +114454,8 @@ function registerApiRoutes(app, largeBody) {
       });
     }
   });
-  app.options("/api/annotation-reply", apiMiddleware);
-  app.post("/api/annotation-reply", apiMiddleware, largeBody, (req, res) => {
+  app.options("/api/annotation-reply", mw);
+  app.post("/api/annotation-reply", mw, largeBody, (req, res) => {
     const { annotationId, text: text5, documentId } = req.body ?? {};
     if (!annotationId || typeof annotationId !== "string") {
       res.status(400).json({ error: "BAD_REQUEST", message: "annotationId is required" });
@@ -114176,6 +114488,32 @@ function registerApiRoutes(app, largeBody) {
     }
     res.json({ data: { replyId: result2.replyId, annotationId } });
   });
+  app.options("/api/rotate-token", mw);
+  app.post("/api/rotate-token", mw, largeBody, async (_req, res) => {
+    if (process.env.TANDEM_AUTH_TOKEN) {
+      res.status(409).json({ error: "Token is managed by Tauri; rotate via the app." });
+      return;
+    }
+    const oldToken = getCurrentToken();
+    let newToken;
+    try {
+      newToken = await readTokenFromFile();
+    } catch (err) {
+      console.error("[tandem] rotate-token: failed to read new token from disk:", err);
+      res.status(500).json({ error: "INTERNAL", message: "Could not read new token from disk." });
+      return;
+    }
+    if (!newToken) {
+      res.status(500).json({ error: "INTERNAL", message: "No token found on disk after rotation." });
+      return;
+    }
+    if (oldToken) {
+      setPreviousToken(oldToken, 6e4);
+    }
+    setCurrentToken(newToken);
+    console.error("[tandem] auth token rotated; 60-second grace window active for old token");
+    res.json({ ok: true });
+  });
 }
 
 // src/server/mcp/awareness.ts
@@ -114769,12 +115107,16 @@ async function startMcpServerStdio() {
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }
-async function startMcpServerHttp(port, host = "127.0.0.1") {
+async function startMcpServerHttp(port, host = DEFAULT_BIND_HOST, token, resolvedLanIP) {
   mcpServer = createMcpServer();
   const { default: express2 } = await Promise.resolve().then(() => __toESM(require_express2(), 1));
   const app = express2();
+  const tokenRef = { current: token ?? null };
+  const authMiddleware = createAuthMiddleware(() => tokenRef.current);
+  const lanAwareApiMiddleware = resolvedLanIP ? createApiMiddleware([resolvedLanIP]) : apiMiddleware;
   const largeBody = express2.json({ limit: "70mb" });
-  const mcpApp = createMcpExpressApp({ host });
+  const allowedHosts = resolvedLanIP ? ["127.0.0.1", "localhost", "[::1]", resolvedLanIP, TAURI_HOSTNAME] : void 0;
+  const mcpApp = createMcpExpressApp({ host, ...allowedHosts ? { allowedHosts } : {} });
   mcpApp.post("/mcp", async (req, res) => {
     const body = req.body;
     const isInit = isInitializeRequest(body) || Array.isArray(body) && body.some(isInitializeRequest);
@@ -114809,16 +115151,21 @@ async function startMcpServerHttp(port, host = "127.0.0.1") {
     await currentTransport.handleRequest(req, res, req.body);
     currentTransport = null;
   });
+  app.use("/mcp", authMiddleware);
+  app.use("/api", authMiddleware);
   app.get(
     "/health",
-    apiMiddleware,
-    (_req, res) => {
-      res.json({
+    lanAwareApiMiddleware,
+    (req, res) => {
+      const body = {
         status: "ok",
         version: APP_VERSION,
-        transport: "http",
-        hasSession: currentTransport !== null
-      });
+        transport: "http"
+      };
+      if (isLoopback(req.socket.remoteAddress)) {
+        body.hasSession = currentTransport !== null;
+      }
+      res.json(body);
     }
   );
   app.get(
@@ -114827,7 +115174,8 @@ async function startMcpServerHttp(port, host = "127.0.0.1") {
       res.header("Access-Control-Allow-Origin", "*");
       res.json({
         resource: `http://localhost:${port}/mcp`,
-        bearer_methods_supported: []
+        bearer_methods_supported: ["header"],
+        authorization_servers: [`http://localhost:${port}`]
       });
     }
   );
@@ -114837,13 +115185,23 @@ async function startMcpServerHttp(port, host = "127.0.0.1") {
       res.header("Access-Control-Allow-Origin", "*");
       res.json({
         resource: `http://localhost:${port}/mcp`,
-        bearer_methods_supported: []
+        bearer_methods_supported: ["header"],
+        authorization_servers: [`http://localhost:${port}`]
       });
     }
   );
   app.use(mcpApp);
-  registerApiRoutes(app, largeBody);
-  registerChannelRoutes(app, apiMiddleware);
+  registerApiRoutes(
+    app,
+    largeBody,
+    token,
+    lanAwareApiMiddleware,
+    (newToken) => {
+      tokenRef.current = newToken;
