tide-commander 1.140.0 → 1.141.0

package/dist/assets/{web-Bp9InB_8.js → web-B0Nj3gOp.js}

@@ -1 +1 @@
-import{cQ as t}from"./main-CAmYbJhQ.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};
+import{cQ as t}from"./main-CAE1L3Sb.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};

package/dist/assets/{web-BV4UqfvW.js → web-B5mCc_qm.js}

@@ -1 +1 @@
-import{cQ as a}from"./main-CAmYbJhQ.js";import{ImpactStyle as i,NotificationType as r}from"./index-BEjvvTvd.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};
+import{cQ as a}from"./main-CAE1L3Sb.js";import{ImpactStyle as i,NotificationType as r}from"./index-YDzuES6L.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};

package/dist/assets/{web-Cbif1aIk.js → web-CaEzTKao.js}

@@ -1 +1 @@
-import{cQ as s}from"./main-CAmYbJhQ.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};
+import{cQ as s}from"./main-CAE1L3Sb.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};

package/dist/index.html

@@ -22,10 +22,10 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/assets/icons/favicon-16x16.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="/assets/icons/apple-touch-icon.png" />
     <title>Tide Commander</title>
-    <script type="module" crossorigin src="/assets/main-CAmYbJhQ.js"></script>
+    <script type="module" crossorigin src="/assets/main-CAE1L3Sb.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-react--Eh9ivFN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-three-Chj50gSY.js">
-    <link rel="stylesheet" crossorigin href="/assets/main-DYAzUs5m.css">
+    <link rel="stylesheet" crossorigin href="/assets/main-BCym1dpG.css">
   </head>
   <body>
     <div id="app"></div>

package/dist/src/packages/server/data/builtin-skills/create-building.js

@@ -47,7 +47,7 @@ ${BT}name${BT}, ${BT}type${BT}, and ${BT}position${BT} are always required. Styl
 ${BT3}typescript
 {
   name: string,                                       // Display name
-  type: 'server'|'link'|'database'|'docker'|'monitor'|'folder'|'boss'|'terminal'|'tests',
+  type: 'server'|'link'|'database'|'docker'|'monitor'|'folder'|'boss'|'terminal'|'tests'|'http',
   position: { x: number, z: number },
   style?: 'server-rack'|'tower'|'dome'|'pyramid'|'desktop'
         | 'filing-cabinet'|'satellite'|'crystal'|'factory'|'command-center',
@@ -58,7 +58,7 @@ ${BT3}typescript
   docker?: { ... },                                   // Docker type — see below
   database?: { connections: [...] },                  // Database type
   terminal?: { ... },                                 // Terminal type
-  folderPath?: string,                                // Folder + tests types — required
+  folderPath?: string,                                // Folder + tests + http types — required
   urls?: [{ label, url }],                            // Link type — required
   commands?: { start, stop, restart, healthCheck, logs },  // Non-PM2 server custom commands
   subordinateBuildingIds?: string[],                  // Boss type
@@ -221,6 +221,11 @@ Requires ${BT}ttyd${BT} installed; ${BT}saveSession: true${BT} also needs ${BT}t
 - ${BT}{"name":"Docs","type":"link","style":"tower","position":{"x":10,"z":0},"urls":[{"label":"Internal Wiki","url":"https://wiki.example.com"}]}${BT}
 - ${BT}{"name":"Host Metrics","type":"monitor","style":"satellite","position":{"x":12,"z":4}}${BT}
 
+### Tests / HTTP requests
+
+- Tests browser (scan + run a folder's test suite): ${BT}{"name":"Core Tests","type":"tests","style":"dome","position":{"x":6,"z":3},"folderPath":"/home/user/projects/core"}${BT}
+- HTTP request tests (IntelliJ-style .http file runner; picks up ${BT}http-client.env.json${BT} / ${BT}http-client.private.env.json${BT} environments in the folder): ${BT}{"name":"Core API Requests","type":"http","style":"satellite","position":{"x":7,"z":3},"folderPath":"/home/user/projects/core/http-requests"}${BT}
+
 ### Boss
 
 Subordinates must already exist — get their IDs from ${BT}GET /api/buildings${BT} first.

