fix(ui): keep submit disabled for empty custom answer

.github/workflows/build-and-upload.yml

@@ -3,11 +3,6 @@ name: Build and Upload Binaries
 on:
   workflow_call:
     inputs:
-      ref:
-        description: "Git ref (branch, tag, or SHA) to build from"
-        required: false
-        default: ""
-        type: string
       version:
         description: "Version to apply to workspace packages (release builds)"
         required: false
@@ -28,21 +23,6 @@ on:
         required: false
         default: true
         type: boolean
-      upload_actions_artifacts:
-        description: "Upload built artifacts to GitHub Actions run artifacts"
-        required: false
-        default: false
-        type: boolean
-      actions_artifacts_retention_days:
-        description: "Retention (days) for GitHub Actions artifacts"
-        required: false
-        default: 7
-        type: number
-      actions_artifacts_name_prefix:
-        description: "Optional prefix for Actions artifact names"
-        required: false
-        default: ""
-        type: string
       set_versions:
         description: "Run npm version to set workspace versions"
         required: false
@@ -65,8 +45,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -76,21 +54,7 @@ jobs:
 
       - name: Set workspace versions
         if: ${{ inputs.set_versions && inputs.version != '' }}
-        shell: bash
-        env:
-          NPM_CONFIG_FETCH_RETRIES: 5
-          NPM_CONFIG_FETCH_RETRY_MINTIMEOUT: 20000
-          NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT: 120000
-        run: |
-          set -euo pipefail
-          for attempt in 1 2 3; do
-            if npm version "${VERSION}" --workspaces --include-workspace-root --no-git-tag-version --allow-same-version; then
-              exit 0
-            fi
-            echo "npm version failed (attempt $attempt/3); retrying..." >&2
-            sleep $((attempt * 10))
-          done
-          exit 1
+        run: npm version ${VERSION} --workspaces --include-workspace-root --no-git-tag-version --allow-same-version
 
       - name: Install dependencies
         run: npm ci --workspaces --include=optional
@@ -101,112 +65,6 @@ jobs:
       - name: Build macOS binaries (Electron)
         run: npm run build:mac --workspace @neuralnomads/codenomad-electron-app
 
-      - name: Ad-hoc sign Electron macOS app bundles (seal resources)
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          release_root="packages/electron-app/release"
-          apps=()
-          while IFS= read -r -d '' app; do
-            apps+=("$app")
-          done < <(find "$release_root" -type d -name 'CodeNomad.app' -print0)
-
-          if [ "${#apps[@]}" -eq 0 ]; then
-            echo "No CodeNomad.app found under $release_root" >&2
-            exit 1
-          fi
-
-          # GitHub macOS runners typically have no signing identity. Without any signature,
-          # the shipped .app can fail Gatekeeper with:
-          #   code has no resources but signature indicates they must be present
-          # Ad-hoc signing seals bundle resources and makes the signature internally consistent.
-          if security find-identity -p codesigning -v | grep -q "0 valid identities found"; then
-            echo "No valid macOS codesigning identity found; applying ad-hoc signature"
-            for app in "${apps[@]}"; do
-              echo "codesign (adhoc): $app"
-              codesign --force --deep --sign - "$app"
-              codesign --verify --deep --strict --verbose=2 "$app"
-            done
-          else
-            echo "macOS codesigning identity present; skipping ad-hoc signing"
-          fi
-
-      - name: Repackage Electron macOS zips (ditto)
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          # Prefer the workflow-provided version; fall back to package.json.
-          VERSION_TO_USE="${VERSION:-}"
-          if [ -z "$VERSION_TO_USE" ]; then
-            VERSION_TO_USE=$(node -p "require('./packages/electron-app/package.json').version")
-          fi
-
-          release_root="packages/electron-app/release"
-          # macOS GitHub runners ship /bin/bash 3.2 which doesn't support `shopt -s globstar`.
-          # Use find to locate built app bundles instead of ** globs.
-          apps=()
-          while IFS= read -r -d '' app; do
-            apps+=("$app")
-          done < <(find "$release_root" -type d -name 'CodeNomad.app' -print0)
-          if [ "${#apps[@]}" -eq 0 ]; then
-            echo "No CodeNomad.app found under $release_root" >&2
-            exit 1
-          fi
-
-          for app in "${apps[@]}"; do
-            bundle_dir=$(basename "$(dirname "$app")")
-            arch="x64"
-            if [[ "$bundle_dir" == *"arm64"* ]]; then
-              arch="arm64"
-            fi
-
-            out_zip="$release_root/CodeNomad-${VERSION_TO_USE}-mac-${arch}.zip"
-            rm -f "$out_zip"
-            echo "ditto -ck: $app -> $out_zip"
-            ditto -ck --sequesterRsrc --keepParent "$app" "$out_zip"
-          done
-
-      - name: Validate Electron macOS codesign (unzipped)
-        shell: bash
-        run: |
-          set -euo pipefail
-          shopt -s nullglob
-
-          tmp_dir=$(mktemp -d)
-          trap 'rm -rf "$tmp_dir"' EXIT
-
-          zips=(packages/electron-app/release/CodeNomad-*-mac-*.zip)
-          if [ "${#zips[@]}" -eq 0 ]; then
-            echo "No Electron macOS zip artifacts found to validate" >&2
-            exit 1
-          fi
-
-          for zip in "${zips[@]}"; do
-            echo "Validating codesign for: $zip"
-            extract_dir="$tmp_dir/$(basename "$zip" .zip)"
-            mkdir -p "$extract_dir"
-
-            # Use ditto for extraction as well to preserve bundle metadata.
-            ditto -x -k "$zip" "$extract_dir"
-
-            app_path=""
-            for candidate in "$extract_dir"/*.app "$extract_dir"/*/*.app; do
-              if [ -d "$candidate" ]; then
-                app_path="$candidate"
-                break
-              fi
-            done
-
-            if [ -z "$app_path" ]; then
-              echo "No .app found after extracting $zip" >&2
-              exit 1
-            fi
-
-            codesign --verify --deep --strict --verbose=2 "$app_path"
-          done
-
       - name: Upload release assets
         if: ${{ inputs.upload && inputs.tag != '' }}
         run: |
@@ -218,15 +76,6 @@ jobs:
             gh release upload "$TAG" "$file" --clobber
           done
 
-      - name: Upload Actions artifacts (Electron macOS)
-        if: ${{ inputs.upload_actions_artifacts }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ inputs.actions_artifacts_name_prefix }}electron-macos
-          path: packages/electron-app/release/*.zip
-          retention-days: ${{ inputs.actions_artifacts_retention_days }}
-          if-no-files-found: error
-
   build-windows:
     runs-on: windows-2025
     env:
@@ -236,8 +85,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -268,15 +115,6 @@ jobs:
             gh release upload $env:TAG $_.FullName --clobber
           }
 
-      - name: Upload Actions artifacts (Electron Windows)
-        if: ${{ inputs.upload_actions_artifacts }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ inputs.actions_artifacts_name_prefix }}electron-windows
-          path: packages/electron-app/release/*.zip
-          retention-days: ${{ inputs.actions_artifacts_retention_days }}
-          if-no-files-found: error
-
   build-linux:
     runs-on: ubuntu-24.04
     env:
@@ -286,8 +124,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -319,15 +155,6 @@ jobs:
             gh release upload "$TAG" "$file" --clobber
           done
 
-      - name: Upload Actions artifacts (Electron Linux)
-        if: ${{ inputs.upload_actions_artifacts }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ inputs.actions_artifacts_name_prefix }}electron-linux
-          path: packages/electron-app/release/*.zip
-          retention-days: ${{ inputs.actions_artifacts_retention_days }}
-          if-no-files-found: error
-
   build-tauri-macos:
     runs-on: macos-15-intel
     env:
@@ -337,8 +164,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -381,7 +206,7 @@ jobs:
         run: npm exec -- tauri build
 
       - name: Package Tauri artifacts (macOS)
-        if: ${{ inputs.upload || inputs.upload_actions_artifacts }}
+        if: ${{ inputs.upload }}
         run: |
           set -euo pipefail
           BUNDLE_ROOT="packages/tauri-app/target/release/bundle"
@@ -392,15 +217,6 @@ jobs:
             ditto -ck --sequesterRsrc --keepParent "$BUNDLE_ROOT/macos/CodeNomad.app" "$ARTIFACT_DIR/CodeNomad-Tauri-${VERSION}-macos-x64.zip"
           fi
 
-      - name: Upload Actions artifacts (Tauri macOS)
-        if: ${{ inputs.upload_actions_artifacts }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ inputs.actions_artifacts_name_prefix }}tauri-macos
-          path: packages/tauri-app/release-tauri/*.zip
-          retention-days: ${{ inputs.actions_artifacts_retention_days }}
-          if-no-files-found: warn
-
       - name: Upload Tauri release assets (macOS)
         if: ${{ inputs.upload && inputs.tag != '' }}
         run: |
@@ -421,8 +237,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -465,7 +279,7 @@ jobs:
         run: npm exec -- tauri build
 
       - name: Package Tauri artifacts (macOS arm64)
-        if: ${{ inputs.upload || inputs.upload_actions_artifacts }}
+        if: ${{ inputs.upload }}
         run: |
           set -euo pipefail
           BUNDLE_ROOT="packages/tauri-app/target/release/bundle"
@@ -476,15 +290,6 @@ jobs:
             ditto -ck --sequesterRsrc --keepParent "$BUNDLE_ROOT/macos/CodeNomad.app" "$ARTIFACT_DIR/CodeNomad-Tauri-${VERSION}-macos-arm64.zip"
           fi
 
-      - name: Upload Actions artifacts (Tauri macOS arm64)
-        if: ${{ inputs.upload_actions_artifacts }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ inputs.actions_artifacts_name_prefix }}tauri-macos-arm64
-          path: packages/tauri-app/release-tauri/*.zip
-          retention-days: ${{ inputs.actions_artifacts_retention_days }}
-          if-no-files-found: warn
-
       - name: Upload Tauri release assets (macOS arm64)
         if: ${{ inputs.upload && inputs.tag != '' }}
         run: |
@@ -505,8 +310,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -552,7 +355,7 @@ jobs:
         run: npm exec -- tauri build
 
       - name: Package Tauri artifacts (Windows)
-        if: ${{ inputs.upload || inputs.upload_actions_artifacts }}
+        if: ${{ inputs.upload }}
         shell: pwsh
         run: |
           $bundleRoot = "packages/tauri-app/target/release/bundle"
@@ -565,15 +368,6 @@ jobs:
             Compress-Archive -Path $exe.Directory.FullName -DestinationPath $dest -Force
           }
 
-      - name: Upload Actions artifacts (Tauri Windows)
-        if: ${{ inputs.upload_actions_artifacts }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ inputs.actions_artifacts_name_prefix }}tauri-windows
-          path: packages/tauri-app/release-tauri/*.zip
-          retention-days: ${{ inputs.actions_artifacts_retention_days }}
-          if-no-files-found: warn
-
       - name: Upload Tauri release assets (Windows)
         if: ${{ inputs.upload && inputs.tag != '' }}
         shell: pwsh
@@ -594,8 +388,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -651,7 +443,7 @@ jobs:
         run: npm exec -- tauri build
 
       - name: Package Tauri artifacts (Linux)
-        if: ${{ inputs.upload || inputs.upload_actions_artifacts }}
+        if: ${{ inputs.upload }}
         run: |
           set -euo pipefail
           SEARCH_ROOT="packages/tauri-app/target"
@@ -677,15 +469,6 @@ jobs:
           cp "$deb" "$ARTIFACT_DIR/CodeNomad-Tauri-${VERSION}-linux-x64.deb"
           cp "$rpm" "$ARTIFACT_DIR/CodeNomad-Tauri-${VERSION}-linux-x64.rpm"
 
-      - name: Upload Actions artifacts (Tauri Linux)
-        if: ${{ inputs.upload_actions_artifacts }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ inputs.actions_artifacts_name_prefix }}tauri-linux
-          path: packages/tauri-app/release-tauri/*
-          retention-days: ${{ inputs.actions_artifacts_retention_days }}
-          if-no-files-found: warn
-
       - name: Upload Tauri release assets (Linux)
         if: ${{ inputs.upload && inputs.tag != '' }}
         run: |
@@ -707,8 +490,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup QEMU
         uses: docker/setup-qemu-action@v3
@@ -806,8 +587,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -844,12 +623,3 @@ jobs:
             echo "Uploading $file"
             gh release upload "$TAG" "$file" --clobber
           done
-
-      - name: Upload Actions artifacts (Electron Linux RPM)
-        if: ${{ inputs.upload_actions_artifacts }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ inputs.actions_artifacts_name_prefix }}electron-linux-rpm
-          path: packages/electron-app/release/*.rpm
-          retention-days: ${{ inputs.actions_artifacts_retention_days }}
-          if-no-files-found: error

.github/workflows/comment-pr-artifacts.yml

@@ -1,121 +0,0 @@
-name: Comment PR Artifacts
-
-on:
-  pull_request_target:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - ready_for_review
-
-permissions:
-  actions: read
-  contents: read
-  issues: write
-  pull-requests: write
-
-jobs:
-  comment:
-    runs-on: ubuntu-latest
-    env:
-      ALLOWED_ACTORS: ${{ vars.ALLOWED_NON_DEV_PR_ACTORS }}
-      ACTOR: ${{ github.actor }}
-      BASE_REF: ${{ github.event.pull_request.base.ref }}
-      IS_DRAFT: ${{ github.event.pull_request.draft }}
-      PR_NUMBER: ${{ github.event.pull_request.number }}
-      HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-      RETENTION_DAYS: 7
-    steps:
-      - name: Check PR authorization
-        id: auth
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [ "$BASE_REF" = "dev" ]; then
-            echo "allowed=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          normalized=",${ALLOWED_ACTORS},"
-          if [[ "$normalized" == *",${ACTOR},"* ]]; then
-            echo "allowed=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "allowed=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Wait for PR build and comment
-        if: ${{ steps.auth.outputs.allowed == 'true' && env.IS_DRAFT != 'true' }}
-        uses: actions/github-script@v8
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const prNumber = Number(process.env.PR_NUMBER);
-            const headSha = process.env.HEAD_SHA;
-            const retentionDays = Number(process.env.RETENTION_DAYS || '7');
-            const marker = '<!-- codenomad-pr-artifacts -->';
-
-            const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-            let matchedRun = null;
-            for (let attempt = 1; attempt <= 30; attempt += 1) {
-              const runs = await github.paginate(github.rest.actions.listWorkflowRuns, {
-                owner,
-                repo,
-                workflow_id: 'pr-build.yml',
-                event: 'pull_request',
-                per_page: 100,
-              });
-
-              const matchingRuns = runs
-                .filter((run) => run.head_sha === headSha)
-                .sort((a, b) => new Date(b.created_at) - new Date(a.created_at));
-
-              matchedRun = matchingRuns[0] || null;
-              if (matchedRun && matchedRun.status === 'completed') {
-                break;
-              }
-
-              core.info(`Waiting for PR Build Validation run for ${headSha} (attempt ${attempt}/30)`);
-              await sleep(10000);
-            }
-
-            if (!matchedRun) {
-              core.setFailed(`Could not find PR Build Validation run for ${headSha}.`);
-              return;
-            }
-
-            if (matchedRun.status !== 'completed') {
-              core.setFailed(`PR Build Validation run ${matchedRun.id} did not complete in time.`);
-              return;
-            }
-
-            const artifacts = await github.paginate(
-              github.rest.actions.listWorkflowRunArtifacts,
-              { owner, repo, run_id: matchedRun.id, per_page: 100 }
-            );
-            const active = artifacts.filter((artifact) => !artifact.expired);
-
-            const runUrl = matchedRun.html_url;
-            const artifactsBlock = active.length
-              ? ['Artifacts:', ...active.map((artifact) => `- ${artifact.name}`)].join('\n')
-              : 'Artifacts: (none found on this run)';
-
-            const body = [
-              marker,
-              'PR builds are available as GitHub Actions artifacts:',
-              '',
-              runUrl,
-              '',
-              `Artifacts expire in ${retentionDays} days.`,
-              artifactsBlock,
-            ].join('\n');
-
-            const created = await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body,
-            });
-            core.info(`Created artifacts comment: ${created.data.html_url}`);

.github/workflows/dev-release.yml

@@ -1,80 +1,18 @@
-name: Develop Pre-Release
+name: Dev CI
 
 on:
-  schedule:
-    # Nightly build of dev (only if dev has new commits)
-    - cron: "0 1 * * *"
+  push:
+    branches:
+      - dev
   workflow_dispatch:
 
 permissions:
-  actions: read
-  id-token: write
-  contents: write
-
-concurrency:
-  group: dev-prerelease
-  cancel-in-progress: true
+  contents: read
 
 jobs:
-  gate:
-    runs-on: ubuntu-latest
-    outputs:
-      run: ${{ steps.gate.outputs.run }}
-      dev_sha: ${{ steps.gate.outputs.dev_sha }}
-      version_suffix: ${{ steps.gate.outputs.version_suffix }}
-    steps:
-      - name: Decide whether to run
-        id: gate
-        shell: bash
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          api() {
-            curl -sS \
-              -H "Authorization: Bearer ${GH_TOKEN}" \
-              -H "Accept: application/vnd.github+json" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              "$1"
-          }
-
-          DEV_SHA=$(api "https://api.github.com/repos/${GITHUB_REPOSITORY}/git/ref/heads/dev" | jq -r '.object.sha')
-          if [ -z "$DEV_SHA" ] || [ "$DEV_SHA" = "null" ]; then
-            echo "Failed to resolve dev head SHA" >&2
-            exit 1
-          fi
-
-          DATE=$(date -u +%Y%m%d)
-          SHA8="${DEV_SHA::8}"
-          VERSION_SUFFIX="-dev-${DATE}-${SHA8}"
-
-          SHOULD_RUN="false"
-          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
-            SHOULD_RUN="true"
-          else
-            # Nightly: only run if dev has advanced since last successful dev-release build.
-            LAST_SHA=$(api "https://api.github.com/repos/${GITHUB_REPOSITORY}/actions/workflows/dev-release.yml/runs?branch=dev&status=success&per_page=1" | jq -r '.workflow_runs[0].head_sha // empty')
-            if [ -z "${LAST_SHA}" ]; then
-              SHOULD_RUN="true"
-            elif [ "${LAST_SHA}" != "${DEV_SHA}" ]; then
-              SHOULD_RUN="true"
-            fi
-          fi
-
-          echo "run=${SHOULD_RUN}" >> "$GITHUB_OUTPUT"
-          echo "dev_sha=${DEV_SHA}" >> "$GITHUB_OUTPUT"
-          echo "version_suffix=${VERSION_SUFFIX}" >> "$GITHUB_OUTPUT"
-
-  prerelease:
-    needs: gate
-    if: ${{ needs.gate.outputs.run == 'true' }}
-    uses: ./.github/workflows/reusable-release.yml
+  dev-ci:
+    uses: ./.github/workflows/build-and-upload.yml
     with:
-      ref: ${{ needs.gate.outputs.dev_sha }}
-      version_suffix: ${{ needs.gate.outputs.version_suffix }}
-      npm_package_name: "@neuralnomads/codenomad-dev"
-      dist_tag: latest
-      prerelease: true
-      release_ui: false
+      upload: false
+      set_versions: false
     secrets: inherit

.github/workflows/manual-npm-publish.yml

@@ -12,17 +12,8 @@ on:
         required: false
         default: dev
         type: string
-      package_name:
-        description: "Package name to publish (e.g. @neuralnomads/codenomad-dev)"
-        required: false
-        default: "@neuralnomads/codenomad"
-        type: string
   workflow_call:
     inputs:
-      ref:
-        required: false
-        default: ""
-        type: string
       version:
         required: true
         type: string
@@ -30,13 +21,6 @@ on:
         required: false
         type: string
         default: dev
-      package_name:
-        required: false
-        type: string
-        default: "@neuralnomads/codenomad"
-    secrets:
-      NPM_TOKEN:
-        required: false
 
 permissions:
   contents: read
@@ -50,8 +34,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -69,7 +51,7 @@ jobs:
         run: npm install @rollup/rollup-linux-x64-gnu --no-save
 
       - name: Build server package (includes UI bundling)
-        run: npm run build --workspace packages/server
+        run: npm run build --workspace @neuralnomads/codenomad
 
       - name: Set publish metadata
         shell: bash
@@ -80,31 +62,13 @@ jobs:
           fi
           echo "VERSION=$VERSION_INPUT" >> "$GITHUB_ENV"
           echo "DIST_TAG=${{ inputs.dist_tag || 'dev' }}" >> "$GITHUB_ENV"
-          echo "PACKAGE_NAME=${{ inputs.package_name }}" >> "$GITHUB_ENV"
 
       - name: Bump package version for publish
         run: npm version ${VERSION} --workspaces --include-workspace-root --no-git-tag-version --allow-same-version
 
-      - name: Set server package name for publish
-        shell: bash
-        run: |
-          set -euo pipefail
-          node -e "const fs=require('fs'); const path=require('path'); const p=path.join('packages','server','package.json'); const j=JSON.parse(fs.readFileSync(p,'utf8')); j.name=process.env.PACKAGE_NAME || j.name; fs.writeFileSync(p, JSON.stringify(j, null, 2)+'\n'); console.log('Publishing as', j.name);"
-
       - name: Publish server package with provenance
         env:
-          # Optional: when present, npm will use token auth.
-          # When empty/unset, npm trusted publishing (OIDC) may be used if configured.
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org
-        shell: bash
         run: |
-          set -euo pipefail
-          if [ -z "${NODE_AUTH_TOKEN:-}" ]; then
-            echo "NPM_TOKEN not set; attempting npm trusted publishing (OIDC)"
-            unset NODE_AUTH_TOKEN
-          else
-            echo "Using NPM_TOKEN authentication"
-          fi
-          npm publish --workspace packages/server --access public --tag ${DIST_TAG} --provenance
+          npm publish --workspace @neuralnomads/codenomad --access public --tag ${DIST_TAG} --provenance

.github/workflows/pr-build.yml

@@ -1,57 +0,0 @@
-name: PR Build Validation
-
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - ready_for_review
-
-permissions:
-  contents: read
-  actions: write
-
-concurrency:
-  group: pr-build-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  authorize:
-    runs-on: ubuntu-latest
-    outputs:
-      allowed: ${{ steps.auth.outputs.allowed }}
-    env:
-      ALLOWED_ACTORS: ${{ vars.ALLOWED_NON_DEV_PR_ACTORS }}
-      ACTOR: ${{ github.actor }}
-      BASE_REF: ${{ github.event.pull_request.base.ref }}
-    steps:
-      - name: Check PR authorization
-        id: auth
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [ "$BASE_REF" = "dev" ]; then
-            echo "allowed=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          normalized=",${ALLOWED_ACTORS},"
-          if [[ "$normalized" == *",${ACTOR},"* ]]; then
-            echo "allowed=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "allowed=false" >> "$GITHUB_OUTPUT"
-            echo "Skipping builds for unauthorized PR targeting $BASE_REF" >&2
-          fi
-
-  build:
-    needs: authorize
-    if: ${{ needs.authorize.outputs.allowed == 'true' && !github.event.pull_request.draft }}
-    uses: ./.github/workflows/build-and-upload.yml
-    with:
-      ref: ${{ github.event.pull_request.head.sha }}
-      upload: false
-      upload_actions_artifacts: true
-      actions_artifacts_retention_days: 7
-      actions_artifacts_name_prefix: pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}-
-      set_versions: false

.github/workflows/release-ui.yml

@@ -1,13 +1,7 @@
 name: Release UI
 
 on:
-  workflow_call:
-    inputs:
-      ref:
-        description: "Git ref (branch, tag, or SHA) to build from"
-        required: false
-        default: ""
-        type: string
+  workflow_call: {}
   workflow_dispatch: {}
 
 permissions:
@@ -24,8 +18,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup Node
         uses: actions/setup-node@v4

.github/workflows/release.yml

@@ -14,5 +14,4 @@ jobs:
     uses: ./.github/workflows/reusable-release.yml
     with:
       dist_tag: latest
-      npm_package_name: "@neuralnomads/codenomad"
     secrets: inherit

.github/workflows/restrict-non-dev-prs.yml

@@ -1,54 +0,0 @@
-name: Restrict Non-Dev PRs
-
-on:
-  pull_request_target:
-    types:
-      - opened
-      - reopened
-      - synchronize
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  restrict-non-dev-prs:
-    if: ${{ github.event.pull_request.base.ref != 'dev' }}
-    runs-on: ubuntu-latest
-    env:
-      ALLOWED_ACTORS: ${{ vars.ALLOWED_NON_DEV_PR_ACTORS }}
-      ACTOR: ${{ github.actor }}
-      PR_NUMBER: ${{ github.event.pull_request.number }}
-      BASE_REF: ${{ github.event.pull_request.base.ref }}
-    steps:
-      - name: Check allowed actor
-        id: auth
-        shell: bash
-        run: |
-          set -euo pipefail
-          normalized=",${ALLOWED_ACTORS},"
-          if [[ "$normalized" == *",${ACTOR},"* ]]; then
-            echo "authorized=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "authorized=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Comment on unauthorized PR
-        if: ${{ steps.auth.outputs.authorized != 'true' }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh pr comment "$PR_NUMBER" --body "Thanks for the contribution. PRs need to target \`dev\` branch. Please retarget this PR to the dev branch"
-
-      - name: Close unauthorized PR
-        if: ${{ steps.auth.outputs.authorized != 'true' }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh pr close "$PR_NUMBER"
-
-      - name: Fail unauthorized PR
-        if: ${{ steps.auth.outputs.authorized != 'true' }}
-        run: |
-          echo "Actor $ACTOR is not allowed to open PRs targeting $BASE_REF" >&2
-          exit 1

.github/workflows/reusable-release.yml

@@ -3,11 +3,6 @@ name: Reusable Release
 on:
   workflow_call:
     inputs:
-      ref:
-        description: "Git ref (branch, tag, or SHA) to build from"
-        required: false
-        default: ""
-        type: string
       version_suffix:
         description: "Suffix appended to package.json version"
         required: false
@@ -18,21 +13,6 @@ on:
         required: false
         default: dev
         type: string
-      npm_package_name:
-        description: "npm package name to publish (defaults to server package name)"
-        required: false
-        default: ""
-        type: string
-      prerelease:
-        description: "Create GitHub prerelease"
-        required: false
-        default: false
-        type: boolean
-      release_ui:
-        description: "Publish remote UI + manifest"
-        required: false
-        default: true
-        type: boolean
 
 permissions:
   id-token: write
@@ -51,8 +31,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -75,23 +53,17 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ steps.versions.outputs.tag }}
-          IS_PRERELEASE: ${{ inputs.prerelease }}
         run: |
           if gh release view "$TAG" >/dev/null 2>&1; then
             echo "Release $TAG already exists"
           else
-            if [ "${IS_PRERELEASE}" = "true" ]; then
-              gh release create "$TAG" --title "$TAG" --generate-notes --prerelease
-            else
-              gh release create "$TAG" --title "$TAG" --generate-notes
-            fi
+            gh release create "$TAG" --title "$TAG" --generate-notes
           fi
 
   build-and-upload:
     needs: prepare-release
     uses: ./.github/workflows/build-and-upload.yml
     with:
-      ref: ${{ inputs.ref || github.ref }}
       version: ${{ needs.prepare-release.outputs.version }}
       tag: ${{ needs.prepare-release.outputs.tag }}
       release_name: ${{ needs.prepare-release.outputs.release_name }}
@@ -99,12 +71,9 @@ jobs:
 
   release-ui:
     needs: prepare-release
-    if: ${{ inputs.release_ui }}
     permissions:
       contents: read
     uses: ./.github/workflows/release-ui.yml
-    with:
-      ref: ${{ inputs.ref || github.ref }}
     secrets: inherit
 
   publish-server:
@@ -113,8 +82,6 @@ jobs:
       - build-and-upload
     uses: ./.github/workflows/manual-npm-publish.yml
     with:
-      ref: ${{ inputs.ref || github.ref }}
       version: ${{ needs.prepare-release.outputs.version }}
       dist_tag: ${{ inputs.dist_tag }}
-      package_name: ${{ inputs.npm_package_name }}
     secrets: inherit

AGENTS.md

@@ -15,35 +15,6 @@
 - Prefer composable primitives (signals, hooks, utilities) over deep inheritance or implicit global state.
 - When adding platform integrations (SSE, IPC, SDK), isolate them in thin adapters that surface typed events/actions.
 
-## Multi-Language Support (i18n)
-
-The UI uses a small custom i18n layer (no ICU/messageformat). When building features, never hardcode user-visible strings.
-
-- **Runtime API:** use `useI18n()` in components (`const { t } = useI18n();`) and `tGlobal(...)` in stores/non-component code.
-  - Implementation: `packages/ui/src/lib/i18n/index.tsx`
-- **Where messages live:** `packages/ui/src/lib/i18n/messages/<locale>/` as TypeScript objects (`"flat.dot.keys": "string"`).
-  - Each locale has an `index.ts` that merges message parts; duplicate keys throw at build time.
-  - Merge helper: `packages/ui/src/lib/i18n/messages/merge.ts`
-- **Adding a new string:** add it to the appropriate `.../messages/en/*.ts` part file, then add the same key to each other locale’s corresponding file.
-  - Missing translations fall back to English (and finally to the key), so gaps can be easy to miss.
-- **Interpolation:** placeholders are simple `{name}` replacements (word characters only). Avoid placeholders like `{file-name}`.
-- **Pluralization:** handle manually via separate keys like `something.one` / `something.other` and choose in code.
-- **Adding a new language:** add a new `messages/<locale>/` folder + `index.ts`, register it in `packages/ui/src/lib/i18n/index.tsx`, and add it to the language picker in `packages/ui/src/components/folder-selection-view.tsx`.
-- **Locale persistence:** the selected locale is stored in app preferences (`locale`) and persisted via the server config (default `~/.config/codenomad/config.json`).
-- **Avoid English-only paths:** do not import `enMessages` directly in feature code; always go through `t(...)` so locale changes apply.
-
-## File Length Guidelines (Highlight Only)
-
-We track file size as a refactoring signal. When you touch or create files, highlight oversized files so the team can plan refactors when time permits.
-
-- Source files: warn after ~500 lines; target limit ~800 lines
-- Test files: highlight after ~1000 lines
-
-Behavior for agents:
-- Do not refactor solely to satisfy these thresholds.
-- When a change touches a file that exceeds the warning/limit, mention it in your final response and include the file path and approximate line count.
-- When creating new files, aim to stay under the thresholds unless there's a clear reason.
-
 ## Tooling Preferences
 - Use the `edit` tool for modifying existing files; prefer it over other editing methods.
 - Use the `write` tool only when creating new files from scratch.

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Neural Nomads
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

README.md

@@ -44,21 +44,13 @@ Run CodeNomad as a local server and access it via your web browser. Perfect for
 npx @neuralnomads/codenomad --launch
 ```
 
-Full server/CLI documentation (flags + env vars, TLS, auth, remote access):
-- [packages/server/README.md](packages/server/README.md)
-
-To see all available options:
+For dev version
 