+    },
+    () => tokenRef.current
+  );
+  registerChannelRoutes(app, lanAwareApiMiddleware);
   if (existsSync2(CLIENT_DIST)) {
     app.use(express2.static(CLIENT_DIST, { index: "index.html" }));
     const indexPath = join3(CLIENT_DIST, "index.html");
@@ -114958,12 +115316,12 @@ init_platform();
 init_manager();
 
 // src/server/version-check.ts
-import fs9 from "fs/promises";
-import path13 from "path";
+import fs10 from "fs/promises";
+import path14 from "path";
 async function checkVersionChange(currentVersion, versionFilePath) {
   let storedVersion = null;
   try {
-    storedVersion = (await fs9.readFile(versionFilePath, "utf-8")).trim();
+    storedVersion = (await fs10.readFile(versionFilePath, "utf-8")).trim();
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error("[Tandem] Failed to read last-seen-version:", err);
@@ -114971,8 +115329,8 @@ async function checkVersionChange(currentVersion, versionFilePath) {
   }
   const result2 = storedVersion === null ? "first-install" : storedVersion === currentVersion ? "current" : "upgraded";
   if (result2 !== "current") {
-    await fs9.mkdir(path13.dirname(versionFilePath), { recursive: true });
-    await fs9.writeFile(versionFilePath, currentVersion, "utf-8");
+    await fs10.mkdir(path14.dirname(versionFilePath), { recursive: true });
+    await fs10.writeFile(versionFilePath, currentVersion, "utf-8");
   }
   return result2;
 }
@@ -115121,6 +115479,43 @@ async function main2() {
       detachObservers(docName);
     }
   );
+  const bindHost = process.env.TANDEM_BIND_HOST ?? DEFAULT_BIND_HOST;
+  const LOOPBACK_AND_WILDCARD = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "0.0.0.0", "::"]);
+  if (!LOOPBACK_AND_WILDCARD.has(bindHost) && isIP(bindHost) === 0) {
+    process.stderr.write(
+      `[tandem] TANDEM_BIND_HOST="${bindHost}" is not a valid IP address. Exiting.
+`
+    );
+    process.exit(1);
+  }
+  const lanIP = process.env.TANDEM_LAN_IP || void 0;
+  if (lanIP && isIP(lanIP) === 0) {
+    process.stderr.write(`[tandem] TANDEM_LAN_IP="${lanIP}" is not a valid IP address. Exiting.
+`);
+    process.exit(1);
+  }
+  const existingToken = process.env.TANDEM_AUTH_TOKEN || await readTokenFromFile();
+  const bindCheck = checkBindConfig({
+    bindHost,
+    port: mcpPort,
+    authToken: existingToken,
+    // Fix 3: Only treat the env var as truthy when it equals exactly "1".
+    allowUnauthLAN: process.env[TANDEM_ALLOW_UNAUTHENTICATED_LAN_ENV] === "1",
+    lanIP
+  });
+  if (!bindCheck.ok) {
+    process.stderr.write(bindCheck.stderrMessage ?? "");
+    process.exit(bindCheck.exitCode ?? 1);
+  }
+  const authToken = await loadOrCreateToken();
+  if (bindCheck.lanWarning) {
+    process.stderr.write(bindCheck.lanWarning);
+  }
+  if (isNonLoopback(bindHost) && bindCheck.detectedIPs && bindCheck.detectedIPs.length === 1) {
+    process.stderr.write(`[tandem] Detected LAN interface: ${bindCheck.detectedIPs[0]}
+`);
+  }
+  const resolvedLanIP = bindCheck.resolvedLanIP;
   if (transportMode === "http") {
     freePort(wsPort);
     freePort(mcpPort);
@@ -115129,11 +115524,11 @@ async function main2() {
     } catch (err) {
       console.error(`[Tandem] ${err instanceof Error ? err.message : err} \u2014 proceeding anyway`);
     }
-    const projectRoot = path14.resolve(path14.dirname(fileURLToPath5(import.meta.url)), "../..");
+    const projectRoot = path15.resolve(path15.dirname(fileURLToPath5(import.meta.url)), "../..");
     try {
       const versionStatus = await checkVersionChange(APP_VERSION, LAST_SEEN_VERSION_FILE);
       if (versionStatus === "upgraded") {
-        await openFileByPath(path14.join(projectRoot, "CHANGELOG.md"));
+        await openFileByPath(path15.join(projectRoot, "CHANGELOG.md"));
         console.error(`[Tandem] Opened CHANGELOG.md (upgraded to v${APP_VERSION})`);
       }
     } catch (err) {
@@ -115141,7 +115536,7 @@ async function main2() {
     }
     if (docCount() === 0 && !process.env.TANDEM_NO_SAMPLE) {
       const sampleBase = process.env.TANDEM_DATA_DIR || projectRoot;
-      const samplePath = path14.join(sampleBase, "sample/welcome.md");
+      const samplePath = path15.join(sampleBase, "sample/welcome.md");
       try {
         await openFileByPath(samplePath);
         try {
@@ -115159,7 +115554,7 @@ async function main2() {
       }
     }
     const [srv] = await Promise.all([
-      startMcpServerHttp(mcpPort),
+      startMcpServerHttp(mcpPort, bindHost, authToken, resolvedLanIP),
       startHocuspocus(wsPort).then(() => {
         console.error(`[Tandem] Hocuspocus WebSocket server running on ws://localhost:${wsPort}`);
       })