package/dist/src/packages/server/data/builtin-skills/http-requests.js

@@ -0,0 +1,51 @@
+export const httpRequests = {
+    slug: 'http-requests',
+    name: 'HTTP Request Tests',
+    description: 'Browse and fire IntelliJ-style .http request files via the Tide Commander http-requests API; results render as rich cards in the terminal (method, status, timing, body preview).',
+    allowedTools: ['Bash(curl:*)', 'Bash(jq:*)'],
+    // Not assigned to anyone by default — enable it per agent/class in the Skills panel.
+    assignedAgentClasses: [],
+    content: `# HTTP Request Tests
+
+Run requests from IntelliJ-style \`.http\` / \`.rest\` files through \`/api/http-requests/*\` (never by hand-crafting the HTTP call yourself) so each result is persisted to the building's history and renders as a **rich card** in the user's terminal — method, status pill, timing, size and a body preview instead of raw JSON.
+
+Use this when asked to fire/test HTTP requests from a project's \`.http\` files, smoke-test API endpoints defined there, or report on past request runs. The folder usually comes from an \`http\`-type building — find it with \`GET /api/buildings\` (look for \`"type":"http"\`, use its \`folderPath\`).
+
+All calls use the API Calling Convention scaffolding (host, \`-H "X-Auth-Token: ..."\`). No exclamation marks in commands.
+
+## 1. Scan — list files, requests and environments
+
+\`POST /api/http-requests/scan\`
+\`\`\`json
+{"path":"/abs/path/to/http-folder"}
+\`\`\`
+Returns every parsed file with its requests (0-based \`index\`, \`name\`, \`method\`, \`url\`, \`variables\`) plus \`environments\` (from \`http-client.env.json\` / \`http-client.private.env.json\`) and \`envFiles\`. Pipe through \`jq\` to keep it short, e.g. \`jq '{environments, files: [.files[] | {relFile, requests: [.requests[] | {index, name, method}]}]}'\`.
+
+## 2. Run one request
+
+\`POST /api/http-requests/run\`
+\`\`\`json
+{"agentId":"YOUR_AGENT_ID","path":"/abs/path/to/http-folder","relFile":"payment-order.http","requestIndex":2,"env":"dev"}
+\`\`\`
+- \`agentId\` (IMPORTANT) — your agent ID from the system prompt. With it, a live card appears in the user's terminal under your curl the moment the request fires (spinner → method/status/time/body, with Re-run and copy-curl buttons). Without it, nothing renders.
+- \`requestIndex\` — the request's 0-based \`index\` from the scan.
+- \`env\` (optional but usually required) — environment name for \`{{variable}}\` resolution; omit only when the file has no variables. \`unresolvedVariables\` in the response tells you what was missing.
+
+Synchronous: the response IS the result (\`ok\`, \`status\`, \`timeMs\`, \`sizeBytes\`, \`headers\`, \`body\`, resolved \`request\`, \`runId\`). 60s timeout, 2 MB body cap.
+
+Silence the response with \`-o /dev/null\` if you don't need to inspect it (the card already shows everything to the user), or print it as-is (plain \`curl -s\`, no jq filter) — printed run JSON also renders as a card. To READ a field yourself, fetch \`GET /runs/RUN_ID\` afterwards and jq that.
+
+## 3. Run several / "run all in a file"
+
+Run each request as its OWN curl command (one Bash call per request, agentId included) so every run gets its own live card in the terminal. Avoid shell for-loops — a loop is a single Bash line, so only the last run's card would attach to it. Do not parallelize.
+
+## 4. History
+
+\`GET /api/http-requests/history?folder=/abs/path&limit=20\` — recent executed requests for that folder (newest first). Printing this JSON also renders as a card (compact list of runs). \`GET /api/http-requests/runs/RUN_ID\` returns one stored run with the full request/response detail.
+
+## Rules
+- A non-2xx status or \`"ok":false\` (connection refused, timeout) is a **normal result to report**, not an API error — summarize which requests passed/failed and why.
+- Prefer the building's configured folder; for ad-hoc paths anything under the home directory works.
+- Requests hit real endpoints. Fire GETs freely; for POST/PUT/PATCH/DELETE against non-test systems, confirm with the user first unless they explicitly asked.
+- After a batch, finish with a short written summary (counts + failures); the cards complement it, they don't replace it.`,
+};