 ```bash
-npx @neuralnomads/codenomad --help
+npx @neuralnomads/codenomad@dev --launch
 ```
 
-### 🧪 Dev Releases
-Bleeding-edge builds are published as GitHub pre-releases and are generated automatically from the `dev` branch.
-
-```bash
-npx @neuralnomads/codenomad-dev --launch
-```
+This command starts the server and opens the web client in your default browser.
 
 ## Highlights
 
@@ -123,6 +115,3 @@ To build the Desktop App from source:
 1.  Clone the repo.
 2.  Run `npm install` (requires pnpm or npm 7+ for workspaces).
 3.  Run `npm run build --workspace @neuralnomads/codenomad-electron-app`.
-
-[![Star History Chart](https://api.star-history.com/svg?repos=NeuralNomadsAI/CodeNomad&type=Date)](https://star-history.com/#NeuralNomadsAI/CodeNomad&Date)
-

package.json

@@ -1,9 +1,8 @@
 {
   "name": "codenomad-workspace",
-  "version": "0.13.3",
+  "version": "0.9.2",
   "private": true,
   "description": "CodeNomad monorepo workspace",
-  "license": "MIT",
   "workspaces": {
     "packages": [
       "packages/server",
@@ -22,7 +21,7 @@
     "build:mac-x64": "npm run build:mac-x64 --workspace @neuralnomads/codenomad-electron-app",
     "build:binaries": "npm run build:binaries --workspace @neuralnomads/codenomad-electron-app",
     "typecheck": "npm run typecheck --workspace @codenomad/ui && npm run typecheck --workspace @neuralnomads/codenomad-electron-app",
-    "bumpVersion": "node ./scripts/bump-version.js"
+    "bumpVersion": "npm version --workspaces --include-workspace-root --no-git-tag-version"
   },
   "dependencies": {
     "7zip-bin": "^5.2.0",

packages/cloudflare/package.json

@@ -1,7 +1,6 @@
 {
   "name": "@codenomad/ui-host-worker",
   "private": true,
-  "license": "MIT",
   "type": "module",
   "scripts": {
     "build:manifest": "node ./scripts/build-manifest.mjs",

packages/cloudflare/release-config.json

@@ -1,4 +1,4 @@
 {
-  "minServerVersion": "0.13.3",
+  "minServerVersion": "0.9.2",
   "latestServerUrl": "https://github.com/NeuralNomadsAI/CodeNomad/releases/latest"
 }

packages/electron-app/.gitignore

@@ -2,4 +2,3 @@ node_modules/
 dist/
 release/
 .vite/
-electron/resources/server/

packages/electron-app/electron.vite.config.ts

@@ -1,7 +1,6 @@
 import { defineConfig, externalizeDepsPlugin } from "electron-vite"
 import solid from "vite-plugin-solid"
 import { resolve } from "path"
-import { copyMonacoPublicAssets } from "../ui/scripts/monaco-public-assets.js"
 
 const uiRoot = resolve(__dirname, "../ui")
 const uiSrc = resolve(uiRoot, "src")
@@ -9,32 +8,6 @@ const uiRendererRoot = resolve(uiRoot, "src/renderer")
 const uiRendererEntry = resolve(uiRendererRoot, "index.html")
 const uiRendererLoadingEntry = resolve(uiRendererRoot, "loading.html")
 
-function prepareMonacoPublicAssets() {
-  return {
-    name: "prepare-monaco-public-assets",
-    configureServer(server: any) {
-      copyMonacoPublicAssets({
-        uiRendererRoot: uiRendererRoot,
-        warn: (msg: string) => server.config.logger.warn(msg),
-        sourceRoots: [
-          resolve(__dirname, "../../node_modules/monaco-editor/min/vs"),
-          resolve(uiRoot, "node_modules/monaco-editor/min/vs"),
-        ],
-      })
-    },
-    buildStart(this: any) {
-      copyMonacoPublicAssets({
-        uiRendererRoot: uiRendererRoot,
-        warn: (msg: string) => this.warn(msg),
-        sourceRoots: [
-          resolve(__dirname, "../../node_modules/monaco-editor/min/vs"),
-          resolve(uiRoot, "node_modules/monaco-editor/min/vs"),
-        ],
-      })
-    },
-  }
-}
-
 export default defineConfig({
   main: {
     plugins: [externalizeDepsPlugin()],
@@ -67,7 +40,7 @@ export default defineConfig({
   },
   renderer: {
     root: uiRendererRoot,
-    plugins: [solid(), prepareMonacoPublicAssets()],
+    plugins: [solid()],
     css: {
       postcss: resolve(uiRoot, "postcss.config.js"),
     },

packages/electron-app/electron/main/ipc.ts

@@ -1,10 +1,6 @@
-import { BrowserWindow, Notification, dialog, ipcMain, powerSaveBlocker, type OpenDialogOptions } from "electron"
-import fs from "fs"
-import { requestMicrophoneAccess } from "./permissions"
+import { BrowserWindow, dialog, ipcMain, type OpenDialogOptions } from "electron"
 import type { CliProcessManager, CliStatus } from "./process-manager"
 
-let wakeLockId: number | null = null
-
 interface DialogOpenRequest {
   mode: "directory" | "file"
   title?: string
@@ -66,73 +62,4 @@ export function setupCliIPC(mainWindow: BrowserWindow, cliManager: CliProcessMan
 
     return { canceled: result.canceled, paths: result.filePaths }
   })
-
-  ipcMain.handle("filesystem:getDirectoryPaths", async (_event, paths: unknown): Promise<string[]> => {
-    if (!Array.isArray(paths)) {
-      return []
-    }
-
-    const directories = paths.filter((value): value is string => {
-      if (typeof value !== "string" || value.trim().length === 0) {
-        return false
-      }
-      try {
-        return fs.statSync(value).isDirectory()
-      } catch {
-        return false
-      }
-    })
-    return directories
-  })
-
-  ipcMain.handle("power:setWakeLock", async (_event, enabled: boolean): Promise<{ enabled: boolean }> => {
-    const next = Boolean(enabled)
-    if (next) {
-      if (wakeLockId !== null && powerSaveBlocker.isStarted(wakeLockId)) {
-        return { enabled: true }
-      }
-      try {
-        wakeLockId = powerSaveBlocker.start("prevent-display-sleep")
-      } catch {
-        wakeLockId = null
-        return { enabled: false }
-      }
-      return { enabled: true }
-    }
-
-    if (wakeLockId !== null) {
-      try {
-        if (powerSaveBlocker.isStarted(wakeLockId)) {
-          powerSaveBlocker.stop(wakeLockId)
-        }
-      } finally {
-        wakeLockId = null
-      }
-    }
-    return { enabled: false }
-  })
-
-  ipcMain.handle(
-    "media:requestMicrophoneAccess",
-    async (): Promise<{ granted: boolean }> => ({ granted: await requestMicrophoneAccess() }),
-  )
-
-  ipcMain.handle(
-    "notifications:show",
-    async (_event, payload: { title?: unknown; body?: unknown }): Promise<{ ok: boolean; reason?: string }> => {
-      if (!Notification.isSupported()) {
-        return { ok: false, reason: "unsupported" }
-      }
-
-      const title = typeof payload?.title === "string" ? payload.title : "CodeNomad"
-      const body = typeof payload?.body === "string" ? payload.body : ""
-      try {
-        const notification = new Notification({ title, body })
-        notification.show()
-        return { ok: true }
-      } catch (error) {
-        return { ok: false, reason: error instanceof Error ? error.message : String(error) }
-      }
-    },
-  )
 }

packages/electron-app/electron/main/main.ts

@@ -6,7 +6,6 @@ import { dirname, join } from "path"
 import { fileURLToPath } from "url"
 import { createApplicationMenu } from "./menu"
 import { setupCliIPC } from "./ipc"
-import { configureMediaPermissionHandlers } from "./permissions"
 import { CliProcessManager } from "./process-manager"
 
 const mainFilename = fileURLToPath(import.meta.url)
@@ -400,11 +399,7 @@ async function exchangeBootstrapToken(baseUrl: string, token: string): Promise<b
 
 async function startCli() {
   try {
-    // In desktop dev workflows we always want the CLI to run in dev mode so it:
-    // - uses plain HTTP
-    // - proxies UI requests to the renderer dev server
-    // Monaco's AMD assets are served from that dev server.
-    const devMode = !app.isPackaged
+    const devMode = process.env.NODE_ENV === "development"
     console.info("[cli] start requested (dev mode:", devMode, ")")
     await cliManager.start({ dev: devMode })
   } catch (error) {
@@ -478,19 +473,10 @@ if (isMac) {
 }
 
 app.whenReady().then(() => {
-  // Required for Windows notifications / taskbar grouping.
-  // Keep in sync with desktop app identifier.
-  try {
-    app.setAppUserModelId("ai.neuralnomads.codenomad.client")
-  } catch {
-    // ignore
-  }
-
   startCli()
 
   if (isMac) {
     session.defaultSession.setSpellCheckerEnabled(false)
-    configureMediaPermissionHandlers(getAllowedRendererOrigins)
     app.on("browser-window-created", (_, window) => {
       window.webContents.session.setSpellCheckerEnabled(false)
     })
@@ -519,6 +505,7 @@ app.on("before-quit", async (event) => {
 })
 
 app.on("window-all-closed", () => {
-  // CodeNomad supports a single window; closing it should quit the app on all platforms.
-  app.quit()
+  if (process.platform !== "darwin") {
+    app.quit()
+  }
 })

packages/electron-app/electron/main/permissions.ts

@@ -1,58 +0,0 @@
-import { session, systemPreferences } from "electron"
-
-const isMac = process.platform === "darwin"
-
-export function isAllowedRendererOrigin(origin: string | undefined | null, allowedOrigins: string[]): boolean {
-  if (!origin) {
-    return false
-  }
-
-  try {
-    const normalized = new URL(origin).origin
-    return allowedOrigins.includes(normalized)
-  } catch {
-    return false
-  }
-}
-
-export function configureMediaPermissionHandlers(getAllowedOrigins: () => string[]) {
-  const isAudioMediaRequest = (permission: string, details?: unknown) => {
-    if (permission !== "media") {
-      return false
-    }
-
-    const mediaTypes = (details as { mediaTypes?: string[] } | undefined)?.mediaTypes ?? []
-    return mediaTypes.length === 0 || mediaTypes.includes("audio")
-  }
-
-  session.defaultSession.setPermissionCheckHandler((_webContents, permission, requestingOrigin, details) => {
-    if (!isAudioMediaRequest(permission, details)) {
-      return false
-    }
-
-    return isAllowedRendererOrigin(requestingOrigin, getAllowedOrigins())
-  })
-
-  session.defaultSession.setPermissionRequestHandler((webContents, permission, callback, details) => {
-    if (!isAudioMediaRequest(permission, details)) {
-      callback(false)
-      return
-    }
-
-    const requestingOrigin = (details as { requestingOrigin?: string } | undefined)?.requestingOrigin || webContents.getURL()
-    callback(isAllowedRendererOrigin(requestingOrigin, getAllowedOrigins()))
-  })
-}
-
-export async function requestMicrophoneAccess(): Promise<boolean> {
-  if (!isMac) {
-    return true
-  }
-
-  const status = systemPreferences.getMediaAccessStatus("microphone")
-  if (status === "granted") {
-    return true
-  }
-
-  return systemPreferences.askForMediaAccess("microphone")
-}

packages/electron-app/electron/main/process-manager.ts

@@ -1,17 +1,13 @@
-import { spawn, spawnSync, type ChildProcess } from "child_process"
-import { app, utilityProcess, type UtilityProcess } from "electron"
+import { spawn, type ChildProcess } from "child_process"
+import { app } from "electron"
 import { createRequire } from "module"
 import { EventEmitter } from "events"
 import { existsSync, readFileSync } from "fs"
 import os from "os"
 import path from "path"
-import { fileURLToPath } from "url"
-import { parse as parseYaml } from "yaml"
 import { buildUserShellCommand, getUserShellEnv, supportsUserShell } from "./user-shell"
 
 const nodeRequire = createRequire(import.meta.url)
-const mainFilename = fileURLToPath(import.meta.url)
-const mainDirname = path.dirname(mainFilename)
 
 const BOOTSTRAP_TOKEN_PREFIX = "CODENOMAD_BOOTSTRAP_TOKEN:"
 
@@ -41,41 +37,8 @@ interface CliEntryResolution {
   runnerPath?: string
 }
 
-type ManagedChild = ChildProcess | UtilityProcess
-type ChildLaunchMode = "spawn" | "utility"
-
 const DEFAULT_CONFIG_PATH = "~/.config/codenomad/config.json"
 
-function isYamlPath(filePath: string): boolean {
-  const lower = filePath.toLowerCase()
-  return lower.endsWith(".yaml") || lower.endsWith(".yml")
-}
-
-function isJsonPath(filePath: string): boolean {
-  return filePath.toLowerCase().endsWith(".json")
-}
-
-function resolveConfigPaths(raw?: string): { configYamlPath: string; legacyJsonPath: string } {
-  const target = raw && raw.trim().length > 0 ? raw.trim() : DEFAULT_CONFIG_PATH
-  const resolved = resolveConfigPath(target)
-
-  if (isYamlPath(resolved)) {
-    const baseDir = path.dirname(resolved)
-    return { configYamlPath: resolved, legacyJsonPath: path.join(baseDir, "config.json") }
-  }
-
-  if (isJsonPath(resolved)) {
-    const baseDir = path.dirname(resolved)
-    return { configYamlPath: path.join(baseDir, "config.yaml"), legacyJsonPath: resolved }
-  }
-
-  // Treat as directory.
-  return {
-    configYamlPath: path.join(resolved, "config.yaml"),
-    legacyJsonPath: path.join(resolved, "config.json"),
-  }
-}
-
 function resolveConfigPath(configPath?: string): string {
   const target = configPath && configPath.trim().length > 0 ? configPath : DEFAULT_CONFIG_PATH
   if (target.startsWith("~/")) {
@@ -90,20 +53,11 @@ function resolveHostForMode(mode: ListeningMode): string {
 
 function readListeningModeFromConfig(): ListeningMode {
   try {
-    const { configYamlPath, legacyJsonPath } = resolveConfigPaths(process.env.CLI_CONFIG)
-
-    let parsed: any = null
-    if (existsSync(configYamlPath)) {
-      const content = readFileSync(configYamlPath, "utf-8")
-      parsed = parseYaml(content)
-    } else if (existsSync(legacyJsonPath)) {
-      const content = readFileSync(legacyJsonPath, "utf-8")
-      parsed = JSON.parse(content)
-    } else {
-      return "local"
-    }
-
-    const mode = parsed?.server?.listeningMode ?? parsed?.preferences?.listeningMode
+    const configPath = resolveConfigPath(process.env.CLI_CONFIG)
+    if (!existsSync(configPath)) return "local"
+    const content = readFileSync(configPath, "utf-8")
+    const parsed = JSON.parse(content)
+    const mode = parsed?.preferences?.listeningMode
     if (mode === "local" || mode === "all") {
       return mode
     }
@@ -123,13 +77,11 @@ export declare interface CliProcessManager {
 }
 
 export class CliProcessManager extends EventEmitter {
-  private child?: ManagedChild
-  private childLaunchMode: ChildLaunchMode = "spawn"
+  private child?: ChildProcess
   private status: CliStatus = { state: "stopped" }
   private stdoutBuffer = ""
   private stderrBuffer = ""
   private bootstrapToken: string | null = null
-  private requestedStop = false
 
   async start(options: StartOptions): Promise<CliStatus> {
     if (this.child) {
@@ -139,66 +91,33 @@ export class CliProcessManager extends EventEmitter {
     this.stdoutBuffer = ""
     this.stderrBuffer = ""
     this.bootstrapToken = null
-    this.requestedStop = false
     this.updateStatus({ state: "starting", port: undefined, pid: undefined, url: undefined, error: undefined })
 
+    const cliEntry = this.resolveCliEntry(options)
     const listeningMode = this.resolveListeningMode()
     const host = resolveHostForMode(listeningMode)
     const args = this.buildCliArgs(options, host)
 
-    let child: ManagedChild
+    console.info(
+      `[cli] launching CodeNomad CLI (${options.dev ? "dev" : "prod"}) using ${cliEntry.runner} at ${cliEntry.entry} (host=${host})`,
+    )
 
-    if (this.shouldUsePackagedShellSupervisor(options)) {
-      const runtimePath = this.resolveShellNodeCommand()
-      const entryPath = this.resolveBundledProdEntry()
-      const supervisorPath = this.resolveCliSupervisorPath()
-      const shellEnv = supportsUserShell() ? getUserShellEnv() : { ...process.env }
-      const shellCommand = buildUserShellCommand(`exec ${this.buildExecutableCommand(runtimePath, [entryPath, ...args])}`)
-      const supervisorPayload = JSON.stringify({
-        command: shellCommand.command,
-        args: shellCommand.args,
-        cwd: process.cwd(),
-      })
+    const env = supportsUserShell() ? getUserShellEnv() : { ...process.env }
+    env.ELECTRON_RUN_AS_NODE = "1"
 
-      console.info(
-        `[cli] launching CodeNomad CLI (${options.dev ? "dev" : "prod"}) via utility supervisor using node at ${runtimePath} (host=${host})`,
-      )
-      console.info(`[cli] utility supervisor: ${supervisorPath}`)
-      console.info(`[cli] shell command: ${shellCommand.command} ${shellCommand.args.join(" ")}`)
+    const spawnDetails = supportsUserShell()
+      ? buildUserShellCommand(`ELECTRON_RUN_AS_NODE=1 exec ${this.buildCommand(cliEntry, args)}`)
+      : this.buildDirectSpawn(cliEntry, args)
 
-      child = utilityProcess.fork(supervisorPath, [supervisorPayload], {
-        env: shellEnv,
-        stdio: "pipe",
-        serviceName: "CodeNomad CLI Supervisor",
-      })
-      this.childLaunchMode = "utility"
-    } else {
-      const cliEntry = this.resolveCliEntry(options)
-      console.info(
-        `[cli] launching CodeNomad CLI (${options.dev ? "dev" : "prod"}) using ${cliEntry.runner} at ${cliEntry.entry} (host=${host})`,
-      )
+    const child = spawn(spawnDetails.command, spawnDetails.args, {
+      cwd: process.cwd(),
+      stdio: ["ignore", "pipe", "pipe"],
+      env,
+      shell: false,
+    })
 
-      const env = supportsUserShell() ? getUserShellEnv() : { ...process.env }
-      env.ELECTRON_RUN_AS_NODE = "1"
-
-      const spawnDetails = supportsUserShell()
-        ? buildUserShellCommand(`ELECTRON_RUN_AS_NODE=1 exec ${this.buildCommand(cliEntry, args)}`)
-        : this.buildDirectSpawn(cliEntry, args)
-
-      const detached = process.platform !== "win32"
-      child = spawn(spawnDetails.command, spawnDetails.args, {
-        cwd: process.cwd(),
-        stdio: ["ignore", "pipe", "pipe"],
-        env,
-        shell: false,
-        detached,
-      })
-
-      console.info(`[cli] spawn command: ${spawnDetails.command} ${spawnDetails.args.join(" ")}`)
-      this.childLaunchMode = "spawn"
-    }
-
-    if (this.childLaunchMode === "spawn" && !child.pid) {
+    console.info(`[cli] spawn command: ${spawnDetails.command} ${spawnDetails.args.join(" ")}`)
+    if (!child.pid) {
       console.error("[cli] spawn failed: no pid")
     }
 
@@ -213,48 +132,23 @@ export class CliProcessManager extends EventEmitter {
       this.handleStream(data.toString(), "stderr")
     })
 
-    if (this.childLaunchMode === "utility") {
-      const utilityChild = child as UtilityProcess
+    child.on("error", (error) => {
+      console.error("[cli] failed to start CLI:", error)
+      this.updateStatus({ state: "error", error: error.message })
+      this.emit("error", error)
+    })
 
-      utilityChild.on("error", (error) => {
-        const message = this.describeUtilityProcessError(error)
-        console.error("[cli] utility supervisor failed:", error)
-        this.updateStatus({ state: "error", error: message })
-        this.emit("error", new Error(message))
-      })
-
-      utilityChild.on("exit", (code) => {
-        const failed = this.status.state !== "ready"
-        const error = failed ? this.status.error ?? `CLI exited with code ${code ?? 0}` : undefined
-        console.info(`[cli] exit (code=${code ?? ""})${error ? ` error=${error}` : ""}`)
-        this.updateStatus({ state: failed ? "error" : "stopped", error })
-        if (failed && error) {
-          this.emit("error", new Error(error))
-        }
-        this.emit("exit", this.status)
-        this.child = undefined
-      })
-    } else {
-      const spawnedChild = child as ChildProcess
-
-      spawnedChild.on("error", (error) => {
-        console.error("[cli] failed to start CLI:", error)
-        this.updateStatus({ state: "error", error: error.message })
-        this.emit("error", error)
-      })
-
-      spawnedChild.on("exit", (code, signal) => {
-        const failed = this.status.state !== "ready"
-        const error = failed ? this.status.error ?? `CLI exited with code ${code ?? 0}${signal ? ` (${signal})` : ""}` : undefined
-        console.info(`[cli] exit (code=${code}, signal=${signal || ""})${error ? ` error=${error}` : ""}`)
-        this.updateStatus({ state: failed ? "error" : "stopped", error })
-        if (failed && error) {
-          this.emit("error", new Error(error))
-        }
-        this.emit("exit", this.status)
-        this.child = undefined
-      })
-    }
+    child.on("exit", (code, signal) => {
+      const failed = this.status.state !== "ready"
+      const error = failed ? this.status.error ?? `CLI exited with code ${code ?? 0}${signal ? ` (${signal})` : ""}` : undefined
+      console.info(`[cli] exit (code=${code}, signal=${signal || ""})${error ? ` error=${error}` : ""}`)
+      this.updateStatus({ state: failed ? "error" : "stopped", error })
+      if (failed && error) {
+        this.emit("error", new Error(error))
+      }
+      this.emit("exit", this.status)
+      this.child = undefined
+    })
 
     return new Promise<CliStatus>((resolve, reject) => {
       const timeout = setTimeout(() => {
@@ -281,98 +175,15 @@ export class CliProcessManager extends EventEmitter {
       return
     }
 
-    if (this.childLaunchMode === "utility") {
-      return this.stopUtilityChild(child as UtilityProcess)
-    }
-
-    const spawnedChild = child as ChildProcess
-
-    this.requestedStop = true
-
-    const pid = spawnedChild.pid
-    if (!pid) {
-      this.child = undefined
-      this.updateStatus({ state: "stopped" })
-      return
-    }
-
-    const isAlreadyExited = () => spawnedChild.exitCode !== null || spawnedChild.signalCode !== null
-
-    const tryKillPosixGroup = (signal: NodeJS.Signals) => {
-      try {
-        // Negative PID targets the process group (POSIX).
-        process.kill(-pid, signal)
-        return true
-      } catch (error) {
-        const err = error as NodeJS.ErrnoException
-        if (err?.code === "ESRCH") {
-          return true
-        }
-        return false
-      }
-    }
-
-    const tryKillSinglePid = (signal: NodeJS.Signals) => {
-      try {
-        process.kill(pid, signal)
-        return true
-      } catch (error) {
-        const err = error as NodeJS.ErrnoException
-        if (err?.code === "ESRCH") {
-          return true
-        }
-        return false
-      }
-    }
-
-    const tryTaskkill = (force: boolean) => {
-      const args = ["/PID", String(pid), "/T"]
-      if (force) {
-        args.push("/F")
-      }
-
-      try {
-        const result = spawnSync("taskkill", args, { encoding: "utf8" })
-        const exitCode = result.status
-        if (exitCode === 0) {
-          return true
-        }
-
-        // If the PID is already gone, treat it as success.
-        const stderr = (result.stderr ?? "").toString().toLowerCase()
-        const stdout = (result.stdout ?? "").toString().toLowerCase()
-        const combined = `${stdout}\n${stderr}`
-        if (combined.includes("not found") || combined.includes("no running instance")) {
-          return true
-        }
-        return false
-      } catch {
-        return false
-      }
-    }
-
-    const sendStopSignal = (signal: NodeJS.Signals) => {
-      if (process.platform === "win32") {
-        tryTaskkill(signal === "SIGKILL")
-        return
-      }
-
-      // Prefer process-group signaling so wrapper launchers (shell/tsx) don't outlive Electron.
-      const groupOk = tryKillPosixGroup(signal)
-      if (!groupOk) {
-        tryKillSinglePid(signal)
-      }
-    }
-
     return new Promise((resolve) => {
       const killTimeout = setTimeout(() => {
         console.warn(
           `[cli] stop timed out after 30000ms; sending SIGKILL (pid=${child.pid ?? "unknown"})`,
         )
-        sendStopSignal("SIGKILL")
+        child.kill("SIGKILL")
       }, 30000)
 
-      spawnedChild.on("exit", () => {
+      child.on("exit", () => {
         clearTimeout(killTimeout)
         this.child = undefined
         console.info("[cli] CLI process exited")
@@ -380,55 +191,7 @@ export class CliProcessManager extends EventEmitter {
         resolve()
       })
 
-      if (isAlreadyExited()) {
-        clearTimeout(killTimeout)
-        this.child = undefined
-        this.updateStatus({ state: "stopped" })
-        resolve()
-        return
-      }
-
-      sendStopSignal("SIGTERM")
-    })
-  }
-
-  private stopUtilityChild(child: UtilityProcess): Promise<void> {
-    this.requestedStop = true
-
-    const pid = child.pid
-    if (!pid) {
-      this.child = undefined
-      this.updateStatus({ state: "stopped" })
-      return Promise.resolve()
-    }
-
-    return new Promise((resolve) => {
-      const killTimeout = setTimeout(() => {
-        console.warn(`[cli] stop timed out after 30000ms; sending SIGKILL (pid=${pid})`)
-        try {
-          process.kill(pid, "SIGKILL")
-        } catch {
-          // no-op
-        }
-      }, 30000)
-
-      child.once("exit", () => {
-        clearTimeout(killTimeout)
-        this.child = undefined
-        console.info("[cli] CLI process exited")
-        this.updateStatus({ state: "stopped" })
-        resolve()
-      })
-
-      if (child.pid === undefined) {
-        clearTimeout(killTimeout)
-        this.child = undefined
-        this.updateStatus({ state: "stopped" })
-        resolve()
-        return
-      }
-
-      child.kill()
+      child.kill("SIGTERM")
     })
   }
 
@@ -442,24 +205,7 @@ export class CliProcessManager extends EventEmitter {
 
   private handleTimeout() {
     if (this.child) {
-      const pid = this.child.pid
-      if (this.childLaunchMode === "utility") {
-        if (pid) {
-          try {
-            process.kill(pid, "SIGKILL")
-          } catch {
-            // no-op
-          }
-        }
-      } else if (pid && process.platform !== "win32") {
-        try {
-          process.kill(-pid, "SIGKILL")
-        } catch {
-          ;(this.child as ChildProcess).kill("SIGKILL")
-        }
-      } else {
-        ;(this.child as ChildProcess).kill("SIGKILL")
-      }
+      this.child.kill("SIGKILL")
       this.child = undefined
     }
     this.updateStatus({ state: "error", error: "CLI did not start in time" })
@@ -503,27 +249,38 @@ export class CliProcessManager extends EventEmitter {
       console.info(`[cli][${stream}] ${trimmed}`)
       this.emit("log", { stream, message: trimmed })
 
-      const localUrl = this.extractLocalUrl(trimmed)
-      if (localUrl && this.status.state === "starting") {
-        let port: number | undefined
-        try {
-          port = Number(new URL(localUrl).port) || undefined
-        } catch {
-          port = undefined
-        }
-        console.info(`[cli] ready on ${localUrl}`)
-        this.updateStatus({ state: "ready", port, url: localUrl })
+      const port = this.extractPort(trimmed)
+      if (port && this.status.state === "starting") {
+        const url = `http://127.0.0.1:${port}`
+        console.info(`[cli] ready on ${url}`)
+        this.updateStatus({ state: "ready", port, url })
         this.emit("ready", this.status)
       }
     }
   }
 
-  private extractLocalUrl(line: string): string | null {
-    const match = line.match(/^Local\s+Connection\s+URL\s*:\s*(https?:\/\/\S+)\s*$/i)
-    if (!match) {
-      return null
+  private extractPort(line: string): number | null {
+    const readyMatch = line.match(/CodeNomad Server is ready at http:\/\/[^:]+:(\d+)/i)
+    if (readyMatch) {
+      return parseInt(readyMatch[1], 10)
     }
-    return match[1] ?? null
+
+    if (line.toLowerCase().includes("http server listening")) {
+      const httpMatch = line.match(/:(\d{2,5})(?!.*:\d)/)
+      if (httpMatch) {
+        return parseInt(httpMatch[1], 10)
+      }
+      try {
+        const parsed = JSON.parse(line)
+        if (typeof parsed.port === "number") {
+          return parsed.port
+        }
+      } catch {
+        // not JSON, ignore
+      }
+    }
+
+    return null
   }
 
   private updateStatus(patch: Partial<CliStatus>) {
@@ -532,24 +289,10 @@ export class CliProcessManager extends EventEmitter {
   }
 
   private buildCliArgs(options: StartOptions, host: string): string[] {
-    const args = ["serve", "--host", host, "--generate-token"]
+    const args = ["serve", "--host", host, "--port", "0", "--generate-token"]
 
     if (options.dev) {
-      // Dev: run plain HTTP + Vite dev server proxy.
-      args.push("--https", "false", "--http", "true")
-      // Avoid collisions with an already-running server (and dual-stack ::/0.0.0.0 quirks)
-      // by forcing an ephemeral port in dev.
-      args.push("--http-port", "0")
-    } else {
-      // Prod desktop: always keep loopback HTTP enabled.
-      args.push("--https", "true", "--http", "true")
-    }
-
-    if (options.dev) {
-      const devServer = process.env.VITE_DEV_SERVER_URL || process.env.ELECTRON_RENDERER_URL || "http://localhost:3000"
-      const rawLogLevel = (process.env.CLI_LOG_LEVEL ?? "info").trim()
-      const logLevel = rawLogLevel.length > 0 ? rawLogLevel.toLowerCase() : "info"
-      args.push("--ui-dev-server", devServer, "--log-level", logLevel)
+      args.push("--ui-dev-server", "http://localhost:3000", "--log-level", "debug")
     }
 
     return args
@@ -565,10 +308,6 @@ export class CliProcessManager extends EventEmitter {
     return parts.join(" ")
   }
 
-  private buildExecutableCommand(command: string, args: string[]): string {
-    return [JSON.stringify(command), ...args.map((arg) => JSON.stringify(arg))].join(" ")
-  }
-
   private buildDirectSpawn(cliEntry: CliEntryResolution, args: string[]) {
     if (cliEntry.runner === "tsx") {
       return { command: process.execPath, args: [cliEntry.runnerPath!, cliEntry.entry, ...args] }
@@ -639,58 +378,4 @@ export class CliProcessManager extends EventEmitter {
     }
     throw new Error("Unable to locate CodeNomad CLI build (dist/bin.js). Run npm run build --workspace @neuralnomads/codenomad.")
   }
-
-  private shouldUsePackagedShellSupervisor(options: StartOptions): boolean {
-    return !options.dev && app.isPackaged && process.platform === "darwin"
-  }
-
-  private resolveCliSupervisorPath(): string {
-    const candidates = [
-      path.join(process.resourcesPath, "cli-supervisor.cjs"),
-      path.join(mainDirname, "../resources/cli-supervisor.cjs"),
-    ]
-
-    for (const candidate of candidates) {
-      if (existsSync(candidate)) {
-        return candidate
-      }
-    }
-
-    throw new Error("Unable to locate CodeNomad CLI supervisor script.")
-  }
-
-  private resolveShellNodeCommand(): string {
-    const configured = process.env.NODE_BINARY?.trim()
-    return configured && configured.length > 0 ? configured : "node"
-  }
-
-  private resolveBundledProdEntry(): string {
-    const candidates = [
-      path.join(process.resourcesPath, "server", "dist", "bin.js"),
-      path.join(mainDirname, "../resources/server/dist/bin.js"),
-    ]
-
-    for (const candidate of candidates) {
-      if (existsSync(candidate)) {
-        return candidate
-      }
-    }
-
-    throw new Error("Unable to locate bundled CodeNomad CLI build in app resources.")
-  }
-
-  private describeUtilityProcessError(error: unknown): string {
-    if (error instanceof Error && error.message) {
-      return error.message
-    }
-
-    if (error && typeof error === "object") {
-      const typed = error as { type?: unknown; location?: unknown }
-      if (typeof typed.type === "string") {
-        return typeof typed.location === "string" ? `${typed.type} at ${typed.location}` : typed.type
-      }
-    }
-
-    return String(error)
-  }
 }

packages/electron-app/electron/preload/index.cjs

@@ -1,4 +1,4 @@
-const { contextBridge, ipcRenderer, webUtils } = require("electron")
+const { contextBridge, ipcRenderer } = require("electron")
 
 const electronAPI = {
   onCliStatus: (callback) => {
@@ -12,17 +12,6 @@ const electronAPI = {
   getCliStatus: () => ipcRenderer.invoke("cli:getStatus"),
   restartCli: () => ipcRenderer.invoke("cli:restart"),
   openDialog: (options) => ipcRenderer.invoke("dialog:open", options),
-  getDirectoryPaths: (paths) => ipcRenderer.invoke("filesystem:getDirectoryPaths", paths),
-  getPathForFile: (file) => {
-    try {
-      return webUtils.getPathForFile(file)
-    } catch {
-      return null
-    }
-  },
-  requestMicrophoneAccess: () => ipcRenderer.invoke("media:requestMicrophoneAccess"),
-  setWakeLock: (enabled) => ipcRenderer.invoke("power:setWakeLock", Boolean(enabled)),
-  showNotification: (payload) => ipcRenderer.invoke("notifications:show", payload),
 }
 
 contextBridge.exposeInMainWorld("electronAPI", electronAPI)

packages/electron-app/electron/resources/cli-supervisor.cjs

@@ -1,131 +0,0 @@
-#!/usr/bin/env node
-
-const { spawn } = require("child_process")
-
-const SHUTDOWN_GRACE_MS = 30_000
-
-let child = null
-let shutdownTimer = null
-
-function log(message, error) {
-  if (error) {
-    console.error(`[cli-supervisor] ${message}`, error)
-    return
-  }
-  console.log(`[cli-supervisor] ${message}`)
-}
-
-function clearShutdownTimer() {
-  if (shutdownTimer) {
-    clearTimeout(shutdownTimer)
-    shutdownTimer = null
-  }
-}
-
-function forwardStream(stream, target) {
-  if (!stream) return
-  stream.on("data", (chunk) => {
-    target.write(chunk)
-  })
-}
-
-function terminateChild(force) {
-  if (!child || child.exitCode !== null || child.signalCode !== null) {
-    return
-  }
-
-  try {
-    child.kill(force ? "SIGKILL" : "SIGTERM")
-  } catch {
-    // no-op
-  }
-}
-
-function requestShutdown(force = false) {
-  if (!child) {
-    process.exit(force ? 1 : 0)
-    return
-  }
-
-  terminateChild(force)
-  if (force) {
-    process.exit(1)
-    return
-  }
-
-  clearShutdownTimer()
-  shutdownTimer = setTimeout(() => {
-    log(`shutdown timed out after ${SHUTDOWN_GRACE_MS}ms; forcing child termination`)
-    terminateChild(true)
-  }, SHUTDOWN_GRACE_MS)
-  shutdownTimer.unref()
-}
-
-function installShutdownHandlers() {
-  process.on("SIGTERM", () => requestShutdown(false))
-  process.on("SIGINT", () => requestShutdown(false))
-  process.on("disconnect", () => requestShutdown(false))
-  process.on("uncaughtException", (error) => {
-    log("uncaught exception", error)
-    requestShutdown(true)
-  })
-  process.on("unhandledRejection", (error) => {
-    log("unhandled rejection", error)
-    requestShutdown(true)
-  })
-}
-
-function parsePayload() {
-  const raw = process.argv[2]
-  if (!raw) {
-    throw new Error("Supervisor payload is required")
-  }
-
-  const parsed = JSON.parse(raw)
-  if (!parsed || typeof parsed !== "object") {
-    throw new Error("Supervisor payload must be an object")
-  }
-  if (typeof parsed.command !== "string" || parsed.command.trim().length === 0) {
-    throw new Error("Supervisor payload command is required")
-  }
-  if (!Array.isArray(parsed.args) || !parsed.args.every((value) => typeof value === "string")) {
-    throw new Error("Supervisor payload args must be a string array")
-  }
-
-  return {
-    command: parsed.command,
-    args: parsed.args,
-    cwd: typeof parsed.cwd === "string" && parsed.cwd.trim().length > 0 ? parsed.cwd : process.cwd(),
-  }
-}
-
-function main() {
-  installShutdownHandlers()
-
-  const payload = parsePayload()
-  log(`launching shell command: ${payload.command} ${payload.args.join(" ")}`)
-
-  child = spawn(payload.command, payload.args, {
-    cwd: payload.cwd,
-    env: process.env,
-    shell: false,
-    stdio: ["ignore", "pipe", "pipe"],
-  })
-
-  forwardStream(child.stdout, process.stdout)
-  forwardStream(child.stderr, process.stderr)
-
-  child.on("error", (error) => {
-    log("failed to spawn shell command", error)
-    process.exit(1)
-  })
-
-  child.on("exit", (code, signal) => {
-    clearShutdownTimer()
-    log(`child exited code=${code ?? ""} signal=${signal ?? ""}`)
-    process.exitCode = typeof code === "number" ? code : signal ? 1 : 0
-    process.exit()
-  })
-}
-
-main()

packages/electron-app/electron/resources/entitlements.mac.plist

@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>com.apple.security.cs.allow-jit</key>
-  <true/>
-  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-  <true/>
-  <key>com.apple.security.cs.disable-library-validation</key>
-  <true/>
-  <key>com.apple.security.device.audio-input</key>
-  <true/>
-</dict>
-</plist>

packages/electron-app/package.json

@@ -1,8 +1,7 @@
 {
   "name": "@neuralnomads/codenomad-electron-app",
-  "version": "0.13.3",
+  "version": "0.9.2",
   "description": "CodeNomad - AI coding assistant",
-  "license": "MIT",
   "author": {
     "name": "Neural Nomads",
     "email": "codenomad@neuralnomads.ai"
@@ -15,13 +14,8 @@
   },
   "homepage": "https://github.com/NeuralNomadsAI/CodeNomad",
   "scripts": {
-    "dev": "npm run dev:info",
-    "dev:info": "cross-env CLI_LOG_LEVEL=info electron-vite dev",
-    "dev:debug": "cross-env CLI_LOG_LEVEL=debug electron-vite dev",
-    "dev:trace": "cross-env CLI_LOG_LEVEL=trace electron-vite dev",
+    "dev": "electron-vite dev",
     "dev:electron": "NODE_ENV=development ELECTRON_ENABLE_LOGGING=1 NODE_OPTIONS=\"--import tsx\" electron electron/main/main.ts",
-    "prepare:resources": "node scripts/prepare-resources.js",
-    "prebuild": "npm run prepare:resources",
     "build": "electron-vite build",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "preview": "electron-vite preview",
@@ -35,22 +29,17 @@
     "build:linux-arm64": "node scripts/build.js linux-arm64",
     "build:linux-rpm": "node scripts/build.js linux-rpm",
     "build:all": "node scripts/build.js all",
-    "prepackage:mac": "npm run prepare:resources",
     "package:mac": "electron-builder --mac",
-    "prepackage:win": "npm run prepare:resources",
     "package:win": "electron-builder --win",
-    "prepackage:linux": "npm run prepare:resources",
     "package:linux": "electron-builder --linux"
   },
   "dependencies": {
     "@neuralnomads/codenomad": "file:../server",
-    "@codenomad/ui": "file:../ui",
-    "yaml": "^2.4.2"
+    "@codenomad/ui": "file:../ui"
   },
   "devDependencies": {
     "7zip-bin": "^5.2.0",
     "app-builder-bin": "^4.2.0",
-    "cross-env": "^7.0.3",
     "electron": "39.0.0",
     "electron-builder": "^24.0.0",
     "electron-vite": "4.0.1",
@@ -87,12 +76,6 @@
       }
     ],
     "mac": {
-      "entitlements": "electron/resources/entitlements.mac.plist",
-      "entitlementsInherit": "electron/resources/entitlements.mac.plist",
-      "extendInfo": {
-        "NSMicrophoneUsageDescription": "CodeNomad needs microphone access for speech-to-text prompt input.",
-        "NSLocalNetworkUsageDescription": "CodeNomad needs local network access to connect to locally hosted AI and speech services."
-      },
       "category": "public.app-category.developer-tools",
       "target": [
         {

packages/electron-app/scripts/build.js

@@ -111,12 +111,6 @@ async function build(platform) {
       env: { NODE_PATH: workspaceNodeModulesPath },
     })
 
-    console.log("\n📦 Step 1.5/3: Preparing packaged server resources...\n")
-    await run(process.execPath, [join(appDir, "scripts", "prepare-resources.js")], {
-      cwd: workspaceRoot,
-      env: { NODE_PATH: workspaceNodeModulesPath },
-    })
-
     console.log("\n📦 Step 2/3: Building Electron app...\n")
     await run(npmCmd, ["run", "build"])
 

packages/electron-app/scripts/prepare-resources.js

@@ -1,132 +0,0 @@
-#!/usr/bin/env node
-
-import fs from "fs"
-import path, { join } from "path"
-import { spawnSync } from "child_process"
-import { fileURLToPath } from "url"
-
-const __dirname = fileURLToPath(new URL(".", import.meta.url))
-const appDir = join(__dirname, "..")
-const workspaceRoot = join(appDir, "..", "..")
-const serverRoot = join(appDir, "..", "server")
-const resourcesRoot = join(appDir, "electron", "resources")
-const serverDest = join(resourcesRoot, "server")
-const npmExecPath = process.env.npm_execpath
-const npmNodeExecPath = process.env.npm_node_execpath
-
-const serverSources = ["dist", "public", "node_modules", "package.json"]
-const serverDepsMarker = join(serverRoot, "node_modules", "fastify", "package.json")
-
-function log(message) {
-  console.log(`[prepare-resources] ${message}`)
-}
-
-function ensureServerBuild() {
-  const distPath = join(serverRoot, "dist")
-  const publicPath = join(serverRoot, "public")
-  if (!fs.existsSync(distPath) || !fs.existsSync(publicPath)) {
-    throw new Error("Server build artifacts are missing. Run the server build before packaging Electron.")
-  }
-}
-
-function ensureServerDependencies() {
-  if (fs.existsSync(serverDepsMarker)) {
-    return
-  }
-
-  log("installing production server dependencies")
-  const npmArgs = [
-    "install",
-    "--omit=dev",
-    "--ignore-scripts",
-    "--workspaces=false",
-    "--package-lock=false",
-    "--install-strategy=shallow",
-    "--fund=false",
-    "--audit=false",
-  ]
-
-  const env = {
-    ...process.env,
-    PATH: `${join(workspaceRoot, "node_modules", ".bin")}${path.delimiter}${process.env.PATH ?? ""}`,
-    npm_config_workspaces: "false",
-  }
-
-  const npmCli = npmExecPath && npmNodeExecPath ? [npmNodeExecPath, [npmExecPath, ...npmArgs]] : null
-  const result = npmCli
-    ? spawnSync(npmCli[0], npmCli[1], { cwd: serverRoot, stdio: "inherit", env })
-    : spawnSync("npm", npmArgs, { cwd: serverRoot, stdio: "inherit", env, shell: process.platform === "win32" })
-
-  if (result.status !== 0) {
-    if (result.error) {
-      throw result.error
-    }
-    throw new Error(`npm install exited with code ${result.status ?? 1}`)
-  }
-}
-
-function copyServerArtifacts() {
-  fs.rmSync(serverDest, { recursive: true, force: true })
-  fs.mkdirSync(serverDest, { recursive: true })
-
-  for (const name of serverSources) {
-    const from = join(serverRoot, name)
-    const to = join(serverDest, name)
-    if (!fs.existsSync(from)) {
-      throw new Error(`Missing required server artifact: ${from}`)
-    }
-    fs.cpSync(from, to, { recursive: true, dereference: true })
-    log(`copied ${name} to Electron resources`) 
-  }
-}
-
-function stripNodeModuleBins() {
-  const root = join(serverDest, "node_modules")
-  if (!fs.existsSync(root)) {
-    return
-  }
-
-  const stack = [root]
-  let removed = 0
-
-  while (stack.length > 0) {
-    const current = stack.pop()
-    if (!current) break
-
-    let entries
-    try {
-      entries = fs.readdirSync(current, { withFileTypes: true })
-    } catch {
-      continue
-    }
-
-    for (const entry of entries) {
-      const full = join(current, entry.name)
-      if (entry.name === ".bin") {
-        fs.rmSync(full, { recursive: true, force: true })
-        removed += 1
-        continue
-      }
-
-      if (entry.isDirectory()) {
-        stack.push(full)
-      }
-    }
-  }
-
-  if (removed > 0) {
-    log(`removed ${removed} node_modules/.bin directories`)
-  }
-}
-
-async function main() {
-  ensureServerBuild()
-  ensureServerDependencies()
-  copyServerArtifacts()
-  stripNodeModuleBins()
-}
-
-main().catch((error) => {
-  console.error("[prepare-resources] failed:", error)
-  process.exit(1)
-})

packages/electron-app/tsconfig.json

@@ -14,5 +14,5 @@
     "noEmit": true
   },
   "include": ["electron/**/*.ts", "electron.vite.config.ts"],
-  "exclude": ["node_modules", "dist", "electron/resources/server"]
+  "exclude": ["node_modules", "dist"]
 }

packages/opencode-config/package.json

@@ -2,8 +2,7 @@
   "name": "@codenomad/opencode-config",
   "version": "0.5.0",
   "private": true,
-  "license": "MIT",
   "dependencies": {
-    "@opencode-ai/plugin": "1.3.7"
+    "@opencode-ai/plugin": "1.1.36"
   }
-}
+}

packages/opencode-config/plugin/codenomad.ts

@@ -2,8 +2,6 @@ import type { PluginInput } from "@opencode-ai/plugin"
 import { createCodeNomadClient, getCodeNomadConfig } from "./lib/client"
 import { createBackgroundProcessTools } from "./lib/background-process"
 
-let voiceModeEnabled = false
-
 export async function CodeNomadPlugin(input: PluginInput) {
   const config = getCodeNomadConfig()
   const client = createCodeNomadClient(config)
@@ -18,11 +16,6 @@ export async function CodeNomadPlugin(input: PluginInput) {
           pingTs: (event.properties as any)?.ts,
         },
       }).catch(() => {})
-      return
-    }
-
-    if (event.type === "codenomad.voiceMode") {
-      voiceModeEnabled = Boolean((event.properties as { enabled?: unknown } | undefined)?.enabled)
     }
   })
 
@@ -30,13 +23,6 @@ export async function CodeNomadPlugin(input: PluginInput) {
     tool: {
       ...backgroundProcessTools,
     },
-    async "chat.message"(_input: { sessionID: string }, output: { message: { system?: string } }) {
-      if (!voiceModeEnabled) {
-        return
-      }
-
-      output.message.system = [output.message.system, buildVoiceModePrompt()].filter(Boolean).join("\n\n")
-    },
     async event(input: { event: any }) {
       const opencodeEvent = input?.event
       if (!opencodeEvent || typeof opencodeEvent !== "object") return
@@ -44,19 +30,3 @@ export async function CodeNomadPlugin(input: PluginInput) {
     },
   }
 }
-
-function buildVoiceModePrompt(): string {
-  return [
-    "Voice conversation mode is enabled.",
-    "Prepend your reply with a fenced code block using language `spoken`.",
-    "The `spoken` block should be the natural conversational reply you would say out loud to the user. It should be a concise spoken gist of the full response in 2 to 4 natural sentences.",
-    "In the spoken block, summarize the main outcome, recommendation, or next step. Sound conversational and natural, not like a document summary.",
-    "Do not include code, bullet lists, markdown formatting, or long technical detail in the spoken block.",
-    "Do not add generic phrases about whether the user should read more.",
-    "Only mention additional written detail when there is something specific that may matter for the user's next response, such as a tradeoff, caveat, risk, open question, exact diff, or test result.",
-    "When referring to that written detail, say `below` or `in the message` rather than `detailed section`.",
-    "After the `spoken` block, continue with your normal detailed response.",
-    "Example:",
-    "```spoken\nI implemented the relay-based voice-mode flow and it works with the current plugin bridge. The reconnect caveat is explained below.\n```",
-  ].join("\n\n")
-}

packages/opencode-config/plugin/lib/request.ts

@@ -1,7 +1,3 @@
-import http from "http"
-import https from "https"
-import { Readable } from "stream"
-
 export type PluginEvent = {
   type: string
   properties?: Record<string, unknown>
@@ -20,8 +16,7 @@ export function getCodeNomadConfig(): CodeNomadConfig {
 }
 
 export function createCodeNomadRequester(config: CodeNomadConfig) {
-  const rawBaseUrl = (config.baseUrl ?? "").trim()
-  const baseUrl = rawBaseUrl.replace(/\/+$/, "")
+  const baseUrl = config.baseUrl.replace(/\/+$/, "")
   const pluginBase = `${baseUrl}/workspaces/${encodeURIComponent(config.instanceId)}/plugin`
   const authorization = buildInstanceAuthorizationHeader()
 
@@ -47,10 +42,10 @@ export function createCodeNomadRequester(config: CodeNomadConfig) {
     const hasBody = init?.body !== undefined
     const headers = buildHeaders(init?.headers, hasBody)
 
-    // The CodeNomad plugin only talks to the local CodeNomad server.
-    // Use a single request implementation that tolerates custom/self-signed certs
-    // without disabling TLS verification for the whole Node process.
-    return nodeFetch(url, { ...init, headers }, { rejectUnauthorized: false })
+    return fetch(url, {
+      ...init,
+      headers,
+    })
   }
 
   const requestJson = async <T>(path: string, init?: RequestInit): Promise<T> => {
@@ -92,91 +87,6 @@ export function createCodeNomadRequester(config: CodeNomadConfig) {
   }
 }
 
-async function nodeFetch(
-  url: string,
-  init: RequestInit & { headers?: Record<string, string> },
-  tls: { rejectUnauthorized: boolean },
-): Promise<Response> {
-  const parsed = new URL(url)
-  const isHttps = parsed.protocol === "https:"
-  const requestFn = isHttps ? https.request : http.request
-
-  const method = (init.method ?? "GET").toUpperCase()
-  const headers = init.headers ?? {}
-  const body = init.body
-
-  return await new Promise<Response>((resolve, reject) => {
-    const req = requestFn(
-      {
-        protocol: parsed.protocol,
-        hostname: parsed.hostname,
-        port: parsed.port ? Number(parsed.port) : undefined,
-        path: `${parsed.pathname}${parsed.search}`,
-        method,
-        headers,
-        ...(isHttps ? { rejectUnauthorized: tls.rejectUnauthorized } : {}),
-      },
-      (res) => {
-        const responseHeaders = new Headers()
-        for (const [key, value] of Object.entries(res.headers)) {
-          if (value === undefined) continue
-          if (Array.isArray(value)) {
-            responseHeaders.set(key, value.join(", "))
-          } else {
-            responseHeaders.set(key, String(value))
-          }
-        }
-
-        // Convert Node stream -> Web ReadableStream for Response.
-        const webBody = Readable.toWeb(res) as unknown as ReadableStream<Uint8Array>
-        resolve(new Response(webBody, { status: res.statusCode ?? 0, headers: responseHeaders }))
-      },
-    )
-
-    const signal = init.signal
-    const abort = () => {
-      const err = new Error("Request aborted")
-      ;(err as any).name = "AbortError"
-      req.destroy(err)
-      reject(err)
-    }
-
-    if (signal) {
-      if (signal.aborted) {
-        abort()
-        return
-      }
-      signal.addEventListener("abort", abort, { once: true })
-      req.once("close", () => signal.removeEventListener("abort", abort))
-    }
-
-    req.once("error", reject)
-
-    if (body === undefined || body === null) {
-      req.end()
-      return
-    }
-
-    if (typeof body === "string") {
-      req.end(body)
-      return
-    }
-
-    if (body instanceof Uint8Array) {
-      req.end(Buffer.from(body))
-      return
-    }
-
-    if (body instanceof ArrayBuffer) {
-      req.end(Buffer.from(new Uint8Array(body)))
-      return
-    }
-
-    // Fallback for less common BodyInit types.
-    req.end(String(body))
-  })
-}
-
 function requireEnv(key: string): string {
   const value = process.env[key]
   if (!value || !value.trim()) {

packages/server/.gitignore

@@ -1,4 +1 @@
 public/
-
-# Local developer config (may contain secrets)
-config-*.json

packages/server/README.md

@@ -5,21 +5,18 @@
 ## Features & Capabilities
 
 ### 🌍 Deployment Freedom
-
 - **Remote Access**: Host CodeNomad on a powerful workstation and access it from your lightweight laptop.
 - **Code Anywhere**: Tunnel in via VPN or SSH to code securely from coffee shops or while traveling.
 - **Multi-Device**: The responsive web client works on tablets and iPads, turning any screen into a dev terminal.
 - **Always-On**: Run as a background service so your sessions are always ready when you connect.
 
 ### ⚡️ Workspace Power
-
 - **Multi-Instance**: Juggle multiple OpenCode sessions side-by-side with per-instance tabs.
 - **Long-Context Native**: Scroll through massive transcripts without hitches.
 - **Deep Task Awareness**: Monitor background tasks and child sessions without losing your flow.
 - **Command Palette**: A single, global palette to jump tabs, launch tools, and fire shortcuts.
 
 ## Prerequisites
-
 - **OpenCode**: `opencode` must be installed and configured on your system.
 - Node.js 18+ and npm (for running or building from source).
 - A workspace folder on disk you want to serve.
@@ -28,26 +25,13 @@
 ## Usage
 
 ### Run via npx (Recommended)
-
 You can run CodeNomad directly without installing it:
 
 ```sh
 npx @neuralnomads/codenomad --launch
 ```
 
-To list all CLI options:
-
-```sh
-npx @neuralnomads/codenomad --help
-```
-
-On startup, CodeNomad prints two URLs:
-
-- `Local Connection URL : ...` (used by desktop shells)
-- `Remote Connection URL : ...` (used by browsers/other machines when remote access is enabled)
-
 ### Install Globally
-
 Or install it globally to use the `codenomad` command:
 