package/dist/src/packages/server/data/builtin-skills/index.js

@@ -29,6 +29,7 @@ import { workflowBuilder } from './workflow-builder.js';
 import { backupRestore } from './backup-restore.js';
 import { browserControl } from './browser-control.js';
 import { runTests } from './run-tests.js';
+import { httpRequests } from './http-requests.js';
 /**
  * All built-in skills that ship with Tide Commander
  */
@@ -57,6 +58,7 @@ export const BUILTIN_SKILLS = [
     backupRestore,
     browserControl,
     runTests,
+    httpRequests,
 ];
 /**
  * Get the ID for a built-in skill based on its slug

package/dist/src/packages/server/data/builtin-skills/release-pipeline.js

@@ -62,6 +62,13 @@ git pull --rebase origin $(git branch --show-current)
 \`\`\`
 On conflicts: STOP immediately and report. Do NOT auto-resolve.
 
+Verify the changelog packaging contract (fail fast — before doing any build/publish work):
+
+\`\`\`bash
+npm pkg get files | grep -q '"CHANGELOG.md"' || echo "MISSING: CHANGELOG.md not in package.json files"
+\`\`\`
+\`CHANGELOG.md\` MUST be listed in package.json \`files\`. It ships in the npm tarball and is served by the server at \`GET /api/system/changelog\`; the in-app changelog (post-update banner + Settings → About) reads this local packaged file instead of the GitHub API, which 403'd on rate limits (60 req/hour). If the check prints \`MISSING\`: STOP and report — do NOT publish, or the in-app changelog breaks.
+
 ### Phase 2: Quality Gates (3 parallel sub-agents)
 
 Spawn all 3 Agent calls in a single response, each using the curl template above with its command, checking output and exitCode, and instructed not to fix any issues:
@@ -105,7 +112,7 @@ npm version <patch|minor|major> --no-git-tag-version
 git log --oneline $(git describe --tags --abbrev=0 2>/dev/null || echo "HEAD~20")..HEAD
 \`\`\`
 
-Add the new version entry at the top of \`CHANGELOG.md\` (below the header), Keep a Changelog format. Only include sections that have entries; write concise, user-facing descriptions.
+Add the new version entry at the top of \`CHANGELOG.md\` (directly below the \`# Changelog\` header), Keep a Changelog format. Only include sections that have entries; write concise, user-facing descriptions. The changelog is a committed, packaged (package.json \`files\`), server-served artifact — it MUST be updated every release so the bundled file stays current.
 
 \`\`\`markdown
 ## [X.Y.Z] - YYYY-MM-DD
@@ -123,6 +130,8 @@ Add the new version entry at the top of \`CHANGELOG.md\` (below the header), Kee
 - (from \`remove:\` or \`delete:\` commits)
 \`\`\`
 
+CRITICAL — keep the per-version header EXACTLY \`## [X.Y.Z] - YYYY-MM-DD\` (Keep a Changelog): one header per release, newest at the top. The in-app changelog modal extracts a single release by matching the line \`## [X.Y.Z]\`; any other header format breaks the per-version view (the full-changelog view still works). Do NOT drop the \`[\` \`]\` brackets, the version number, or change the \` - YYYY-MM-DD\` suffix.
+
 ### Phase 6: Commit, Tag, Push (run yourself — sequential git ops)
 
 \`\`\`bash

package/dist/src/packages/server/data/index.js

@@ -923,3 +923,68 @@ export function saveTestRun(run) {
         log.error(' Failed to save test run:', err);
     }
 }
+// ============================================================================
+// HTTP Run History (persisted to http-runs/ — one file per run + an index)
+// Mirrors the test-run history above for the "http" (.http requests) building.
+// ============================================================================
+const HTTP_RUNS_DIR = path.join(DATA_DIR, 'http-runs');
+const HTTP_RUNS_INDEX_FILE = path.join(HTTP_RUNS_DIR, 'index.json');
+const MAX_HTTP_RUNS = 300;
+function ensureHttpRunsDir() {
+    if (!fs.existsSync(HTTP_RUNS_DIR)) {
+        fs.mkdirSync(HTTP_RUNS_DIR, { recursive: true });
+        log.log(` Created http runs directory: ${HTTP_RUNS_DIR}`);
+    }
+}
+function getHttpRunFile(runId) {
+    return path.join(HTTP_RUNS_DIR, `${runId}.json`);
+}
+function summarizeHttpRun(run) {
+    const { result: _result, ...summary } = run;
+    return summary;
+}
+/** List recent http runs (newest first); optionally scoped to one folder. */
+export function loadHttpRunSummaries(limit = 50, folder) {
+    ensureHttpRunsDir();
+    const data = safeReadJsonSync(HTTP_RUNS_INDEX_FILE, 'Http runs index');
+    let runs = data?.runs || [];
+    if (folder)
+        runs = runs.filter((r) => r.folder === folder);
+    return limit > 0 ? runs.slice(0, limit) : runs;
+}
+/** Read a single stored http run (full request/response detail) by id. */
+export function loadHttpRun(runId) {
+    return safeReadJsonSync(getHttpRunFile(runId), `Http run ${runId}`);
+}
+/**
+ * Persist an executed request: write its full file, prepend a summary to the
+ * index, cap at MAX_HTTP_RUNS, prune per-run files that fell out.
+ */
+export function saveHttpRun(run) {
+    ensureHttpRunsDir();
+    try {
+        atomicWriteJsonSync(getHttpRunFile(run.runId), run);
+        const existing = loadHttpRunSummaries(0).filter((r) => r.runId !== run.runId);
+        const runs = [summarizeHttpRun(run), ...existing];
+        const kept = runs.slice(0, MAX_HTTP_RUNS);
+        const dropped = runs.slice(MAX_HTTP_RUNS);
+        atomicWriteJsonSync(HTTP_RUNS_INDEX_FILE, {
+            runs: kept,
+            savedAt: Date.now(),
+            version: '1.0.0',
+        });
+        for (const d of dropped) {
+            try {
+                const f = getHttpRunFile(d.runId);
+                if (fs.existsSync(f))
+                    fs.unlinkSync(f);
+            }
+            catch {
+                // best-effort prune
+            }
+        }
+    }
+    catch (err) {
+        log.error(' Failed to save http run:', err);
+    }
+}