 ```sh
@@ -55,119 +39,20 @@ npm install -g @neuralnomads/codenomad
 codenomad --launch
 ```
 
-### Install Locally (per-project)
-
-If you prefer to install CodeNomad into a project and run the local binary:
-
-```sh
-npm install @neuralnomads/codenomad
-npx codenomad --launch
-```
-
-(`npx codenomad ...` will use `./node_modules/.bin/codenomad` when present.)
-
 ### Common Flags
-
 You can configure the server using flags or environment variables:
 
 | Flag | Env Variable | Description |
 |------|--------------|-------------|
-| `--https <enabled>` | `CLI_HTTPS` | Enable HTTPS listener (default `true`) |
-| `--http <enabled>` | `CLI_HTTP` | Enable HTTP listener (default `false`) |
-| `--https-port <number>` | `CLI_HTTPS_PORT` | HTTPS port (default `9898`, use `0` for auto) |
-| `--http-port <number>` | `CLI_HTTP_PORT` | HTTP port (default `9899`, use `0` for auto) |
-| `--tls-key <path>` | `CLI_TLS_KEY` | TLS private key (PEM). Requires `--tls-cert`. |
-| `--tls-cert <path>` | `CLI_TLS_CERT` | TLS certificate (PEM). Requires `--tls-key`. |
-| `--tls-ca <path>` | `CLI_TLS_CA` | Optional CA chain/bundle (PEM) |
-| `--tlsSANs <list>` | `CLI_TLS_SANS` | Additional TLS SANs (comma-separated) |
+| `--port <number>` | `CLI_PORT` | HTTP port (default 9898) |
 | `--host <addr>` | `CLI_HOST` | Interface to bind (default 127.0.0.1) |
-| `--workspace-root <path>` | `CLI_WORKSPACE_ROOT` | Restricts the root path where new workspaces can be opened. Git worktrees are created in `.codenomad/worktrees` inside the project folder. |
+| `--workspace-root <path>` | `CLI_WORKSPACE_ROOT` | Default root for new workspaces |
 | `--unrestricted-root` | `CLI_UNRESTRICTED_ROOT` | Allow full-filesystem browsing |
 | `--config <path>` | `CLI_CONFIG` | Config file location |
 | `--launch` | `CLI_LAUNCH` | Open the UI in a Chromium-based browser |
 | `--log-level <level>` | `CLI_LOG_LEVEL` | Logging level (trace, debug, info, warn, error) |
-| `--log-destination <path>` | `CLI_LOG_DESTINATION` | Log destination file (defaults to stdout) |
-| `--username <username>` | `CODENOMAD_SERVER_USERNAME` | Username for CodeNomad's internal auth (default `codenomad`) |
-| `--password <password>` | `CODENOMAD_SERVER_PASSWORD` | Password for CodeNomad's internal auth |
-| `--generate-token` | `CODENOMAD_GENERATE_TOKEN` | Emit a one-time local bootstrap token for desktop flows |
-| `--dangerously-skip-auth` | `CODENOMAD_SKIP_AUTH` | Disable CodeNomad's internal auth (use only behind a trusted perimeter) |
-| `--ui-dir <path>` | `CLI_UI_DIR` | Directory containing the built UI bundle |
-| `--ui-dev-server <url>` | `CLI_UI_DEV_SERVER` | Proxy UI requests to a running dev server (requires `--https=false --http=true`) |
-| `--ui-no-update` | `CLI_UI_NO_UPDATE` | Disable remote UI updates |
-| `--ui-auto-update <enabled>` | `CLI_UI_AUTO_UPDATE` | Enable remote UI updates (`true` |
-| `--ui-manifest-url <url>` | `CLI_UI_MANIFEST_URL` | Remote UI manifest URL |
-
-### Dev Releases (Advanced)
-
-If you want the latest bleeding-edge builds (published as GitHub pre-releases), use the dev package:
-
-```sh
-npx @neuralnomads/codenomad-dev --launch
-```
-
-These environment variables control how CodeNomad checks for dev updates:
-
-| Env Variable | Description |
-|-------------|-------------|
-| `CODENOMAD_UPDATE_CHANNEL` | Update channel (use `dev` to enable dev build update checks) |
-| `CODENOMAD_GITHUB_REPO` | GitHub repo used for dev release checks (default `NeuralNomadsAI/CodeNomad`) |
-
-### HTTP vs HTTPS
-
-- Default: `--https=true --http=false` (HTTPS only).
-- To run plain HTTP only (useful for development):
-
-```sh
-codenomad --https=false --http=true
-```
-
-- To run both HTTPS (for remote) and HTTP loopback (for desktop):
-
-```sh
-codenomad --https=true --http=true
-```
-
-### Remote Access Binding Rules
-
-- When remote access is enabled (bind host is non-loopback, e.g. `--host 0.0.0.0`):
-  - HTTP listens on `127.0.0.1` only.
-  - HTTPS listens on `--host` (LAN/all interfaces).
-- When remote access is disabled (bind host is loopback, e.g. `--host 127.0.0.1`):
-  - Both HTTP and HTTPS listen on `127.0.0.1`.
-
-### Self-Signed Certificates
-
-If `--https=true` and you do not provide `--tls-key/--tls-cert`, CodeNomad generates a local certificate automatically under your config directory:
-
-- `~/.config/codenomad/tls/ca-cert.pem`
-- `~/.config/codenomad/tls/server-cert.pem`
-
-Certificates are valid for about 30 days and rotate automatically on startup when needed. You can add extra SANs via:
-
-```sh
-codenomad --tlsSANs "localhost,127.0.0.1,my-hostname,192.168.1.10"
-```
-
-### Authentication
-
-- Default behavior: CodeNomad requires a login (username/password) and stores a session cookie in the browser.
-- `--dangerously-skip-auth` / `CODENOMAD_SKIP_AUTH=true` disables the login prompt and treats all requests as authenticated.
-  Use this only when access is already protected by another layer (SSO proxy, VPN, Coder workspace auth, etc.).
-  If you bind to `0.0.0.0` while skipping auth, anyone who can reach the port can access the API.
-
-### Progressive Web App (PWA)
-
-When running as a server CodeNomad can also be installed as a PWA from any supported browser, giving you a native app experience just like the Electron installation but executing on the remote server instead.
-
-1. Open the CodeNomad UI in a Chromium-based browser (Chrome, Edge, Brave, etc.).
-2. Click the install icon in the address bar, or use the browser menu → "Install CodeNomad".
-3. The app will open in a standalone window and appear in your OS app list.
-
-> **TLS requirement**
-> Browsers require a secure (`https://`) connection for PWA installation.
-> If you host CodeNomad on a remote machine, use HTTPS. Self-signed certificates generally won't work unless they are explicitly trusted by the device/browser (e.g., via a custom CA).
 
 ### Data Storage
-
 - **Config**: `~/.config/codenomad/config.json`
 - **Instance Data**: `~/.config/codenomad/instances` (chat history, etc.)
+

packages/server/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@neuralnomads/codenomad",
-  "version": "0.13.3",
+  "version": "0.9.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@neuralnomads/codenomad",
-      "version": "0.13.3",
+      "version": "0.9.2",
       "dependencies": {
         "@fastify/cors": "^8.5.0",
         "@fastify/reply-from": "^9.8.0",

packages/server/package.json

@@ -1,8 +1,7 @@
 {
   "name": "@neuralnomads/codenomad",
-  "version": "0.13.3",
+  "version": "0.9.2",
   "description": "CodeNomad Server",
-  "license": "MIT",
   "author": {
     "name": "Neural Nomads",
     "email": "codenomad@neuralnomads.ai"
@@ -21,7 +20,7 @@
     "build:ui": "npm run build --prefix ../ui",
     "prepare-ui": "node ./scripts/copy-ui-dist.mjs",
     "prepare-config": "node ./scripts/copy-opencode-config.mjs",
-    "dev": "cross-env CODENOMAD_DEV=1 CODENOMAD_SERVER_PASSWORD=codenomad-dev CLI_UI_DEV_SERVER=http://localhost:3000 CLI_HTTPS=false CLI_HTTP=true tsx src/index.ts",
+    "dev": "cross-env CODENOMAD_DEV=1 CODENOMAD_SERVER_PASSWORD=codenomad-dev CLI_UI_DEV_SERVER=http://localhost:3000 tsx src/index.ts",
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
@@ -31,16 +30,12 @@
     "commander": "^12.1.0",
     "fastify": "^4.28.1",
     "fuzzysort": "^2.0.4",
-    "node-forge": "^1.3.3",
-    "openai": "^6.27.0",
     "pino": "^9.4.0",
     "undici": "^6.19.8",
-    "yaml": "^2.4.2",
     "yauzl": "^2.10.0",
     "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@types/node-forge": "^1.3.14",
     "@types/yauzl": "^2.10.0",
     "cross-env": "^7.0.3",
     "ts-node": "^10.9.2",

packages/server/src/api-types.ts

@@ -1,6 +1,7 @@
 import type {
   AgentModelSelection,
   AgentModelSelections,
+  ConfigFile,
   ModelPreference,
   OpenCodeBinary,
   Preferences,
@@ -49,38 +50,6 @@ export interface WorkspaceDeleteResponse {
   status: WorkspaceStatus
 }
 
-export type WorktreeKind = "root" | "worktree"
-
-export interface WorktreeDescriptor {
-  /** Stable identifier used by CodeNomad + clients ("root" for repo root). */
-  slug: string
-  /** Absolute directory path on the server host. */
-  directory: string
-  kind: WorktreeKind
-  /** Optional VCS branch name when available. */
-  branch?: string
-}
-
-export interface WorktreeListResponse {
-  worktrees: WorktreeDescriptor[]
-  /** True when the workspace folder resolves to a Git repository. */
-  isGitRepo?: boolean
-}
-
-export interface WorktreeCreateRequest {
-  slug: string
-  /** Optional branch name (defaults to slug). */
-  branch?: string
-}
-
-export interface WorktreeMap {
-  version: 1
-  /** Default worktree to use for new sessions and as fallback. */
-  defaultWorktreeSlug: string
-  /** Mapping of *parent* session IDs to a worktree slug. */
-  parentSessionWorktreeSlug: Record<string, string>
-}
-
 export type LogLevel = "debug" | "info" | "warn" | "error"
 
 export interface WorkspaceLogEntry {
@@ -182,9 +151,9 @@ export interface BinaryRecord {
   validationError?: string
 }
 
-export type SettingsOwner = string
-export type SettingsBucket = Record<string, unknown>
-export type SettingsDoc = Record<string, unknown>
+export type AppConfig = ConfigFile
+export type AppConfigResponse = AppConfig
+export type AppConfigUpdateRequest = Partial<AppConfig>
 
 export interface BinaryListResponse {
   binaries: BinaryRecord[]
@@ -207,51 +176,14 @@ export interface BinaryValidationResult {
   error?: string
 }
 
-export interface SpeechSegment {
-  startMs: number
-  endMs: number
-  text: string
-}
-
-export interface SpeechCapabilitiesResponse {
-  available: boolean
-  configured: boolean
-  provider: string
-  supportsStt: boolean
-  supportsTts: boolean
-  supportsStreamingTts: boolean
-  baseUrl?: string
-  sttModel: string
-  ttsModel: string
-  ttsVoice: string
-  ttsFormats: string[]
-  streamingTtsFormats: string[]
-}
-
-export interface SpeechTranscriptionResponse {
-  text: string
-  language?: string
-  durationMs?: number
-  segments?: SpeechSegment[]
-}
-
-export interface SpeechSynthesisResponse {
-  audioBase64: string
-  mimeType: string
-}
-
-export interface VoiceModeStateResponse {
-  enabled: boolean
-}
-
 export type WorkspaceEventType =
   | "workspace.created"
   | "workspace.started"
   | "workspace.error"
   | "workspace.stopped"
   | "workspace.log"
-  | "storage.configChanged"
-  | "storage.stateChanged"
+  | "config.appChanged"
+  | "config.binariesChanged"
   | "instance.dataChanged"
   | "instance.event"
   | "instance.eventStatus"
@@ -262,8 +194,8 @@ export type WorkspaceEventPayload =
   | { type: "workspace.error"; workspace: WorkspaceDescriptor }
   | { type: "workspace.stopped"; workspaceId: string }
   | { type: "workspace.log"; entry: WorkspaceLogEntry }
-  | { type: "storage.configChanged"; owner: SettingsOwner; value: SettingsBucket }
-  | { type: "storage.stateChanged"; owner: SettingsOwner; value: SettingsBucket }
+  | { type: "config.appChanged"; config: AppConfig }
+  | { type: "config.binariesChanged"; binaries: BinaryRecord[] }
   | { type: "instance.dataChanged"; instanceId: string; data: InstanceData }
   | { type: "instance.event"; instanceId: string; event: InstanceStreamEvent }
   | { type: "instance.eventStatus"; instanceId: string; status: InstanceStreamStatus; reason?: string }
@@ -272,8 +204,7 @@ export interface NetworkAddress {
   ip: string
   family: "ipv4" | "ipv6"
   scope: "external" | "internal" | "loopback"
-  /** Remote URL using the server's remote protocol/port for this IP. */
-  remoteUrl: string
+  url: string
 }
 
 export interface LatestReleaseInfo {
@@ -299,20 +230,16 @@ export interface SupportMeta {
 }
 
 export interface ServerMeta {
-  /** URL desktop apps should use to connect (prefers loopback HTTP when enabled). */
-  localUrl: string
-  /** URL remote clients should use (prefers HTTPS when enabled). */
-  remoteUrl?: string
+  /** Base URL clients should target for REST calls (useful for Electron embedding). */
+  httpBaseUrl: string
   /** SSE endpoint advertised to clients (`/api/events` by default). */
   eventsUrl: string
   /** Host the server is bound to (e.g., 127.0.0.1 or 0.0.0.0). */
   host: string
   /** Listening mode derived from host binding. */
   listeningMode: "local" | "all"
-  /** Actual local port in use after binding. */
-  localPort: number
-  /** Actual remote port in use after binding (when remoteUrl is set). */
-  remotePort?: number
+  /** Actual port in use after binding. */
+  port: number
   /** Display label for the host (e.g., hostname or friendly name). */
   hostLabel: string
   /** Absolute path of the filesystem root exposed to clients. */
@@ -322,8 +249,6 @@ export interface ServerMeta {
   serverVersion?: string
   ui?: UiMeta
   support?: SupportMeta
-  /** Optional update info (dev channel only). */
-  update?: LatestReleaseInfo | null
 }
 
 export type BackgroundProcessStatus = "running" | "stopped" | "error"

packages/server/src/auth/manager.ts

@@ -15,25 +15,15 @@ export interface AuthManagerInit {
   username: string
   password?: string
   generateToken: boolean
-  dangerouslySkipAuth?: boolean
 }
 
 export class AuthManager {
-  private readonly authStore: AuthStore | null
+  private readonly authStore: AuthStore
   private readonly tokenManager: TokenManager | null
   private readonly sessionManager = new SessionManager()
   private readonly cookieName = DEFAULT_AUTH_COOKIE_NAME
-  private readonly authEnabled: boolean
 
   constructor(private readonly init: AuthManagerInit, private readonly logger: Logger) {
-    this.authEnabled = !Boolean(init.dangerouslySkipAuth)
-
-    if (!this.authEnabled) {
-      this.authStore = null
-      this.tokenManager = null
-      return
-    }
-
     const authFilePath = resolveAuthFilePath(init.configPath)
     this.authStore = new AuthStore(authFilePath, logger.child({ component: "auth" }))
 
@@ -47,10 +37,6 @@ export class AuthManager {
     this.tokenManager = init.generateToken ? new TokenManager(60_000) : null
   }
 
-  isAuthEnabled(): boolean {
-    return this.authEnabled
-  }
-
   getCookieName(): string {
     return this.cookieName
   }
@@ -70,31 +56,19 @@ export class AuthManager {
   }
 
   validateLogin(username: string, password: string): boolean {
-    if (!this.authEnabled) {
-      return true
-    }
-    return this.requireAuthStore().validateCredentials(username, password)
+    return this.authStore.validateCredentials(username, password)
   }
 
   createSession(username: string) {
-    if (!this.authEnabled) {
-      return { id: "auth-disabled", createdAt: Date.now(), username: this.init.username }
-    }
     return this.sessionManager.createSession(username)
   }
 
   getStatus() {
-    if (!this.authEnabled) {
-      return { username: this.init.username, passwordUserProvided: false }
-    }
-    return this.requireAuthStore().getStatus()
+    return this.authStore.getStatus()
   }
 
   setPassword(password: string) {
-    if (!this.authEnabled) {
-      throw new Error("Internal authentication is disabled")
-    }
-    return this.requireAuthStore().setPassword({ password, markUserProvided: true })
+    return this.authStore.setPassword({ password, markUserProvided: true })
   }
 
   isLoopbackRequest(request: FastifyRequest): boolean {
@@ -102,12 +76,6 @@ export class AuthManager {
   }
 
   getSessionFromRequest(request: FastifyRequest): { username: string; sessionId: string } | null {
-    if (!this.authEnabled) {
-      // When auth is disabled, treat all requests as authenticated.
-      // We still return a stable username so callers can display it.
-      return { username: this.init.username, sessionId: "auth-disabled" }
-    }
-
     const cookies = parseCookies(request.headers.cookie)
     const sessionId = cookies[this.cookieName]
     const session = this.sessionManager.getSession(sessionId)
@@ -119,24 +87,9 @@ export class AuthManager {
     reply.header("Set-Cookie", buildSessionCookie(this.cookieName, sessionId))
   }
 
-  setSessionCookieWithOptions(reply: FastifyReply, sessionId: string, options?: { secure?: boolean }) {
-    reply.header("Set-Cookie", buildSessionCookie(this.cookieName, sessionId, options))
-  }
-
   clearSessionCookie(reply: FastifyReply) {
     reply.header("Set-Cookie", buildSessionCookie(this.cookieName, "", { maxAgeSeconds: 0 }))
   }
-
-  clearSessionCookieWithOptions(reply: FastifyReply, options?: { secure?: boolean }) {
-    reply.header("Set-Cookie", buildSessionCookie(this.cookieName, "", { maxAgeSeconds: 0, ...options }))
-  }
-
-  private requireAuthStore(): AuthStore {
-    if (!this.authStore) {
-      throw new Error("Auth store is unavailable")
-    }
-    return this.authStore
-  }
 }
 
 function resolveAuthFilePath(configPath: string) {
@@ -151,11 +104,8 @@ function resolvePath(filePath: string) {
   return path.resolve(filePath)
 }
 
-function buildSessionCookie(name: string, value: string, options?: { maxAgeSeconds?: number; secure?: boolean }) {
+function buildSessionCookie(name: string, value: string, options?: { maxAgeSeconds?: number }) {
   const parts = [`${name}=${encodeURIComponent(value)}`, "HttpOnly", "Path=/", "SameSite=Lax"]
-  if (options?.secure) {
-    parts.push("Secure")
-  }
   if (options?.maxAgeSeconds !== undefined) {
     parts.push(`Max-Age=${Math.max(0, Math.floor(options.maxAgeSeconds))}`)
   }

packages/server/src/clients/connection-manager.ts

@@ -1,128 +0,0 @@
-import type { Logger } from "../logger"
-
-const STALE_CONNECTION_TIMEOUT_MS = 45000
-const STALE_SWEEP_INTERVAL_MS = 5000
-
-export interface ClientConnectionRef {
-  clientId: string
-  connectionId: string
-}
-
-export interface ClientConnectionRecord extends ClientConnectionRef {
-  key: string
-  connectedAt: number
-  lastSeenAt: number
-}
-
-type ConnectionChangeEvent = {
-  type: "connected" | "disconnected"
-  connection: ClientConnectionRecord
-  reason?: string
-}
-
-interface RegisteredConnection extends ClientConnectionRecord {
-  close: () => void
-}
-
-export class ClientConnectionManager {
-  private readonly connections = new Map<string, RegisteredConnection>()
-  private readonly subscribers = new Set<(event: ConnectionChangeEvent) => void>()
-  private readonly sweepTimer: NodeJS.Timeout
-
-  constructor(private readonly logger: Logger) {
-    this.sweepTimer = setInterval(() => this.sweepStaleConnections(), STALE_SWEEP_INTERVAL_MS)
-    this.sweepTimer.unref?.()
-  }
-
-  shutdown(): void {
-    clearInterval(this.sweepTimer)
-    for (const connection of Array.from(this.connections.values())) {
-      this.disconnect(connection.key, "shutdown", false)
-    }
-  }
-
-  subscribe(listener: (event: ConnectionChangeEvent) => void): () => void {
-    this.subscribers.add(listener)
-    return () => this.subscribers.delete(listener)
-  }
-
-  register(input: ClientConnectionRef & { close: () => void }): () => void {
-    const key = getConnectionKey(input)
-    const now = Date.now()
-    const existing = this.connections.get(key)
-
-    if (existing) {
-      this.logger.debug({ clientId: input.clientId, connectionId: input.connectionId }, "Replacing existing client connection")
-      this.disconnect(key, "replaced")
-    }
-
-    const connection: RegisteredConnection = {
-      key,
-      clientId: input.clientId,
-      connectionId: input.connectionId,
-      connectedAt: now,
-      lastSeenAt: now,
-      close: input.close,
-    }
-    this.connections.set(key, connection)
-    this.logger.debug({ clientId: input.clientId, connectionId: input.connectionId }, "Client connected")
-    this.notify({ type: "connected", connection })
-    return () => this.disconnect(key, "closed")
-  }
-
-  pong(input: ClientConnectionRef): boolean {
-    const key = getConnectionKey(input)
-    const connection = this.connections.get(key)
-    if (!connection) {
-      this.logger.debug({ clientId: input.clientId, connectionId: input.connectionId }, "Ignoring pong for unknown client connection")
-      return false
-    }
-
-    connection.lastSeenAt = Date.now()
-    return true
-  }
-
-  isConnected(input: ClientConnectionRef): boolean {
-    return this.connections.has(getConnectionKey(input))
-  }
-
-  private sweepStaleConnections(): void {
-    const cutoff = Date.now() - STALE_CONNECTION_TIMEOUT_MS
-    for (const connection of Array.from(this.connections.values())) {
-      if (connection.lastSeenAt > cutoff) continue
-      this.logger.debug({ clientId: connection.clientId, connectionId: connection.connectionId }, "Client connection timed out")
-      this.disconnect(connection.key, "timeout")
-    }
-  }
-
-  private disconnect(key: string, reason: string, invokeClose = true): void {
-    const connection = this.connections.get(key)
-    if (!connection) return
-    this.connections.delete(key)
-    this.logger.debug({ clientId: connection.clientId, connectionId: connection.connectionId, reason }, "Client disconnected")
-
-    if (invokeClose) {
-      try {
-        connection.close()
-      } catch (error) {
-        this.logger.warn({ err: error, clientId: connection.clientId, connectionId: connection.connectionId }, "Failed to close stale client connection")
-      }
-    }
-
-    this.notify({ type: "disconnected", connection, reason })
-  }
-
-  private notify(event: ConnectionChangeEvent): void {
-    for (const subscriber of this.subscribers) {
-      try {
-        subscriber(event)
-      } catch (error) {
-        this.logger.warn({ err: error, eventType: event.type }, "Client connection subscriber failed")
-      }
-    }
-  }
-}
-
-function getConnectionKey(input: ClientConnectionRef): string {
-  return `${input.clientId}:${input.connectionId}`
-}

packages/server/src/config/binaries.ts

@@ -0,0 +1,192 @@
+import {
+  BinaryCreateRequest,
+  BinaryRecord,
+  BinaryUpdateRequest,
+  BinaryValidationResult,
+} from "../api-types"
+import { spawnSync } from "child_process"
+import { ConfigStore } from "./store"
+import { EventBus } from "../events/bus"
+import type { ConfigFile } from "./schema"
+import { Logger } from "../logger"
+import { buildSpawnSpec } from "../workspaces/runtime"
+
+export class BinaryRegistry {
+  constructor(
+    private readonly configStore: ConfigStore,
+    private readonly eventBus: EventBus | undefined,
+    private readonly logger: Logger,
+  ) {}
+
+  list(): BinaryRecord[] {
+    return this.mapRecords()
+  }
+
+  resolveDefault(): BinaryRecord {
+    const binaries = this.mapRecords()
+    if (binaries.length === 0) {
+      this.logger.warn("No configured binaries found, falling back to opencode")
+      return this.buildFallbackRecord("opencode")
+    }
+    return binaries.find((binary) => binary.isDefault) ?? binaries[0]
+  }
+
+  create(request: BinaryCreateRequest): BinaryRecord {
+    this.logger.debug({ path: request.path }, "Registering OpenCode binary")
+    const entry = {
+      path: request.path,
+      version: undefined,
+      lastUsed: Date.now(),
+      label: request.label,
+    }
+
+    const config = this.configStore.get()
+    const nextConfig = this.cloneConfig(config)
+    const deduped = nextConfig.opencodeBinaries.filter((binary) => binary.path !== request.path)
+    nextConfig.opencodeBinaries = [entry, ...deduped]
+
+    if (request.makeDefault) {
+      nextConfig.preferences.lastUsedBinary = request.path
+    }
+
+    this.configStore.replace(nextConfig)
+    const record = this.getById(request.path)
+    this.emitChange()
+    return record
+  }
+
+  update(id: string, updates: BinaryUpdateRequest): BinaryRecord {
+    this.logger.debug({ id }, "Updating OpenCode binary")
+    const config = this.configStore.get()
+    const nextConfig = this.cloneConfig(config)
+    nextConfig.opencodeBinaries = nextConfig.opencodeBinaries.map((binary) =>
+      binary.path === id ? { ...binary, label: updates.label ?? binary.label } : binary,
+    )
+
+    if (updates.makeDefault) {
+      nextConfig.preferences.lastUsedBinary = id
+    }
+
+    this.configStore.replace(nextConfig)
+    const record = this.getById(id)
+    this.emitChange()
+    return record
+  }
+
+  remove(id: string) {
+    this.logger.debug({ id }, "Removing OpenCode binary")
+    const config = this.configStore.get()
+    const nextConfig = this.cloneConfig(config)
+    const remaining = nextConfig.opencodeBinaries.filter((binary) => binary.path !== id)
+    nextConfig.opencodeBinaries = remaining
+
+    if (nextConfig.preferences.lastUsedBinary === id) {
+      nextConfig.preferences.lastUsedBinary = remaining[0]?.path
+    }
+
+    this.configStore.replace(nextConfig)
+    this.emitChange()
+  }
+
+  validatePath(path: string): BinaryValidationResult {
+    this.logger.debug({ path }, "Validating OpenCode binary path")
+    return this.validateRecord({
+      id: path,
+      path,
+      label: this.prettyLabel(path),
+      isDefault: false,
+    })
+  }
+
+  private cloneConfig(config: ConfigFile): ConfigFile {
+    return JSON.parse(JSON.stringify(config)) as ConfigFile
+  }
+
+  private mapRecords(): BinaryRecord[] {
+
+    const config = this.configStore.get()
+    const configuredBinaries = config.opencodeBinaries.map<BinaryRecord>((binary) => ({
+      id: binary.path,
+      path: binary.path,
+      label: binary.label ?? this.prettyLabel(binary.path),
+      version: binary.version,
+      isDefault: false,
+    }))
+
+    const defaultPath = config.preferences.lastUsedBinary ?? configuredBinaries[0]?.path ?? "opencode"
+
+    const annotated = configuredBinaries.map((binary) => ({
+      ...binary,
+      isDefault: binary.path === defaultPath,
+    }))
+
+    if (!annotated.some((binary) => binary.path === defaultPath)) {
+      annotated.unshift(this.buildFallbackRecord(defaultPath))
+    }
+
+    return annotated
+  }
+
+  private getById(id: string): BinaryRecord {
+    return this.mapRecords().find((binary) => binary.id === id) ?? this.buildFallbackRecord(id)
+  }
+
+  private emitChange() {
+    this.logger.debug("Emitting binaries changed event")
+    this.eventBus?.publish({ type: "config.binariesChanged", binaries: this.mapRecords() })
+  }
+
+  private validateRecord(record: BinaryRecord): BinaryValidationResult {
+    const inputPath = record.path
+    if (!inputPath) {
+      return { valid: false, error: "Missing binary path" }
+    }
+
+    const spec = buildSpawnSpec(inputPath, ["--version"])
+
+    try {
+      const result = spawnSync(spec.command, spec.args, {
+        encoding: "utf8",
+        windowsVerbatimArguments: Boolean((spec.options as { windowsVerbatimArguments?: boolean }).windowsVerbatimArguments),
+      })
+
+      if (result.error) {
+        return { valid: false, error: result.error.message }
+      }
+
+      if (result.status !== 0) {
+        const stderr = result.stderr?.trim()
+        const stdout = result.stdout?.trim()
+        const combined = stderr || stdout
+        const error = combined ? `Exited with code ${result.status}: ${combined}` : `Exited with code ${result.status}`
+        return { valid: false, error }
+      }
+
+      const stdout = (result.stdout ?? "").trim()
+      const firstLine = stdout.split(/\r?\n/).find((line) => line.trim().length > 0)
+      const normalized = firstLine?.trim()
+
+      const versionMatch = normalized?.match(/([0-9]+\.[0-9]+\.[0-9A-Za-z.-]+)/)
+      const version = versionMatch?.[1]
+
+      return { valid: true, version }
+    } catch (error) {
+      return { valid: false, error: error instanceof Error ? error.message : String(error) }
+    }
+  }
+
+  private buildFallbackRecord(path: string): BinaryRecord {
+    return {
+      id: path,
+      path,
+      label: this.prettyLabel(path),
+      isDefault: true,
+    }
+  }
+
+  private prettyLabel(path: string) {
+    const parts = path.split(/[\\/]/)
+    const last = parts[parts.length - 1] || path
+    return last || path
+  }
+}

packages/server/src/config/location.ts

@@ -1,78 +0,0 @@
-import os from "os"
-import path from "path"
-
-export interface ConfigLocation {
-  /** Resolved absolute base directory containing all persisted server data. */
-  baseDir: string
-  /** Canonical YAML config file path (may be custom when input points to a YAML file). */
-  configYamlPath: string
-  /** Canonical YAML state file path (always in baseDir). */
-  stateYamlPath: string
-  /** Legacy JSON config file path used for migration (always in baseDir, or explicit JSON input). */
-  legacyJsonPath: string
-  /** Directory for per-instance persisted data (chat history etc.). */
-  instancesDir: string
-}
-
-function resolvePath(inputPath: string): string {
-  if (inputPath.startsWith("~/")) {
-    return path.join(os.homedir(), inputPath.slice(2))
-  }
-  return path.resolve(inputPath)
-}
-
-function isYamlPath(filePath: string): boolean {
-  const lower = filePath.toLowerCase()
-  return lower.endsWith(".yaml") || lower.endsWith(".yml")
-}
-
-function isJsonPath(filePath: string): boolean {
-  return filePath.toLowerCase().endsWith(".json")
-}
-
-/**
- * Resolve CodeNomad's config location into a stable base directory + derived file paths.
- *
- * Supported inputs:
- * - Directory: "~/.config/codenomad"
- * - YAML file: "~/.config/codenomad/config.yaml" (or any *.yml/*.yaml)
- * - Legacy JSON file: "~/.config/codenomad/config.json"
- */
-export function resolveConfigLocation(raw: string): ConfigLocation {
-  const trimmed = (raw ?? "").trim()
-  const fallback = "~/.config/codenomad/config.json"
-  const input = trimmed.length > 0 ? trimmed : fallback
-
-  const resolvedInput = resolvePath(input)
-
-  if (isYamlPath(resolvedInput)) {
-    const baseDir = path.dirname(resolvedInput)
-    return {
-      baseDir,
-      configYamlPath: resolvedInput,
-      stateYamlPath: path.join(baseDir, "state.yaml"),
-      legacyJsonPath: path.join(baseDir, "config.json"),
-      instancesDir: path.join(baseDir, "instances"),
-    }
-  }
-
-  if (isJsonPath(resolvedInput)) {
-    const baseDir = path.dirname(resolvedInput)
-    return {
-      baseDir,
-      configYamlPath: path.join(baseDir, "config.yaml"),
-      stateYamlPath: path.join(baseDir, "state.yaml"),
-      legacyJsonPath: resolvedInput,
-      instancesDir: path.join(baseDir, "instances"),
-    }
-  }
-
-  const baseDir = resolvedInput
-  return {
-    baseDir,
-    configYamlPath: path.join(baseDir, "config.yaml"),
-    stateYamlPath: path.join(baseDir, "state.yaml"),
-    legacyJsonPath: path.join(baseDir, "config.json"),
-    instancesDir: path.join(baseDir, "instances"),
-  }
-}

packages/server/src/config/schema.ts

@@ -8,12 +8,10 @@ const ModelPreferenceSchema = z.object({
 const AgentModelSelectionSchema = z.record(z.string(), ModelPreferenceSchema)
 const AgentModelSelectionsSchema = z.record(z.string(), AgentModelSelectionSchema)
 
-const PreferencesSchema = z
-  .object({
+const PreferencesSchema = z.object({
   showThinkingBlocks: z.boolean().default(false),
   thinkingBlocksExpansion: z.enum(["expanded", "collapsed"]).default("expanded"),
   showTimelineTools: z.boolean().default(true),
-  promptSubmitOnEnter: z.boolean().default(false),
   lastUsedBinary: z.string().optional(),
   locale: z.string().optional(),
   environmentVariables: z.record(z.string()).default({}),
@@ -26,15 +24,7 @@ const PreferencesSchema = z
   showUsageMetrics: z.boolean().default(true),
   autoCleanupBlankSessions: z.boolean().default(true),
   listeningMode: z.enum(["local", "all"]).default("local"),
-
-  // OS notifications
-  osNotificationsEnabled: z.boolean().default(false),
-  osNotificationsAllowWhenVisible: z.boolean().default(false),
-  notifyOnNeedsInput: z.boolean().default(true),
-  notifyOnIdle: z.boolean().default(true),
-  })
-  // Preserve unknown preference keys so newer configs survive older binaries.
-  .passthrough()
+})
 
 const RecentFolderSchema = z.object({
   path: z.string(),
@@ -48,35 +38,14 @@ const OpenCodeBinarySchema = z.object({
   label: z.string().optional(),
 })
 
-const ConfigFileSchema = z
-  .object({
-    preferences: PreferencesSchema.default({}),
-    recentFolders: z.array(RecentFolderSchema).default([]),
-    opencodeBinaries: z.array(OpenCodeBinarySchema).default([]),
-    theme: z.enum(["light", "dark", "system"]).optional(),
-  })
-  // Preserve unknown top-level keys so optional future features survive downgrades.
-  .passthrough()
-
-// On-disk config.yaml only stores stable configuration (not volatile state like recent folders).
-const ConfigYamlSchema = z
-  .object({
-    preferences: PreferencesSchema.default({}),
-    opencodeBinaries: z.array(OpenCodeBinarySchema).default([]),
-    theme: z.enum(["light", "dark", "system"]).optional(),
-  })
-  .passthrough()
-
-// On-disk state.yaml stores server-scoped mutable state (per-server, not per-client).
-const StateFileSchema = z
-  .object({
-    recentFolders: z.array(RecentFolderSchema).default([]),
-  })
-  .passthrough()
+const ConfigFileSchema = z.object({
+  preferences: PreferencesSchema.default({}),
+  recentFolders: z.array(RecentFolderSchema).default([]),
+  opencodeBinaries: z.array(OpenCodeBinarySchema).default([]),
+  theme: z.enum(["light", "dark", "system"]).optional(),
+})
 
 const DEFAULT_CONFIG = ConfigFileSchema.parse({})
-const DEFAULT_CONFIG_YAML = ConfigYamlSchema.parse({})
-const DEFAULT_STATE = StateFileSchema.parse({})
 
 export {
   ModelPreferenceSchema,
@@ -86,11 +55,7 @@ export {
   RecentFolderSchema,
   OpenCodeBinarySchema,
   ConfigFileSchema,
-  ConfigYamlSchema,
-  StateFileSchema,
   DEFAULT_CONFIG,
-  DEFAULT_CONFIG_YAML,
-  DEFAULT_STATE,
 }
 
 export type ModelPreference = z.infer<typeof ModelPreferenceSchema>
@@ -100,5 +65,3 @@ export type Preferences = z.infer<typeof PreferencesSchema>
 export type RecentFolder = z.infer<typeof RecentFolderSchema>
 export type OpenCodeBinary = z.infer<typeof OpenCodeBinarySchema>
 export type ConfigFile = z.infer<typeof ConfigFileSchema>
-export type ConfigYamlFile = z.infer<typeof ConfigYamlSchema>
-export type StateFile = z.infer<typeof StateFileSchema>

packages/server/src/config/store.ts

@@ -0,0 +1,78 @@
+import fs from "fs"
+import path from "path"
+import { EventBus } from "../events/bus"
+import { Logger } from "../logger"
+import { ConfigFile, ConfigFileSchema, DEFAULT_CONFIG } from "./schema"
+
+export class ConfigStore {
+  private cache: ConfigFile = DEFAULT_CONFIG
+  private loaded = false
+
+  constructor(
+    private readonly configPath: string,
+    private readonly eventBus: EventBus | undefined,
+    private readonly logger: Logger,
+  ) {}
+
+  load(): ConfigFile {
+    if (this.loaded) {
+      return this.cache
+    }
+
+    try {
+      const resolved = this.resolvePath(this.configPath)
+      if (fs.existsSync(resolved)) {
+        const content = fs.readFileSync(resolved, "utf-8")
+        const parsed = JSON.parse(content)
+        this.cache = ConfigFileSchema.parse(parsed)
+        this.logger.debug({ resolved }, "Loaded existing config file")
+      } else {
+        this.cache = DEFAULT_CONFIG
+        this.logger.debug({ resolved }, "No config file found, using defaults")
+      }
+    } catch (error) {
+      this.logger.warn({ err: error }, "Failed to load config, using defaults")
+      this.cache = DEFAULT_CONFIG
+    }
+
+    this.loaded = true
+    return this.cache
+  }
+
+  get(): ConfigFile {
+    return this.load()
+  }
+
+  replace(config: ConfigFile) {
+    const validated = ConfigFileSchema.parse(config)
+    this.commit(validated)
+  }
+
+  private commit(next: ConfigFile) {
+    this.cache = next
+    this.loaded = true
+    this.persist()
+    const published = Boolean(this.eventBus)
+    this.eventBus?.publish({ type: "config.appChanged", config: this.cache })
+    this.logger.debug({ broadcast: published }, "Config SSE event emitted")
+    this.logger.trace({ config: this.cache }, "Config payload")
+  }
+
+  private persist() {
+    try {
+      const resolved = this.resolvePath(this.configPath)
+      fs.mkdirSync(path.dirname(resolved), { recursive: true })
+      fs.writeFileSync(resolved, JSON.stringify(this.cache, null, 2), "utf-8")
+      this.logger.debug({ resolved }, "Persisted config file")
+    } catch (error) {
+      this.logger.warn({ err: error }, "Failed to persist config")
+    }
+  }
+
+  private resolvePath(filePath: string) {
+    if (filePath.startsWith("~/")) {
+      return path.join(process.env.HOME ?? "", filePath.slice(2))
+    }
+    return path.resolve(filePath)
+  }
+}

packages/server/src/events/bus.ts

@@ -24,8 +24,8 @@ export class EventBus extends EventEmitter {
     this.on("workspace.error", handler)
     this.on("workspace.stopped", handler)
     this.on("workspace.log", handler)
-    this.on("storage.configChanged", handler)
-    this.on("storage.stateChanged", handler)
+    this.on("config.appChanged", handler)
+    this.on("config.binariesChanged", handler)
     this.on("instance.dataChanged", handler)
     this.on("instance.event", handler)
     this.on("instance.eventStatus", handler)
@@ -35,8 +35,8 @@ export class EventBus extends EventEmitter {
       this.off("workspace.error", handler)
       this.off("workspace.stopped", handler)
       this.off("workspace.log", handler)
-      this.off("storage.configChanged", handler)
-      this.off("storage.stateChanged", handler)
+      this.off("config.appChanged", handler)
+      this.off("config.binariesChanged", handler)
       this.off("instance.dataChanged", handler)
       this.off("instance.event", handler)
       this.off("instance.eventStatus", handler)

packages/server/src/filesystem/browser.ts

@@ -81,14 +81,6 @@ export class FileSystemBrowser {
     return { path: relativePath, absolutePath }
   }
 
-  writeFile(relativePath: string, contents: string): void {
-    if (this.unrestricted) {
-      throw new Error("writeFile is not available in unrestricted mode")
-    }
-    const resolved = this.toRestrictedAbsolute(relativePath)
-    fs.writeFileSync(resolved, contents, "utf-8")
-  }
-
   readFile(relativePath: string): string {
     if (this.unrestricted) {
       throw new Error("readFile is not available in unrestricted mode")
@@ -230,18 +222,20 @@ export class FileSystemBrowser {
     const results: FileSystemEntry[] = []
 
     for (const entry of dirents) {
+      if (!options.includeFiles && !entry.isDirectory()) {
+        continue
+      }
+
       const absoluteEntryPath = path.join(directory, entry.name)
       let stats: fs.Stats
       try {
-        // Use fs.statSync (not Dirent.isDirectory) so symlinks to directories
-        // are treated as directories in directory-only listings.
         stats = fs.statSync(absoluteEntryPath)
       } catch {
         // Skip entries we cannot stat (insufficient permissions, etc.)
         continue
       }
 
-      const isDirectory = stats.isDirectory()
+      const isDirectory = entry.isDirectory()
       if (!options.includeFiles && !isDirectory) {
         continue
       }

packages/server/src/index.ts

@@ -8,9 +8,8 @@ import { fileURLToPath } from "url"
 import { createRequire } from "module"
 import { createHttpServer } from "./server/http-server"
 import { WorkspaceManager } from "./workspaces/manager"
-import { resolveConfigLocation } from "./config/location"
-import { SettingsService } from "./settings/service"
-import { BinaryResolver } from "./settings/binaries"
+import { ConfigStore } from "./config/store"
+import { BinaryRegistry } from "./config/binaries"
 import { FileSystemBrowser } from "./filesystem/browser"
 import { EventBus } from "./events/bus"
 import { ServerMeta } from "./api-types"
@@ -20,10 +19,6 @@ import { createLogger } from "./logger"
 import { launchInBrowser } from "./launcher"
 import { resolveUi } from "./ui/remote-ui"
 import { AuthManager, BOOTSTRAP_TOKEN_STDOUT_PREFIX, DEFAULT_AUTH_USERNAME } from "./auth/manager"
-import { resolveHttpsOptions } from "./server/tls"
-import { resolveNetworkAddresses } from "./server/network-addresses"
-import { startDevReleaseMonitor } from "./releases/dev-release-monitor"
-import { SpeechService } from "./speech/service"
 
 const require = createRequire(import.meta.url)
 
@@ -33,15 +28,8 @@ const __dirname = path.dirname(__filename)
 const DEFAULT_UI_STATIC_DIR = path.resolve(__dirname, "../public")
 
 interface CliOptions {
+  port: number
   host: string
-  https: boolean
-  http: boolean
-  httpsPort: number
-  httpPort: number
-  tlsKeyPath?: string
-  tlsCertPath?: string
-  tlsCaPath?: string
-  tlsSANs?: string
   rootDir: string
   configPath: string
   unrestrictedRoot: boolean
@@ -56,13 +44,11 @@ interface CliOptions {
   authUsername: string
   authPassword?: string
   generateToken: boolean
-  dangerouslySkipAuth: boolean
 }
 
+const DEFAULT_PORT = 9898
 const DEFAULT_HOST = "127.0.0.1"
 const DEFAULT_CONFIG_PATH = "~/.config/codenomad/config.json"
-const DEFAULT_HTTPS_PORT = 9898
-const DEFAULT_HTTP_PORT = 9899
 
 function parseCliOptions(argv: string[]): CliOptions {
   const program = new Command()
@@ -70,16 +56,9 @@ function parseCliOptions(argv: string[]): CliOptions {
     .description("CodeNomad CLI server")
     .version(packageJson.version, "-v, --version", "Show the CLI version")
     .addOption(new Option("--host <host>", "Host interface to bind").env("CLI_HOST").default(DEFAULT_HOST))
-    .addOption(new Option("--https <enabled>", "Enable HTTPS listener (true|false)").env("CLI_HTTPS").default("true"))
-    .addOption(new Option("--http <enabled>", "Enable HTTP listener (true|false)").env("CLI_HTTP").default("false"))
-    .addOption(new Option("--https-port <number>", "HTTPS port (0 for auto)").env("CLI_HTTPS_PORT").default(DEFAULT_HTTPS_PORT).argParser(parsePort))
-    .addOption(new Option("--http-port <number>", "HTTP port (0 for auto)").env("CLI_HTTP_PORT").default(DEFAULT_HTTP_PORT).argParser(parsePort))
-    .addOption(new Option("--tls-key <path>", "TLS private key (PEM)").env("CLI_TLS_KEY"))
-    .addOption(new Option("--tls-cert <path>", "TLS certificate (PEM)").env("CLI_TLS_CERT"))
-    .addOption(new Option("--tls-ca <path>", "TLS CA chain (PEM)").env("CLI_TLS_CA"))
-    .addOption(new Option("--tlsSANs <list>", "Additional TLS SANs (comma-separated)").env("CLI_TLS_SANS"))
+    .addOption(new Option("--port <number>", "Port for the HTTP server").env("CLI_PORT").default(DEFAULT_PORT).argParser(parsePort))
     .addOption(
-      new Option("--workspace-root <path>", "Restricts root path where workspaces can be opened").env("CLI_WORKSPACE_ROOT").default(process.cwd()),
+      new Option("--workspace-root <path>", "Workspace root directory").env("CLI_WORKSPACE_ROOT").default(process.cwd()),
     )
     .addOption(new Option("--root <path>").env("CLI_ROOT").hideHelp(true))
     .addOption(new Option("--unrestricted-root", "Allow browsing the full filesystem").env("CLI_UNRESTRICTED_ROOT").default(false))
@@ -105,26 +84,11 @@ function parseCliOptions(argv: string[]): CliOptions {
         .env("CODENOMAD_GENERATE_TOKEN")
         .default(false),
     )
-    .addOption(
-      new Option(
-        "--dangerously-skip-auth",
-        "Disable CodeNomad's internal auth. Use only behind a trusted perimeter (SSO/VPN/etc).",
-      )
-        .env("CODENOMAD_SKIP_AUTH")
-        .default(false),
-    )
 
   program.parse(argv, { from: "user" })
   const parsed = program.opts<{
     host: string