package/dist/src/packages/server/routes/http-requests.js

@@ -0,0 +1,148 @@
+/**
+ * HTTP Request Tests Routes (IntelliJ-style .http files)
+ *
+ * REST API for the "http" building: scan a folder for .http files and fire
+ * individual requests. Runs are synchronous — a single HTTP request resolves
+ * quickly (60s server-side timeout), so no runId/WebSocket plumbing is needed.
+ */
+import { Router } from 'express';
+import { httpRequestsService } from '../services/index.js';
+import { createLogger, generateId } from '../utils/index.js';
+import { saveHttpRun, loadHttpRun, loadHttpRunSummaries } from '../data/index.js';
+const log = createLogger('HttpRequestsRoute');
+const router = Router();
+// Store for broadcasting via WebSocket (wired from the websocket handler).
+let broadcastFn = null;
+export function setBroadcast(fn) {
+    broadcastFn = fn;
+}
+function broadcast(message) {
+    broadcastFn?.(message);
+}
+/**
+ * POST /api/http-requests/scan - Parse every .http/.rest file under a folder.
+ * Body: { path: string }
+ */
+router.post('/scan', (req, res) => {
+    const { path: targetPath } = req.body;
+    if (!targetPath) {
+        res.status(400).json({ error: 'Missing required field: path' });
+        return;
+    }
+    if (!httpRequestsService.isSafeFolder(targetPath)) {
+        res.status(400).json({ error: 'Refusing to scan folders outside your home directory.' });
+        return;
+    }
+    res.json(httpRequestsService.scanFolder(targetPath));
+});
+/**
+ * POST /api/http-requests/run - Execute one request from a .http file.
+ * Body: { path, relFile, requestIndex, env? } — responds with HttpRunResult
+ * once the request completes (or fails / times out).
+ */
+router.post('/run', async (req, res) => {
+    const { path: targetPath, relFile, requestIndex, env, agentId } = req.body;
+    if (!targetPath || !relFile || typeof requestIndex !== 'number') {
+        res.status(400).json({ error: 'Missing required fields: path, relFile, requestIndex' });
+        return;
+    }
+    if (!httpRequestsService.isSafeFolder(targetPath)) {
+        res.status(400).json({ error: 'Refusing to run requests outside your home directory.' });
+        return;
+    }
+    const startAgentId = typeof agentId === 'string' && agentId ? agentId : undefined;
+    const runId = generateId();
+    try {
+        // Announce the run when an agent fired it, so its terminal shows a live
+        // inline card immediately (spinner → result), like test runs.
+        if (startAgentId) {
+            const item = httpRequestsService.peekRequest(targetPath, relFile, requestIndex);
+            broadcast({
+                type: 'http_run_started',
+                payload: {
+                    runId,
+                    agentId: startAgentId,
+                    folder: targetPath,
+                    relFile,
+                    requestIndex,
+                    requestName: item?.name || `${relFile}#${requestIndex}`,
+                    method: item?.method || 'GET',
+                    url: item?.url || '',
+                    env,
+                },
+            });
+        }
+        const result = await httpRequestsService.executeRequest(targetPath, relFile, requestIndex, env);
+        log.log(`${result.request.method} ${result.request.url} → ` +
+            (result.ok ? `${result.status} in ${result.timeMs}ms` : `error: ${result.error}`));
+        // Persist to history (best-effort — the response never waits on failures
+        // beyond the synchronous write).
+        const stored = {
+            runId,
+            folder: targetPath,
+            relFile,
+            requestIndex,
+            requestName: result.requestName || `${result.request.method} ${result.request.url}`,
+            method: result.request.method,
+            url: result.request.url,
+            env,
+            ok: result.ok,
+            status: result.status,
+            timeMs: result.timeMs,
+            sizeBytes: result.sizeBytes,
+            error: result.error,
+            finishedAt: Date.now(),
+            result,
+        };
+        saveHttpRun(stored);
+        if (startAgentId) {
+            broadcast({
+                type: 'http_run_completed',
+                payload: { runId, agentId: startAgentId, result },
+            });
+        }
+        res.json({ ...result, runId });
+    }
+    catch (err) {
+        // Close the inline card on hard failures too (parse error, missing file).
+        if (startAgentId) {
+            broadcast({
+                type: 'http_run_completed',
+                payload: {
+                    runId,
+                    agentId: startAgentId,
+                    result: {
+                        ok: false,
+                        request: { method: 'GET', url: '', headers: [] },
+                        timeMs: 0,
+                        error: err?.message || 'Failed to run request',
+                    },
+                },
+            });
+        }
+        res.status(400).json({ error: err?.message || 'Failed to run request' });
+    }
+});
+/**
+ * GET /api/http-requests/history - Recent executed requests (newest first).
+ * Query: ?folder=<abs path> scopes to one building's folder; ?limit=N (default
+ * 50, max 200). Summaries only — fetch /runs/:runId for the full detail.
+ */
+router.get('/history', (req, res) => {
+    const raw = parseInt(req.query.limit, 10);
+    const limit = Number.isFinite(raw) && raw > 0 ? Math.min(raw, 200) : 50;
+    const folder = typeof req.query.folder === 'string' && req.query.folder ? req.query.folder : undefined;
+    res.json({ runs: loadHttpRunSummaries(limit, folder) });
+});
+/**
+ * GET /api/http-requests/runs/:runId - Full stored run (request + response).
+ */
+router.get('/runs/:runId', (req, res) => {
+    const run = loadHttpRun(req.params.runId);
+    if (!run) {
+        res.status(404).json({ error: 'Run not found' });
+        return;
+    }
+    res.json(run);
+});
+export default router;