-    https?: string
-    http?: string
-    httpsPort: number
-    httpPort: number
-    tlsKey?: string
-    tlsCert?: string
-    tlsCa?: string
-    tlsSANs?: string
+    port: number
     workspaceRoot?: string
     root?: string
     unrestrictedRoot?: boolean
@@ -140,14 +104,8 @@ function parseCliOptions(argv: string[]): CliOptions {
     username: string
     password?: string
     generateToken?: boolean
-    dangerouslySkipAuth?: boolean
   }>()
 
-  const parseBooleanEnv = (value: string | undefined): boolean => {
-    const normalized = (value ?? "").trim().toLowerCase()
-    return normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "y" || normalized === "on"
-  }
-
   const resolvedRoot = parsed.workspaceRoot ?? parsed.root ?? process.cwd()
 
   const normalizedHost = resolveHost(parsed.host)
@@ -155,23 +113,9 @@ function parseCliOptions(argv: string[]): CliOptions {
   const autoUpdateString = (parsed.uiAutoUpdate ?? "true").trim().toLowerCase()
   const uiAutoUpdate = autoUpdateString === "1" || autoUpdateString === "true" || autoUpdateString === "yes"
 
-  const httpsEnabled = parseBooleanEnv(parsed.https)
-  const httpEnabled = parseBooleanEnv(parsed.http)
-
-  if (!httpsEnabled && !httpEnabled) {
-    throw new InvalidArgumentError("At least one listener must be enabled (--https or --http)")
-  }
-
   return {
+    port: parsed.port,
     host: normalizedHost,
-    https: httpsEnabled,
-    http: httpEnabled,
-    httpsPort: parsed.httpsPort,
-    httpPort: parsed.httpPort,
-    tlsKeyPath: parsed.tlsKey,
-    tlsCertPath: parsed.tlsCert,
-    tlsCaPath: parsed.tlsCa,
-    tlsSANs: parsed.tlsSANs,
     rootDir: resolvedRoot,
     configPath: parsed.config,
     unrestrictedRoot: Boolean(parsed.unrestrictedRoot),
@@ -186,7 +130,6 @@ function parseCliOptions(argv: string[]): CliOptions {
     authUsername: parsed.username,
     authPassword: parsed.password,
     generateToken: Boolean(parsed.generateToken),
-    dangerouslySkipAuth: Boolean(parsed.dangerouslySkipAuth),
   }
 }
 
@@ -231,31 +174,16 @@ async function main() {
 
   logger.info({ options: logOptions }, "Starting CodeNomad CLI server")
 
-  if (options.dangerouslySkipAuth) {
-    logger.warn(
-      "DANGEROUS: internal authentication is disabled (--dangerously-skip-auth / CODENOMAD_SKIP_AUTH).",
-    )
-  }
-
   const eventBus = new EventBus(eventLogger)
 
   const isLoopbackHost = (host: string) => host === "127.0.0.1" || host === "::1" || host.startsWith("127.")
 
-  const configLocation = resolveConfigLocation(options.configPath)
-  const configDir = configLocation.baseDir
-
-  if ((options.tlsKeyPath && !options.tlsCertPath) || (!options.tlsKeyPath && options.tlsCertPath)) {
-    throw new InvalidArgumentError("--tls-key and --tls-cert must be provided together")
-  }
-
   const serverMeta: ServerMeta = {
-    localUrl: "http://localhost:0",
-    remoteUrl: undefined,
+    httpBaseUrl: `http://${options.host}:${options.port}`,
     eventsUrl: `/api/events`,
     host: options.host,
     listeningMode: isLoopbackHost(options.host) ? "local" : "all",
-    localPort: 0,
-    remotePort: undefined,
+    port: options.port,
     hostLabel: options.host,
     workspaceRoot: options.rootDir,
     addresses: [],
@@ -263,49 +191,33 @@ async function main() {
 
   const authManager = new AuthManager(
     {
-      configPath: configLocation.configYamlPath,
+      configPath: options.configPath,
       username: options.authUsername,
       password: options.authPassword,
       generateToken: options.generateToken,
-      dangerouslySkipAuth: options.dangerouslySkipAuth,
     },
     logger.child({ component: "auth" }),
   )
 
-  if (options.generateToken && !options.dangerouslySkipAuth) {
+  if (options.generateToken) {
     const token = authManager.issueBootstrapToken()
     if (token) {
       console.log(`${BOOTSTRAP_TOKEN_STDOUT_PREFIX}${token}`)
     }
   }
 
-  const tlsResolution = resolveHttpsOptions({
-    enabled: options.https,
-    configDir,
-    host: options.host,
-    tlsKeyPath: options.tlsKeyPath,
-    tlsCertPath: options.tlsCertPath,
-    tlsCaPath: options.tlsCaPath,
-    tlsSANs: options.tlsSANs,
-    logger: logger.child({ component: "tls" }),
-  })
-
-  const nodeExtraCaCertsPath = !options.http ? tlsResolution?.caCertPath : undefined
-
-  const settings = new SettingsService(configLocation, eventBus, configLogger)
-  const binaryResolver = new BinaryResolver(settings)
+  const configStore = new ConfigStore(options.configPath, eventBus, configLogger)
+  const binaryRegistry = new BinaryRegistry(configStore, eventBus, configLogger)
   const workspaceManager = new WorkspaceManager({
     rootDir: options.rootDir,
-    settings,
-    binaryResolver,
+    configStore,
+    binaryRegistry,
     eventBus,
     logger: workspaceLogger,
-    getServerBaseUrl: () => serverMeta.localUrl,
-    nodeExtraCaCertsPath,
+    getServerBaseUrl: () => serverMeta.httpBaseUrl,
   })
   const fileSystemBrowser = new FileSystemBrowser({ rootDir: options.rootDir, unrestricted: options.unrestrictedRoot })
-  const instanceStore = new InstanceStore(configLocation.instancesDir)
-  const speechService = new SpeechService(settings, logger.child({ component: "speech" }))
+  const instanceStore = new InstanceStore()
   const instanceEventBridge = new InstanceEventBridge({
     workspaceManager,
     eventBus,
@@ -342,140 +254,28 @@ async function main() {
     minServerVersion: uiResolution.minServerVersion,
   }
 
-  const updateChannel = (process.env.CODENOMAD_UPDATE_CHANNEL ?? "").trim().toLowerCase()
-  const githubRepo = (process.env.CODENOMAD_GITHUB_REPO ?? "NeuralNomadsAI/CodeNomad").trim()
-  const isDevVersion = packageJson.version.includes("-dev.") || packageJson.version.includes("-dev-")
-  const enableDevUpdateChecks = updateChannel === "dev" || (updateChannel === "" && isDevVersion)
-  const devReleaseMonitor = enableDevUpdateChecks
-    ? startDevReleaseMonitor({
-        currentVersion: packageJson.version,
-        repo: githubRepo,
-        logger: logger.child({ component: "updates" }),
-        onUpdate: (release) => {
-          serverMeta.update = release
-        },
-      })
-    : null
+  const server = createHttpServer({
+    host: options.host,
+    port: options.port,
+    workspaceManager,
+    configStore,
+    binaryRegistry,
+    fileSystemBrowser,
+    eventBus,
+    serverMeta,
+    instanceStore,
+    authManager,
+    uiStaticDir: uiResolution.uiStaticDir ?? DEFAULT_UI_STATIC_DIR,
+    uiDevServerUrl: uiResolution.uiDevServerUrl,
+    logger,
+  })
 
-  if (uiResolution.uiDevServerUrl && options.https) {
-    throw new InvalidArgumentError("UI dev proxy is only supported with --https=false --http=true")
-  }
-
-  const remoteAccessEnabled = options.host === "0.0.0.0" || !isLoopbackHost(options.host)
-
-  const httpsPortExplicit = programHasArg(process.argv.slice(2), "--https-port") || Boolean(process.env.CLI_HTTPS_PORT)
-  const httpPortExplicit = programHasArg(process.argv.slice(2), "--http-port") || Boolean(process.env.CLI_HTTP_PORT)
-
-  const httpsBindPort = httpsPortExplicit ? options.httpsPort : 0
-  const httpBindPort = httpPortExplicit ? options.httpPort : 0
-
-  // Listener binding rules:
-  // - Remote access enabled: HTTP listens on loopback, HTTPS on all IPs (host=0.0.0.0 / LAN IP).
-  // - Remote access disabled: both listen on loopback.
-  // - HTTP-only mode: respect --host (used for dev/testing).
-  const httpsBindHost = remoteAccessEnabled ? options.host : "127.0.0.1"
-  const httpBindHost = options.http ? (options.https ? "127.0.0.1" : options.host) : "127.0.0.1"
-
-  const servers: Array<ReturnType<typeof createHttpServer>> = []
-
-  const httpServer = options.http
-    ? createHttpServer({
-        bindHost: httpBindHost,
-        bindPort: httpBindPort,
-        defaultPort: options.httpPort,
-        protocol: "http",
-        workspaceManager,
-        settings,
-        fileSystemBrowser,
-        eventBus,
-        serverMeta,
-        instanceStore,
-        speechService,
-        authManager,
-        uiStaticDir: uiResolution.uiStaticDir ?? DEFAULT_UI_STATIC_DIR,
-        uiDevServerUrl: uiResolution.uiDevServerUrl,
-        logger,
-      })
-    : null
-
-  const httpsServer = options.https
-    ? createHttpServer({
-        bindHost: httpsBindHost,
-        bindPort: httpsBindPort,
-        defaultPort: options.httpsPort,
-        protocol: "https",
-        httpsOptions: tlsResolution?.httpsOptions,
-        workspaceManager,
-        settings,
-        fileSystemBrowser,
-        eventBus,
-        serverMeta,
-        instanceStore,
-        speechService,
-        authManager,
-        uiStaticDir: uiResolution.uiStaticDir ?? DEFAULT_UI_STATIC_DIR,
-        uiDevServerUrl: undefined,
-        logger,
-      })
-    : null
-
-  if (httpServer) servers.push(httpServer)
-  if (httpsServer) servers.push(httpsServer)
-
-  const [httpStart, httpsStart] = await Promise.all([
-    httpServer ? httpServer.start() : Promise.resolve(null),
-    httpsServer ? httpsServer.start() : Promise.resolve(null),
-  ])
-
-  const localStart = httpStart ?? httpsStart
-  if (!localStart) {
-    throw new Error("No listeners started")
-  }
-
-  const remoteStart = httpsStart ?? httpStart
-  const localProtocol: "http" | "https" = httpStart ? "http" : "https"
-  const remoteProtocol: "http" | "https" = httpsStart ? "https" : "http"
-
-  // Use an explicit IPv4 loopback address for the "local" URL.
-  // On macOS, `localhost` often resolves to ::1 first, and it is possible to have
-  // another instance bound on IPv6 while this instance binds IPv4 (or vice versa),
-  // which can lead clients to talk to the wrong process.
-  const localUrl = `${localProtocol}://127.0.0.1:${localStart.port}`
-  let remoteUrl: string | undefined
-  if (remoteStart) {
-    const wantsAll = options.host === "0.0.0.0" || !isLoopbackHost(options.host)
-    let remoteHost = options.host
-    if (wantsAll) {
-      if (options.host === "0.0.0.0") {
-        const candidates = resolveNetworkAddresses({ host: options.host, protocol: remoteProtocol, port: remoteStart.port })
-        remoteHost = candidates.find((addr) => addr.scope === "external")?.ip ?? "localhost"
-      }
-    } else {
-      remoteHost = "localhost"
-    }
-    remoteUrl = `${remoteProtocol}://${remoteHost}:${remoteStart.port}`
-  }
-
-  serverMeta.localUrl = localUrl
-  serverMeta.localPort = localStart.port
-  serverMeta.remoteUrl = remoteUrl
-  serverMeta.remotePort = remoteStart?.port
-  serverMeta.host = options.host
-  serverMeta.listeningMode = options.host === "0.0.0.0" || !isLoopbackHost(options.host) ? "all" : "local"
-
-  if (serverMeta.remotePort && remoteUrl) {
-    serverMeta.addresses = resolveNetworkAddresses({ host: options.host, protocol: remoteProtocol, port: serverMeta.remotePort })
-  } else {
-    serverMeta.addresses = []
-  }
-
-  console.log(`Local Connection URL : ${serverMeta.localUrl}`)
-  if (serverMeta.remoteUrl) {
-    console.log(`Remote Connection URL : ${serverMeta.remoteUrl}`)
-  }
+  const startInfo = await server.start()
+  logger.info({ port: startInfo.port, host: options.host }, "HTTP server listening")
+  console.log(`CodeNomad Server is ready at ${startInfo.url}`)
 
   if (options.launch) {
-    await launchInBrowser(serverMeta.localUrl, logger.child({ component: "launcher" }))
+    await launchInBrowser(startInfo.url, logger.child({ component: "launcher" }))
   }
 
   let shuttingDown = false
@@ -505,8 +305,8 @@ async function main() {
 
     const shutdownHttp = (async () => {
       try {
-        await Promise.allSettled(servers.map((srv) => srv.stop()))
-        logger.info("HTTP server(s) stopped")
+        await server.stop()
+        logger.info("HTTP server stopped")
       } catch (error) {
         logger.error({ err: error }, "Failed to stop HTTP server")
       }
@@ -516,8 +316,6 @@ async function main() {
 
     // no-op: remote UI manifest replaces GitHub release monitor
 
-    devReleaseMonitor?.stop()
-
     logger.info("Exiting process")
     process.exit(0)
   }

packages/server/src/plugins/voice-mode.ts

@@ -1,96 +0,0 @@
-import type { Logger } from "../logger"
-import type { ClientConnectionManager, ClientConnectionRef } from "../clients/connection-manager"
-import type { PluginChannelManager } from "./channel"
-
-interface VoiceModeManagerOptions {
-  connections: ClientConnectionManager
-  channel: PluginChannelManager
-  logger: Logger
-}
-
-export class VoiceModeManager {
-  private readonly enabledConnectionsByInstance = new Map<string, Set<string>>()
-  private readonly aggregateByInstance = new Map<string, boolean>()
-
-  constructor(private readonly options: VoiceModeManagerOptions) {
-    this.options.connections.subscribe((event) => {
-      if (event.type !== "disconnected") return
-      this.clearConnection(event.connection)
-    })
-  }
-
-  setEnabled(instanceId: string, connection: ClientConnectionRef, enabled: boolean): void {
-    if (enabled && !this.options.connections.isConnected(connection)) {
-      this.options.logger.debug(
-        { instanceId, clientId: connection.clientId, connectionId: connection.connectionId },
-        "Ignoring voice mode enable for disconnected client connection",
-      )
-      return
-    }
-
-    const key = getConnectionKey(connection)
-    const current = this.enabledConnectionsByInstance.get(instanceId) ?? new Set<string>()
-
-    if (enabled) {
-      current.add(key)
-      this.enabledConnectionsByInstance.set(instanceId, current)
-    } else if (current.delete(key)) {
-      if (current.size === 0) {
-        this.enabledConnectionsByInstance.delete(instanceId)
-      } else {
-        this.enabledConnectionsByInstance.set(instanceId, current)
-      }
-    }
-
-    this.options.logger.debug({ instanceId, clientId: connection.clientId, connectionId: connection.connectionId, enabled }, "Voice mode updated for client connection")
-    this.publishIfChanged(instanceId)
-  }
-
-  syncInstance(instanceId: string): void {
-    this.options.channel.send(instanceId, buildVoiceModeEvent(this.isEnabled(instanceId)))
-  }
-
-  isEnabled(instanceId: string): boolean {
-    return this.aggregateByInstance.get(instanceId) === true
-  }
-
-  private clearConnection(connection: ClientConnectionRef): void {
-    const key = getConnectionKey(connection)
-    for (const [instanceId, enabledConnections] of Array.from(this.enabledConnectionsByInstance.entries())) {
-      if (!enabledConnections.delete(key)) continue
-      if (enabledConnections.size === 0) {
-        this.enabledConnectionsByInstance.delete(instanceId)
-      }
-      this.publishIfChanged(instanceId)
-    }
-  }
-
-  private publishIfChanged(instanceId: string): void {
-    const enabled = (this.enabledConnectionsByInstance.get(instanceId)?.size ?? 0) > 0
-    const previous = this.aggregateByInstance.get(instanceId) === true
-    if (enabled === previous) return
-
-    if (enabled) {
-      this.aggregateByInstance.set(instanceId, true)
-    } else {
-      this.aggregateByInstance.delete(instanceId)
-    }
-
-    this.options.logger.debug({ instanceId, enabled }, "Broadcasting aggregate voice mode")
-    this.options.channel.send(instanceId, buildVoiceModeEvent(enabled))
-  }
-}
-
-function buildVoiceModeEvent(enabled: boolean) {
-  return {
-    type: "codenomad.voiceMode",
-    properties: {
-      enabled,
-      formatVersion: "v1",
-    },
-  }
-}
-
-function getConnectionKey(connection: ClientConnectionRef): string {
-  return `${connection.clientId}:${connection.connectionId}`
-}

packages/server/src/releases/dev-release-monitor.ts

@@ -1,118 +0,0 @@
-import { fetch } from "undici"
-import type { LatestReleaseInfo } from "../api-types"
-import type { Logger } from "../logger"
-import { compareVersionStrings, stripTagPrefix } from "./release-monitor"
-
-interface DevReleaseMonitorOptions {
-  /** Current running server version (from package.json). */
-  currentVersion: string
-  /** GitHub repo in the form "owner/name". */
-  repo: string
-  logger: Logger
-  onUpdate: (release: LatestReleaseInfo | null) => void
-  pollIntervalMs?: number
-}
-
-interface GithubReleaseListItem {
-  tag_name?: string
-  name?: string
-  html_url?: string
-  body?: string
-  published_at?: string
-  created_at?: string
-  prerelease?: boolean
-  draft?: boolean
-}
-
-export interface DevReleaseMonitor {
-  stop(): void
-}
-
-const DEFAULT_POLL_INTERVAL_MS = 15 * 60 * 1000
-
-export function startDevReleaseMonitor(options: DevReleaseMonitorOptions): DevReleaseMonitor {
-  let stopped = false
-  let timer: ReturnType<typeof setInterval> | null = null
-
-  const pollIntervalMs =
-    Number.isFinite(options.pollIntervalMs) && (options.pollIntervalMs ?? 0) > 0
-      ? (options.pollIntervalMs as number)
-      : DEFAULT_POLL_INTERVAL_MS
-
-  const refresh = async () => {
-    if (stopped) return
-    try {
-      const release = await fetchLatestPrerelease({
-        repo: options.repo,
-        currentVersion: options.currentVersion,
-      })
-      options.onUpdate(release)
-    } catch (error) {
-      options.logger.debug({ err: error }, "Failed to refresh dev prerelease information")
-    }
-  }
-
-  void refresh()
-  timer = setInterval(() => void refresh(), pollIntervalMs)
-
-  return {
-    stop() {
-      stopped = true
-      if (timer) {
-        clearInterval(timer)
-        timer = null
-      }
-    },
-  }
-}
-
-async function fetchLatestPrerelease(args: {
-  repo: string
-  currentVersion: string
-}): Promise<LatestReleaseInfo | null> {
-  const normalizedRepo = args.repo.trim()
-  if (!/^[^/\s]+\/[^/\s]+$/.test(normalizedRepo)) {
-    throw new Error(`Invalid GitHub repo: ${args.repo}`)
-  }
-
-  const apiUrl = `https://api.github.com/repos/${normalizedRepo}/releases?per_page=20`
-  const response = await fetch(apiUrl, {
-    headers: {
-      Accept: "application/vnd.github+json",
-      "User-Agent": "CodeNomad-CLI",
-    },
-  })
-
-  if (!response.ok) {
-    throw new Error(`GitHub releases API responded with ${response.status}`)
-  }
-
-  const list = (await response.json()) as GithubReleaseListItem[]
-  const latest = list.find((r) => r && r.prerelease === true && r.draft !== true)
-  if (!latest) {
-    return null
-  }
-
-  const tag = latest.tag_name || latest.name
-  if (!tag) {
-    return null
-  }
-
-  const normalizedVersion = stripTagPrefix(tag)
-  if (!normalizedVersion) {
-    return null
-  }
-
-  if (compareVersionStrings(normalizedVersion, args.currentVersion) <= 0) {
-    return null
-  }
-
-  return {
-    version: normalizedVersion,
-    tag,
-    url: latest.html_url ?? `https://github.com/${normalizedRepo}/releases/tag/${encodeURIComponent(tag)}`,
-    channel: "dev",
-    publishedAt: latest.published_at ?? latest.created_at,
-    notes: latest.body,
-  }
-}

packages/server/src/releases/release-monitor.ts

@@ -52,12 +52,6 @@ export function startReleaseMonitor(options: ReleaseMonitorOptions): ReleaseMoni
   }
 }
 
-export function compareVersionStrings(a: string, b: string): number {
-  const left = parseVersion(a)
-  const right = parseVersion(b)
-  return compareVersions(left, right)
-}
-
 async function fetchLatestRelease(options: ReleaseMonitorOptions): Promise<LatestReleaseInfo | null> {
   const response = await fetch(RELEASES_API_URL, {
     headers: {
@@ -98,7 +92,7 @@ async function fetchLatestRelease(options: ReleaseMonitorOptions): Promise<Lates
   }
 }
 
-export function stripTagPrefix(tag: string | undefined): string | null {
+function stripTagPrefix(tag: string | undefined): string | null {
   if (!tag) return null
   const trimmed = tag.trim()
   if (!trimmed) return null
@@ -107,9 +101,7 @@ export function stripTagPrefix(tag: string | undefined): string | null {
 
 function parseVersion(value: string): NormalizedVersion {
   const normalized = stripTagPrefix(value) ?? "0.0.0"
-  const dashIndex = normalized.indexOf("-")
-  const core = dashIndex >= 0 ? normalized.slice(0, dashIndex) : normalized
-  const prerelease = dashIndex >= 0 ? normalized.slice(dashIndex + 1) : null
+  const [core, prerelease = null] = normalized.split("-", 2)
   const [major = 0, minor = 0, patch = 0] = core.split(".").map((segment) => {
     const parsed = Number.parseInt(segment, 10)
     return Number.isFinite(parsed) ? parsed : 0

packages/server/src/server/http-server.ts

@@ -7,46 +7,36 @@ import path from "path"
 import { fetch } from "undici"
 import type { Logger } from "../logger"
 import { WorkspaceManager } from "../workspaces/manager"
-import { isValidWorktreeSlug, listWorktrees, resolveRepoRoot } from "../workspaces/git-worktrees"
 
-import type { SettingsService } from "../settings/service"
+import { ConfigStore } from "../config/store"
+import { BinaryRegistry } from "../config/binaries"
 import { FileSystemBrowser } from "../filesystem/browser"
 import { EventBus } from "../events/bus"
 import { registerWorkspaceRoutes } from "./routes/workspaces"
-import { registerSettingsRoutes } from "./routes/settings"
+import { registerConfigRoutes } from "./routes/config"
 import { registerFilesystemRoutes } from "./routes/filesystem"
 import { registerMetaRoutes } from "./routes/meta"
 import { registerEventRoutes } from "./routes/events"
 import { registerStorageRoutes } from "./routes/storage"
 import { registerPluginRoutes } from "./routes/plugin"
 import { registerBackgroundProcessRoutes } from "./routes/background-processes"
-import { registerWorktreeRoutes } from "./routes/worktrees"
-import { registerSpeechRoutes } from "./routes/speech"
 import { ServerMeta } from "../api-types"
 import { InstanceStore } from "../storage/instance-store"
 import { BackgroundProcessManager } from "../background-processes/manager"
 import type { AuthManager } from "../auth/manager"
 import { registerAuthRoutes } from "./routes/auth"
 import { sendUnauthorized, wantsHtml } from "../auth/http-auth"
-import type { SpeechService } from "../speech/service"
-import { ClientConnectionManager } from "../clients/connection-manager"
-import { PluginChannelManager } from "../plugins/channel"
-import { VoiceModeManager } from "../plugins/voice-mode"
 
 interface HttpServerDeps {
-  bindHost: string
-  bindPort: number
-  /** When bindPort is 0, try this first. */
-  defaultPort: number
-  protocol: "http" | "https"
-  httpsOptions?: { key: string | Buffer; cert: string | Buffer; ca?: string | Buffer }
+  host: string
+  port: number
   workspaceManager: WorkspaceManager
-  settings: SettingsService
+  configStore: ConfigStore
+  binaryRegistry: BinaryRegistry
   fileSystemBrowser: FileSystemBrowser
   eventBus: EventBus
   serverMeta: ServerMeta
   instanceStore: InstanceStore
-  speechService: SpeechService
   authManager: AuthManager
   uiStaticDir: string
   uiDevServerUrl?: string
@@ -59,15 +49,10 @@ interface HttpServerStartResult {
   displayHost: string
 }
 
+const DEFAULT_HTTP_PORT = 9898
+
 export function createHttpServer(deps: HttpServerDeps) {
-  // Fastify's type-level RawServer inference gets noisy when toggling HTTP vs HTTPS.
-  // We keep the runtime behavior correct and cast the instance to a generic FastifyInstance.
-  const app = Fastify(
-    ({
-      logger: false,
-      ...(deps.protocol === "https" && deps.httpsOptions ? { https: deps.httpsOptions } : {}),
-    } as unknown) as any,
-  ) as unknown as FastifyInstance
+  const app = Fastify({ logger: false })
   const proxyLogger = deps.logger.child({ component: "proxy" })
   const apiLogger = deps.logger.child({ component: "http" })
   const sseLogger = deps.logger.child({ component: "sse" })
@@ -110,27 +95,6 @@ export function createHttpServer(deps: HttpServerDeps) {
   const allowedDevOrigins = new Set(["http://localhost:3000", "http://127.0.0.1:3000"])
   const isLoopbackHost = (host: string) => host === "127.0.0.1" || host === "::1" || host.startsWith("127.")
 
-  const getSelfOrigins = (): Set<string> => {
-    const origins = new Set<string>()
-    const candidates: Array<string | undefined> = [deps.serverMeta.localUrl, deps.serverMeta.remoteUrl]
-    for (const candidate of candidates) {
-      if (!candidate) continue
-      try {
-        origins.add(new URL(candidate).origin)
-      } catch {
-        // ignore
-      }
-    }
-    for (const addr of deps.serverMeta.addresses ?? []) {
-      try {
-        origins.add(new URL(addr.remoteUrl).origin)
-      } catch {
-        // ignore
-      }
-    }
-    return origins
-  }
-
   app.register(cors, {
     origin: (origin, cb) => {
       if (!origin) {
@@ -138,8 +102,14 @@ export function createHttpServer(deps: HttpServerDeps) {
         return
       }
 
-      const selfOrigins = getSelfOrigins()
-      if (selfOrigins.has(origin)) {
+      let selfOrigin: string | null = null
+      try {
+        selfOrigin = new URL(deps.serverMeta.httpBaseUrl).origin
+      } catch {
+        selfOrigin = null
+      }
+
+      if (selfOrigin && origin === selfOrigin) {
         cb(null, true)
         return
       }
@@ -150,7 +120,7 @@ export function createHttpServer(deps: HttpServerDeps) {
        }
 
        // When we bind to a non-loopback host (e.g., 0.0.0.0 or LAN IP), allow cross-origin UI access.
-       if (deps.bindHost === "0.0.0.0" || !isLoopbackHost(deps.bindHost)) {
+       if (deps.host === "0.0.0.0" || !isLoopbackHost(deps.host)) {
          cb(null, true)
          return
        }
@@ -176,13 +146,6 @@ export function createHttpServer(deps: HttpServerDeps) {
     eventBus: deps.eventBus,
     logger: deps.logger.child({ component: "background-processes" }),
   })
-  const clientConnectionManager = new ClientConnectionManager(deps.logger.child({ component: "client-connections" }))
-  const pluginChannel = new PluginChannelManager(deps.logger.child({ component: "plugin-channel" }))
-  const voiceModeManager = new VoiceModeManager({
-    connections: clientConnectionManager,
-    channel: pluginChannel,
-    logger: deps.logger.child({ component: "voice-mode" }),
-  })
 
   registerAuthRoutes(app, { authManager: deps.authManager })
 
@@ -255,29 +218,16 @@ export function createHttpServer(deps: HttpServerDeps) {
   })
 
   registerWorkspaceRoutes(app, { workspaceManager: deps.workspaceManager })
-  registerSettingsRoutes(app, { settings: deps.settings, logger: apiLogger })
+  registerConfigRoutes(app, { configStore: deps.configStore, binaryRegistry: deps.binaryRegistry })
   registerFilesystemRoutes(app, { fileSystemBrowser: deps.fileSystemBrowser })
   registerMetaRoutes(app, { serverMeta: deps.serverMeta })
-  registerEventRoutes(app, {
-    eventBus: deps.eventBus,
-    registerClient: registerSseClient,
-    logger: sseLogger,
-    connectionManager: clientConnectionManager,
-  })
-  registerWorktreeRoutes(app, { workspaceManager: deps.workspaceManager })
+  registerEventRoutes(app, { eventBus: deps.eventBus, registerClient: registerSseClient, logger: sseLogger })
   registerStorageRoutes(app, {
     instanceStore: deps.instanceStore,
     eventBus: deps.eventBus,
     workspaceManager: deps.workspaceManager,
   })
-  registerSpeechRoutes(app, { speechService: deps.speechService })
-  registerPluginRoutes(app, {
-    workspaceManager: deps.workspaceManager,
-    eventBus: deps.eventBus,
-    logger: proxyLogger,
-    channel: pluginChannel,
-    voiceModeManager,
-  })
+  registerPluginRoutes(app, { workspaceManager: deps.workspaceManager, eventBus: deps.eventBus, logger: proxyLogger })
   registerBackgroundProcessRoutes(app, { backgroundProcessManager })
   registerInstanceProxyRoutes(app, { workspaceManager: deps.workspaceManager, logger: proxyLogger })
 
@@ -292,12 +242,12 @@ export function createHttpServer(deps: HttpServerDeps) {
     instance: app,
     start: async (): Promise<HttpServerStartResult> => {
       const attemptListen = async (requestedPort: number) => {
-        const addressInfo = await app.listen({ port: requestedPort, host: deps.bindHost })
+        const addressInfo = await app.listen({ port: requestedPort, host: deps.host })
         return { addressInfo, requestedPort }
       }
 
-      const autoPortRequested = deps.bindPort === 0
-      const primaryPort = autoPortRequested ? deps.defaultPort : deps.bindPort
+      const autoPortRequested = deps.port === 0
+      const primaryPort = autoPortRequested ? DEFAULT_HTTP_PORT : deps.port
 
       const shouldRetryWithEphemeral = (error: unknown) => {
         if (!autoPortRequested) return false
@@ -333,16 +283,20 @@ export function createHttpServer(deps: HttpServerDeps) {
         }
       }
 
-      const displayHost = deps.bindHost === "127.0.0.1" ? "localhost" : deps.bindHost
-      const serverUrl = `${deps.protocol}://${displayHost}:${actualPort}`
+      const displayHost = deps.host === "127.0.0.1" ? "localhost" : deps.host
+      const serverUrl = `http://${displayHost}:${actualPort}`
 
-      deps.logger.info({ port: actualPort, host: deps.bindHost, protocol: deps.protocol }, "HTTP server listening")
+      deps.serverMeta.httpBaseUrl = serverUrl
+      deps.serverMeta.host = deps.host
+      deps.serverMeta.port = actualPort
+      deps.serverMeta.listeningMode = deps.host === "0.0.0.0" || !isLoopbackHost(deps.host) ? "all" : "local"
+      deps.logger.info({ port: actualPort, host: deps.host }, "HTTP server listening")
+      console.log(`CodeNomad Server is ready at ${serverUrl}`)
 
       return { port: actualPort, url: serverUrl, displayHost }
     },
     stop: () => {
       closeSseClients()
-      clientConnectionManager.shutdown()
       return app.close()
     },
   }
@@ -358,130 +312,47 @@ function registerInstanceProxyRoutes(app: FastifyInstance, deps: InstanceProxyDe
     instance.removeAllContentTypeParsers()
     instance.addContentTypeParser("*", (req, body, done) => done(null, body))
 
-    const proxyBaseHandler = async (
-      request: FastifyRequest<{ Params: { id: string; slug: string } }>,
-      reply: FastifyReply,
-    ) => {
+    const proxyBaseHandler = async (request: FastifyRequest<{ Params: { id: string } }>, reply: FastifyReply) => {
       await proxyWorkspaceRequest({
         request,
         reply,
         workspaceManager: deps.workspaceManager,
-        worktreeSlug: request.params.slug,
         pathSuffix: "",
         logger: deps.logger,
       })
     }
 
     const proxyWildcardHandler = async (
-      request: FastifyRequest<{ Params: { id: string; slug: string; "*": string } }>,
+      request: FastifyRequest<{ Params: { id: string; "*": string } }>,
       reply: FastifyReply,
     ) => {
       await proxyWorkspaceRequest({
         request,
         reply,
         workspaceManager: deps.workspaceManager,
-        worktreeSlug: request.params.slug,
         pathSuffix: request.params["*"] ?? "",
         logger: deps.logger,
       })
     }
 
-    instance.all("/workspaces/:id/worktrees/:slug/instance", proxyBaseHandler)
-    instance.all("/workspaces/:id/worktrees/:slug/instance/*", proxyWildcardHandler)
+    instance.all("/workspaces/:id/instance", proxyBaseHandler)
+    instance.all("/workspaces/:id/instance/*", proxyWildcardHandler)
   })
 }
 
 const INSTANCE_PROXY_HOST = "127.0.0.1"
 
-// Special-case OpenCode directory override.
-//
-// UI clients may need to scope certain requests to an arbitrary directory that is not
-// part of the Git worktree list. Since the OpenCode SDK does not reliably support
-// injecting per-request headers, we encode an override into the *path* and strip it
-// before proxying to the instance.
-//
-// Example proxied request path:
-//   /workspaces/:id/worktrees/:slug/instance/__dir/<base64url>/session/create
-//
-// The server will decode <base64url> -> absolute directory, validate it, then set
-// x-opencode-directory accordingly and forward the request to /session/create.
-const OPENCODE_DIR_OVERRIDE_PREFIX = "__dir/"
-const OPENCODE_DIR_OVERRIDE_MAX_LEN = 4096
-
 async function proxyWorkspaceRequest(args: {
   request: FastifyRequest
   reply: FastifyReply
   workspaceManager: WorkspaceManager
   logger: Logger
-  worktreeSlug: string
   pathSuffix?: string
 }) {
-  const { request, reply, workspaceManager, logger, worktreeSlug } = args
+  const { request, reply, workspaceManager, logger } = args
   const workspaceId = (request.params as { id: string }).id
   const workspace = workspaceManager.get(workspaceId)
 
-  const bodyToJson = (body: unknown): unknown => {
-    if (body == null) return null
-
-    const anyBody = body as any
-    if (anyBody && typeof anyBody.pipe === "function") {
-      // Don't consume streams (would break proxying).
-      // Best-effort: if the stream already has buffered chunks, parse those.
-      try {
-        const buffered = anyBody?._readableState?.buffer
-        if (Array.isArray(buffered) && buffered.length > 0) {
-          const chunks: Buffer[] = []
-          for (const entry of buffered) {
-            if (!entry) continue
-            if (Buffer.isBuffer(entry)) {
-              chunks.push(entry)
-              continue
-            }
-            const data = (entry as any).data
-            if (Buffer.isBuffer(data)) {
-              chunks.push(data)
-            }
-          }
-
-          if (chunks.length > 0) {
-            const text = Buffer.concat(chunks).toString("utf-8")
-            try {
-              return JSON.parse(text)
-            } catch {
-              return { __raw: text }
-            }
-          }
-        }
-      } catch {
-        // fall through
-      }
-
-      return { __stream: true }
-    }
-
-    const maybeParse = (input: string): unknown => {
-      try {
-        return JSON.parse(input)
-      } catch {
-        return { __raw: input }
-      }
-    }
-
-    if (Buffer.isBuffer(body)) {
-      return maybeParse(body.toString("utf-8"))
-    }
-
-    if (typeof body === "string") {
-      return maybeParse(body)
-    }
-
-    if (typeof body === "object") {
-      return body
-    }
-
-    return body
-  }
-
   if (!workspace) {
     reply.code(404).send({ error: "Workspace not found" })
     return
@@ -493,48 +364,7 @@ async function proxyWorkspaceRequest(args: {
     return
   }
 
-  if (!isValidWorktreeSlug(worktreeSlug)) {
-    reply.code(400).send({ error: "Invalid worktree slug" })
-    return
-  }
-
-  let extracted: { overrideDirectory: string | null; forwardedSuffix: string | undefined }
-  try {
-    extracted = extractOpencodeDirectoryOverride(args.pathSuffix)
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "Invalid directory override"
-    reply.code(400).send({ error: message })
-    return
-  }
-  let directory: string | null = null
-  let forwardedSuffix = extracted.forwardedSuffix
-
-  if (extracted.overrideDirectory) {
-    try {
-      directory = validateAndNormalizeOverrideDirectory({
-        overrideDirectory: extracted.overrideDirectory,
-        workspaceRoot: workspace.path,
-      })
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Invalid directory override"
-      reply.code(400).send({ error: message })
-      return
-    }
-  } else {
-    directory = await resolveWorktreeDirectory({
-      workspaceId,
-      workspacePath: workspace.path,
-      worktreeSlug,
-      logger,
-    })
-
-    if (!directory) {
-      reply.code(404).send({ error: "Worktree not found" })
-      return
-    }
-  }
-
-  const normalizedSuffix = normalizeInstanceSuffix(forwardedSuffix)
+  const normalizedSuffix = normalizeInstanceSuffix(args.pathSuffix)
   const queryIndex = (request.raw.url ?? "").indexOf("?")
   const search = queryIndex >= 0 ? (request.raw.url ?? "").slice(queryIndex) : ""
   const targetUrl = `http://${INSTANCE_PROXY_HOST}:${port}${normalizedSuffix}${search}`
@@ -550,43 +380,6 @@ async function proxyWorkspaceRequest(args: {
       if (instanceAuthHeader) {
         headers.authorization = instanceAuthHeader
       }
-
-      // OpenCode expects the *full* path; we send it via header to avoid query tampering.
-      const isNonASCII = /[^\x00-\x7F]/.test(directory)
-      const encodedDirectory = isNonASCII ? encodeURIComponent(directory) : directory
-
-      // Overwrite any client-provided value (case-insensitive headers are normalized by Node).
-      ;(headers as Record<string, unknown>)["x-opencode-directory"] = encodedDirectory
-
-      if (logger.isLevelEnabled("trace")) {
-        const outgoing: Record<string, unknown> = {}
-        for (const [key, value] of Object.entries(headers as Record<string, unknown>)) {
-          outgoing[key] = value
-        }
-
-        // Redact sensitive headers.
-        for (const key of Object.keys(outgoing)) {
-          const lower = key.toLowerCase()
-          if (lower === "authorization" || lower === "cookie" || lower === "set-cookie") {
-            outgoing[key] = "<redacted>"
-          }
-        }
-
-        logger.trace(
-          {
-            workspaceId,
-            method: request.method,
-            targetUrl,
-            worktreeSlug,
-            directory,
-            contentType: request.headers["content-type"],
-            body: bodyToJson(request.body),
-            headers: outgoing,
-          },
-          "Proxy -> OpenCode request",
-        )
-      }
-
       return headers
     },
     onError: (proxyReply, { error }) => {
@@ -598,89 +391,6 @@ async function proxyWorkspaceRequest(args: {
   })
 }
 
-function extractOpencodeDirectoryOverride(pathSuffix: string | undefined): {
-  overrideDirectory: string | null
-  forwardedSuffix: string | undefined
-} {
-  if (!pathSuffix) {
-    return { overrideDirectory: null, forwardedSuffix: pathSuffix }
-  }
-
-  // Fastify wildcard param does not include a leading slash.
-  const trimmed = pathSuffix.replace(/^\/+/, "")
-  if (!trimmed.startsWith(OPENCODE_DIR_OVERRIDE_PREFIX)) {
-    return { overrideDirectory: null, forwardedSuffix: pathSuffix }
-  }
-
-  const rest = trimmed.slice(OPENCODE_DIR_OVERRIDE_PREFIX.length)
-  const slashIndex = rest.indexOf("/")
-  const encoded = (slashIndex >= 0 ? rest.slice(0, slashIndex) : rest).trim()
-  const remaining = slashIndex >= 0 ? rest.slice(slashIndex + 1) : ""
-
-  if (!encoded) {
-    throw new Error("Missing directory override")
-  }
-
-  if (encoded.length > OPENCODE_DIR_OVERRIDE_MAX_LEN) {
-    throw new Error("Directory override too large")
-  }
-
-  let overrideDirectory = ""
-  try {
-    overrideDirectory = decodeBase64Url(encoded)
-  } catch {
-    throw new Error("Invalid directory override")
-  }
-  const forwardedSuffix = remaining
-  return { overrideDirectory, forwardedSuffix }
-}
-
-function decodeBase64Url(input: string): string {
-  // base64url -> base64
-  const normalized = input.replace(/-/g, "+").replace(/_/g, "/")
-  const padding = normalized.length % 4 === 0 ? "" : "=".repeat(4 - (normalized.length % 4))
-  const base64 = `${normalized}${padding}`
-  return Buffer.from(base64, "base64").toString("utf-8")
-}
-
-function validateAndNormalizeOverrideDirectory(params: { overrideDirectory: string; workspaceRoot: string }): string {
-  const raw = params.overrideDirectory.trim()
-  if (!raw) {
-    throw new Error("Override directory is empty")
-  }
-
-  if (!path.isAbsolute(raw)) {
-    throw new Error("Override directory must be an absolute path")
-  }
-
-  if (!fs.existsSync(raw)) {
-    throw new Error(`Override directory does not exist: ${raw}`)
-  }
-
-  const stats = fs.statSync(raw)
-  if (!stats.isDirectory()) {
-    throw new Error(`Override path is not a directory: ${raw}`)
-  }
-
-  const normalizedOverride = fs.realpathSync(raw)
-  const normalizedRoot = fs.realpathSync(params.workspaceRoot)
-
-  if (!isSubpath(normalizedOverride, normalizedRoot)) {
-    throw new Error("Override directory must be within the workspace root")
-  }
-
-  return normalizedOverride
-}
-
-function isSubpath(candidate: string, root: string): boolean {
-  const rel = path.relative(root, candidate)
-  if (rel === "") return true
-  if (rel === "..") return false
-  if (rel.startsWith(`..${path.sep}`)) return false
-  if (path.isAbsolute(rel)) return false
-  return true
-}
-
 function normalizeInstanceSuffix(pathSuffix: string | undefined) {
   if (!pathSuffix || pathSuffix === "/") {
     return "/"
@@ -689,52 +399,6 @@ function normalizeInstanceSuffix(pathSuffix: string | undefined) {
   return trimmed.length === 0 ? "/" : `/${trimmed}`
 }
 
-type WorktreeCacheEntry = {
-  expiresAt: number
-  repoRoot: string
-  worktrees: Array<{ slug: string; directory: string }>
-}
-
-const WORKTREE_CACHE_TTL_MS = 2000
-const worktreeCache = new Map<string, WorktreeCacheEntry>()
-
-async function getCachedWorktrees(params: { workspaceId: string; workspacePath: string; logger: Logger }) {
-  const cached = worktreeCache.get(params.workspaceId)
-  const now = Date.now()
-  if (cached && cached.expiresAt > now) {
-    return cached
-  }
-
-  const { repoRoot } = await resolveRepoRoot(params.workspacePath, params.logger)
-  const worktrees = await listWorktrees({ repoRoot, workspaceFolder: params.workspacePath, logger: params.logger })
-  const entry: WorktreeCacheEntry = {
-    expiresAt: now + WORKTREE_CACHE_TTL_MS,
-    repoRoot,
-    worktrees: worktrees.map((wt) => ({ slug: wt.slug, directory: wt.directory })),
-  }
-  worktreeCache.set(params.workspaceId, entry)
-  return entry
-}
-
-async function resolveWorktreeDirectory(params: {
-  workspaceId: string
-  workspacePath: string
-  worktreeSlug: string
-  logger: Logger
-}): Promise<string | null> {
-  const { worktreeSlug } = params
-  const cached = await getCachedWorktrees({ workspaceId: params.workspaceId, workspacePath: params.workspacePath, logger: params.logger })
-  const match = cached.worktrees.find((wt) => wt.slug === worktreeSlug)
-  if (match) {
-    return match.directory
-  }
-
-  // If the slug is new (e.g., created moments ago), refresh once.
-  worktreeCache.delete(params.workspaceId)
-  const refreshed = await getCachedWorktrees({ workspaceId: params.workspaceId, workspacePath: params.workspacePath, logger: params.logger })
-  return refreshed.worktrees.find((wt) => wt.slug === worktreeSlug)?.directory ?? null
-}
-
 function setupStaticUi(app: FastifyInstance, uiDir: string, authManager: AuthManager) {
   if (!uiDir) {
     app.log.warn("UI static directory not provided; API endpoints only")

packages/server/src/server/network-addresses.ts

@@ -1,75 +0,0 @@
-import os from "os"
-import type { NetworkAddress } from "../api-types"
-
-export function resolveNetworkAddresses(args: {
-  host: string
-  protocol: "http" | "https"
-  port: number
-}): NetworkAddress[] {
-  const { host, protocol, port } = args
-  const interfaces = os.networkInterfaces()
-  const seen = new Set<string>()
-  const results: NetworkAddress[] = []
-
-  const addAddress = (ip: string, scope: NetworkAddress["scope"]) => {
-    if (!ip || ip === "0.0.0.0") return
-    const key = `ipv4-${ip}`
-    if (seen.has(key)) return
-    seen.add(key)
-    results.push({ ip, family: "ipv4", scope, remoteUrl: `${protocol}://${ip}:${port}` })
-  }
-
-  const normalizeFamily = (value: string | number) => {
-    if (typeof value === "string") {
-      const lowered = value.toLowerCase()
-      if (lowered === "ipv4") {
-        return "ipv4" as const
-      }
-    }
-    if (value === 4) return "ipv4" as const
-    return null
-  }
-
-  if (host === "0.0.0.0") {