package/dist/src/packages/server/routes/index.js

@@ -11,6 +11,7 @@ import agentPromptRouter from './agent-prompt.js';
 import notificationsRouter, { setBroadcast as setNotificationBroadcast } from './notifications.js';
 import execRouter, { setBroadcast as setExecBroadcast } from './exec.js';
 import testsRouter, { setBroadcast as setTestsBroadcast } from './tests.js';
+import httpRequestsRouter, { setBroadcast as setHttpRequestsBroadcast } from './http-requests.js';
 import focusAgentRouter, { setBroadcast as setFocusAgentBroadcast } from './focus-agent.js';
 import customModelsRouter from './custom-models.js';
 import configRouter from './config.js';
@@ -44,6 +45,7 @@ router.use('/folders', foldersRouter);
 router.use('/notify', notificationsRouter);
 router.use('/exec', execRouter);
 router.use('/tests', testsRouter);
+router.use('/http-requests', httpRequestsRouter);
 router.use('/focus-agent', focusAgentRouter);
 router.use('/custom-models', customModelsRouter);
 router.use('/tts', ttsRouter);
@@ -83,5 +85,5 @@ router.use('/', permissionsRouter);
 // Agent prompt routes — root-level: /api/agent-prompt and /api/agent-prompt/:id/respond
 router.use('/', agentPromptRouter);
 // Export the broadcast setters for WebSocket handler to use
-export { setNotificationBroadcast, setExecBroadcast, setTestsBroadcast, setFocusAgentBroadcast, setAgentsBroadcast, setTriggerBroadcast, setBuildingsBroadcast, setSkillsBroadcast };
+export { setNotificationBroadcast, setExecBroadcast, setTestsBroadcast, setHttpRequestsBroadcast, setFocusAgentBroadcast, setAgentsBroadcast, setTriggerBroadcast, setBuildingsBroadcast, setSkillsBroadcast };
 export default router;

package/dist/src/packages/server/routes/system.js

@@ -3,6 +3,8 @@
  * Endpoints for inspecting / updating the running Tide Commander install.
  */
 import { Router } from 'express';
+import * as fs from 'fs';
+import * as path from 'path';
 import { createLogger } from '../utils/logger.js';
 import { fetchLatestNpmVersion, getVersionRelation } from '../../shared/version.js';
 import { getInstallInfo, isAutoUpdateSupported, runNpmGlobalUpdate, schedulePostUpdateRestart, } from '../services/self-update-service.js';
@@ -45,6 +47,34 @@ router.get('/install-info', async (_req, res) => {
         res.status(500).json({ error: message });
     }
 });
+/**
+ * GET /api/system/changelog
+ *
+ * Serves the bundled CHANGELOG.md (Keep a Changelog markdown) so the UI can
+ * render release notes locally — no GitHub API, no rate limits, works offline
+ * and always matches the installed version.
+ */
+router.get('/changelog', (_req, res) => {
+    try {
+        const installRoot = getInstallInfo().installRoot;
+        if (!installRoot) {
+            res.status(404).json({ error: 'Could not locate install root.' });
+            return;
+        }
+        const changelogPath = path.join(installRoot, 'CHANGELOG.md');
+        if (!fs.existsSync(changelogPath)) {
+            res.status(404).json({ error: 'CHANGELOG.md not found.' });
+            return;
+        }
+        const content = fs.readFileSync(changelogPath, 'utf8');
+        res.type('text/markdown').send(content);
+    }
+    catch (err) {
+        const message = err.message;
+        log.error(`Failed to read changelog: ${message}`);
+        res.status(500).json({ error: message });
+    }
+});
 /**
  * POST /api/system/self-update
  *