-    // Enumerate system interfaces (IPv4 only)
-    for (const entries of Object.values(interfaces)) {
-      if (!entries) continue
-      for (const entry of entries) {
-        const family = normalizeFamily(entry.family)
-        if (!family) continue
-        if (!entry.address || entry.address === "0.0.0.0") continue
-        const scope: NetworkAddress["scope"] = entry.internal ? "loopback" : "external"
-        addAddress(entry.address, scope)
-      }
-    }
-  }
-
-  // Always include loopback address
-  addAddress("127.0.0.1", "loopback")
-
-  // Include explicitly configured host if it was IPv4
-  if (isIPv4Address(host) && host !== "0.0.0.0") {
-    const isLoopback = host.startsWith("127.")
-    addAddress(host, isLoopback ? "loopback" : "external")
-  }
-
-  const scopeWeight: Record<NetworkAddress["scope"], number> = { external: 0, internal: 1, loopback: 2 }
-
-  return results.sort((a, b) => {
-    const scopeDelta = scopeWeight[a.scope] - scopeWeight[b.scope]
-    if (scopeDelta !== 0) return scopeDelta
-    return a.ip.localeCompare(b.ip)
-  })
-}
-
-function isIPv4Address(value: string | undefined): value is string {
-  if (!value) return false
-  const parts = value.split(".")
-  if (parts.length !== 4) return false
-  return parts.every((part) => {
-    if (part.length === 0 || part.length > 3) return false
-    if (!/^[0-9]+$/.test(part)) return false
-    const num = Number(part)
-    return Number.isInteger(num) && num >= 0 && num <= 255
-  })
-}

packages/server/src/server/routes/auth-pages/login.html

@@ -119,8 +119,7 @@
             showError(message || `Login failed (${res.status})`)
             return
           }
-          // Replace history entry so Back doesn't return to /login.
-          window.location.replace("/")
+          window.location.href = "/"
         } catch (e) {
           showError(e && e.message ? e.message : String(e))
         }

packages/server/src/server/routes/auth.ts

@@ -51,19 +51,7 @@ function getTokenHtml(): string {
 }
 
 export function registerAuthRoutes(app: FastifyInstance, deps: RouteDeps) {
-  app.get("/login", async (request, reply) => {
-    // If already authenticated, don't show the login page.
-    const session = deps.authManager.getSessionFromRequest(request)
-    if (session) {
-      reply.redirect("/")
-      return
-    }
-
-    // Avoid caching the login page (helps with bfcache/back behavior).
-    reply.header("Cache-Control", "no-store")
-    reply.header("Pragma", "no-cache")
-    reply.header("Expires", "0")
-
+  app.get("/login", async (_request, reply) => {
     const status = deps.authManager.getStatus()
     reply.type("text/html").send(getLoginHtml(status.username))
   })
@@ -79,11 +67,6 @@ export function registerAuthRoutes(app: FastifyInstance, deps: RouteDeps) {
       return
     }
 
-    // Avoid caching the token bootstrap page.
-    reply.header("Cache-Control", "no-store")
-    reply.header("Pragma", "no-cache")
-    reply.header("Expires", "0")
-
     reply.type("text/html").send(getTokenHtml())
   })
 
@@ -105,7 +88,7 @@ export function registerAuthRoutes(app: FastifyInstance, deps: RouteDeps) {
     }
 
     const session = deps.authManager.createSession(body.username)
-    deps.authManager.setSessionCookieWithOptions(reply, session.id, { secure: isSecureRequest(request) })
+    deps.authManager.setSessionCookie(reply, session.id)
     reply.send({ ok: true })
   })
 
@@ -129,12 +112,12 @@ export function registerAuthRoutes(app: FastifyInstance, deps: RouteDeps) {
 
     const username = deps.authManager.getStatus().username
     const session = deps.authManager.createSession(username)
-    deps.authManager.setSessionCookieWithOptions(reply, session.id, { secure: isSecureRequest(request) })
+    deps.authManager.setSessionCookie(reply, session.id)
     reply.send({ ok: true })
   })
 
-  app.post("/api/auth/logout", async (request, reply) => {
-    deps.authManager.clearSessionCookieWithOptions(reply, { secure: isSecureRequest(request) })
+  app.post("/api/auth/logout", async (_request, reply) => {
+    deps.authManager.clearSessionCookie(reply)
     reply.send({ ok: true })
   })
 
@@ -156,13 +139,6 @@ export function registerAuthRoutes(app: FastifyInstance, deps: RouteDeps) {
   })
 }
 
-function isSecureRequest(request: any) {
-  if (request.protocol === "https") {
-    return true
-  }
-  return Boolean(request.raw?.socket && request.raw.socket.encrypted)
-}
-
 function escapeHtml(value: string) {
   return value.replace(/[&<>"]/g, (char) => {
     switch (char) {

packages/server/src/server/routes/config.ts

@@ -0,0 +1,62 @@
+import { FastifyInstance } from "fastify"
+import { z } from "zod"
+import { ConfigStore } from "../../config/store"
+import { BinaryRegistry } from "../../config/binaries"
+import { ConfigFileSchema } from "../../config/schema"
+
+interface RouteDeps {
+  configStore: ConfigStore
+  binaryRegistry: BinaryRegistry
+}
+
+const BinaryCreateSchema = z.object({
+  path: z.string(),
+  label: z.string().optional(),
+  makeDefault: z.boolean().optional(),
+})
+
+const BinaryUpdateSchema = z.object({
+  label: z.string().optional(),
+  makeDefault: z.boolean().optional(),
+})
+
+const BinaryValidateSchema = z.object({
+  path: z.string(),
+})
+
+export function registerConfigRoutes(app: FastifyInstance, deps: RouteDeps) {
+  app.get("/api/config/app", async () => deps.configStore.get())
+
+  app.put("/api/config/app", async (request) => {
+    const body = ConfigFileSchema.parse(request.body ?? {})
+    deps.configStore.replace(body)
+    return deps.configStore.get()
+  })
+
+  app.get("/api/config/binaries", async () => {
+    return { binaries: deps.binaryRegistry.list() }
+  })
+
+  app.post("/api/config/binaries", async (request, reply) => {
+    const body = BinaryCreateSchema.parse(request.body ?? {})
+    const binary = deps.binaryRegistry.create(body)
+    reply.code(201)
+    return { binary }
+  })
+
+  app.patch<{ Params: { id: string } }>("/api/config/binaries/:id", async (request) => {
+    const body = BinaryUpdateSchema.parse(request.body ?? {})
+    const binary = deps.binaryRegistry.update(request.params.id, body)
+    return { binary }
+  })
+
+  app.delete<{ Params: { id: string } }>("/api/config/binaries/:id", async (request, reply) => {
+    deps.binaryRegistry.remove(request.params.id)
+    reply.code(204)
+  })
+
+  app.post("/api/config/binaries/validate", async (request) => {
+    const body = BinaryValidateSchema.parse(request.body ?? {})
+    return deps.binaryRegistry.validatePath(body.path)
+  })
+}

packages/server/src/server/routes/events.ts

@@ -1,32 +1,19 @@
 import { FastifyInstance } from "fastify"
-import { z } from "zod"
 import { EventBus } from "../../events/bus"
 import { WorkspaceEventPayload } from "../../api-types"
-import type { ClientConnectionManager } from "../../clients/connection-manager"
 import { Logger } from "../../logger"
 
 interface RouteDeps {
   eventBus: EventBus
   registerClient: (cleanup: () => void) => () => void
   logger: Logger
-  connectionManager: ClientConnectionManager
 }
 
 let nextClientId = 0
 
-const ConnectionQuerySchema = z.object({
-  clientId: z.string().trim().min(1),
-  connectionId: z.string().trim().min(1),
-})
-
-const PongBodySchema = ConnectionQuerySchema.extend({
-  pingTs: z.number().optional(),
-})
-
 export function registerEventRoutes(app: FastifyInstance, deps: RouteDeps) {
   app.get("/api/events", (request, reply) => {
     const clientId = ++nextClientId
-    const connection = ConnectionQuerySchema.parse(request.query ?? {})
     deps.logger.debug({ clientId }, "SSE client connected")
 
     const origin = request.headers.origin ?? "*"
@@ -48,8 +35,7 @@ export function registerEventRoutes(app: FastifyInstance, deps: RouteDeps) {
 
     const unsubscribe = deps.eventBus.onEvent(send)
     const heartbeat = setInterval(() => {
-      const ping = { ts: Date.now() }
-      reply.raw.write(`event: codenomad.client.ping\ndata: ${JSON.stringify(ping)}\n\n`)
+      reply.raw.write(`:hb ${Date.now()}\n\n`)
     }, 15000)
 
     let closed = false
@@ -63,27 +49,13 @@ export function registerEventRoutes(app: FastifyInstance, deps: RouteDeps) {
     }
 
     const unregister = deps.registerClient(close)
-    const unregisterConnection = deps.connectionManager.register({
-      ...connection,
-      close,
-    })
 
     const handleClose = () => {
       close()
       unregister()
-      unregisterConnection()
     }
 
     request.raw.on("close", handleClose)
     request.raw.on("error", handleClose)
   })
-
-  app.post("/api/client-connections/pong", (request, reply) => {
-    const body = PongBodySchema.parse(request.body ?? {})
-    if (!deps.connectionManager.pong(body)) {
-      reply.code(404).send({ error: "Client connection not found" })
-      return
-    }
-    reply.code(204).send()
-  })
 }

packages/server/src/server/routes/meta.ts

@@ -1,6 +1,6 @@
 import { FastifyInstance } from "fastify"
-import { ServerMeta } from "../../api-types"
-import { resolveNetworkAddresses } from "../network-addresses"
+import os from "os"
+import { NetworkAddress, ServerMeta } from "../../api-types"
 
 interface RouteDeps {
   serverMeta: ServerMeta
@@ -11,25 +11,23 @@ export function registerMetaRoutes(app: FastifyInstance, deps: RouteDeps) {
 }
 
 function buildMetaResponse(meta: ServerMeta): ServerMeta {
-  const localPort = resolveLocalPort(meta)
-  const remote = resolveRemote(meta)
-  const addresses = remote && remote.port > 0 ? resolveNetworkAddresses({ host: meta.host, protocol: remote.protocol, port: remote.port }) : []
+  const port = resolvePort(meta)
+  const addresses = port > 0 ? resolveAddresses(port, meta.host) : []
 
   return {
     ...meta,
-    localPort,
-    remotePort: remote?.port,
+    port,
     listeningMode: meta.host === "0.0.0.0" || !isLoopbackHost(meta.host) ? "all" : "local",
     addresses,
   }
 }
 
-function resolveLocalPort(meta: ServerMeta): number {
-  if (Number.isInteger(meta.localPort) && meta.localPort > 0) {
-    return meta.localPort
+function resolvePort(meta: ServerMeta): number {
+  if (Number.isInteger(meta.port) && meta.port > 0) {
+    return meta.port
   }
   try {
-    const parsed = new URL(meta.localUrl)
+    const parsed = new URL(meta.httpBaseUrl)
     const port = Number(parsed.port)
     return Number.isInteger(port) && port > 0 ? port : 0
   } catch {
@@ -37,22 +35,74 @@ function resolveLocalPort(meta: ServerMeta): number {
   }
 }
 
-function resolveRemote(meta: ServerMeta): { protocol: "http" | "https"; port: number } | null {
-  if (!meta.remoteUrl) {
-    return null
-  }
-  try {
-    const parsed = new URL(meta.remoteUrl)
-    const protocol = parsed.protocol === "https:" ? "https" : "http"
-    const port = Number(parsed.port)
-    return { protocol, port: Number.isInteger(port) && port > 0 ? port : 0 }
-  } catch {
-    return null
-  }
-}
-
 function isLoopbackHost(host: string): boolean {
   return host === "127.0.0.1" || host === "::1" || host.startsWith("127.")
 }
 
-// NetworkAddress shape is resolved in ../network-addresses
+function resolveAddresses(port: number, host: string): NetworkAddress[] {
+  const interfaces = os.networkInterfaces()
+  const seen = new Set<string>()
+  const results: NetworkAddress[] = []
+
+  const addAddress = (ip: string, scope: NetworkAddress["scope"]) => {
+    if (!ip || ip === "0.0.0.0") return
+    const key = `ipv4-${ip}`
+    if (seen.has(key)) return
+    seen.add(key)
+    results.push({ ip, family: "ipv4", scope, url: `http://${ip}:${port}` })
+  }
+
+  const normalizeFamily = (value: string | number) => {
+    if (typeof value === "string") {
+      const lowered = value.toLowerCase()
+      if (lowered === "ipv4") {
+        return "ipv4" as const
+      }
+    }
+    if (value === 4) return "ipv4" as const
+    return null
+  }
+
+  if (host === "0.0.0.0") {
+    // Enumerate system interfaces (IPv4 only)
+    for (const entries of Object.values(interfaces)) {
+      if (!entries) continue
+      for (const entry of entries) {
+        const family = normalizeFamily(entry.family)
+        if (!family) continue
+        if (!entry.address || entry.address === "0.0.0.0") continue
+        const scope: NetworkAddress["scope"] = entry.internal ? "loopback" : "external"
+        addAddress(entry.address, scope)
+      }
+    }
+  }
+
+  // Always include loopback address
+  addAddress("127.0.0.1", "loopback")
+
+  // Include explicitly configured host if it was IPv4
+  if (isIPv4Address(host) && host !== "0.0.0.0") {
+    const isLoopback = host.startsWith("127.")
+    addAddress(host, isLoopback ? "loopback" : "external")
+  }
+
+  const scopeWeight: Record<NetworkAddress["scope"], number> = { external: 0, internal: 1, loopback: 2 }
+
+  return results.sort((a, b) => {
+    const scopeDelta = scopeWeight[a.scope] - scopeWeight[b.scope]
+    if (scopeDelta !== 0) return scopeDelta
+    return a.ip.localeCompare(b.ip)
+  })
+}
+
+function isIPv4Address(value: string | undefined): value is string {
+  if (!value) return false
+  const parts = value.split(".")
+  if (parts.length !== 4) return false
+  return parts.every((part) => {
+    if (part.length === 0 || part.length > 3) return false
+    if (!/^[0-9]+$/.test(part)) return false
+    const num = Number(part)
+    return Number.isInteger(num) && num >= 0 && num <= 255
+  })
+}

packages/server/src/server/routes/plugin.ts

@@ -1,19 +1,15 @@
 import { FastifyInstance } from "fastify"
 import { z } from "zod"
-import type { VoiceModeStateResponse } from "../../api-types"
 import type { WorkspaceManager } from "../../workspaces/manager"
 import type { EventBus } from "../../events/bus"
 import type { Logger } from "../../logger"
 import { PluginChannelManager } from "../../plugins/channel"
 import { buildPingEvent, handlePluginEvent } from "../../plugins/handlers"
-import { VoiceModeManager } from "../../plugins/voice-mode"
 
 interface RouteDeps {
   workspaceManager: WorkspaceManager
   eventBus: EventBus
   logger: Logger
-  channel: PluginChannelManager
-  voiceModeManager: VoiceModeManager
 }
 
 const PluginEventSchema = z.object({
@@ -21,13 +17,9 @@ const PluginEventSchema = z.object({
   properties: z.record(z.unknown()).optional(),
 })
 
-const VoiceModeStateSchema = z.object({
-  enabled: z.boolean(),
-  clientId: z.string().trim().min(1),
-  connectionId: z.string().trim().min(1),
-})
-
 export function registerPluginRoutes(app: FastifyInstance, deps: RouteDeps) {
+  const channel = new PluginChannelManager(deps.logger.child({ component: "plugin-channel" }))
+
   app.get<{ Params: { id: string } }>("/workspaces/:id/plugin/events", (request, reply) => {
     const workspace = deps.workspaceManager.get(request.params.id)
     if (!workspace) {
@@ -41,11 +33,10 @@ export function registerPluginRoutes(app: FastifyInstance, deps: RouteDeps) {
     reply.raw.flushHeaders?.()
     reply.hijack()
 
-    const registration = deps.channel.register(request.params.id, reply)
-    deps.voiceModeManager.syncInstance(request.params.id)
+    const registration = channel.register(request.params.id, reply)
 
     const heartbeat = setInterval(() => {
-      deps.channel.send(request.params.id, buildPingEvent())
+      channel.send(request.params.id, buildPingEvent())
     }, 15000)
 
     const close = () => {
@@ -58,22 +49,6 @@ export function registerPluginRoutes(app: FastifyInstance, deps: RouteDeps) {
     request.raw.on("error", close)
   })
 
-  app.post<{ Params: { id: string }; Body: VoiceModeStateResponse }>("/workspaces/:id/plugin/voice-mode", (request, reply) => {
-    const workspace = deps.workspaceManager.get(request.params.id)
-    if (!workspace) {
-      reply.code(404).send({ error: "Workspace not found" })
-      return
-    }
-
-    const payload = VoiceModeStateSchema.parse(request.body ?? {})
-    deps.voiceModeManager.setEnabled(
-      request.params.id,
-      { clientId: payload.clientId, connectionId: payload.connectionId },
-      payload.enabled,
-    )
-    return { enabled: payload.enabled }
-  })
-
   const handleWildcard = async (request: any, reply: any) => {
     const workspaceId = request.params.id as string
     const workspace = deps.workspaceManager.get(workspaceId)

packages/server/src/server/routes/settings.ts

@@ -1,84 +0,0 @@
-import { FastifyInstance } from "fastify"
-import { z } from "zod"
-import { probeBinaryVersion } from "../../workspaces/runtime"
-import type { SettingsService } from "../../settings/service"
-import type { Logger } from "../../logger"
-import { sanitizeConfigDoc, sanitizeConfigOwner } from "../../settings/public-config"
-
-interface RouteDeps {
-  settings: SettingsService
-  logger: Logger
-}
-
-const ValidateBinarySchema = z.object({
-  path: z.string(),
-})
-
-function validateBinaryPath(binaryPath: string): { valid: boolean; version?: string; error?: string } {
-  const result = probeBinaryVersion(binaryPath)
-  return { valid: result.valid, version: result.version, error: result.error }
-}
-
-export function registerSettingsRoutes(app: FastifyInstance, deps: RouteDeps) {
-  // Full-document access
-  app.get("/api/storage/config", async () => sanitizeConfigDoc(deps.settings.getDoc("config")))
-  app.patch("/api/storage/config", async (request, reply) => {
-    try {
-      return sanitizeConfigDoc(deps.settings.mergePatchDoc("config", request.body ?? {}))
-    } catch (error) {
-      reply.code(400)
-      return { error: error instanceof Error ? error.message : "Invalid patch" }
-    }
-  })
-
-  app.get<{ Params: { owner: string } }>("/api/storage/config/:owner", async (request) => {
-    return sanitizeConfigOwner(request.params.owner, deps.settings.getOwner("config", request.params.owner))
-  })
-
-  app.patch<{ Params: { owner: string } }>("/api/storage/config/:owner", async (request, reply) => {
-    try {
-      return sanitizeConfigOwner(
-        request.params.owner,
-        deps.settings.mergePatchOwner("config", request.params.owner, request.body ?? {}),
-      )
-    } catch (error) {
-      reply.code(400)
-      return { error: error instanceof Error ? error.message : "Invalid patch" }
-    }
-  })
-
-  app.get("/api/storage/state", async () => deps.settings.getDoc("state"))
-  app.patch("/api/storage/state", async (request, reply) => {
-    try {
-      return deps.settings.mergePatchDoc("state", request.body ?? {})
-    } catch (error) {
-      reply.code(400)
-      return { error: error instanceof Error ? error.message : "Invalid patch" }
-    }
-  })
-
-  app.get<{ Params: { owner: string } }>("/api/storage/state/:owner", async (request) => {
-    return deps.settings.getOwner("state", request.params.owner)
-  })
-
-  app.patch<{ Params: { owner: string } }>("/api/storage/state/:owner", async (request, reply) => {
-    try {
-      return deps.settings.mergePatchOwner("state", request.params.owner, request.body ?? {})
-    } catch (error) {
-      reply.code(400)
-      return { error: error instanceof Error ? error.message : "Invalid patch" }
-    }
-  })
-
-  // Binary validation helper (used by UI when adding binaries)
-  app.post("/api/storage/binaries/validate", async (request, reply) => {
-    try {
-      const body = ValidateBinarySchema.parse(request.body ?? {})
-      return validateBinaryPath(body.path)
-    } catch (error) {
-      deps.logger.warn({ err: error }, "Failed to validate binary")
-      reply.code(400)
-      return { valid: false, error: error instanceof Error ? error.message : "Invalid request" }
-    }
-  })
-}

packages/server/src/server/routes/speech.ts

@@ -1,74 +0,0 @@
-import type { FastifyInstance } from "fastify"
-import { z } from "zod"
-import type { SpeechService } from "../../speech/service"
-
-interface RouteDeps {
-  speechService: SpeechService
-}
-
-const TranscribeBodySchema = z.object({
-  audioBase64: z.string().min(1, "Audio payload is required"),
-  mimeType: z.string().min(1, "Audio MIME type is required"),
-  filename: z.string().optional(),
-  language: z.string().optional(),
-  prompt: z.string().optional(),
-})
-
-const SynthesizeBodySchema = z.object({
-  text: z.string().trim().min(1, "Text is required"),
-  format: z.enum(["mp3", "wav", "opus", "aac"]).optional(),
-})
-
-function getSpeechErrorStatus(error: unknown): number {
-  if (error instanceof z.ZodError) {
-    return 400
-  }
-  if (error instanceof Error && /not configured/i.test(error.message)) {
-    return 503
-  }
-  return 502
-}
-
-function getSpeechErrorMessage(error: unknown, fallback: string): string {
-  return error instanceof Error ? error.message : fallback
-}
-
-export function registerSpeechRoutes(app: FastifyInstance, deps: RouteDeps) {
-  app.get("/api/speech/capabilities", async () => deps.speechService.getCapabilities())
-
-  app.post("/api/speech/transcribe", async (request, reply) => {
-    try {
-      const body = TranscribeBodySchema.parse(request.body ?? {})
-      return await deps.speechService.transcribe(body)
-    } catch (error) {
-      request.log.error({ err: error }, "Failed to transcribe audio")
-      reply.code(getSpeechErrorStatus(error))
-      return { error: getSpeechErrorMessage(error, "Failed to transcribe audio") }
-    }
-  })
-
-  app.post("/api/speech/synthesize", async (request, reply) => {
-    try {
-      const body = SynthesizeBodySchema.parse(request.body ?? {})
-      return await deps.speechService.synthesize(body)
-    } catch (error) {
-      request.log.error({ err: error }, "Failed to synthesize audio")
-      reply.code(getSpeechErrorStatus(error))
-      return { error: getSpeechErrorMessage(error, "Failed to synthesize audio") }
-    }
-  })
-
-  app.post("/api/speech/synthesize/stream", async (request, reply) => {
-    try {
-      const body = SynthesizeBodySchema.parse(request.body ?? {})
-      const result = await deps.speechService.synthesizeStream(body)
-      reply.header("Content-Type", result.mimeType)
-      reply.header("Cache-Control", "no-store")
-      return reply.send(result.stream)
-    } catch (error) {
-      request.log.error({ err: error }, "Failed to stream synthesized audio")
-      reply.code(getSpeechErrorStatus(error))
-      return { error: getSpeechErrorMessage(error, "Failed to stream synthesized audio") }
-    }
-  })
-}

packages/server/src/server/routes/workspaces.ts

@@ -19,10 +19,6 @@ const WorkspaceFileContentQuerySchema = z.object({
   path: z.string(),
 })
 
-const WorkspaceFileContentBodySchema = z.object({
-  contents: z.string(),
-})
-
 const WorkspaceFileSearchQuerySchema = z.object({
   q: z.string().trim().min(1, "Query is required"),
   limit: z.coerce.number().int().positive().max(200).optional(),
@@ -104,20 +100,6 @@ export function registerWorkspaceRoutes(app: FastifyInstance, deps: RouteDeps) {
       return handleWorkspaceError(error, reply)
     }
   })
-
-  app.put<{
-    Params: { id: string }
-    Querystring: { path?: string }
-  }>("/api/workspaces/:id/files/content", async (request, reply) => {
-    try {
-      const query = WorkspaceFileContentQuerySchema.parse(request.query ?? {})
-      const body = WorkspaceFileContentBodySchema.parse(request.body ?? {})
-      deps.workspaceManager.writeFile(request.params.id, query.path, body.contents)
-      reply.code(204)
-    } catch (error) {
-      return handleWorkspaceError(error, reply)
-    }
-  })
 }
 
 

packages/server/src/server/routes/worktrees.ts

@@ -1,195 +0,0 @@
-import type { FastifyInstance, FastifyReply } from "fastify"
-import { z } from "zod"
-import { WorkspaceManager } from "../../workspaces/manager"
-import {
-  resolveRepoRoot,
-  listWorktrees,
-  isValidWorktreeSlug,
-  createManagedWorktree,
-  removeWorktree,
-} from "../../workspaces/git-worktrees"
-import type { WorktreeListResponse, WorktreeMap } from "../../api-types"
-import { ensureCodenomadGitExclude, readWorktreeMap, writeWorktreeMap } from "../../workspaces/worktree-map"
-
-interface RouteDeps {
-  workspaceManager: WorkspaceManager
-}
-
-const WorktreeMapSchema = z.object({
-  version: z.literal(1),
-  defaultWorktreeSlug: z.string().min(1).default("root"),
-  parentSessionWorktreeSlug: z.record(z.string(), z.string()).default({}),
-})
-
-const WorktreeCreateSchema = z.object({
-  slug: z.string().trim().min(1),
-  branch: z.string().trim().min(1).optional(),
-})
-
-export function registerWorktreeRoutes(app: FastifyInstance, deps: RouteDeps) {
-  app.get<{ Params: { id: string } }>("/api/workspaces/:id/worktrees", async (request, reply) => {
-    const workspace = deps.workspaceManager.get(request.params.id)
-    if (!workspace) {
-      reply.code(404)
-      return { error: "Workspace not found" }
-    }
-
-    const { repoRoot, isGitRepo } = await resolveRepoRoot(workspace.path, request.log)
-    const worktrees = await listWorktrees({ repoRoot, workspaceFolder: workspace.path, logger: request.log })
-    const response: WorktreeListResponse = { worktrees, isGitRepo }
-    return response
-  })
-
-  app.post<{ Params: { id: string } }>("/api/workspaces/:id/worktrees", async (request, reply) => {
-    const workspace = deps.workspaceManager.get(request.params.id)
-    if (!workspace) {
-      reply.code(404)
-      return { error: "Workspace not found" }
-    }
-
-    try {
-      const body = WorktreeCreateSchema.parse(request.body ?? {})
-      const slug = body.slug
-      if (!isValidWorktreeSlug(slug) || slug === "root") {
-        reply.code(400)
-        return { error: "Invalid worktree slug" }
-      }
-      if (body.branch) {
-        if (!isValidWorktreeSlug(body.branch) || body.branch === "root") {
-          reply.code(400)
-          return { error: "Invalid worktree branch" }
-        }
-        if (body.branch !== slug) {
-          reply.code(400)
-          return { error: "Branch must match slug" }
-        }
-      }
-
-      const { repoRoot, isGitRepo } = await resolveRepoRoot(workspace.path, request.log)
-      if (!isGitRepo) {
-        reply.code(400)
-        return { error: "Workspace is not a Git repository" }
-      }
-
-      await ensureCodenomadGitExclude(workspace.path, request.log).catch(() => undefined)
-
-      const created = await createManagedWorktree({
-        repoRoot,
-        workspaceFolder: workspace.path,
-        slug,
-        logger: request.log,
-      })
-
-      reply.code(201)
-      return created
-    } catch (error) {
-      return handleError(error, reply)
-    }
-  })
-
-  app.delete<{ Params: { id: string; slug: string }; Querystring: { force?: string } }>(
-    "/api/workspaces/:id/worktrees/:slug",
-    async (request, reply) => {
-    const workspace = deps.workspaceManager.get(request.params.id)
-    if (!workspace) {
-      reply.code(404)
-      return { error: "Workspace not found" }
-    }
-
-    const slug = (request.params.slug ?? "").trim()
-    if (!isValidWorktreeSlug(slug) || slug === "root") {
-      reply.code(400)
-      return { error: "Invalid worktree slug" }
-    }
-
-    const { repoRoot, isGitRepo } = await resolveRepoRoot(workspace.path, request.log)
-    if (!isGitRepo) {
-      reply.code(400)
-      return { error: "Workspace is not a Git repository" }
-    }
-
-    const force = (request.query?.force ?? "").toString().toLowerCase() === "true"
-
-    try {
-      const worktrees = await listWorktrees({ repoRoot, workspaceFolder: workspace.path, logger: request.log })
-      const match = worktrees.find((wt) => wt.slug === slug)
-      if (!match || match.kind === "root") {
-        reply.code(404)
-        return { error: "Worktree not found" }
-      }
-
-      await removeWorktree({ workspaceFolder: workspace.path, directory: match.directory, force, logger: request.log })
-
-      // Best-effort: prune any mappings that point at the deleted worktree.
-      const current = await readWorktreeMap(workspace.path, request.log)
-      let changed = false
-      const nextMapping: Record<string, string> = { ...(current.parentSessionWorktreeSlug ?? {}) }
-      for (const [sessionId, mapped] of Object.entries(nextMapping)) {
-        if (mapped === slug) {
-          delete nextMapping[sessionId]
-          changed = true
-        }
-      }
-      const nextDefault = current.defaultWorktreeSlug === slug ? "root" : current.defaultWorktreeSlug
-      if (nextDefault !== current.defaultWorktreeSlug) {
-        changed = true
-      }
-      if (changed) {
-        await writeWorktreeMap(
-          workspace.path,
-          {
-            version: 1,
-            defaultWorktreeSlug: nextDefault,
-            parentSessionWorktreeSlug: nextMapping,
-          },
-          request.log,
-        )
-      }
-
-      reply.code(204)
-    } catch (error) {
-      return handleError(error, reply)
-    }
-  },
-  )
-
-  app.get<{ Params: { id: string } }>("/api/workspaces/:id/worktrees/map", async (request, reply) => {
-    const workspace = deps.workspaceManager.get(request.params.id)
-    if (!workspace) {
-      reply.code(404)
-      return { error: "Workspace not found" }
-    }
-    return await readWorktreeMap(workspace.path, request.log)
-  })
-
-  app.put<{ Params: { id: string } }>("/api/workspaces/:id/worktrees/map", async (request, reply) => {
-    const workspace = deps.workspaceManager.get(request.params.id)
-    if (!workspace) {
-      reply.code(404)
-      return { error: "Workspace not found" }
-    }
-
-    try {
-      const parsed = WorktreeMapSchema.parse(request.body ?? {}) as WorktreeMap
-      if (!isValidWorktreeSlug(parsed.defaultWorktreeSlug)) {
-        reply.code(400)
-        return { error: "Invalid defaultWorktreeSlug" }
-      }
-      for (const slug of Object.values(parsed.parentSessionWorktreeSlug ?? {})) {
-        if (!isValidWorktreeSlug(slug)) {
-          reply.code(400)
-          return { error: "Invalid worktree slug in mapping" }
-        }
-      }
-      await writeWorktreeMap(workspace.path, parsed, request.log)
-      reply.code(204)
-    } catch (error) {
-      return handleError(error, reply)
-    }
-  })
-}
-
-function handleError(error: unknown, reply: FastifyReply) {
-  reply.code(400)
-  return { error: error instanceof Error ? error.message : "Unable to fulfill request" }
-}

packages/server/src/server/tls.ts

@@ -1,283 +0,0 @@
-import crypto from "crypto"
-import fs from "fs"
-import path from "path"
-import { createRequire } from "module"
-import type { Logger } from "../logger"
-
-const require = createRequire(import.meta.url)
-
-type Forge = typeof import("node-forge")
-
-function loadForge(): Forge {
-  // node-forge is CJS in many installs; require keeps this compatible with our ESM output.
-  return require("node-forge") as Forge
-}
-
-export interface ResolvedHttpsOptions {
-  httpsOptions: { key: string | Buffer; cert: string | Buffer; ca?: string | Buffer }
-  /** Path to CA certificate suitable for NODE_EXTRA_CA_CERTS. */
-  caCertPath?: string
-  mode: "provided" | "generated"
-}
-
-export interface ResolveHttpsOptionsArgs {
-  enabled: boolean
-  configDir: string
-  host: string
-  tlsKeyPath?: string
-  tlsCertPath?: string
-  tlsCaPath?: string
-  tlsSANs?: string
-  logger: Logger
-}
-
-const LEAF_VALIDITY_DAYS = 30
-const ROTATE_IF_EXPIRES_WITHIN_DAYS = 3
-
-const CA_VALIDITY_DAYS = 365
-
-export function resolveHttpsOptions(args: ResolveHttpsOptionsArgs): ResolvedHttpsOptions | null {
-  if (!args.enabled) {
-    return null
-  }
-
-  const hasProvided = Boolean(args.tlsKeyPath && args.tlsCertPath)
-  if (hasProvided) {
-    const key = fs.readFileSync(args.tlsKeyPath!, "utf-8")
-    const cert = fs.readFileSync(args.tlsCertPath!, "utf-8")
-    const ca = args.tlsCaPath ? fs.readFileSync(args.tlsCaPath, "utf-8") : undefined
-    return {
-      httpsOptions: { key, cert, ca },
-      caCertPath: args.tlsCaPath,
-      mode: "provided",
-    }
-  }
-
-  return ensureGeneratedTls(args)
-}
-
-function ensureGeneratedTls(args: ResolveHttpsOptionsArgs): ResolvedHttpsOptions {
-  const tlsDir = path.join(args.configDir, "tls")
-  const caKeyPath = path.join(tlsDir, "ca-key.pem")
-  const caCertPath = path.join(tlsDir, "ca-cert.pem")
-  const keyPath = path.join(tlsDir, "server-key.pem")
-  const certPath = path.join(tlsDir, "server-cert.pem")
-
-  fs.mkdirSync(tlsDir, { recursive: true })
-
-  const shouldRotateLeaf = () => {
-    try {
-      if (!fs.existsSync(certPath)) return true
-      const pem = fs.readFileSync(certPath, "utf-8")
-      const x509 = new crypto.X509Certificate(pem)
-      const validToMs = Date.parse(x509.validTo)
-      if (!Number.isFinite(validToMs)) return true
-      const rotateAt = validToMs - ROTATE_IF_EXPIRES_WITHIN_DAYS * 24 * 60 * 60 * 1000
-      return Date.now() >= rotateAt
-    } catch {
-      return true
-    }
-  }
-
-  const shouldRotateCa = () => {
-    try {
-      if (!fs.existsSync(caCertPath)) return true
-      const pem = fs.readFileSync(caCertPath, "utf-8")
-      const x509 = new crypto.X509Certificate(pem)
-      const validToMs = Date.parse(x509.validTo)
-      if (!Number.isFinite(validToMs)) return true
-      // CA rotates only when expired.
-      return Date.now() >= validToMs
-    } catch {
-      return true
-    }
-  }
-
-  if (shouldRotateCa() || !fs.existsSync(caKeyPath)) {
-    const { caKeyPem, caCertPem } = generateCaCertificate()
-    writePemFile(caKeyPath, caKeyPem, 0o600)
-    writePemFile(caCertPath, caCertPem, 0o644)
-    args.logger.info({ caCertPath }, "Generated self-signed CodeNomad CA certificate")
-  }
-
-  if (shouldRotateLeaf() || !fs.existsSync(keyPath)) {
-    const caKeyPem = fs.readFileSync(caKeyPath, "utf-8")
-    const caCertPem = fs.readFileSync(caCertPath, "utf-8")
-
-    const { keyPem, certPem } = generateServerCertificate({
-      host: args.host,
-      tlsSANs: args.tlsSANs,
-      caKeyPem,
-      caCertPem,
-    })
-
-    writePemFile(keyPath, keyPem, 0o600)
-    writePemFile(certPath, certPem, 0o644)
-    args.logger.info({ certPath }, "Generated CodeNomad HTTPS certificate")
-  }
-
-  const key = fs.readFileSync(keyPath, "utf-8")
-  const cert = fs.readFileSync(certPath, "utf-8")
-  const ca = fs.readFileSync(caCertPath, "utf-8")
-
-  // Present the CA as part of the chain.
-  const chainedCert = `${cert.trim()}\n${ca.trim()}\n`
-
-  return {
-    httpsOptions: {
-      key,
-      cert: chainedCert,
-    },
-    caCertPath,
-    mode: "generated",
-  }
-}
-
-function writePemFile(filePath: string, content: string, mode: number) {
-  fs.writeFileSync(filePath, content, { encoding: "utf-8", mode })
-  try {
-    fs.chmodSync(filePath, mode)
-  } catch {
-    // best effort on platforms that ignore chmod
-  }
-}
-
-function generateCaCertificate(): { caKeyPem: string; caCertPem: string } {
-  const forge = loadForge()
-
-  const keys = forge.pki.rsa.generateKeyPair(2048)
-  const cert = forge.pki.createCertificate()
-  cert.publicKey = keys.publicKey
-  cert.serialNumber = crypto.randomBytes(16).toString("hex")
-
-  const now = new Date()
-  const notBefore = new Date(now.getTime() - 60_000)
-  const notAfter = new Date(now.getTime() + CA_VALIDITY_DAYS * 24 * 60 * 60 * 1000)
-  cert.validity.notBefore = notBefore
-  cert.validity.notAfter = notAfter
-
-  const attrs = [{ name: "commonName", value: "CodeNomad Local CA" }]
-  cert.setSubject(attrs)
-  cert.setIssuer(attrs)
-
-  cert.setExtensions([
-    { name: "basicConstraints", cA: true },
-    { name: "keyUsage", keyCertSign: true, cRLSign: true, digitalSignature: true },
-    { name: "subjectKeyIdentifier" },
-  ])
-
-  cert.sign(keys.privateKey, forge.md.sha256.create())
-
-  return {
-    caKeyPem: forge.pki.privateKeyToPem(keys.privateKey),
-    caCertPem: forge.pki.certificateToPem(cert),
-  }
-}
-
-function generateServerCertificate(args: {
-  host: string
-  tlsSANs?: string
-  caKeyPem: string
-  caCertPem: string
-}): { keyPem: string; certPem: string } {
-  const forge = loadForge()
-
-  const caKey = forge.pki.privateKeyFromPem(args.caKeyPem)
-  const caCert = forge.pki.certificateFromPem(args.caCertPem)
-
-  const keys = forge.pki.rsa.generateKeyPair(2048)
-  const cert = forge.pki.createCertificate()
-  cert.publicKey = keys.publicKey
-  cert.serialNumber = crypto.randomBytes(16).toString("hex")
-
-  const now = new Date()
-  const notBefore = new Date(now.getTime() - 60_000)
-  const notAfter = new Date(now.getTime() + LEAF_VALIDITY_DAYS * 24 * 60 * 60 * 1000)
-  cert.validity.notBefore = notBefore
-  cert.validity.notAfter = notAfter
-
-  const commonName = pickCommonName(args.host)
-  cert.setSubject([{ name: "commonName", value: commonName }])
-  cert.setIssuer(caCert.subject.attributes)
-
-  const san = buildSubjectAltNames(args.host, args.tlsSANs)
-
-  cert.setExtensions([
-    { name: "basicConstraints", cA: false },
-    { name: "keyUsage", digitalSignature: true, keyEncipherment: true },
-    { name: "extKeyUsage", serverAuth: true },
-    { name: "subjectAltName", altNames: san },
-    { name: "subjectKeyIdentifier" },
-  ])
-
-  cert.sign(caKey, forge.md.sha256.create())
-
-  return {
-    keyPem: forge.pki.privateKeyToPem(keys.privateKey),
-    certPem: forge.pki.certificateToPem(cert),
-  }
-}
-
-function pickCommonName(host: string): string {
-  if (!host || host === "0.0.0.0") {
-    return "localhost"
-  }
-  if (host === "127.0.0.1") {
-    return "localhost"
-  }
-  return host
-}
-
-function buildSubjectAltNames(host: string, tlsSANs?: string): Array<{ type: number; value?: string; ip?: string }> {
-  const dns = new Set<string>()
-  const ips = new Set<string>()
-
-  dns.add("localhost")
-  ips.add("127.0.0.1")
-
-  if (host && host !== "0.0.0.0") {
-    if (isIPv4(host)) {
-      ips.add(host)
-    } else {
-      dns.add(host)
-    }
-  }
-
-  for (const token of splitList(tlsSANs)) {
-    if (isIPv4(token)) {
-      ips.add(token)
-    } else if (token) {
-      dns.add(token)
-    }
-  }
-
-  const altNames: Array<{ type: number; value?: string; ip?: string }> = []
-
-  // 2 = DNS, 7 = IP
-  for (const name of Array.from(dns)) {
-    altNames.push({ type: 2, value: name })
-  }
-  for (const ip of Array.from(ips)) {
-    altNames.push({ type: 7, ip })
-  }
-
-  return altNames
-}
-
-function splitList(input: string | undefined): string[] {
-  if (!input) return []
-  return input
-    .split(",")
-    .map((part) => part.trim())
-    .filter(Boolean)
-}
-
-function isIPv4(value: string): boolean {
-  const parts = value.split(".")
-  if (parts.length !== 4) return false
-  return parts.every((part) => {
-    if (!/^[0-9]+$/.test(part)) return false
-    const num = Number(part)
-    return Number.isInteger(num) && num >= 0 && num <= 255
-  })
-}

packages/server/src/settings/binaries.ts

@@ -1,55 +0,0 @@
-import type { SettingsService } from "./service"
-
-export interface OpenCodeBinaryEntry {
-  path: string
-  version?: string
-  lastUsed?: number
-  label?: string
-}
-
-export interface ResolvedBinary {
-  path: string
-  label: string
-  version?: string
-}
-
-function prettyLabel(p: string): string {
-  const parts = p.split(/[\\/]/)
-  const last = parts[parts.length - 1] || p
-  return last || p
-}
-
-function readUiBinaries(settings: SettingsService): OpenCodeBinaryEntry[] {
-  const ui = settings.getOwner("state", "ui")
-  const list = (ui as any)?.opencodeBinaries
-  if (!Array.isArray(list)) return []
-  return list.filter((item) => item && typeof item === "object" && typeof (item as any).path === "string") as any
-}
-
-function readDefaultBinaryPath(settings: SettingsService): string | undefined {
-  const server = settings.getOwner("config", "server")
-  const value = (server as any)?.opencodeBinary
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined
-}
-
-export class BinaryResolver {
-  constructor(private readonly settings: SettingsService) {}
-
-  list(): OpenCodeBinaryEntry[] {
-    return readUiBinaries(this.settings)
-  }
-
-  resolveDefault(): ResolvedBinary {
-    const binaries = this.list()
-    const configuredDefault = readDefaultBinaryPath(this.settings)
-    const fallback = binaries[0]?.path
-    const path = configuredDefault ?? fallback ?? "opencode"
-
-    const entry = binaries.find((b) => b.path === path)
-    return {
-      path,
-      label: entry?.label ?? prettyLabel(path),
-      version: entry?.version,
-    }
-  }
-}

packages/server/src/settings/merge-patch.ts

@@ -1,39 +0,0 @@
-type PlainObject = Record<string, unknown>
-
-export function isPlainObject(value: unknown): value is PlainObject {
-  if (!value || typeof value !== "object") return false
-  if (Array.isArray(value)) return false
-  const proto = Object.getPrototypeOf(value)
-  return proto === Object.prototype || proto === null
-}
-
-/**
- * RFC 7396-ish merge patch with explicit null deletes.
- * - Objects merge recursively
- * - Arrays/scalars replace
- * - null deletes keys
- */
-export function applyMergePatch(current: unknown, patch: unknown): unknown {
-  if (!isPlainObject(patch)) {
-    return patch
-  }
-
-  const base: PlainObject = isPlainObject(current) ? { ...(current as PlainObject) } : {}
-
-  for (const [key, value] of Object.entries(patch)) {
-    if (value === null) {
-      delete base[key]
-      continue
-    }
-
-    const existing = base[key]
-    if (isPlainObject(value) && isPlainObject(existing)) {
-      base[key] = applyMergePatch(existing, value)
-      continue
-    }
-
-    base[key] = value
-  }
-
-  return base
-}

packages/server/src/settings/migrate.ts

@@ -1,269 +0,0 @@
-import fs from "fs"
-import path from "path"
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml"
-import type { Logger } from "../logger"
-import type { ConfigLocation } from "../config/location"
-import { isPlainObject } from "./merge-patch"
-
-type Doc = Record<string, unknown>
-
-function ensureTrailingNewline(content: string): string {
-  if (!content) return "\n"
-  return content.endsWith("\n") ? content : `${content}\n`
-}
-
-function safeReadYaml(filePath: string, logger: Logger): unknown {
-  try {
-    const content = fs.readFileSync(filePath, "utf-8")
-    return parseYaml(content)
-  } catch (error) {
-    logger.warn({ err: error, filePath }, "Failed to read YAML file during migration")
-    return null
-  }
-}
-
-function safeReadJson(filePath: string, logger: Logger): unknown {
-  try {
-    const content = fs.readFileSync(filePath, "utf-8")
-    return JSON.parse(content)
-  } catch (error) {
-    logger.warn({ err: error, filePath }, "Failed to read JSON file during migration")
-    return null
-  }
-}
-
-function writeYaml(filePath: string, doc: Doc, logger: Logger) {
-  try {
-    fs.mkdirSync(path.dirname(filePath), { recursive: true })
-    const yaml = stringifyYaml(doc as any)
-    fs.writeFileSync(filePath, ensureTrailingNewline(yaml), "utf-8")
-  } catch (error) {
-    logger.warn({ err: error, filePath }, "Failed to write YAML file during migration")
-  }
-}
-
-function pickBackupPath(filePath: string): string {
-  const preferred = `${filePath}.bak`
-  if (!fs.existsSync(preferred)) {
-    return preferred
-  }
-  return `${filePath}.bak.${Date.now()}`
-}
-
-function normalizeDoc(value: unknown): Doc {
-  return isPlainObject(value) ? (value as Doc) : {}
-}
-
-function looksLikeNewOwnerDoc(value: unknown): boolean {
-  const doc = normalizeDoc(value)
-  // Heuristic: owner-bucket docs have at least one of these roots.