package/dist/src/packages/server/services/building-service.js

@@ -1088,7 +1088,7 @@ export async function handleBuildingSync(newBuildings, _broadcast) {
 // Validation & CRUD (Phase 1 - REST API support)
 // ============================================================================
 const VALID_TYPES = new Set([
-    'server', 'link', 'database', 'docker', 'monitor', 'folder', 'boss', 'terminal', 'tests',
+    'server', 'link', 'database', 'docker', 'monitor', 'folder', 'boss', 'terminal', 'tests', 'http',
 ]);
 const VALID_STYLES = new Set([
     'server-rack', 'tower', 'dome', 'pyramid', 'desktop',
@@ -1113,6 +1113,7 @@ const DEFAULT_STYLE_BY_TYPE = {
     boss: 'command-center',
     terminal: 'desktop',
     tests: 'dome',
+    http: 'satellite',
 };
 function generateBuildingId(name) {
     const slug = name
@@ -1203,6 +1204,9 @@ export function validateBuilding(input) {
     if (input.type === 'tests' && !input.folderPath) {
         errors.push('folderPath is required for tests buildings (the folder whose tests it browses)');
     }
+    if (input.type === 'http' && !input.folderPath) {
+        errors.push('folderPath is required for http buildings (the folder containing the .http request files)');
+    }
     if (input.type === 'link' && (!input.urls || input.urls.length === 0)) {
         errors.push('urls is required (non-empty array) for link buildings');
     }