-  return Boolean(doc.ui || doc.server || doc.app || doc.legacy)
-}
-
-function looksLikeLegacyConfig(value: unknown): boolean {
-  const doc = normalizeDoc(value)
-  return Boolean(doc.preferences || doc.opencodeBinaries || doc.theme || doc.recentFolders)
-}
-
-function looksLikeLegacyState(value: unknown): boolean {
-  const doc = normalizeDoc(value)
-  return Boolean(doc.recentFolders)
-}
-
-function omitKeys(source: Doc, keys: Set<string>): Doc {
-  const out: Doc = {}
-  for (const [k, v] of Object.entries(source)) {
-    if (keys.has(k)) continue
-    out[k] = v
-  }
-  return out
-}
-
-function mapLegacyToOwnerDocs(legacyConfig: unknown, legacyState: unknown): { config: Doc; state: Doc } {
-  const cfg = normalizeDoc(legacyConfig)
-  const st = normalizeDoc(legacyState)
-
-  const outConfig: Doc = {}
-  const outState: Doc = {}
-
-  const uiConfig: Doc = {}
-  const uiSettings: Doc = {}
-  const serverConfig: Doc = {}
-  const uiState: Doc = {}
-
-  // theme -> config.ui.theme
-  if (typeof cfg.theme === "string") {
-    uiConfig.theme = cfg.theme
-  }
-
-  const preferences = normalizeDoc(cfg.preferences)
-  if (Object.keys(preferences).length > 0) {
-    // Server-owned stable keys
-    const envVars = preferences.environmentVariables
-    if (isPlainObject(envVars)) {
-      serverConfig.environmentVariables = envVars
-    }
-    const listeningMode = preferences.listeningMode
-    if (typeof listeningMode === "string") {
-      serverConfig.listeningMode = listeningMode
-    }
-    const lastUsedBinary = preferences.lastUsedBinary
-    if (typeof lastUsedBinary === "string") {
-      serverConfig.opencodeBinary = lastUsedBinary
-    }
-
-    // UI-owned state keys (drop preferences)
-    const modelRecents = preferences.modelRecents
-    const modelFavorites = preferences.modelFavorites
-    const modelThinkingSelections = preferences.modelThinkingSelections
-
-    const models: Doc = {}
-    if (Array.isArray(modelRecents)) {
-      models.recents = modelRecents
-    }
-    if (Array.isArray(modelFavorites)) {
-      models.favorites = modelFavorites
-    }
-    if (isPlainObject(modelThinkingSelections)) {
-      models.thinkingSelections = modelThinkingSelections
-    }
-    if (Object.keys(models).length > 0) {
-      uiState.models = models
-    }
-
-    // Remaining preferences are treated as stable UI settings.
-    const moved = new Set([
-      "environmentVariables",
-      "listeningMode",
-      "lastUsedBinary",
-      "modelRecents",
-      "modelFavorites",
-      "modelThinkingSelections",
-    ])
-    Object.assign(uiSettings, omitKeys(preferences, moved))
-  }
-
-  // recentFolders lives in legacy state (yaml) or legacy config.json
-  const recentFolders = (st.recentFolders ?? cfg.recentFolders) as unknown
-  if (Array.isArray(recentFolders)) {
-    uiState.recentFolders = recentFolders
-  }
-
-  // opencodeBinaries -> state.ui.opencodeBinaries
-  if (Array.isArray(cfg.opencodeBinaries)) {
-    uiState.opencodeBinaries = cfg.opencodeBinaries
-  }
-
-  if (Object.keys(uiSettings).length > 0) {
-    uiConfig.settings = uiSettings
-  }
-
-  if (Object.keys(uiConfig).length > 0) {
-    outConfig.ui = uiConfig
-  }
-  if (Object.keys(serverConfig).length > 0) {
-    outConfig.server = serverConfig
-  }
-  if (Object.keys(uiState).length > 0) {
-    outState.ui = uiState
-  }
-
-  // Unknown top-level keys -> legacy.unknown
-  const knownConfigKeys = new Set(["preferences", "opencodeBinaries", "theme", "recentFolders"])
-  const unknownConfig = omitKeys(cfg, knownConfigKeys)
-  if (Object.keys(unknownConfig).length > 0) {
-    outConfig.legacy = { unknown: unknownConfig }
-  }
-
-  const knownStateKeys = new Set(["recentFolders"])
-  const unknownState = omitKeys(st, knownStateKeys)
-  if (Object.keys(unknownState).length > 0) {
-    outState.legacy = { unknown: unknownState }
-  }
-
-  return { config: outConfig, state: outState }
-}
-
-/**
- * Migrate older config/state layouts into owner-bucket YAML docs.
- *
- * Legacy inputs supported:
- * - config.yaml with { preferences, opencodeBinaries, theme }
- * - state.yaml with { recentFolders }
- * - legacy config.json with full ConfigFile schema
- */
-export function migrateSettingsLayout(location: ConfigLocation, logger: Logger) {
-  const configYamlPath = location.configYamlPath
-  const stateYamlPath = location.stateYamlPath
-  const legacyJsonPath = location.legacyJsonPath
-
-  const configExists = fs.existsSync(configYamlPath)
-  const stateExists = fs.existsSync(stateYamlPath)
-
-  const configDoc = configExists ? safeReadYaml(configYamlPath, logger) : null
-  const stateDoc = stateExists ? safeReadYaml(stateYamlPath, logger) : null
-
-  const configIsNew = configExists && looksLikeNewOwnerDoc(configDoc) && !looksLikeLegacyConfig(configDoc)
-  const stateIsNew = stateExists && looksLikeNewOwnerDoc(stateDoc) && !looksLikeLegacyState(stateDoc)
-
-  if (configIsNew && stateIsNew) {
-    return
-  }
-
-  const legacyJsonExists = fs.existsSync(legacyJsonPath)
-
-  const hasLegacyYaml = (configExists && looksLikeLegacyConfig(configDoc)) || (stateExists && looksLikeLegacyState(stateDoc))
-  const shouldMigrateFromJson = !configExists && legacyJsonExists
-
-  if (!hasLegacyYaml && !shouldMigrateFromJson) {
-    // Either fresh install or partially written docs; let stores create on first write.
-    return
-  }
-
-  const sourceConfig = shouldMigrateFromJson ? safeReadJson(legacyJsonPath, logger) : configDoc
-  const sourceState = shouldMigrateFromJson ? sourceConfig : stateDoc
-
-  const { config, state } = mapLegacyToOwnerDocs(sourceConfig, sourceState)
-
-  try {
-    fs.mkdirSync(location.baseDir, { recursive: true })
-  } catch (error) {
-    logger.warn({ err: error, baseDir: location.baseDir }, "Failed to create base directory during migration")
-  }
-
-  // Backup legacy files before rewriting.
-  if (configExists) {
-    try {
-      const bak = pickBackupPath(configYamlPath)
-      fs.renameSync(configYamlPath, bak)
-      logger.info({ configYamlPath, bak }, "Backed up legacy config.yaml")
-    } catch (error) {
-      logger.warn({ err: error, configYamlPath }, "Failed to backup legacy config.yaml")
-    }
-  }
-
-  if (stateExists) {
-    try {
-      const bak = pickBackupPath(stateYamlPath)
-      fs.renameSync(stateYamlPath, bak)
-      logger.info({ stateYamlPath, bak }, "Backed up legacy state.yaml")
-    } catch (error) {
-      logger.warn({ err: error, stateYamlPath }, "Failed to backup legacy state.yaml")
-    }
-  }
-
-  if (shouldMigrateFromJson) {
-    try {
-      const bak = pickBackupPath(legacyJsonPath)
-      fs.renameSync(legacyJsonPath, bak)
-      logger.info({ legacyJsonPath, bak }, "Moved legacy config.json to backup")
-    } catch (error) {
-      logger.warn({ err: error, legacyJsonPath }, "Failed to move legacy config.json to backup")
-    }
-  }
-
-  writeYaml(configYamlPath, config, logger)
-  writeYaml(stateYamlPath, state, logger)
-
-  logger.info({ configYamlPath, stateYamlPath }, "Migrated settings docs to owner-bucket layout")
-}

packages/server/src/settings/public-config.ts

@@ -1,40 +0,0 @@
-import type { SettingsDoc } from "./yaml-doc-store"
-
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value)
-}
-
-function sanitizeServerOwner(value: SettingsDoc): SettingsDoc {
-  const next: SettingsDoc = { ...value }
-  const speech = isPlainObject(next.speech) ? { ...next.speech } : null
-
-  if (!speech) {
-    return next
-  }
-
-  const rawApiKey = typeof speech.apiKey === "string" ? speech.apiKey.trim() : ""
-  if (rawApiKey) {
-    delete speech.apiKey
-    speech.hasApiKey = true
-  } else if (!("hasApiKey" in speech)) {
-    speech.hasApiKey = false
-  }
-
-  next.speech = speech
-  return next
-}
-
-export function sanitizeConfigOwner(owner: string, value: SettingsDoc): SettingsDoc {
-  if (owner !== "server") {
-    return value
-  }
-  return sanitizeServerOwner(value)
-}
-
-export function sanitizeConfigDoc(value: SettingsDoc): SettingsDoc {
-  const next: SettingsDoc = { ...value }
-  if (isPlainObject(next.server)) {
-    next.server = sanitizeServerOwner(next.server)
-  }
-  return next
-}

packages/server/src/settings/service.ts

@@ -1,57 +0,0 @@
-import type { Logger } from "../logger"
-import type { EventBus } from "../events/bus"
-import type { ConfigLocation } from "../config/location"
-import { YamlDocStore, type SettingsDoc } from "./yaml-doc-store"
-import { migrateSettingsLayout } from "./migrate"
-import type { WorkspaceEventPayload } from "../api-types"
-import { sanitizeConfigOwner } from "./public-config"
-
-export type DocKind = "config" | "state"
-
-export class SettingsService {
-  private readonly configStore: YamlDocStore
-  private readonly stateStore: YamlDocStore
-
-  constructor(
-    private readonly location: ConfigLocation,
-    private readonly eventBus: EventBus | undefined,
-    private readonly logger: Logger,
-  ) {
-    migrateSettingsLayout(location, logger)
-    this.configStore = new YamlDocStore(location.configYamlPath, logger.child({ component: "settings-config" }))
-    this.stateStore = new YamlDocStore(location.stateYamlPath, logger.child({ component: "settings-state" }))
-  }
-
-  getDoc(kind: DocKind): SettingsDoc {
-    return kind === "config" ? this.configStore.get() : this.stateStore.get()
-  }
-
-  mergePatchDoc(kind: DocKind, patch: unknown): SettingsDoc {
-    const updated = kind === "config" ? this.configStore.mergePatch(patch) : this.stateStore.mergePatch(patch)
-    this.publish(kind, "*")
-    return updated
-  }
-
-  getOwner(kind: DocKind, owner: string): SettingsDoc {
-    return kind === "config" ? this.configStore.getOwner(owner) : this.stateStore.getOwner(owner)
-  }
-
-  mergePatchOwner(kind: DocKind, owner: string, patch: unknown): SettingsDoc {
-    const updated =
-      kind === "config" ? this.configStore.mergePatchOwner(owner, patch) : this.stateStore.mergePatchOwner(owner, patch)
-    this.publish(kind, owner, updated)
-    return updated
-  }
-
-  private publish(kind: DocKind, owner: string, value?: SettingsDoc) {
-    if (!this.eventBus) return
-    const type = kind === "config" ? "storage.configChanged" : "storage.stateChanged"
-    const nextValue = value ?? this.getOwner(kind, owner)
-    const payload: WorkspaceEventPayload = {
-      type,
-      owner,
-      value: kind === "config" ? sanitizeConfigOwner(owner, nextValue) : nextValue,
-    } as any
-    this.eventBus.publish(payload)
-  }
-}

packages/server/src/settings/yaml-doc-store.ts

@@ -1,110 +0,0 @@
-import fs from "fs"
-import path from "path"
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml"
-import type { Logger } from "../logger"
-import { applyMergePatch, isPlainObject } from "./merge-patch"
-
-export type SettingsDoc = Record<string, unknown>
-
-function ensureTrailingNewline(content: string): string {
-  if (!content) return "\n"
-  return content.endsWith("\n") ? content : `${content}\n`
-}
-
-function normalizeDoc(input: unknown): SettingsDoc {
-  if (!isPlainObject(input)) {
-    return {}
-  }
-  return input
-}
-
-export class YamlDocStore {
-  private cache: SettingsDoc = {}
-  private loaded = false
-
-  constructor(
-    private readonly filePath: string,
-    private readonly logger: Logger,
-  ) {}
-
-  load(): SettingsDoc {
-    if (this.loaded) {
-      return this.cache
-    }
-
-    try {
-      if (!fs.existsSync(this.filePath)) {
-        this.cache = {}
-        this.loaded = true
-        return this.cache
-      }
-
-      const content = fs.readFileSync(this.filePath, "utf-8")
-      const parsed = parseYaml(content)
-      this.cache = normalizeDoc(parsed)
-      this.loaded = true
-      return this.cache
-    } catch (error) {
-      this.logger.warn({ err: error, filePath: this.filePath }, "Failed to read YAML doc; using empty object")
-      this.cache = {}
-      this.loaded = true
-      return this.cache
-    }
-  }
-
-  get(): SettingsDoc {
-    return this.load()
-  }
-
-  replace(next: unknown): SettingsDoc {
-    const normalized = normalizeDoc(next)
-    this.cache = normalized
-    this.loaded = true
-    this.persist()
-    return this.cache
-  }
-
-  mergePatch(patch: unknown): SettingsDoc {
-    if (!isPlainObject(patch)) {
-      throw new Error("Patch must be a JSON object")
-    }
-    const current = this.get()
-    const next = applyMergePatch(current, patch)
-    return this.replace(next)
-  }
-
-  getOwner(owner: string): SettingsDoc {
-    const doc = this.get()
-    const value = (doc as any)?.[owner]
-    return normalizeDoc(value)
-  }
-
-  replaceOwner(owner: string, value: unknown): SettingsDoc {
-    const doc = this.get()
-    const nextDoc: SettingsDoc = { ...doc, [owner]: normalizeDoc(value) }
-    this.replace(nextDoc)
-    return nextDoc[owner] as SettingsDoc
-  }
-
-  mergePatchOwner(owner: string, patch: unknown): SettingsDoc {
-    if (!isPlainObject(patch)) {
-      throw new Error("Patch must be a JSON object")
-    }
-    const doc = this.get()
-    const currentOwner = normalizeDoc((doc as any)?.[owner])
-    const nextOwner = normalizeDoc(applyMergePatch(currentOwner, patch))
-    const nextDoc: SettingsDoc = { ...doc, [owner]: nextOwner }
-    this.replace(nextDoc)
-    return nextOwner
-  }
-
-  private persist() {
-    try {
-      fs.mkdirSync(path.dirname(this.filePath), { recursive: true })
-      const yaml = stringifyYaml(this.cache as any)
-      fs.writeFileSync(this.filePath, ensureTrailingNewline(yaml), "utf-8")
-    } catch (error) {
-      this.logger.warn({ err: error, filePath: this.filePath }, "Failed to persist YAML doc")
-    }
-  }
-}

packages/server/src/speech/providers/openai-compatible.ts

@@ -1,234 +0,0 @@
-import { Readable } from "node:stream"
-import OpenAI from "openai"
-import { toFile } from "openai/uploads"
-import type { SpeechSynthesisResponse, SpeechTranscriptionResponse } from "../../api-types"
-import type { Logger } from "../../logger"
-import type { NormalizedSpeechSettings, SpeechSynthesisStreamResponse, SynthesizeSpeechInput, TranscribeAudioInput } from "../service"
-
-interface OpenAICompatibleSpeechProviderOptions {
-  settings: NormalizedSpeechSettings
-  logger: Logger
-}
-
-export class OpenAICompatibleSpeechProvider {
-  constructor(private readonly options: OpenAICompatibleSpeechProviderOptions) {}
-
-  getCapabilities() {
-    const { settings } = this.options
-    return {
-      available: true,
-      configured: Boolean(settings.apiKey),
-      provider: settings.provider,
-      supportsStt: true,
-      supportsTts: true,
-      supportsStreamingTts: true,
-      baseUrl: settings.baseUrl,
-      sttModel: settings.sttModel,
-      ttsModel: settings.ttsModel,
-      ttsVoice: settings.ttsVoice,
-      ttsFormats: ["mp3", "wav", "opus", "aac"],
-      streamingTtsFormats: ["mp3", "wav", "opus", "aac"],
-    }
-  }
-
-  async transcribe(input: TranscribeAudioInput): Promise<SpeechTranscriptionResponse> {
-    const client = this.createClient()
-    const startedAt = Date.now()
-    const extension = extensionForMime(input.mimeType)
-    const buffer = Buffer.from(input.audioBase64, "base64")
-    const filename = input.filename?.trim() || `prompt-input.${extension}`
-
-    this.options.logger.info(
-      {
-        mimeType: input.mimeType,
-        bytes: buffer.byteLength,
-        language: input.language,
-        model: this.options.settings.sttModel,
-      },
-      "speech.transcribe",
-    )
-
-    const response = await this.requestTranscription(client, buffer, filename, input)
-
-    return {
-      text: typeof response?.text === "string" ? response.text : "",
-      language: typeof response?.language === "string" ? response.language : input.language,
-      durationMs: Number.isFinite(response?.duration) ? Math.round(Number(response.duration) * 1000) : Date.now() - startedAt,
-      segments: Array.isArray(response?.segments)
-        ? response.segments
-            .filter((segment: any) => typeof segment?.text === "string")
-            .map((segment: any) => ({
-              startMs: Math.max(0, Math.round(Number(segment.start ?? 0) * 1000)),
-              endMs: Math.max(0, Math.round(Number(segment.end ?? 0) * 1000)),
-              text: String(segment.text),
-            }))
-        : undefined,
-    }
-  }
-
-  private async requestTranscription(
-    client: OpenAI,
-    buffer: Buffer,
-    filename: string,
-    input: TranscribeAudioInput,
-  ): Promise<any> {
-    const baseRequest = {
-      model: this.options.settings.sttModel,
-      ...(input.language ? { language: input.language } : {}),
-      ...(input.prompt ? { prompt: input.prompt } : {}),
-    }
-
-    try {
-      const file = await toFile(buffer, filename, { type: input.mimeType })
-      return (await client.audio.transcriptions.create({
-        ...baseRequest,
-        file,
-        response_format: "verbose_json" as any,
-      } as any)) as any
-    } catch (error) {
-      this.options.logger.warn({ err: error }, "speech.transcribe verbose_json failed; retrying default format")
-      const retryFile = await toFile(buffer, filename, { type: input.mimeType })
-      return (await client.audio.transcriptions.create({
-        ...baseRequest,
-        file: retryFile,
-      } as any)) as any
-    }
-  }
-
-  async synthesize(input: SynthesizeSpeechInput): Promise<SpeechSynthesisResponse> {
-    const format = input.format ?? this.options.settings.ttsFormat
-
-    this.options.logger.info(
-      {
-        model: this.options.settings.ttsModel,
-        voice: this.options.settings.ttsVoice,
-        format,
-      },
-      "speech.synthesize",
-    )
-
-    const response = await this.requestSpeechAudio(input.text, format)
-    const mimeType = response.headers.get("content-type") || mimeTypeForFormat(format)
-
-    const audioBuffer = Buffer.from(await response.arrayBuffer())
-    return {
-      audioBase64: audioBuffer.toString("base64"),
-      mimeType,
-    }
-  }
-
-  async synthesizeStream(input: SynthesizeSpeechInput): Promise<SpeechSynthesisStreamResponse> {
-    const format = input.format ?? this.options.settings.ttsFormat
-
-    this.options.logger.info(
-      {
-        model: this.options.settings.ttsModel,
-        voice: this.options.settings.ttsVoice,
-        format,
-      },
-      "speech.synthesize.stream",
-    )
-
-    const response = await this.requestSpeechAudio(input.text, format)
-    if (!response.body) {
-      throw new Error("Speech provider did not return a stream.")
-    }
-
-    return {
-      stream: Readable.fromWeb(response.body as any),
-      mimeType: response.headers.get("content-type") || mimeTypeForFormat(format),
-    }
-  }
-
-  private async requestSpeechAudio(text: string, format: "mp3" | "wav" | "opus" | "aac"): Promise<Response> {
-    const { settings } = this.options
-    if (!settings.apiKey) {
-      throw new Error("Speech provider is not configured. Add an API key in Speech settings.")
-    }
-
-    const endpoint = new URL("audio/speech", ensureTrailingSlash(settings.baseUrl ?? "https://api.openai.com/v1"))
-    let response: Response
-    try {
-      response = await fetch(endpoint, {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${settings.apiKey}`,
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-          model: settings.ttsModel,
-          voice: settings.ttsVoice,
-          input: text,
-          response_format: format,
-        }),
-      })
-    } catch (error) {
-      const detailedError = error as Error & {
-        cause?: unknown
-        code?: string
-        errno?: number | string
-        syscall?: string
-        address?: string
-        port?: number
-      }
-      this.options.logger.error(
-        {
-          err: error,
-          endpoint: endpoint.toString(),
-          baseUrl: settings.baseUrl,
-          model: settings.ttsModel,
-          voice: settings.ttsVoice,
-          format,
-          cause: detailedError.cause,
-          code: detailedError.code,
-          errno: detailedError.errno,
-          syscall: detailedError.syscall,
-          address: detailedError.address,
-          port: detailedError.port,
-        },
-        "speech.synthesize fetch failed",
-      )
-      throw error
-    }
-
-    if (!response.ok) {
-      const detail = await response.text()
-      throw new Error(detail || `Speech synthesis failed with ${response.status}`)
-    }
-
-    return response
-  }
-
-  private createClient(): OpenAI {
-    const { settings } = this.options
-    if (!settings.apiKey) {
-      throw new Error("Speech provider is not configured. Add an API key in Speech settings.")
-    }
-
-    return new OpenAI({
-      apiKey: settings.apiKey,
-      baseURL: settings.baseUrl,
-    })
-  }
-}
-
-function extensionForMime(mimeType: string): string {
-  const normalized = mimeType.toLowerCase()
-  if (normalized.includes("webm")) return "webm"
-  if (normalized.includes("ogg")) return "ogg"
-  if (normalized.includes("wav")) return "wav"
-  if (normalized.includes("mpeg") || normalized.includes("mp3")) return "mp3"
-  if (normalized.includes("mp4") || normalized.includes("aac")) return "m4a"
-  return "webm"
-}
-
-function mimeTypeForFormat(format: "mp3" | "wav" | "opus" | "aac"): string {
-  if (format === "wav") return "audio/wav"
-  if (format === "opus") return 'audio/ogg; codecs="opus"'
-  if (format === "aac") return "audio/aac"
-  return "audio/mpeg"
-}
-
-function ensureTrailingSlash(value: string): string {
-  return value.endsWith("/") ? value : `${value}/`
-}

packages/server/src/speech/service.ts

@@ -1,106 +0,0 @@
-import { z } from "zod"
-import type { Readable } from "node:stream"
-import type { Logger } from "../logger"
-import type { SettingsService } from "../settings/service"
-import type { SpeechCapabilitiesResponse, SpeechSynthesisResponse, SpeechTranscriptionResponse } from "../api-types"
-import { OpenAICompatibleSpeechProvider } from "./providers/openai-compatible"
-
-const ServerSpeechSettingsSchema = z.object({
-  speech: z
-    .object({
-      provider: z.string().optional(),
-      apiKey: z.string().optional(),
-      baseUrl: z.string().optional(),
-      sttModel: z.string().optional(),
-      ttsModel: z.string().optional(),
-      ttsVoice: z.string().optional(),
-      ttsFormat: z.enum(["mp3", "wav", "opus", "aac"]).optional(),
-    })
-    .optional(),
-})
-
-export interface TranscribeAudioInput {
-  audioBase64: string
-  mimeType: string
-  filename?: string
-  language?: string
-  prompt?: string
-}
-
-export interface SynthesizeSpeechInput {
-  text: string
-  format?: "mp3" | "wav" | "opus" | "aac"
-}
-
-export interface SpeechSynthesisStreamResponse {
-  stream: Readable
-  mimeType: string
-}
-
-export interface SpeechProvider {
-  getCapabilities(): SpeechCapabilitiesResponse
-  transcribe(input: TranscribeAudioInput): Promise<SpeechTranscriptionResponse>
-  synthesize(input: SynthesizeSpeechInput): Promise<SpeechSynthesisResponse>
-  synthesizeStream(input: SynthesizeSpeechInput): Promise<SpeechSynthesisStreamResponse>
-}
-
-export interface NormalizedSpeechSettings {
-  provider: string
-  apiKey?: string
-  baseUrl?: string
-  sttModel: string
-  ttsModel: string
-  ttsVoice: string
-  ttsFormat: "mp3" | "wav" | "opus" | "aac"
-}
-
-const DEFAULT_PROVIDER = "openai-compatible"
-const DEFAULT_STT_MODEL = "gpt-4o-mini-transcribe"
-const DEFAULT_TTS_MODEL = "gpt-4o-mini-tts"
-const DEFAULT_TTS_VOICE = "alloy"
-const DEFAULT_TTS_FORMAT = "mp3"
-export class SpeechService {
-  constructor(
-    private readonly settings: SettingsService,
-    private readonly logger: Logger,
-  ) {}
-
-  getCapabilities(): SpeechCapabilitiesResponse {
-    return this.createProvider().getCapabilities()
-  }
-
-  async transcribe(input: TranscribeAudioInput): Promise<SpeechTranscriptionResponse> {
-    return this.createProvider().transcribe(input)
-  }
-
-  async synthesize(input: SynthesizeSpeechInput): Promise<SpeechSynthesisResponse> {
-    return this.createProvider().synthesize(input)
-  }
-
-  async synthesizeStream(input: SynthesizeSpeechInput): Promise<SpeechSynthesisStreamResponse> {
-    return this.createProvider().synthesizeStream(input)
-  }
-
-  private createProvider(): SpeechProvider {
-    const settings = this.resolveSettings()
-    return new OpenAICompatibleSpeechProvider({
-      settings,
-      logger: this.logger.child({ provider: settings.provider }),
-    })
-  }
-
-  private resolveSettings(): NormalizedSpeechSettings {
-    const parsed = ServerSpeechSettingsSchema.parse(this.settings.getOwner("config", "server") ?? {})
-    const speech = parsed.speech ?? {}
-
-    return {
-      provider: speech.provider?.trim() || DEFAULT_PROVIDER,
-      apiKey: speech.apiKey?.trim() || process.env.OPENAI_API_KEY,
-      baseUrl: speech.baseUrl?.trim() || process.env.OPENAI_BASE_URL || undefined,
-      sttModel: speech.sttModel?.trim() || DEFAULT_STT_MODEL,
-      ttsModel: speech.ttsModel?.trim() || DEFAULT_TTS_MODEL,
-      ttsVoice: speech.ttsVoice?.trim() || DEFAULT_TTS_VOICE,
-      ttsFormat: speech.ttsFormat ?? DEFAULT_TTS_FORMAT,
-    }
-  }
-}

packages/server/src/ui/__tests__/remote-ui.test.ts

@@ -55,31 +55,4 @@ describe("resolveUi local version preference", () => {
     assert.equal(result.uiStaticDir, bundledDir)
     assert.equal(result.uiVersion, "0.8.1")
   })
-
-  it("prefers bundled when bundled and downloaded versions are equal", async () => {
-    const bundledDir = path.join(tempRoot, "bundled")
-    const configDir = path.join(tempRoot, "config")
-    const currentDir = path.join(configDir, "ui", "current")
-
-    await mkdir(bundledDir, { recursive: true })
-    await mkdir(currentDir, { recursive: true })
-
-    writeFileSync(path.join(bundledDir, "index.html"), "<html>bundled</html>")
-    writeFileSync(path.join(bundledDir, "ui-version.json"), JSON.stringify({ uiVersion: "0.8.1" }))
-
-    writeFileSync(path.join(currentDir, "index.html"), "<html>current</html>")
-    writeFileSync(path.join(currentDir, "ui-version.json"), JSON.stringify({ uiVersion: "0.8.1" }))
-
-    const result = await resolveUi({
-      serverVersion: "0.8.1",
-      bundledUiDir: bundledDir,
-      autoUpdate: false,
-      configDir,
-      logger: noopLogger,
-    })
-
-    assert.equal(result.source, "bundled")
-    assert.equal(result.uiStaticDir, bundledDir)
-    assert.equal(result.uiVersion, "0.8.1")
-  })
 })

packages/server/src/ui/remote-ui.ts

@@ -250,7 +250,7 @@ async function pickBestLocalUi(args: {
       uiStaticDir: currentResolved,
       source: "downloaded",
       uiVersion: await readUiVersion(currentResolved),
-      priority: 1,
+      priority: 2,
     })
   }
 
@@ -260,7 +260,7 @@ async function pickBestLocalUi(args: {
       uiStaticDir: bundledResolved,
       source: "bundled",
       uiVersion: await readUiVersion(bundledResolved),
-      priority: 2,
+      priority: 1,
     })
   }
 

packages/server/src/workspaces/git-worktrees.ts

@@ -1,241 +0,0 @@
-import path from "path"
-import { spawn } from "child_process"
-import type { WorktreeDescriptor } from "../api-types"
-import { promises as fsp } from "fs"
-
-export interface LogLike {
-  debug?: (obj: any, msg?: string) => void
-  warn?: (obj: any, msg?: string) => void
-}
-
-type GitResult = { ok: true; stdout: string } | { ok: false; error: Error; stdout?: string; stderr?: string }
-
-function runGit(args: string[], cwd: string): Promise<GitResult> {
-  return new Promise((resolve) => {
-    const child = spawn("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] })
-    let stdout = ""
-    let stderr = ""
-
-    child.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString()
-    })
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString()
-    })
-    child.once("error", (error) => {
-      resolve({ ok: false, error, stdout, stderr })
-    })
-    child.once("close", (code) => {
-      if (code === 0) {
-        resolve({ ok: true, stdout })
-      } else {
-        const error = new Error(stderr.trim() || `git ${args.join(" ")} failed with code ${code}`)
-        resolve({ ok: false, error, stdout, stderr })
-      }
-    })
-  })
-}
-
-export async function resolveRepoRoot(folder: string, logger?: LogLike): Promise<{ repoRoot: string; isGitRepo: boolean }> {
-  const result = await runGit(["rev-parse", "--show-toplevel"], folder)
-  if (!result.ok) {
-    logger?.debug?.({ folder, err: result.error }, "Folder is not a Git repository; using workspace folder as root")
-    return { repoRoot: folder, isGitRepo: false }
-  }
-  const repoRoot = result.stdout.trim()
-  if (!repoRoot) {
-    return { repoRoot: folder, isGitRepo: false }
-  }
-  return { repoRoot, isGitRepo: true }
-}
-
-function parseWorktreePorcelain(output: string): Array<{ worktree: string; branch?: string; head?: string; detached?: boolean }> {
-  const records: Array<{ worktree: string; branch?: string; head?: string; detached?: boolean }> = []
-  const lines = output.split(/\r?\n/)
-  let current: { worktree?: string; branch?: string; head?: string; detached?: boolean } = {}
-
-  const flush = () => {
-    if (current.worktree) {
-      records.push({ worktree: current.worktree, branch: current.branch })
-    }
-    current = {}
-  }
-
-  for (const line of lines) {
-    const trimmed = line.trim()
-    if (!trimmed) {
-      flush()
-      continue
-    }
-    const [key, ...rest] = trimmed.split(" ")
-    const value = rest.join(" ").trim()
-    if (key === "worktree") {
-      current.worktree = value
-    } else if (key === "branch") {
-      // branch is like refs/heads/foo
-      current.branch = value.replace(/^refs\/heads\//, "")
-    } else if (key === "HEAD") {
-      current.head = value
-    } else if (key === "detached") {
-      current.detached = true
-    }
-  }
-  flush()
-  return records
-}
-
-export async function listWorktrees(params: {
-  repoRoot: string
-  workspaceFolder: string
-  logger?: LogLike
-}): Promise<WorktreeDescriptor[]> {
-  const { repoRoot, workspaceFolder, logger } = params
-  const rootDescriptor: WorktreeDescriptor = { slug: "root", directory: repoRoot, kind: "root" }
-
-  const result = await runGit(["worktree", "list", "--porcelain"], workspaceFolder)
-  if (!result.ok) {
-    logger?.debug?.({ repoRoot, err: result.error }, "Failed to list git worktrees; returning root only")
-    return [rootDescriptor]
-  }
-
-  const records = parseWorktreePorcelain(result.stdout)
-
-  const worktrees: WorktreeDescriptor[] = [rootDescriptor]
-  const seen = new Set<string>(["root"])
-
-  const normalizeSlug = (record: { branch?: string; head?: string; detached?: boolean; worktree: string }): string => {
-    const branch = (record.branch ?? "").trim()
-    if (branch) {
-      return branch
-    }
-    const head = (record.head ?? "").trim()
-    if (head && /^[0-9a-f]{7,40}$/i.test(head)) {
-      return `detached-${head.slice(0, 7)}`
-    }
-    // Fallback: stable-ish identifier derived from directory basename.
-    const base = path.basename(record.worktree || "")
-    return base ? `worktree-${base}` : "worktree"
-  }
-
-
-  for (const record of records) {
-    const abs = record.worktree
-    if (!abs || typeof abs !== "string") continue
-
-    // Skip the root record (we always expose it as slug="root").
-    if (path.resolve(abs) === path.resolve(repoRoot)) {
-      continue
-    }
-
-    const slug = normalizeSlug(record)
-    if (!slug || slug === "root") {
-      continue
-    }
-    if (seen.has(slug)) {
-      continue
-    }
-    seen.add(slug)
-    worktrees.push({ slug, directory: abs, kind: "worktree", branch: record.branch })
-  }
-
-  return worktrees
-}
-
-export function isValidWorktreeSlug(slug: string): boolean {
-  if (!slug) return false
-  const trimmed = slug.trim()
-  if (!trimmed) return false
-  if (trimmed.length > 200) return false
-  // Disallow control characters; allow branch-like slugs including '/'.
-  if (/[\x00-\x1F\x7F]/.test(trimmed)) return false
-  return true
-}
-
-export async function createManagedWorktree(params: {
-  repoRoot: string
-  workspaceFolder: string
-  slug: string
-  logger?: LogLike
-}): Promise<{ slug: string; directory: string; branch?: string }> {
-  const { repoRoot, workspaceFolder, logger } = params
-  const branch = params.slug.trim()
-
-  if (!branch || branch === "root" || !isValidWorktreeSlug(branch)) {
-    throw new Error("Invalid worktree slug")
-  }
-
-  const sanitizeDirName = (input: string): string => {
-    const normalized = input
-      .trim()
-      .replace(/[\\/]+/g, "-")
-      .replace(/\s+/g, "-")
-      .replace(/[^a-zA-Z0-9_.-]+/g, "-")
-      .replace(/-{2,}/g, "-")
-      .replace(/^-+|-+$/g, "")
-    return normalized || "worktree"
-  }
-
-  const worktreesDir = path.join(repoRoot, ".codenomad", "worktrees")
-  const targetDir = path.join(worktreesDir, sanitizeDirName(branch))
-  await fsp.mkdir(worktreesDir, { recursive: true })
-
-  try {
-    const stat = await fsp.stat(targetDir)
-    if (stat.isDirectory()) {
-      throw new Error("Worktree directory already exists")
-    }
-  } catch (error) {
-    const code = (error as NodeJS.ErrnoException).code
-    if (code !== "ENOENT") {
-      throw error
-    }
-  }
-
-  logger?.debug?.({ slug: branch, branch, targetDir }, "Creating managed git worktree")
-
-  // Prefer creating a new branch from HEAD.
-  const first = await runGit(["worktree", "add", "-b", branch, targetDir, "HEAD"], workspaceFolder)
-  if (first.ok) {
-    return { slug: branch, directory: targetDir, branch }
-  }
-
-  const message = first.stderr?.toLowerCase() ?? first.error.message.toLowerCase()
-  if (message.includes("already exists")) {
-    // If the branch already exists, add worktree for that branch.
-    const second = await runGit(["worktree", "add", targetDir, branch], workspaceFolder)
-    if (second.ok) {
-      return { slug: branch, directory: targetDir, branch }
-    }
-    throw second.error
-  }
-
-  throw first.error
-}
-
-export async function removeWorktree(params: {
-  workspaceFolder: string
-  directory: string
-  force?: boolean
-  logger?: LogLike
-}): Promise<void> {
-  const { workspaceFolder, logger } = params
-  const directory = (params.directory ?? "").trim()
-  if (!directory) {
-    throw new Error("Invalid worktree directory")
-  }
-  logger?.debug?.({ directory, force: Boolean(params.force) }, "Removing git worktree")
-
-  const args = ["worktree", "remove"]
-  if (params.force) {
-    args.push("--force")
-  }
-  args.push(directory)
-
-  const result = await runGit(args, workspaceFolder)
-  if (!result.ok) {
-    throw result.error
-  }
-
-  // Best-effort cleanup of stale metadata.
-  await runGit(["worktree", "prune"], workspaceFolder).catch(() => undefined)
-}

packages/server/src/workspaces/instance-events.ts

@@ -95,7 +95,7 @@ export class InstanceEventBridge {
   }
 
   private async consumeStream(workspaceId: string, port: number, signal: AbortSignal) {
-    const url = `http://${INSTANCE_HOST}:${port}/global/event`
+    const url = `http://${INSTANCE_HOST}:${port}/event`
 
     const headers: Record<string, string> = { Accept: "text/event-stream" }
     const authHeader = this.options.workspaceManager.getInstanceAuthorizationHeader(workspaceId)
@@ -165,32 +165,8 @@ export class InstanceEventBridge {
     }
 
     try {
-      const parsed = JSON.parse(payload) as any
-      if (!parsed || typeof parsed !== "object") {
-        this.options.logger.warn({ workspaceId, chunk: payload }, "Dropped malformed instance event")
-        return
-      }
-
-      // OpenCode SSE payload shapes vary across versions.
-      // Common variants:
-      // - { type, properties, ... }
-      // - { payload: { type, properties, ... }, directory: "/abs/path" }
-      // - { payload: { type, properties, ... } }
-      const base = parsed.payload && typeof parsed.payload === "object" ? parsed.payload : parsed
-
-      const event: InstanceStreamEvent | null = base && typeof base === "object" ? ({ ...base } as any) : null
-
-      // Attach directory when available (don't overwrite if already present).
-      if (event && !(event as any).directory && typeof (parsed as any).directory === "string") {
-        ;(event as any).directory = (parsed as any).directory
-      }
-
-      if (!event || typeof (event as any).type !== "string") {
-        this.options.logger.warn({ workspaceId, chunk: payload }, "Dropped malformed instance event")
-        return
-      }
-
-      this.options.logger.debug({ workspaceId, eventType: (event as any).type }, "Instance SSE event received")
+      const event = JSON.parse(payload) as InstanceStreamEvent
+      this.options.logger.debug({ workspaceId, eventType: event.type }, "Instance SSE event received")
       if (this.options.logger.isLevelEnabled("trace")) {
         this.options.logger.trace({ workspaceId, event }, "Instance SSE event payload")
       }

packages/server/src/workspaces/manager.ts

@@ -2,8 +2,8 @@ import path from "path"
 import { spawnSync } from "child_process"
 import { connect } from "net"
 import { EventBus } from "../events/bus"
-import type { SettingsService } from "../settings/service"
-import type { BinaryResolver } from "../settings/binaries"
+import { ConfigStore } from "../config/store"
+import { BinaryRegistry } from "../config/binaries"
 import { FileSystemBrowser } from "../filesystem/browser"
 import { searchWorkspaceFiles, WorkspaceFileSearchOptions } from "../filesystem/search"
 import { clearWorkspaceSearchCache } from "../filesystem/search-cache"
@@ -23,13 +23,11 @@ const STARTUP_STABILITY_DELAY_MS = 1500
 
 interface WorkspaceManagerOptions {
   rootDir: string
-  settings: SettingsService
-  binaryResolver: BinaryResolver
+  configStore: ConfigStore
+  binaryRegistry: BinaryRegistry
   eventBus: EventBus
   logger: Logger
   getServerBaseUrl: () => string
-  /** Optional CA bundle path to trust CodeNomad HTTPS certs. */
-  nodeExtraCaCertsPath?: string
 }
 
 interface WorkspaceRecord extends WorkspaceDescriptor {}
@@ -83,23 +81,17 @@ export class WorkspaceManager {
     }
   }
 
-  writeFile(workspaceId: string, relativePath: string, contents: string): void {
-    const workspace = this.requireWorkspace(workspaceId)
-    const browser = new FileSystemBrowser({ rootDir: workspace.path })
-    browser.writeFile(relativePath, contents)
-  }
-
   async create(folder: string, name?: string): Promise<WorkspaceDescriptor> {
  
     const id = `${Date.now().toString(36)}`
-    const binary = this.options.binaryResolver.resolveDefault()
+    const binary = this.options.binaryRegistry.resolveDefault()
     const resolvedBinaryPath = this.resolveBinaryPath(binary.path)
     const workspacePath = path.isAbsolute(folder) ? folder : path.resolve(this.options.rootDir, folder)
     clearWorkspaceSearchCache(workspacePath)
 
     this.options.logger.info({ workspaceId: id, folder: workspacePath, binary: resolvedBinaryPath }, "Creating workspace")
 
-    const proxyPath = `/workspaces/${id}/worktrees/root/instance`
+    const proxyPath = `/workspaces/${id}/instance`
 
 
     const descriptor: WorkspaceRecord = {
@@ -115,14 +107,17 @@ export class WorkspaceManager {
       updatedAt: new Date().toISOString(),
     }
 
+    if (!descriptor.binaryVersion) {
+      descriptor.binaryVersion = this.detectBinaryVersion(resolvedBinaryPath)
+    }
+
     this.workspaces.set(id, descriptor)
 
 
     this.options.eventBus.publish({ type: "workspace.created", workspace: descriptor })
 
-    const serverConfig = this.options.settings.getOwner("config", "server")
-    const envVars = (serverConfig as any)?.environmentVariables
-    const userEnvironment = envVars && typeof envVars === "object" && !Array.isArray(envVars) ? (envVars as any) : {}
+    const preferences = this.options.configStore.get().preferences ?? {}
+    const userEnvironment = preferences.environmentVariables ?? {}
 
     const opencodeUsername = DEFAULT_OPENCODE_USERNAME
     const opencodePassword = generateOpencodeServerPassword()
@@ -137,7 +132,6 @@ export class WorkspaceManager {
       OPENCODE_CONFIG_DIR: this.opencodeConfigDir,
       CODENOMAD_INSTANCE_ID: id,
       CODENOMAD_BASE_URL: this.options.getServerBaseUrl(),
-      ...(this.options.nodeExtraCaCertsPath ? { NODE_EXTRA_CA_CERTS: this.options.nodeExtraCaCertsPath } : {}),
       [OPENCODE_SERVER_USERNAME_ENV]: opencodeUsername,
       [OPENCODE_SERVER_PASSWORD_ENV]: opencodePassword,
     }
@@ -151,10 +145,7 @@ export class WorkspaceManager {
         onExit: (info) => this.handleProcessExit(info.workspaceId, info),
       })
 
-      const runtimeVersion = await this.waitForWorkspaceReadiness({ workspaceId: id, port, exitPromise, getLastOutput })
-      if (runtimeVersion) {
-        descriptor.binaryVersion = runtimeVersion
-      }
+      await this.waitForWorkspaceReadiness({ workspaceId: id, port, exitPromise, getLastOutput })
 
       descriptor.pid = pid
       descriptor.port = port
@@ -283,12 +274,42 @@ export class WorkspaceManager {
     return candidates[0] ?? ""
   }
 
+  private detectBinaryVersion(resolvedPath: string): string | undefined {
+    if (!resolvedPath) {
+      return undefined
+    }
+
+    try {
+      const result = spawnSync(resolvedPath, ["--version"], { encoding: "utf8" })
+      if (result.status === 0 && result.stdout) {
+        const line = result.stdout.split(/\r?\n/).find((entry) => entry.trim().length > 0)
+        if (line) {
+          const normalized = line.trim()
+          const versionMatch = normalized.match(/([0-9]+\.[0-9]+\.[0-9A-Za-z.-]+)/)
+          if (versionMatch) {
+            const version = versionMatch[1]
+            this.options.logger.debug({ binary: resolvedPath, version }, "Detected binary version")
+            return version
+          }
+          this.options.logger.debug({ binary: resolvedPath, reported: normalized }, "Binary reported version string")
+          return normalized
+        }
+      } else if (result.error) {
+        this.options.logger.warn({ binary: resolvedPath, err: result.error }, "Failed to read binary version")
+      }
+    } catch (error) {
+      this.options.logger.warn({ binary: resolvedPath, err: error }, "Failed to detect binary version")
+    }
+
+    return undefined
+  }
+
   private async waitForWorkspaceReadiness(params: {
     workspaceId: string
     port: number
     exitPromise: Promise<ProcessExitInfo>
     getLastOutput: () => string
-  }): Promise<string | undefined> {
+  }) {
 
     await Promise.race([
       this.waitForPortAvailability(params.port),
@@ -302,7 +323,7 @@ export class WorkspaceManager {
       }),
     ])
 
-    const version = await this.waitForInstanceHealth(params)
+    await this.waitForInstanceHealth(params)
 
     await Promise.race([
       this.delay(STARTUP_STABILITY_DELAY_MS),
@@ -315,8 +336,6 @@ export class WorkspaceManager {
         )
       }),
     ])
-
-    return version
   }
 
   private async waitForInstanceHealth(params: {
@@ -324,7 +343,7 @@ export class WorkspaceManager {
     port: number
     exitPromise: Promise<ProcessExitInfo>
     getLastOutput: () => string
-  }): Promise<string | undefined> {
+  }) {
     const probeResult = await Promise.race([
       this.probeInstance(params.workspaceId, params.port),
       params.exitPromise.then((info) => {
@@ -338,7 +357,7 @@ export class WorkspaceManager {
     ])
 
     if (probeResult.ok) {
-      return probeResult.version
+      return
     }
 
     const latestOutput = params.getLastOutput().trim()
@@ -349,11 +368,8 @@ export class WorkspaceManager {
     throw new Error(`Workspace ${params.workspaceId} failed health check: ${reason}.`)
   }
 
-  private async probeInstance(
-    workspaceId: string,
-    port: number,
-  ): Promise<{ ok: boolean; reason?: string; version?: string }> {
-    const url = `http://127.0.0.1:${port}/global/health`
+  private async probeInstance(workspaceId: string, port: number): Promise<{ ok: boolean; reason?: string }> {
+    const url = `http://127.0.0.1:${port}/project/current`
 
     try {
       const headers: Record<string, string> = {}
@@ -364,22 +380,11 @@ export class WorkspaceManager {
 
       const response = await fetch(url, { headers })
       if (!response.ok) {
-        const reason = `/global/health returned HTTP ${response.status}`
+        const reason = `health probe returned HTTP ${response.status}`
         this.options.logger.debug({ workspaceId, status: response.status }, "Health probe returned server error")
         return { ok: false, reason }
       }
-
-      const payload = (await response.json().catch(() => null)) as null | { healthy?: unknown; version?: unknown }
-      const healthy = payload?.healthy === true
-      const version = typeof payload?.version === "string" ? payload.version.trim() : undefined
-
-      if (!healthy) {
-        const reason = "Instance reported unhealthy"
-        this.options.logger.debug({ workspaceId, payload }, "Health probe returned unhealthy response")
-        return { ok: false, reason }
-      }
-
-      return { ok: true, version: version || undefined }
+      return { ok: true }
     } catch (error) {
       const reason = error instanceof Error ? error.message : String(error)
       this.options.logger.debug({ workspaceId, err: error }, "Health probe failed")

packages/server/src/workspaces/runtime.ts

@@ -8,8 +8,6 @@ import { Logger } from "../logger"
 export const WINDOWS_CMD_EXTENSIONS = new Set([".cmd", ".bat"])
 export const WINDOWS_POWERSHELL_EXTENSIONS = new Set([".ps1"])
 
-const VERSION_REGEX = /([0-9]+\.[0-9]+\.[0-9A-Za-z.-]+)/
-
 export function buildSpawnSpec(binaryPath: string, args: string[]) {
   if (process.platform !== "win32") {
     return { command: binaryPath, args, options: {} as const }
@@ -42,61 +40,6 @@ export function buildSpawnSpec(binaryPath: string, args: string[]) {
   return { command: binaryPath, args, options: {} as const }
 }
 
-export function probeBinaryVersion(binaryPath: string): {
-  valid: boolean
-  version?: string
-  reported?: string
-  error?: string
-} {
-  if (!binaryPath) {
-    return { valid: false, error: "Missing binary path" }
-  }
-
-  const spec = buildSpawnSpec(binaryPath, ["--version"])
-
-  try {
-    const result = spawnSync(spec.command, spec.args, {
-      encoding: "utf8",
-      windowsVerbatimArguments: Boolean(
-        (spec.options as { windowsVerbatimArguments?: boolean }).windowsVerbatimArguments,
-      ),
-    })
-
-    if (result.error) {
-      return { valid: false, error: result.error.message }
-    }
-
-    if (result.status !== 0) {
-      const stderr = result.stderr?.trim()
-      const stdout = result.stdout?.trim()
-      const combined = stderr || stdout
-      const error = combined ? `Exited with code ${result.status}: ${combined}` : `Exited with code ${result.status}`
-      return { valid: false, error }
-    }
-
-    const stdoutLines = String(result.stdout ?? "")
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter((line) => line.length > 0)
-    const stderrLines = String(result.stderr ?? "")
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter((line) => line.length > 0)
-
-    // Prefer stdout; fall back to stderr (some tools report version there).
-    const reported = stdoutLines[0] ?? stderrLines[0]
-    if (!reported) {
-      return { valid: true }
-    }
-
-    const versionMatch = reported.match(VERSION_REGEX)
-    const version = versionMatch?.[1]
-    return { valid: true, version, reported }
-  } catch (error) {
-    return { valid: false, error: error instanceof Error ? error.message : String(error) }
-  }
-}
-
 const SENSITIVE_ENV_KEY = /(PASSWORD|TOKEN|SECRET)/i
 
 function redactEnvironment(env: Record<string, string | undefined>): Record<string, string | undefined> {
@@ -173,25 +116,11 @@ export class WorkspaceRuntime {
           folder: options.folder,
           binary: options.binaryPath,
           spawnCommand: spec.command,
-          commandLine,
-        },
-        "Launching OpenCode process",
-      )
-
-      this.logger.debug(
-        {
-          workspaceId: options.workspaceId,
           spawnArgs: spec.args,
-        },
-        "OpenCode spawn args",
-      )
-
-      this.logger.trace(
-        {
-          workspaceId: options.workspaceId,
+          commandLine,
           env: redactEnvironment(env),
         },
-        "OpenCode spawn environment",
+        "Launching OpenCode process",
       )
       const detached = process.platform !== "win32"
       const child = spawn(spec.command, spec.args, {

packages/server/src/workspaces/worktree-map.ts

@@ -1,129 +0,0 @@
-import fs from "fs"
-import { promises as fsp } from "fs"
-import path from "path"
-import type { WorktreeMap } from "../api-types"
-import { resolveRepoRoot } from "./git-worktrees"
-import type { LogLike } from "./git-worktrees"
-
-const DEFAULT_MAP: WorktreeMap = {
-  version: 1,
-  defaultWorktreeSlug: "root",
-  parentSessionWorktreeSlug: {},
-}
-
-function getMapPath(repoRoot: string): string {
-  return path.join(repoRoot, ".codenomad", "worktreeMap.json")
-}
-
-function getGitExcludePath(repoRoot: string): string {
-  return path.join(repoRoot, ".git", "info", "exclude")
-}
-
-async function ensureGitExclude(repoRoot: string, logger?: LogLike): Promise<void> {
-  const excludePath = getGitExcludePath(repoRoot)
-  try {
-    await fsp.mkdir(path.dirname(excludePath), { recursive: true })
-  } catch {
-    return
-  }
-
-  const entries = [
-    ".codenomad/worktrees/",
-    ".codenomad/worktreeMap.json",
-  ]
-
-  let existing = ""
-  try {
-    existing = await fsp.readFile(excludePath, "utf-8")
-  } catch (error) {
-    const code = (error as NodeJS.ErrnoException).code
-    if (code !== "ENOENT") {
-      logger?.debug?.({ err: error, excludePath }, "Failed to read .git/info/exclude")
-      return
-    }
-    existing = ""
-  }
-
-  const lines = new Set(existing.split(/\r?\n/).map((l) => l.trim()).filter(Boolean))
-  const missing = entries.filter((e) => !lines.has(e))
-  if (missing.length === 0) {
-    return
-  }
-
-  const header = existing.includes("# codenomad") ? "" : (existing.trim() ? "\n" : "") + "# codenomad\n"
-  const suffix = missing.map((e) => `${e}\n`).join("")
-  await fsp.writeFile(excludePath, `${existing}${header}${suffix}`, "utf-8")
-}
-
-export async function ensureCodenomadGitExclude(workspaceFolder: string, logger?: LogLike): Promise<void> {
-  const { repoRoot, isGitRepo } = await resolveRepoRoot(workspaceFolder, logger)
-  if (!isGitRepo) {
-    return
-  }
-  await ensureGitExclude(repoRoot, logger)
-}
-
-export async function readWorktreeMap(workspaceFolder: string, logger?: LogLike): Promise<WorktreeMap> {
-  const { repoRoot, isGitRepo } = await resolveRepoRoot(workspaceFolder, logger)
-  const filePath = getMapPath(repoRoot)
-  try {
-    const raw = await fsp.readFile(filePath, "utf-8")
-    const parsed = JSON.parse(raw)
-    if (!parsed || typeof parsed !== "object") {
-      return DEFAULT_MAP
-    }
-    const version = (parsed as any).version
-    if (version !== 1) {
-      return DEFAULT_MAP
-    }
-    const defaultWorktreeSlug = typeof (parsed as any).defaultWorktreeSlug === "string" ? (parsed as any).defaultWorktreeSlug : "root"
-    const parentSessionWorktreeSlug = (parsed as any).parentSessionWorktreeSlug
-    const mapping = parentSessionWorktreeSlug && typeof parentSessionWorktreeSlug === "object" ? parentSessionWorktreeSlug : {}
-    return {
-      version: 1,
-      defaultWorktreeSlug,
-      parentSessionWorktreeSlug: { ...mapping },
-    }
-  } catch (error) {
-    const code = (error as NodeJS.ErrnoException).code
-    if (code === "ENOENT") {
-      if (isGitRepo) {
-        // Best-effort ignore setup on first use.
-        await ensureGitExclude(repoRoot, logger).catch(() => undefined)
-      }
-      return DEFAULT_MAP
-    }
-    logger?.warn?.({ err: error, filePath }, "Failed to read worktree map")
-    return DEFAULT_MAP
-  }
-}
-
-export async function writeWorktreeMap(workspaceFolder: string, next: WorktreeMap, logger?: LogLike): Promise<void> {
-  const { repoRoot, isGitRepo } = await resolveRepoRoot(workspaceFolder, logger)
-  const filePath = getMapPath(repoRoot)
-  await fsp.mkdir(path.dirname(filePath), { recursive: true })
-
-  // Ensure ignore rules are present (local-only).
-  if (isGitRepo) {
-    await ensureGitExclude(repoRoot, logger).catch(() => undefined)
-  }
-
-  const payload: WorktreeMap = {
-    version: 1,
-    defaultWorktreeSlug: next.defaultWorktreeSlug || "root",
-    parentSessionWorktreeSlug: next.parentSessionWorktreeSlug ?? {},
-  }
-
-  // Write atomically.
-  const tmpPath = `${filePath}.${process.pid}.tmp`
-  await fsp.writeFile(tmpPath, JSON.stringify(payload, null, 2), "utf-8")
-  await fsp.rename(tmpPath, filePath)
-}
-
-export function worktreeMapExists(repoRoot: string): boolean {
-  try {
-    return fs.existsSync(getMapPath(repoRoot))
-  } catch {
-    return false
-  }
-}

packages/tauri-app/package.json

@@ -1,14 +1,12 @@
 {
   "name": "@codenomad/tauri-app",
-  "version": "0.13.3",
+  "version": "0.9.2",
   "private": true,
-  "license": "MIT",
   "scripts": {
     "dev": "tauri dev",
     "dev:ui": "npm run dev --workspace @codenomad/ui",
     "dev:prep": "node ./scripts/dev-prep.js",
     "dev:bootstrap": "npm run dev:prep && npm run dev:ui",
-    "sync:version": "node ./scripts/sync-tauri-version.js",
     "prebuild": "node ./scripts/prebuild.js",
     "bundle:server": "npm run prebuild",
     "build": "tauri build"

packages/tauri-app/scripts/dev-prep.js

@@ -3,7 +3,6 @@
 const fs = require("fs")
 const path = require("path")
 const { execSync } = require("child_process")
-const { pathToFileURL } = require("url")
 
 const root = path.resolve(__dirname, "..")
 const workspaceRoot = path.resolve(root, "..", "..")
@@ -11,20 +10,6 @@ const uiRoot = path.resolve(root, "..", "ui")
 const uiDist = path.resolve(uiRoot, "src", "renderer", "dist")
 const uiLoadingDest = path.resolve(root, "src-tauri", "resources", "ui-loading")
 
-async function ensureMonacoAssets() {
-  const helperPath = path.join(uiRoot, "scripts", "monaco-public-assets.js")
-  const helperUrl = pathToFileURL(helperPath).href
-  const { copyMonacoPublicAssets } = await import(helperUrl)
-  copyMonacoPublicAssets({
-    uiRendererRoot: path.join(uiRoot, "src", "renderer"),
-    warn: (msg) => console.warn(`[dev-prep] ${msg}`),
-    sourceRoots: [
-      path.resolve(workspaceRoot, "node_modules", "monaco-editor", "min", "vs"),
-      path.resolve(uiRoot, "node_modules", "monaco-editor", "min", "vs"),
-    ],
-  })
-}
-
 function ensureUiBuild() {
   const loadingHtml = path.join(uiDist, "loading.html")
   if (fs.existsSync(loadingHtml)) {
@@ -57,11 +42,5 @@ function copyUiLoadingAssets() {
   console.log(`[dev-prep] copied loader bundle from ${uiDist}`)
 }
 
-;(async () => {
-  await ensureMonacoAssets()
-  ensureUiBuild()
-  copyUiLoadingAssets()
-})().catch((err) => {
-  console.error("[dev-prep] failed:", err)
-  process.exit(1)
-})
+ensureUiBuild()
+copyUiLoadingAssets()

packages/tauri-app/scripts/prebuild.js

@@ -2,7 +2,6 @@
 const fs = require("fs")
 const path = require("path")
 const { execSync } = require("child_process")
-const { pathToFileURL } = require("url")
 
 const root = path.resolve(__dirname, "..")
 const workspaceRoot = path.resolve(root, "..", "..")
@@ -20,7 +19,6 @@ const serverDevInstallCommand =
   "npm install --workspace @neuralnomads/codenomad --include-workspace-root=false --install-strategy=nested --fund=false --audit=false"
 const uiDevInstallCommand =
   "npm install --workspace @codenomad/ui --include-workspace-root=false --install-strategy=nested --fund=false --audit=false"
-const serverPrepareUiCommand = "npm run prepare-ui --workspace @neuralnomads/codenomad"
 
 const envWithRootBin = {
   ...process.env,
@@ -39,24 +37,14 @@ const braceExpansionPath = path.join(
 
 const viteBinPath = path.join(uiRoot, "node_modules", ".bin", "vite")
 
-async function ensureMonacoAssets() {
-  const helperPath = path.join(uiRoot, "scripts", "monaco-public-assets.js")
-  const helperUrl = pathToFileURL(helperPath).href
-  const { copyMonacoPublicAssets } = await import(helperUrl)
-  copyMonacoPublicAssets({
-    uiRendererRoot: path.join(uiRoot, "src", "renderer"),
-    warn: (msg) => console.warn(`[prebuild] ${msg}`),
-    sourceRoots: [
-      path.resolve(workspaceRoot, "node_modules", "monaco-editor", "min", "vs"),
-      path.resolve(uiRoot, "node_modules", "monaco-editor", "min", "vs"),
-    ],
-  })
-}
-
 function ensureServerBuild() {
   const distPath = path.join(serverRoot, "dist")
   const publicPath = path.join(serverRoot, "public")
-  console.log("[prebuild] rebuilding server workspace for desktop packaging...")
+  if (fs.existsSync(distPath) && fs.existsSync(publicPath)) {
+    return
+  }
+
+  console.log("[prebuild] server build missing; running workspace build...")
   execSync("npm --workspace @neuralnomads/codenomad run build", {
     cwd: workspaceRoot,
     stdio: "inherit",
@@ -88,15 +76,6 @@ function ensureUiBuild() {
   }
 }
 
-function syncServerUiBundle() {
-  console.log("[prebuild] syncing server public UI bundle...")
-  execSync(serverPrepareUiCommand, {
-    cwd: workspaceRoot,
-    stdio: "inherit",
-    env: envWithRootBin,
-  })
-}
-
 function ensureServerDevDependencies() {
   if (fs.existsSync(braceExpansionPath)) {
     return
@@ -244,19 +223,12 @@ function copyUiLoadingAssets() {
   console.log(`[prebuild] prepared UI loading assets from ${uiDist}`)
 }
 
-;(async () => {
-  ensureServerDevDependencies()
-  ensureUiDevDependencies()
-  await ensureMonacoAssets()
-  ensureRollupPlatformBinary()
-  ensureServerDependencies()
-  ensureServerBuild()
-  ensureUiBuild()
-  syncServerUiBundle()
-  copyServerArtifacts()
-  stripNodeModuleBins()
-  copyUiLoadingAssets()
-})().catch((err) => {
-  console.error("[prebuild] failed:", err)
-  process.exit(1)
-})
+ensureServerDevDependencies()
+ensureUiDevDependencies()
+ensureRollupPlatformBinary()
+ensureServerDependencies()
+ensureServerBuild()
+ensureUiBuild()
+copyServerArtifacts()
+stripNodeModuleBins()
+copyUiLoadingAssets()

packages/tauri-app/scripts/sync-tauri-version.js

@@ -1,102 +0,0 @@
-#!/usr/bin/env node
-
-const fs = require("fs")
-const path = require("path")
-
-const root = path.resolve(__dirname, "..")
-const packageJsonPath = path.join(root, "package.json")
-const cargoTomlPath = path.join(root, "src-tauri", "Cargo.toml")
-const cargoLockPath = path.join(root, "Cargo.lock")
-const tauriConfigPath = path.join(root, "src-tauri", "tauri.conf.json")
-
-function readPackageVersion() {
-  const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"))
-  if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
-    throw new Error("Missing version in packages/tauri-app/package.json")
-  }
-  return packageJson.version
-}
-
-function syncCargoToml(version) {
-  const current = fs.readFileSync(cargoTomlPath, "utf8")
-  const packageVersionPattern = /(\[package\][\s\S]*?^version\s*=\s*")([^"]+)(")/m
-  const match = current.match(packageVersionPattern)
-
-  if (!match) {
-    throw new Error("Unable to find [package] version in packages/tauri-app/src-tauri/Cargo.toml")
-  }
-
-  if (match[2] === version) {
-    return false
-  }
-
-  const updated = current.replace(packageVersionPattern, (_, prefix, __, suffix) => `${prefix}${version}${suffix}`)
-  fs.writeFileSync(cargoTomlPath, updated)
-  return true
-}
-
-function syncCargoLock(version) {
-  if (!fs.existsSync(cargoLockPath)) {
-    return false
-  }
-
-  const current = fs.readFileSync(cargoLockPath, "utf8")
-  const packageVersionPattern = /(\[\[package\]\]\r?\nname = "codenomad-tauri"\r?\nversion = ")([^"]+)(")/
-  const match = current.match(packageVersionPattern)
-
-  if (!match) {
-    throw new Error("Unable to find codenomad-tauri version in packages/tauri-app/Cargo.lock")
-  }
-
-  if (match[2] === version) {
-    return false
-  }
-
-  const updated = current.replace(packageVersionPattern, (_, prefix, __, suffix) => `${prefix}${version}${suffix}`)
-  fs.writeFileSync(cargoLockPath, updated)
-  return true
-}
-
-function syncTauriConfig(version) {
-  const current = fs.readFileSync(tauriConfigPath, "utf8")
-  const config = JSON.parse(current)
-  if (config.version === version) {
-    return false
-  }
-
-  config.version = version
-  fs.writeFileSync(tauriConfigPath, `${JSON.stringify(config, null, 2)}\n`)
-  return true
-}
-
-function main() {
-  const version = readPackageVersion()
-  const changed = []
-
-  if (syncCargoToml(version)) {
-    changed.push(path.relative(root, cargoTomlPath))
-  }
-
-  if (syncCargoLock(version)) {
-    changed.push(path.relative(root, cargoLockPath))
-  }
-
-  if (syncTauriConfig(version)) {
-    changed.push(path.relative(root, tauriConfigPath))
-  }
-
-  if (changed.length === 0) {
-    console.log(`[sync-tauri-version] already aligned to ${version}`)
-    return
-  }
-
-  console.log(`[sync-tauri-version] synced ${version} -> ${changed.join(", ")}`)
-}
-
-try {
-  main()
-} catch (error) {
-  const message = error instanceof Error ? error.message : String(error)
-  console.error(`[sync-tauri-version] failed: ${message}`)
-  process.exit(1)
-}

packages/tauri-app/src-tauri/Cargo.toml

@@ -1,8 +1,7 @@
 [package]
 name = "codenomad-tauri"
-version = "0.13.3"
+version = "0.1.0"
 edition = "2021"
-license = "MIT"
 
 [build-dependencies]
 tauri-build = { version = "2.5.2", features = [] }
@@ -11,7 +10,6 @@ tauri-build = { version = "2.5.2", features = [] }
 tauri = { version = "2.5.2", features = [ "devtools"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-serde_yaml = "0.9"
 regex = "1"
 once_cell = "1"
 parking_lot = "0.12"
@@ -19,13 +17,7 @@ thiserror = "1"
 anyhow = "1"
 which = "4"
 libc = "0.2"
-keepawake = "0.6"
 tauri-plugin-dialog = "2"
 dirs = "5"
 tauri-plugin-opener = "2"
-tauri-plugin-global-shortcut = "2"
 url = "2"
-tauri-plugin-notification = "2"
-
-[target.'cfg(windows)'.dependencies]
-windows-sys = { version = "0.59", features = ["Win32_UI_Shell"] }

packages/tauri-app/src-tauri/Info.plist

@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>NSMicrophoneUsageDescription</key>
-  <string>CodeNomad needs microphone access for speech-to-text prompt input.</string>
-  <key>NSLocalNetworkUsageDescription</key>
-  <string>CodeNomad needs local network access to connect to locally hosted AI and speech services.</string>
-</dict>
-</plist>

packages/tauri-app/src-tauri/capabilities/main-window.json

@@ -3,7 +3,7 @@
   "identifier": "main-window-native-dialogs",
   "description": "Grant the main window access to required core features and native dialog commands.",
   "remote": {
-    "urls": ["http://127.0.0.1:*", "http://localhost:*", "http://tauri.localhost/*", "https://tauri.localhost/*"]
+    "urls": ["http://127.0.0.1:*", "http://localhost:*"]
   },
   "windows": ["main"],
   "permissions": [
@@ -11,11 +11,6 @@
     "core:menu:default",
     "dialog:allow-open",
     "opener:allow-default-urls",
-    "opener:allow-open-url",
-    "notification:allow-is-permission-granted",
-    "notification:allow-request-permission",
-    "notification:allow-notify",
-    "notification:allow-show",
     "core:webview:allow-set-webview-zoom"
   ]
 }

packages/tauri-app/src-tauri/gen/schemas/capabilities.json

@@ -1 +1 @@
-{"main-window-native-dialogs":{"identifier":"main-window-native-dialogs","description":"Grant the main window access to required core features and native dialog commands.","remote":{"urls":["http://127.0.0.1:*","http://localhost:*","http://tauri.localhost/*","https://tauri.localhost/*"]},"local":true,"windows":["main"],"permissions":["core:default","core:menu:default","dialog:allow-open","opener:allow-default-urls","opener:allow-open-url","notification:allow-is-permission-granted","notification:allow-request-permission","notification:allow-notify","notification:allow-show","core:webview:allow-set-webview-zoom"]}}
+{"main-window-native-dialogs":{"identifier":"main-window-native-dialogs","description":"Grant the main window access to required core features and native dialog commands.","remote":{"urls":["http://127.0.0.1:*","http://localhost:*"]},"local":true,"windows":["main"],"permissions":["core:default","core:menu:default","dialog:allow-open","opener:allow-default-urls","core:webview:allow-set-webview-zoom"]}}

packages/tauri-app/src-tauri/gen/schemas/desktop-schema.json

@@ -2378,270 +2378,6 @@
           "const": "dialog:deny-save",
           "markdownDescription": "Denies the save command without any pre-configured scope."
         },
-        {
-          "description": "No features are enabled by default, as we believe\nthe shortcuts can be inherently dangerous and it is\napplication specific if specific shortcuts should be\nregistered or unregistered.\n",
-          "type": "string",
-          "const": "global-shortcut:default",
-          "markdownDescription": "No features are enabled by default, as we believe\nthe shortcuts can be inherently dangerous and it is\napplication specific if specific shortcuts should be\nregistered or unregistered.\n"
-        },
-        {
-          "description": "Enables the is_registered command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:allow-is-registered",
-          "markdownDescription": "Enables the is_registered command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the register command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:allow-register",
-          "markdownDescription": "Enables the register command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the register_all command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:allow-register-all",
-          "markdownDescription": "Enables the register_all command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the unregister command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:allow-unregister",
-          "markdownDescription": "Enables the unregister command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the unregister_all command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:allow-unregister-all",
-          "markdownDescription": "Enables the unregister_all command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the is_registered command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:deny-is-registered",
-          "markdownDescription": "Denies the is_registered command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the register command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:deny-register",
-          "markdownDescription": "Denies the register command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the register_all command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:deny-register-all",
-          "markdownDescription": "Denies the register_all command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the unregister command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:deny-unregister",
-          "markdownDescription": "Denies the unregister command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the unregister_all command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:deny-unregister-all",
-          "markdownDescription": "Denies the unregister_all command without any pre-configured scope."
-        },
-        {
-          "description": "This permission set configures which\nnotification features are by default exposed.\n\n#### Granted Permissions\n\nIt allows all notification related features.\n\n\n#### This default permission set includes:\n\n- `allow-is-permission-granted`\n- `allow-request-permission`\n- `allow-notify`\n- `allow-register-action-types`\n- `allow-register-listener`\n- `allow-cancel`\n- `allow-get-pending`\n- `allow-remove-active`\n- `allow-get-active`\n- `allow-check-permissions`\n- `allow-show`\n- `allow-batch`\n- `allow-list-channels`\n- `allow-delete-channel`\n- `allow-create-channel`\n- `allow-permission-state`",
-          "type": "string",
-          "const": "notification:default",
-          "markdownDescription": "This permission set configures which\nnotification features are by default exposed.\n\n#### Granted Permissions\n\nIt allows all notification related features.\n\n\n#### This default permission set includes:\n\n- `allow-is-permission-granted`\n- `allow-request-permission`\n- `allow-notify`\n- `allow-register-action-types`\n- `allow-register-listener`\n- `allow-cancel`\n- `allow-get-pending`\n- `allow-remove-active`\n- `allow-get-active`\n- `allow-check-permissions`\n- `allow-show`\n- `allow-batch`\n- `allow-list-channels`\n- `allow-delete-channel`\n- `allow-create-channel`\n- `allow-permission-state`"
-        },
-        {
-          "description": "Enables the batch command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-batch",
-          "markdownDescription": "Enables the batch command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the cancel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-cancel",
-          "markdownDescription": "Enables the cancel command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the check_permissions command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-check-permissions",
-          "markdownDescription": "Enables the check_permissions command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the create_channel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-create-channel",
-          "markdownDescription": "Enables the create_channel command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the delete_channel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-delete-channel",
-          "markdownDescription": "Enables the delete_channel command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the get_active command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-get-active",
-          "markdownDescription": "Enables the get_active command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the get_pending command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-get-pending",
-          "markdownDescription": "Enables the get_pending command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the is_permission_granted command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-is-permission-granted",
-          "markdownDescription": "Enables the is_permission_granted command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the list_channels command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-list-channels",
-          "markdownDescription": "Enables the list_channels command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the notify command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-notify",
-          "markdownDescription": "Enables the notify command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the permission_state command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-permission-state",
-          "markdownDescription": "Enables the permission_state command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the register_action_types command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-register-action-types",
-          "markdownDescription": "Enables the register_action_types command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the register_listener command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-register-listener",
-          "markdownDescription": "Enables the register_listener command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the remove_active command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-remove-active",
-          "markdownDescription": "Enables the remove_active command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the request_permission command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-request-permission",
-          "markdownDescription": "Enables the request_permission command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the show command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-show",
-          "markdownDescription": "Enables the show command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the batch command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-batch",
-          "markdownDescription": "Denies the batch command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the cancel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-cancel",
-          "markdownDescription": "Denies the cancel command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the check_permissions command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-check-permissions",
-          "markdownDescription": "Denies the check_permissions command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the create_channel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-create-channel",
-          "markdownDescription": "Denies the create_channel command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the delete_channel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-delete-channel",
-          "markdownDescription": "Denies the delete_channel command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the get_active command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-get-active",
-          "markdownDescription": "Denies the get_active command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the get_pending command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-get-pending",
-          "markdownDescription": "Denies the get_pending command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the is_permission_granted command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-is-permission-granted",
-          "markdownDescription": "Denies the is_permission_granted command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the list_channels command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-list-channels",
-          "markdownDescription": "Denies the list_channels command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the notify command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-notify",
-          "markdownDescription": "Denies the notify command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the permission_state command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-permission-state",
-          "markdownDescription": "Denies the permission_state command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the register_action_types command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-register-action-types",
-          "markdownDescription": "Denies the register_action_types command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the register_listener command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-register-listener",
-          "markdownDescription": "Denies the register_listener command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the remove_active command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-remove-active",
-          "markdownDescription": "Denies the remove_active command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the request_permission command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-request-permission",
-          "markdownDescription": "Denies the request_permission command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the show command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-show",
-          "markdownDescription": "Denies the show command without any pre-configured scope."
-        },
         {
           "description": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`",
           "type": "string",

packages/tauri-app/src-tauri/gen/schemas/macOS-schema.json

@@ -2378,204 +2378,6 @@
           "const": "dialog:deny-save",
           "markdownDescription": "Denies the save command without any pre-configured scope."
         },
-        {
-          "description": "This permission set configures which\nnotification features are by default exposed.\n\n#### Granted Permissions\n\nIt allows all notification related features.\n\n\n#### This default permission set includes:\n\n- `allow-is-permission-granted`\n- `allow-request-permission`\n- `allow-notify`\n- `allow-register-action-types`\n- `allow-register-listener`\n- `allow-cancel`\n- `allow-get-pending`\n- `allow-remove-active`\n- `allow-get-active`\n- `allow-check-permissions`\n- `allow-show`\n- `allow-batch`\n- `allow-list-channels`\n- `allow-delete-channel`\n- `allow-create-channel`\n- `allow-permission-state`",
-          "type": "string",
-          "const": "notification:default",
-          "markdownDescription": "This permission set configures which\nnotification features are by default exposed.\n\n#### Granted Permissions\n\nIt allows all notification related features.\n\n\n#### This default permission set includes:\n\n- `allow-is-permission-granted`\n- `allow-request-permission`\n- `allow-notify`\n- `allow-register-action-types`\n- `allow-register-listener`\n- `allow-cancel`\n- `allow-get-pending`\n- `allow-remove-active`\n- `allow-get-active`\n- `allow-check-permissions`\n- `allow-show`\n- `allow-batch`\n- `allow-list-channels`\n- `allow-delete-channel`\n- `allow-create-channel`\n- `allow-permission-state`"
-        },
-        {
-          "description": "Enables the batch command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-batch",
-          "markdownDescription": "Enables the batch command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the cancel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-cancel",
-          "markdownDescription": "Enables the cancel command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the check_permissions command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-check-permissions",
-          "markdownDescription": "Enables the check_permissions command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the create_channel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-create-channel",
-          "markdownDescription": "Enables the create_channel command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the delete_channel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-delete-channel",
-          "markdownDescription": "Enables the delete_channel command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the get_active command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-get-active",
-          "markdownDescription": "Enables the get_active command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the get_pending command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-get-pending",
-          "markdownDescription": "Enables the get_pending command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the is_permission_granted command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-is-permission-granted",
-          "markdownDescription": "Enables the is_permission_granted command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the list_channels command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-list-channels",
-          "markdownDescription": "Enables the list_channels command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the notify command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-notify",
-          "markdownDescription": "Enables the notify command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the permission_state command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-permission-state",
-          "markdownDescription": "Enables the permission_state command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the register_action_types command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-register-action-types",
-          "markdownDescription": "Enables the register_action_types command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the register_listener command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-register-listener",
-          "markdownDescription": "Enables the register_listener command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the remove_active command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-remove-active",
-          "markdownDescription": "Enables the remove_active command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the request_permission command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-request-permission",
-          "markdownDescription": "Enables the request_permission command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the show command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:allow-show",
-          "markdownDescription": "Enables the show command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the batch command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-batch",
-          "markdownDescription": "Denies the batch command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the cancel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-cancel",
-          "markdownDescription": "Denies the cancel command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the check_permissions command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-check-permissions",
-          "markdownDescription": "Denies the check_permissions command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the create_channel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-create-channel",
-          "markdownDescription": "Denies the create_channel command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the delete_channel command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-delete-channel",
-          "markdownDescription": "Denies the delete_channel command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the get_active command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-get-active",
-          "markdownDescription": "Denies the get_active command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the get_pending command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-get-pending",
-          "markdownDescription": "Denies the get_pending command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the is_permission_granted command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-is-permission-granted",
-          "markdownDescription": "Denies the is_permission_granted command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the list_channels command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-list-channels",
-          "markdownDescription": "Denies the list_channels command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the notify command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-notify",
-          "markdownDescription": "Denies the notify command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the permission_state command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-permission-state",
-          "markdownDescription": "Denies the permission_state command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the register_action_types command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-register-action-types",
-          "markdownDescription": "Denies the register_action_types command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the register_listener command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-register-listener",
-          "markdownDescription": "Denies the register_listener command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the remove_active command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-remove-active",
-          "markdownDescription": "Denies the remove_active command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the request_permission command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-request-permission",
-          "markdownDescription": "Denies the request_permission command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the show command without any pre-configured scope.",
-          "type": "string",
-          "const": "notification:deny-show",
-          "markdownDescription": "Denies the show command without any pre-configured scope."
-        },
         {
           "description": "This permission set allows opening `mailto:`, `tel:`, `https://` and `http://` urls using their default application\nas well as reveal file in directories using default file explorer\n#### This default permission set includes:\n\n- `allow-open-url`\n- `allow-reveal-item-in-dir`\n- `allow-default-urls`",
           "type": "string",

packages/tauri-app/src-tauri/src/cli_manager.rs

@@ -9,8 +9,6 @@ use std::ffi::OsStr;
 use std::fs;
 use std::io::{BufRead, BufReader, Read, Write};
 use std::net::TcpStream;
-#[cfg(unix)]
-use std::os::unix::process::CommandExt;
 use std::path::PathBuf;
 use std::process::{Child, Command, Stdio};
 use std::sync::atomic::{AtomicBool, Ordering};
@@ -19,24 +17,10 @@ use std::thread;
 use std::time::{Duration, Instant};
 use tauri::{webview::cookie::Cookie, AppHandle, Emitter, Manager, Url};
 
-#[cfg(windows)]
-use std::os::windows::process::CommandExt;
-
-#[cfg(windows)]
-const CREATE_NO_WINDOW: u32 = 0x08000000;
-
 fn log_line(message: &str) {
     println!("[tauri-cli] {message}");
 }
 
-#[cfg(windows)]
-fn configure_spawn(command: &mut Command) {
-    command.creation_flags(CREATE_NO_WINDOW);
-}
-
-#[cfg(not(windows))]
-fn configure_spawn(_command: &mut Command) {}
-
 fn workspace_root() -> Option<PathBuf> {
     std::env::current_dir().ok().and_then(|mut dir| {
         for _ in 0..3 {
@@ -51,49 +35,7 @@ fn workspace_root() -> Option<PathBuf> {
 const SESSION_COOKIE_NAME: &str = "codenomad_session";
 
 const CLI_STOP_GRACE_SECS: u64 = 30;
-#[cfg(windows)]
-const CLI_WINDOWS_FORCE_GRACE_MS: u64 = 2_000;
 
-#[cfg(unix)]
-fn configure_posix_process_group(command: &mut Command) {
-    // Ensure the CLI runs in its own process group so we can terminate wrapper
-    // processes (login shell/tsx) without leaving the server orphaned.
-    unsafe {
-        command.pre_exec(|| {
-            if libc::setpgid(0, 0) != 0 {
-                return Err(std::io::Error::last_os_error());
-            }
-            Ok(())
-        });
-    }
-}
-
-#[cfg(windows)]
-fn kill_process_tree_windows(pid: u32, force: bool) -> bool {
-    let mut args = vec!["/PID".to_string(), pid.to_string(), "/T".to_string()];
-    if force {
-        args.push("/F".to_string());
-    }
-
-    let mut command = Command::new("taskkill");