package/dist/src/packages/server/services/claude-usage-service.js

@@ -25,6 +25,18 @@ const STATS_CACHE_PATH = path.join(os.homedir(), '.claude', 'stats-cache.json');
 const CREDENTIALS_PATH = path.join(os.homedir(), '.claude', '.credentials.json');
 const OAUTH_USAGE_URL = 'https://api.anthropic.com/api/oauth/usage';
 const OAUTH_USAGE_TIMEOUT_MS = 5_000;
+// --- Local throttling of the Anthropic OAuth usage endpoint ------------------
+//
+// The rate-limit gauges are ACCOUNT-WIDE — identical no matter which agent asks —
+// so a single cached value serves every agent and every client poll. Before this
+// throttle, each hovered agent chip / open usage panel fired its own request to
+// Anthropic and the endpoint started returning 429. We (1) reuse a good result
+// for a TTL, (2) dedupe concurrent fetches into ONE network request
+// (single-flight), and (3) back off hard when Anthropic rate-limits us — honoring
+// its `Retry-After` header when present.
+const RATE_LIMIT_CACHE_TTL_MS = 60_000; // reuse a good result for a minute
+const RATE_LIMIT_429_BACKOFF_MS = 5 * 60_000; // after a 429, don't retry for 5 min
+const RATE_LIMIT_ERROR_BACKOFF_MS = 30_000; // after any other failure, cool down 30s
 function readStatsCache() {
     try {
         if (!fs.existsSync(STATS_CACHE_PATH))
@@ -279,13 +291,29 @@ function parseRateLimitWindow(value) {
         resetsAt: window.resets_at,
     };
 }
+// `Retry-After` is either delta-seconds or an HTTP date; return ms-from-now.
+function parseRetryAfterMs(headerValue) {
+    if (!headerValue)
+        return undefined;
+    const seconds = Number(headerValue);
+    if (Number.isFinite(seconds))
+        return Math.max(0, seconds * 1000);
+    const dateMs = Date.parse(headerValue);
+    if (Number.isFinite(dateMs))
+        return Math.max(0, dateMs - Date.now());
+    return undefined;
+}
 /**
  * Fetch the live session/weekly rate-limit gauges — the data behind the
  * progress bars in the CLI's `/usage` panel — using the OAuth token the CLI
  * keeps in `~/.claude/.credentials.json`. Returns the gauges or an error
  * string (never throws); the caller folds either into the snapshot.
+ *
+ * This is the RAW network call. Go through `getClaudeRateLimits()` instead —
+ * it caches, dedupes, and rate-limits calls to this so we don't hammer (and get
+ * 429'd by) the Anthropic endpoint.
  */
-async function fetchClaudeRateLimits() {
+async function fetchClaudeRateLimitsFromApi() {
     let accessToken;
     try {
         if (!fs.existsSync(CREDENTIALS_PATH)) {
@@ -315,7 +343,12 @@ async function fetchClaudeRateLimits() {
             signal: AbortSignal.timeout(OAUTH_USAGE_TIMEOUT_MS),
         });
         if (!response.ok) {
-            return { rateLimits: null, error: `Anthropic usage endpoint returned ${response.status}` };
+            return {
+                rateLimits: null,
+                error: `Anthropic usage endpoint returned ${response.status}`,
+                status: response.status,
+                retryAfterMs: parseRetryAfterMs(response.headers.get('retry-after')),
+            };
         }
         const body = await response.json();
         return {
@@ -326,6 +359,7 @@ async function fetchClaudeRateLimits() {
                 sevenDaySonnet: parseRateLimitWindow(body.seven_day_sonnet),
             },
             error: null,
+            status: response.status,
         };
     }
     catch (err) {
@@ -334,6 +368,70 @@ async function fetchClaudeRateLimits() {
         return { rateLimits: null, error: `Could not reach Anthropic usage endpoint (${reason})` };
     }
 }
+// Account-wide, so a single cache line serves every agent/client. Never keyed.
+let rateLimitCache = null;
+// Last successful gauges, kept so we can serve them (stale) while backing off —
+// the panel keeps showing numbers instead of going blank after a transient 429.
+let lastGoodRateLimits = null;
+// In-flight fetch, so N concurrent callers share ONE network request.
+let rateLimitInFlight = null;
+/**
+ * Cached, single-flight, backoff-aware accessor for the rate-limit gauges.
+ *
+ * Guarantees at most one request to the Anthropic usage endpoint per TTL window
+ * (or per backoff window after a failure), no matter how many agents or clients
+ * poll `/api/agents/:id/usage` concurrently. On 429 we honor `Retry-After` (or
+ * fall back to a 5-minute cooldown); on any other failure we cool down briefly.
+ * `resetClaudeRateLimitCache()` clears the cache for tests.
+ */
+async function getClaudeRateLimits() {
+    const now = Date.now();
+    // Serve the cached value while it's still valid (covers both the TTL after a
+    // success AND the backoff window after a failure).
+    if (rateLimitCache && now < rateLimitCache.validUntil) {
+        return { rateLimits: rateLimitCache.rateLimits, error: rateLimitCache.error };
+    }
+    // Single-flight: concurrent callers await the same request rather than each
+    // firing their own (which is exactly what triggered the 429s).
+    if (rateLimitInFlight)
+        return rateLimitInFlight;
+    rateLimitInFlight = (async () => {
+        const result = await fetchClaudeRateLimitsFromApi();
+        let ttl = RATE_LIMIT_CACHE_TTL_MS;
+        if (result.rateLimits) {
+            lastGoodRateLimits = result.rateLimits;
+        }
+        else if (result.status === 429) {
+            // Respect Anthropic's own Retry-After when it sends one; never shorter
+            // than the normal TTL so a stray header can't reopen the floodgates.
+            ttl = Math.max(result.retryAfterMs ?? RATE_LIMIT_429_BACKOFF_MS, RATE_LIMIT_CACHE_TTL_MS);
+        }
+        else {
+            ttl = RATE_LIMIT_ERROR_BACKOFF_MS;
+        }
+        // During a failure/backoff, still surface the last good gauges (stale) so
+        // the panel keeps showing numbers alongside the error string.
+        const entry = {
+            rateLimits: result.rateLimits ?? lastGoodRateLimits,
+            error: result.error,
+            validUntil: Date.now() + ttl,
+        };
+        rateLimitCache = entry;
+        return { rateLimits: entry.rateLimits, error: entry.error };
+    })();
+    try {
+        return await rateLimitInFlight;
+    }
+    finally {
+        rateLimitInFlight = null;
+    }
+}
+/** Test helper: drop the cached rate-limit result and backoff state. */
+export function resetClaudeRateLimitCache() {
+    rateLimitCache = null;
+    lastGoodRateLimits = null;
+    rateLimitInFlight = null;
+}
 function todayString() {
     const d = new Date();
     const yyyy = d.getFullYear();
@@ -462,7 +560,7 @@ export async function buildClaudeUsageSnapshot(agent) {
     // transcript scan alongside the rate-limit fetch — they're independent I/O.
     const [liveToday, { rateLimits, error: rateLimitsError }] = await Promise.all([
         cachedToday ? Promise.resolve(null) : computeTodayActivity(),
-        fetchClaudeRateLimits(),
+        getClaudeRateLimits(),
     ]);
     const today = cachedToday ?? liveToday;
     const recentDays = (liveToday ? [liveToday, ...sortedDesc] : sortedDesc).slice(0, 8);