-    command.args(&args);
-    configure_spawn(&mut command);
-
-    match command.output() {
-        Ok(output) => {
-            if output.status.success() {
-                return true;
-            }
-
-            // If the PID is already gone, treat it as success.
-            let stdout = String::from_utf8_lossy(&output.stdout).to_lowercase();
-            let stderr = String::from_utf8_lossy(&output.stderr).to_lowercase();
-            let combined = format!("{stdout}\n{stderr}");
-            combined.contains("not found") || combined.contains("no running instance")
-        }
-        Err(_) => false,
-    }
-}
 fn navigate_main(app: &AppHandle, url: &str) {
     if let Some(win) = app.webview_windows().get("main") {
         let mut display = url.to_string();
@@ -198,45 +140,17 @@ struct PreferencesConfig {
     listening_mode: Option<String>,
 }
 
-#[derive(Debug, Deserialize)]
-struct ServerConfig {
-    #[serde(rename = "listeningMode")]
-    listening_mode: Option<String>,
-}
-
 #[derive(Debug, Deserialize)]
 struct AppConfig {
     preferences: Option<PreferencesConfig>,
-    server: Option<ServerConfig>,
 }
 
-fn resolve_config_locations() -> (PathBuf, PathBuf) {
+fn resolve_config_path() -> PathBuf {
     let raw = env::var("CLI_CONFIG")
         .ok()
         .filter(|value| !value.trim().is_empty())
         .unwrap_or_else(|| DEFAULT_CONFIG_PATH.to_string());
-
-    let expanded = expand_home(&raw);
-    let lower = raw.trim().to_lowercase();
-
-    if lower.ends_with(".yaml") || lower.ends_with(".yml") {
-        let base = expanded
-            .parent()
-            .map(|p| p.to_path_buf())
-            .unwrap_or_else(|| expanded.clone());
-        return (expanded, base.join("config.json"));
-    }
-
-    if lower.ends_with(".json") {
-        let base = expanded
-            .parent()
-            .map(|p| p.to_path_buf())
-            .unwrap_or_else(|| expanded.clone());
-        return (base.join("config.yaml"), expanded);
-    }
-
-    // Treat as directory.
-    (expanded.join("config.yaml"), expanded.join("config.json"))
+    expand_home(&raw)
 }
 
 fn expand_home(path: &str) -> PathBuf {
@@ -249,46 +163,14 @@ fn expand_home(path: &str) -> PathBuf {
 }
 
 fn resolve_listening_mode() -> String {
-    let (yaml_path, json_path) = resolve_config_locations();
-
-    if let Ok(content) = fs::read_to_string(&yaml_path) {
-        if let Ok(config) = serde_yaml::from_str::<AppConfig>(&content) {
-            let mode = config
-                .server
-                .as_ref()
-                .and_then(|srv| srv.listening_mode.as_ref())
-                .or_else(|| {
-                    config
-                        .preferences
-                        .as_ref()
-                        .and_then(|prefs| prefs.listening_mode.as_ref())
-                });
-
-            if let Some(mode) = mode {
-                if mode == "local" {
-                    return "local".to_string();
-                }
-                if mode == "all" {
-                    return "all".to_string();
-                }
-            }
-        }
-    }
-
-    // Legacy fallback.
-    if let Ok(content) = fs::read_to_string(&json_path) {
+    let path = resolve_config_path();
+    if let Ok(content) = fs::read_to_string(path) {
         if let Ok(config) = serde_json::from_str::<AppConfig>(&content) {
-            let mode = config
-                .server
+            if let Some(mode) = config
+                .preferences
                 .as_ref()
-                .and_then(|srv| srv.listening_mode.as_ref())
-                .or_else(|| {
-                    config
-                        .preferences
-                        .as_ref()
-                        .and_then(|prefs| prefs.listening_mode.as_ref())
-                });
-            if let Some(mode) = mode {
+                .and_then(|prefs| prefs.listening_mode.as_ref())
+            {
                 if mode == "local" {
                     return "local".to_string();
                 }
@@ -378,14 +260,7 @@ impl CliProcessManager {
         let ready_flag = self.ready.clone();
         let token_arc = self.bootstrap_token.clone();
         thread::spawn(move || {
-            if let Err(err) = Self::spawn_cli(
-                app.clone(),
-                status_arc.clone(),
-                child_arc,
-                ready_flag,
-                token_arc,
-                dev,
-            ) {
+            if let Err(err) = Self::spawn_cli(app.clone(), status_arc.clone(), child_arc, ready_flag, token_arc, dev) {
                 log_line(&format!("cli spawn failed: {err}"));
                 let mut locked = status_arc.lock();
                 locked.state = CliState::Error;
@@ -404,21 +279,13 @@ impl CliProcessManager {
         let mut child_opt = self.child.lock();
         if let Some(mut child) = child_opt.take() {
             log_line(&format!("stopping CLI pid={}", child.id()));
-            #[cfg(windows)]
-            let mut forced_tree_shutdown = false;
             #[cfg(unix)]
             unsafe {
-                let pid = child.id() as i32;
-                // Prefer signaling the process group to avoid orphaning children
-                // when the CLI was launched via a wrapper shell.
-                let group_res = libc::kill(-pid, libc::SIGTERM);
-                if group_res != 0 {
-                    let _ = libc::kill(pid, libc::SIGTERM);
-                }
+                libc::kill(child.id() as i32, libc::SIGTERM);
             }
             #[cfg(windows)]
             {
-                let _ = kill_process_tree_windows(child.id(), false);
+                let _ = child.kill();
             }
 
             let start = Instant::now();
@@ -426,21 +293,6 @@ impl CliProcessManager {
                 match child.try_wait() {
                     Ok(Some(_)) => break,
                     Ok(None) => {
-                        #[cfg(windows)]
-                        if !forced_tree_shutdown
-                            && start.elapsed() > Duration::from_millis(CLI_WINDOWS_FORCE_GRACE_MS)
-                        {
-                            log_line(&format!(
-                                "regular Windows shutdown still running after {}ms; escalating pid={}",
-                                CLI_WINDOWS_FORCE_GRACE_MS,
-                                child.id()
-                            ));
-                            forced_tree_shutdown = true;
-                            if !kill_process_tree_windows(child.id(), true) {
-                                let _ = child.kill();
-                            }
-                        }
-
                         if start.elapsed() > Duration::from_secs(CLI_STOP_GRACE_SECS) {
                             log_line(&format!(
                                 "stop timed out after {}s; sending SIGKILL pid={}",
@@ -449,21 +301,11 @@ impl CliProcessManager {
                             ));
                             #[cfg(unix)]
                             unsafe {
-                                let pid = child.id() as i32;
-                                let group_res = libc::kill(-pid, libc::SIGKILL);
-                                if group_res != 0 {
-                                    let _ = libc::kill(pid, libc::SIGKILL);
-                                }
+                                libc::kill(child.id() as i32, libc::SIGKILL);
                             }
                             #[cfg(windows)]
                             {
-                                if !forced_tree_shutdown
-                                    && !kill_process_tree_windows(child.id(), true)
-                                {
-                                    let _ = child.kill();
-                                } else if forced_tree_shutdown {
-                                    let _ = child.kill();
-                                }
+                                let _ = child.kill();
                             }
                             break;
                         }
@@ -527,9 +369,7 @@ impl CliProcessManager {
 
         if !supports_user_shell() {
             if which::which(&resolution.node_binary).is_err() {
-                return Err(anyhow::anyhow!(
-                    "Node binary not found. Make sure Node.js is installed."
-                ));
+                return Err(anyhow::anyhow!("Node binary not found. Make sure Node.js is installed."));
             }
         }
 
@@ -541,12 +381,9 @@ impl CliProcessManager {
                     .env("ELECTRON_RUN_AS_NODE", "1")
                     .stdout(Stdio::piped())
                     .stderr(Stdio::piped());
-                configure_spawn(&mut c);
                 if let Some(ref cwd) = cwd {
                     c.current_dir(cwd);
                 }
-                #[cfg(unix)]
-                configure_posix_process_group(&mut c);
                 c.spawn()?
             }
             ShellCommandType::Direct(cmd) => {
@@ -556,12 +393,9 @@ impl CliProcessManager {
                     .env("ELECTRON_RUN_AS_NODE", "1")
                     .stdout(Stdio::piped())
                     .stderr(Stdio::piped());
-                configure_spawn(&mut c);
                 if let Some(ref cwd) = cwd {
                     c.current_dir(cwd);
                 }
-                #[cfg(unix)]
-                configure_posix_process_group(&mut c);
                 c.spawn()?
             }
         };
@@ -586,6 +420,7 @@ impl CliProcessManager {
         let token_clone = bootstrap_token.clone();
 
         thread::spawn(move || {
+
             let stdout = child_clone
                 .lock()
                 .as_mut()
@@ -598,24 +433,10 @@ impl CliProcessManager {
                 .map(BufReader::new);
 
             if let Some(reader) = stdout {
-                Self::process_stream(
-                    reader,
-                    "stdout",
-                    &app_clone,
-                    &status_clone,
-                    &ready_clone,
-                    &token_clone,
-                );
+                Self::process_stream(reader, "stdout", &app_clone, &status_clone, &ready_clone, &token_clone);
             }
             if let Some(reader) = stderr {
-                Self::process_stream(
-                    reader,
-                    "stderr",
-                    &app_clone,
-                    &status_clone,
-                    &ready_clone,
-                    &token_clone,
-                );
+                Self::process_stream(reader, "stderr", &app_clone, &status_clone, &ready_clone, &token_clone);
             }
         });
 
@@ -634,24 +455,7 @@ impl CliProcessManager {
             locked.error = Some("CLI did not start in time".to_string());
             log_line("timeout waiting for CLI readiness");
             if let Some(child) = child_holder_clone.lock().as_mut() {
-                #[cfg(unix)]
-                unsafe {
-                    let pid = child.id() as i32;
-                    let group_res = libc::kill(-pid, libc::SIGKILL);
-                    if group_res != 0 {
-                        let _ = libc::kill(pid, libc::SIGKILL);
-                    }
-                }
-                #[cfg(windows)]
-                {
-                    if !kill_process_tree_windows(child.id(), true) {
-                        let _ = child.kill();
-                    }
-                }
-                #[cfg(not(any(unix, windows)))]
-                {
-                    let _ = child.kill();
-                }
+                let _ = child.kill();
             }
             let _ = app_clone.emit("cli:error", json!({"message": "CLI did not start in time"}));
             Self::emit_status(&app_clone, &locked);
@@ -660,33 +464,13 @@ impl CliProcessManager {
         let status_clone = status.clone();
         let app_clone = app.clone();
         thread::spawn(move || {
-            // Do not hold the child mutex while waiting for process exit.
-            // Holding the lock across `wait()` deadlocks `stop()`, which needs the
-            // same lock to send SIGTERM/SIGKILL when the user quits the app.
-            let code = loop {
-                let maybe_exited = {
-                    let mut guard = child_holder.lock();
-                    if guard.is_none() {
-                        return;
-                    }
-                    match guard
-                        .as_mut()
-                        .and_then(|child| child.try_wait().ok().flatten())
-                    {
-                        Some(status) => {
-                            // Drop the handle after the process exits so other callers
-                            // don't attempt to stop/kill a finished process.
-                            *guard = None;
-                            Some(status)
-                        }
-                        None => None,
-                    }
-                };
-
-                if let Some(status) = maybe_exited {
-                    break Some(status);
+            let code = {
+                let mut guard = child_holder.lock();
+                if let Some(child) = guard.as_mut() {
+                    child.wait().ok()
+                } else {
+                    None
                 }
-                thread::sleep(Duration::from_millis(100));
             };
 
             let mut locked = status_clone.lock();
@@ -705,14 +489,8 @@ impl CliProcessManager {
                 if locked.error.is_none() {
                     locked.error = err_msg.clone();
                 }
-                log_line(&format!(
-                    "cli process exited before ready: {:?}",
-                    locked.error
-                ));
-                let _ = app_clone.emit(
-                    "cli:error",
-                    json!({"message": locked.error.clone().unwrap_or_default()}),
-                );
+                log_line(&format!("cli process exited before ready: {:?}", locked.error));
+                let _ = app_clone.emit("cli:error", json!({"message": locked.error.clone().unwrap_or_default()}));
             } else {
                 locked.state = CliState::Stopped;
                 log_line("cli process stopped cleanly");
@@ -733,7 +511,7 @@ impl CliProcessManager {
         bootstrap_token: &Arc<Mutex<Option<String>>>,
     ) {
         let mut buffer = String::new();
-        let local_url_regex = Regex::new(r"^Local\s+Connection\s+URL\s*:\s*(https?://\S+)").ok();
+        let port_regex = Regex::new(r"CodeNomad Server is ready at http://[^:]+:(\d+)").ok();
         let http_regex = Regex::new(r":(\d{2,5})(?!.*:\d)").ok();
         let token_prefix = "CODENOMAD_BOOTSTRAP_TOKEN:";
 
@@ -761,12 +539,12 @@ impl CliProcessManager {
                             continue;
                         }
 
-                        if let Some(url) = local_url_regex
+                        if let Some(port) = port_regex
                             .as_ref()
                             .and_then(|re| re.captures(line).and_then(|c| c.get(1)))
-                            .map(|m| m.as_str().to_string())
+                            .and_then(|m| m.as_str().parse::<u16>().ok())
                         {
-                            Self::mark_ready(app, status, ready, bootstrap_token, url);
+                            Self::mark_ready(app, status, ready, bootstrap_token, port);
                             continue;
                         }
 
@@ -776,25 +554,13 @@ impl CliProcessManager {
                                 .and_then(|re| re.captures(line).and_then(|c| c.get(1)))
                                 .and_then(|m| m.as_str().parse::<u16>().ok())
                             {
-                                Self::mark_ready(
-                                    app,
-                                    status,
-                                    ready,
-                                    bootstrap_token,
-                                    format!("http://localhost:{port}"),
-                                );
+                                Self::mark_ready(app, status, ready, bootstrap_token, port);
                                 continue;
                             }
 
                             if let Ok(value) = serde_json::from_str::<serde_json::Value>(line) {
                                 if let Some(port) = value.get("port").and_then(|p| p.as_u64()) {
-                                    Self::mark_ready(
-                                        app,
-                                        status,
-                                        ready,
-                                        bootstrap_token,
-                                        format!("http://localhost:{}", port),
-                                    );
+                                    Self::mark_ready(app, status, ready, bootstrap_token, port as u16);
                                     continue;
                                 }
                             }
@@ -811,15 +577,12 @@ impl CliProcessManager {
         status: &Arc<Mutex<CliStatus>>,
         ready: &Arc<AtomicBool>,
         bootstrap_token: &Arc<Mutex<Option<String>>>,
-        base_url: String,
+        port: u16,
     ) {
         ready.store(true, Ordering::SeqCst);
-        let port = Url::parse(&base_url)
-            .ok()
-            .and_then(|u| u.port_or_known_default())
-            .map(|p| p as u16);
+        let base_url = format!("http://127.0.0.1:{port}");
         let mut locked = status.lock();
-        locked.port = port;
+        locked.port = Some(port);
         locked.url = Some(base_url.clone());
         locked.state = CliState::Ready;
         locked.error = None;
@@ -828,30 +591,23 @@ impl CliProcessManager {
         let token = bootstrap_token.lock().take();
 
         if let Some(token) = token {
-            // Token exchange is only implemented for loopback HTTP. If localUrl is HTTPS,
-            // skip the exchange and let the user authenticate normally.
-            let scheme = Url::parse(&base_url).ok().map(|u| u.scheme().to_string());
-            if scheme.as_deref() != Some("http") {
-                navigate_main(app, &base_url);
-            } else {
-                match exchange_bootstrap_token(&base_url, &token) {
-                    Ok(Some(session_id)) => {
-                        if let Err(err) = set_session_cookie(app, &base_url, &session_id) {
-                            log_line(&format!("failed to set session cookie: {err}"));
-                            navigate_main(app, &format!("{base_url}/login"));
-                        } else {
-                            navigate_main(app, &base_url);
-                        }
-                    }
-                    Ok(None) => {
-                        log_line("bootstrap token exchange failed (invalid token)");
-                        navigate_main(app, &format!("{base_url}/login"));
-                    }
-                    Err(err) => {
-                        log_line(&format!("bootstrap token exchange failed: {err}"));
+            match exchange_bootstrap_token(&base_url, &token) {
+                Ok(Some(session_id)) => {
+                    if let Err(err) = set_session_cookie(app, &base_url, &session_id) {
+                        log_line(&format!("failed to set session cookie: {err}"));
                         navigate_main(app, &format!("{base_url}/login"));
+                    } else {
+                        navigate_main(app, &base_url);
                     }
                 }
+                Ok(None) => {
+                    log_line("bootstrap token exchange failed (invalid token)");
+                    navigate_main(app, &format!("{base_url}/login"));
+                }
+                Err(err) => {
+                    log_line(&format!("bootstrap token exchange failed: {err}"));
+                    navigate_main(app, &format!("{base_url}/login"));
+                }
             }
         } else {
             navigate_main(app, &base_url);
@@ -937,42 +693,15 @@ impl CliEntry {
             "serve".to_string(),
             "--host".to_string(),
             host.to_string(),
+            "--port".to_string(),
+            "0".to_string(),
             "--generate-token".to_string(),
         ];
-
         if dev {
-            // Dev: plain HTTP + Vite dev server proxy.
-            let ui_dev_server = std::env::var("VITE_DEV_SERVER_URL")
-                .ok()
-                .filter(|value| !value.trim().is_empty())
-                .or_else(|| {
-                    std::env::var("ELECTRON_RENDERER_URL")
-                        .ok()
-                        .filter(|value| !value.trim().is_empty())
-                })
-                .unwrap_or_else(|| "http://localhost:3000".to_string());
-            let log_level = std::env::var("CLI_LOG_LEVEL")
-                .ok()
-                .map(|value| value.trim().to_lowercase())
-                .filter(|value| !value.is_empty())
-                .unwrap_or_else(|| "info".to_string());
-
-            args.push("--https".to_string());
-            args.push("false".to_string());
-            args.push("--http".to_string());
-            args.push("true".to_string());
-            args.push("--http-port".to_string());
-            args.push("0".to_string());
             args.push("--ui-dev-server".to_string());
-            args.push(ui_dev_server);
+            args.push("http://localhost:3000".to_string());
             args.push("--log-level".to_string());
-            args.push(log_level);
-        } else {
-            // Prod desktop: always keep loopback HTTP enabled.
-            args.push("--https".to_string());
-            args.push("true".to_string());
-            args.push("--http".to_string());
-            args.push("true".to_string());
+            args.push("debug".to_string());
         }
         args
     }
@@ -997,10 +726,9 @@ fn resolve_tsx(_app: &AppHandle) -> Option<String> {
         std::env::current_dir()
             .ok()
             .map(|p| p.join("node_modules/tsx/dist/cli.js")),
-        std::env::current_exe().ok().and_then(|ex| {
-            ex.parent()
-                .map(|p| p.join("../node_modules/tsx/dist/cli.js"))
-        }),
+        std::env::current_exe()
+            .ok()
+            .and_then(|ex| ex.parent().map(|p| p.join("../node_modules/tsx/dist/cli.js"))),
     ];
 
     first_existing(candidates)
@@ -1023,19 +751,13 @@ fn resolve_dist_entry(_app: &AppHandle) -> Option<String> {
     let base = workspace_root();
     let mut candidates: Vec<Option<PathBuf>> = vec![
         base.as_ref().map(|p| p.join("packages/server/dist/bin.js")),
-        base.as_ref()
-            .map(|p| p.join("packages/server/dist/index.js")),
+        base.as_ref().map(|p| p.join("packages/server/dist/index.js")),
         base.as_ref().map(|p| p.join("server/dist/bin.js")),
         base.as_ref().map(|p| p.join("server/dist/index.js")),
     ];
 
     if let Ok(exe) = std::env::current_exe() {
         if let Some(dir) = exe.parent() {
-            candidates.push(Some(dir.join("resources/server/dist/bin.js")));
-            candidates.push(Some(dir.join("resources/server/dist/index.js")));
-            candidates.push(Some(dir.join("resources/server/dist/server/bin.js")));
-            candidates.push(Some(dir.join("resources/server/dist/server/index.js")));
-
             let resources = dir.join("../Resources");
             candidates.push(Some(resources.join("server/dist/bin.js")));
             candidates.push(Some(resources.join("server/dist/index.js")));
@@ -1044,9 +766,7 @@ fn resolve_dist_entry(_app: &AppHandle) -> Option<String> {
             candidates.push(Some(resources.join("resources/server/dist/bin.js")));
             candidates.push(Some(resources.join("resources/server/dist/index.js")));
             candidates.push(Some(resources.join("resources/server/dist/server/bin.js")));
-            candidates.push(Some(
-                resources.join("resources/server/dist/server/index.js"),
-            ));
+            candidates.push(Some(resources.join("resources/server/dist/server/index.js")));
 
             let linux_resource_roots = [dir.join("../lib/CodeNomad"), dir.join("../lib/codenomad")];
             for root in linux_resource_roots {
@@ -1065,10 +785,8 @@ fn resolve_dist_entry(_app: &AppHandle) -> Option<String> {
     first_existing(candidates)
 }
 
-fn build_shell_command_string(
-    entry: &CliEntry,
-    cli_args: &[String],
-) -> anyhow::Result<ShellCommand> {
+fn build_shell_command_string(entry: &CliEntry, cli_args: &[String]) -> anyhow::Result<ShellCommand> {
+
     let shell = default_shell();
     let mut quoted: Vec<String> = Vec::new();
     quoted.push(shell_escape(&entry.node_binary));
@@ -1099,7 +817,7 @@ fn shell_escape(input: &str) -> String {
         "''".to_string()
     } else if !input
         .chars()
-        .any(|c| matches!(c, ' ' | '"' | '\'' | '$' | '`' | '!'))
+        .any(|c| matches!(c, ' ' | '"' | '\'' | '$' | '`' | '!' ))
     {
         input.to_string()
     } else {
@@ -1131,18 +849,9 @@ fn first_existing(paths: Vec<Option<PathBuf>>) -> Option<String> {
 }
 
 fn normalize_path(path: PathBuf) -> String {
-    let resolved = if let Ok(clean) = path.canonicalize() {
-        clean
+    if let Ok(clean) = path.canonicalize() {
+        clean.to_string_lossy().to_string()
     } else {
-        path
-    };
-
-    let rendered = resolved.to_string_lossy().to_string();
-    if let Some(stripped) = rendered.strip_prefix("\\\\?\\UNC\\") {
-        format!("\\\\{}", stripped)
-    } else if let Some(stripped) = rendered.strip_prefix("\\\\?\\") {
-        stripped.to_string()
-    } else {
-        rendered
+        path.to_string_lossy().to_string()
     }
 }

packages/tauri-app/src-tauri/src/main.rs

@@ -3,52 +3,17 @@
 mod cli_manager;
 
 use cli_manager::{CliProcessManager, CliStatus};
-use keepawake::KeepAwake;
-use serde::Deserialize;
 use serde_json::json;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::Mutex;
-use std::time::{SystemTime, UNIX_EPOCH};
 use tauri::menu::{MenuBuilder, MenuItem, SubmenuBuilder};
 use tauri::plugin::{Builder as PluginBuilder, TauriPlugin};
 use tauri::webview::Webview;
-use tauri::{AppHandle, Emitter, Manager, Runtime, WindowEvent, Wry};
-use tauri_plugin_global_shortcut::{
-    Code as ShortcutCode, GlobalShortcutExt, Shortcut, ShortcutState,
-};
+use tauri::{AppHandle, Emitter, Manager, Runtime, Wry};
 use tauri_plugin_opener::OpenerExt;
 use url::Url;
 
-#[cfg(windows)]
-use std::ffi::OsStr;
-#[cfg(windows)]
-use std::iter;
-#[cfg(windows)]
-use std::os::windows::ffi::OsStrExt;
-#[cfg(windows)]
-use windows_sys::Win32::UI::Shell::SetCurrentProcessExplicitAppUserModelID;
-
-static QUIT_REQUESTED: AtomicBool = AtomicBool::new(false);
-const DEFAULT_ZOOM_LEVEL: f64 = 1.0;
-const ZOOM_STEP: f64 = 0.2;
-const MIN_ZOOM_LEVEL: f64 = 0.2;
-const MAX_ZOOM_LEVEL: f64 = 5.0;
-
-#[cfg(windows)]
-const WINDOWS_APP_USER_MODEL_ID: &str = "ai.neuralnomads.codenomad.client";
-
+#[derive(Clone)]
 pub struct AppState {
     pub manager: CliProcessManager,
-    pub wake_lock: Mutex<Option<KeepAwake>>,
-    pub zoom_level: Mutex<f64>,
-}
-
-#[derive(Debug, Default, Deserialize)]
-#[serde(default, rename_all = "camelCase")]
-struct WakeLockConfig {
-    display: bool,
-    idle: bool,
-    sleep: bool,
 }
 
 #[tauri::command]
@@ -67,39 +32,6 @@ fn cli_restart(app: AppHandle, state: tauri::State<AppState>) -> Result<CliStatu
     Ok(state.manager.status())
 }
 
-#[tauri::command]
-fn wake_lock_start(
-    state: tauri::State<AppState>,
-    config: Option<WakeLockConfig>,
-) -> Result<(), String> {
-    let config = config.unwrap_or(WakeLockConfig {
-        display: true,
-        idle: false,
-        sleep: false,
-    });
-
-    let mut builder = keepawake::Builder::default();
-    builder
-        .display(config.display)
-        .idle(config.idle)
-        .sleep(config.sleep)
-        .reason("CodeNomad active session")
-        .app_name("CodeNomad")
-        .app_reverse_domain("ai.neuralnomads.codenomad.client");
-
-    let wake_lock = builder.create().map_err(|err| err.to_string())?;
-    let mut state_lock = state.wake_lock.lock().map_err(|err| err.to_string())?;
-    *state_lock = Some(wake_lock);
-    Ok(())
-}
-
-#[tauri::command]
-fn wake_lock_stop(state: tauri::State<AppState>) -> Result<(), String> {
-    let mut state_lock = state.wake_lock.lock().map_err(|err| err.to_string())?;
-    state_lock.take();
-    Ok(())
-}
-
 fn is_dev_mode() -> bool {
     cfg!(debug_assertions) || std::env::var("TAURI_DEV").is_ok()
 }
@@ -107,13 +39,7 @@ fn is_dev_mode() -> bool {
 fn should_allow_internal(url: &Url) -> bool {
     match url.scheme() {
         "tauri" | "asset" | "file" => true,
-        // On Windows/WebView2, Tauri serves the app assets from `tauri.localhost`.
-        // This must be treated as an internal origin or the navigation guard will
-        // redirect it to the system browser and the app will appear blank.
-        "http" | "https" => matches!(
-            url.host_str(),
-            Some("127.0.0.1" | "localhost" | "tauri.localhost")
-        ),
+        "http" | "https" => matches!(url.host_str(), Some("127.0.0.1" | "localhost")),
         _ => false,
     }
 }
@@ -133,132 +59,6 @@ fn intercept_navigation<R: Runtime>(webview: &Webview<R>, url: &Url) -> bool {
     false
 }
 
-fn collect_directory_paths(paths: &[std::path::PathBuf]) -> Vec<String> {
-    paths
-        .iter()
-        .filter_map(|path| match std::fs::metadata(path) {
-            Ok(metadata) if metadata.is_dir() => Some(path.to_string_lossy().to_string()),
-            _ => None,
-        })
-        .collect()
-}
-
-fn emit_window_event(app_handle: &AppHandle, window_label: &str, event_name: &str) {
-    if let Some(window) = app_handle.get_webview_window(window_label) {
-        let _ = window.emit(event_name, ());
-    }
-}
-
-fn emit_folder_drop_event(
-    app_handle: &AppHandle,
-    window_label: &str,
-    event_name: &str,
-    paths: &[std::path::PathBuf],
-) {
-    let directories = collect_directory_paths(paths);
-
-    if directories.is_empty() {
-        return;
-    }
-
-    if let Some(window) = app_handle.get_webview_window(window_label) {
-        let _ = window.emit(event_name, json!({ "paths": directories }));
-    }
-}
-
-fn clamp_zoom_level(value: f64) -> f64 {
-    value.clamp(MIN_ZOOM_LEVEL, MAX_ZOOM_LEVEL)
-}
-
-fn set_main_window_zoom(app_handle: &AppHandle, next_zoom: f64) {
-    if let Some(window) = app_handle.get_webview_window("main") {
-        let normalized = clamp_zoom_level(next_zoom);
-        if window.set_zoom(normalized).is_ok() {
-            if let Ok(mut zoom_level) = app_handle.state::<AppState>().zoom_level.lock() {
-                *zoom_level = normalized;
-            }
-        }
-    }
-}
-
-fn reload_main_window(app_handle: &AppHandle) {
-    if let Some(window) = app_handle.get_webview_window("main") {
-        let _ = window.reload();
-    }
-}
-
-fn force_reload_main_window(app_handle: &AppHandle) {
-    if let Some(window) = app_handle.get_webview_window("main") {
-        if let Ok(mut url) = window.url() {
-            if should_allow_internal(&url) {
-                let reload_token = SystemTime::now()
-                    .duration_since(UNIX_EPOCH)
-                    .unwrap_or_default()
-                    .as_millis()
-                    .to_string();
-
-                let existing_pairs: Vec<(String, String)> = url
-                    .query_pairs()
-                    .into_owned()
-                    .filter(|(key, _)| key != "__codenomad_force_reload")
-                    .collect();
-
-                {
-                    let mut pairs = url.query_pairs_mut();
-                    pairs.clear();
-                    for (key, value) in existing_pairs {
-                        pairs.append_pair(&key, &value);
-                    }
-                    pairs.append_pair("__codenomad_force_reload", &reload_token);
-                }
-
-                let _ = window.navigate(url);
-                return;
-            }
-        }
-
-        let _ = window.reload();
-    }
-}
-
-fn toggle_fullscreen_window(app_handle: &AppHandle) {
-    if let Some(window) = app_handle.get_webview_window("main") {
-        let next_fullscreen = !window.is_fullscreen().unwrap_or(false);
-        let _ = window.set_fullscreen(next_fullscreen);
-        if cfg!(not(target_os = "macos")) {
-            if next_fullscreen {
-                let _ = window.hide_menu();
-            } else {
-                let _ = window.show_menu();
-            }
-        }
-    }
-}
-
-fn fullscreen_shortcut() -> Option<Shortcut> {
-    if cfg!(target_os = "macos") {
-        None
-    } else {
-        Some(Shortcut::new(None, ShortcutCode::F11))
-    }
-}
-
-#[cfg(windows)]
-fn set_windows_app_user_model_id() {
-    let app_id: Vec<u16> = OsStr::new(WINDOWS_APP_USER_MODEL_ID)
-        .encode_wide()
-        .chain(iter::once(0))
-        .collect();
-
-    let result = unsafe { SetCurrentProcessExplicitAppUserModelID(app_id.as_ptr()) };
-    if result < 0 {
-        eprintln!("[tauri] failed to set AppUserModelID: {result}");
-    }
-}
-
-#[cfg(not(windows))]
-fn set_windows_app_user_model_id() {}
-
 fn main() {
     let navigation_guard: TauriPlugin<Wry, ()> = PluginBuilder::new("external-link-guard")
         .on_navigation(|webview, url| intercept_navigation(webview, url))
@@ -267,48 +67,12 @@ fn main() {
     tauri::Builder::default()
         .plugin(tauri_plugin_dialog::init())
         .plugin(tauri_plugin_opener::init())
-        .plugin(
-            tauri_plugin_global_shortcut::Builder::new()
-                .with_handler(|app, shortcut, event| {
-                    if event.state() != ShortcutState::Pressed {
-                        return;
-                    }
-
-                    if fullscreen_shortcut().as_ref() == Some(shortcut) {
-                        toggle_fullscreen_window(app);
-                    }
-                })
-                .build(),
-        )
-        .plugin(tauri_plugin_notification::init())
         .plugin(navigation_guard)
         .manage(AppState {
             manager: CliProcessManager::new(),
-            wake_lock: Mutex::new(None),
-            zoom_level: Mutex::new(DEFAULT_ZOOM_LEVEL),
         })
         .setup(|app| {
-            set_windows_app_user_model_id();
             build_menu(&app.handle())?;
-            if let Some(shortcut) = fullscreen_shortcut() {
-                let shortcut_manager = app.handle().global_shortcut();
-                let _ = shortcut_manager.register(shortcut.clone());
-
-                if let Some(window) = app.get_webview_window("main") {
-                    let app_handle = app.handle().clone();
-                    window.on_window_event(move |event| {
-                        if let WindowEvent::Focused(focused) = event {
-                            let shortcut_manager = app_handle.global_shortcut();
-                            if *focused {
-                                let _ = shortcut_manager.register(shortcut.clone());
-                            } else {
-                                let _ = shortcut_manager.unregister(shortcut.clone());
-                            }
-                        }
-                    });
-                }
-            }
-
             let dev_mode = is_dev_mode();
             let app_handle = app.handle().clone();
             let manager = app.state::<AppState>().manager.clone();
@@ -319,12 +83,7 @@ fn main() {
             });
             Ok(())
         })
-        .invoke_handler(tauri::generate_handler![
-            cli_get_status,
-            cli_restart,
-            wake_lock_start,
-            wake_lock_stop
-        ])
+        .invoke_handler(tauri::generate_handler![cli_get_status, cli_restart])
         .on_menu_event(|app_handle, event| {
             match event.id().0.as_str() {
                 // File menu
@@ -333,42 +92,36 @@ fn main() {
                         let _ = window.emit("menu:newInstance", ());
                     }
                 }
+                "close" => {
+                    if let Some(window) = app_handle.get_webview_window("main") {
+                        let _ = window.close();
+                    }
+                }
                 "quit" => {
                     app_handle.exit(0);
                 }
 
                 // View menu
                 "reload" => {
-                    reload_main_window(app_handle);
+                    if let Some(window) = app_handle.get_webview_window("main") {
+                        let _ = window.eval("window.location.reload()");
+                    }
                 }
                 "force_reload" => {
-                    force_reload_main_window(app_handle);
+                    if let Some(window) = app_handle.get_webview_window("main") {
+                        let _ = window.eval("window.location.reload(true)");
+                    }
                 }
                 "toggle_devtools" => {
                     if let Some(window) = app_handle.get_webview_window("main") {
-                        if window.is_devtools_open() {
-                            window.close_devtools();
-                        } else {
-                            window.open_devtools();
-                        }
-                    }
-                }
-                "reset_zoom" => {
-                    set_main_window_zoom(app_handle, DEFAULT_ZOOM_LEVEL);
-                }
-                "zoom_in" => {
-                    if let Ok(zoom_level) = app_handle.state::<AppState>().zoom_level.lock() {
-                        set_main_window_zoom(app_handle, *zoom_level + ZOOM_STEP);
-                    }
-                }
-                "zoom_out" => {
-                    if let Ok(zoom_level) = app_handle.state::<AppState>().zoom_level.lock() {
-                        set_main_window_zoom(app_handle, *zoom_level - ZOOM_STEP);
+                        window.open_devtools();
                     }
                 }
 
                 "toggle_fullscreen" => {
-                    toggle_fullscreen_window(app_handle);
+                    if let Some(window) = app_handle.get_webview_window("main") {
+                        let _ = window.set_fullscreen(!window.is_fullscreen().unwrap_or(false));
+                    }
                 }
 
                 // Window menu
@@ -382,11 +135,6 @@ fn main() {
                         let _ = window.maximize();
                     }
                 }
-                "close_window" => {
-                    if let Some(window) = app_handle.get_webview_window("main") {
-                        let _ = window.close();
-                    }
-                }
 
                 // App menu (macOS)
                 "about" => {
@@ -416,11 +164,6 @@ fn main() {
         .expect("error while building tauri application")
         .run(|app_handle, event| match event {
             tauri::RunEvent::ExitRequested { api, .. } => {
-                // `app_handle.exit(0)` triggers another `ExitRequested`. Without a guard, we can
-                // prevent exit forever and the app never quits (Cmd+Q / Quit menu appears stuck).
-                if QUIT_REQUESTED.swap(true, Ordering::SeqCst) {
-                    return;
-                }
                 api.prevent_exit();
                 let app = app_handle.clone();
                 std::thread::spawn(move || {
@@ -430,35 +173,11 @@ fn main() {
                     app.exit(0);
                 });
             }
-            tauri::RunEvent::WindowEvent {
-                label,
-                event: tauri::WindowEvent::DragDrop(tauri::DragDropEvent::Enter { paths, .. }),
-                ..
-            } => {
-                emit_folder_drop_event(&app_handle, &label, "desktop:folder-drag-enter", &paths);
-            }
-            tauri::RunEvent::WindowEvent {
-                label,
-                event: tauri::WindowEvent::DragDrop(tauri::DragDropEvent::Drop { paths, .. }),
-                ..
-            } => {
-                emit_folder_drop_event(&app_handle, &label, "desktop:folder-drop", &paths);
-            }
-            tauri::RunEvent::WindowEvent {
-                label,
-                event: tauri::WindowEvent::DragDrop(tauri::DragDropEvent::Leave),
-                ..
-            } => {
-                emit_window_event(&app_handle, &label, "desktop:folder-drag-leave");
-            }
             tauri::RunEvent::WindowEvent {
                 event: tauri::WindowEvent::CloseRequested { api, .. },
                 ..
             } => {
                 // Ensure we have time to stop the CLI process before the app exits.
-                if QUIT_REQUESTED.swap(true, Ordering::SeqCst) {
-                    return;
-                }
                 api.prevent_close();
                 let app = app_handle.clone();
                 std::thread::spawn(move || {
@@ -474,7 +193,6 @@ fn main() {
 
 fn build_menu(app: &AppHandle) -> tauri::Result<()> {
     let is_mac = cfg!(target_os = "macos");
-    let is_linux = cfg!(target_os = "linux");
 
     // Create submenus
     let mut submenus = Vec::new();
@@ -499,77 +217,16 @@ fn build_menu(app: &AppHandle) -> tauri::Result<()> {
         "new_instance",
         "New Instance",
         true,
-        Some("CmdOrCtrl+N"),
+        Some("CmdOrCtrl+N")
     )?;
-
-    let file_menu = if is_mac {
-        SubmenuBuilder::new(app, "File")
-            .item(&new_instance_item)
-            .separator()
-            .close_window()
-            .build()?
-    } else {
-        SubmenuBuilder::new(app, "File")
-            .item(&new_instance_item)
-            .separator()
-            .text("quit", "Quit")
-            .build()?
-    };
+    
+    let file_menu = SubmenuBuilder::new(app, "File")
+        .item(&new_instance_item)
+        .separator()
+        .text(if is_mac { "close" } else { "quit" }, if is_mac { "Close" } else { "Quit" })
+        .build()?;
     submenus.push(file_menu);
 
-    let reload_item = MenuItem::with_id(app, "reload", "Reload", true, Some("CmdOrCtrl+R"))?;
-    let force_reload_item = MenuItem::with_id(
-        app,
-        "force_reload",
-        "Force Reload",
-        true,
-        Some("CmdOrCtrl+Shift+R"),
-    )?;
-    let toggle_devtools_item = MenuItem::with_id(
-        app,
-        "toggle_devtools",
-        "Toggle Developer Tools",
-        true,
-        Some("Alt+CmdOrCtrl+I"),
-    )?;
-    let reset_zoom_item =
-        MenuItem::with_id(app, "reset_zoom", "Actual Size", true, Some("CmdOrCtrl+0"))?;
-    let zoom_in_item = MenuItem::with_id(
-        app,
-        "zoom_in",
-        if is_mac { "Zoom In" } else { "Zoom In\tCtrl++" },
-        true,
-        None::<&str>,
-    )?;
-    let zoom_out_item = MenuItem::with_id(
-        app,
-        "zoom_out",
-        if is_mac {
-            "Zoom Out"
-        } else {
-            "Zoom Out\tCtrl+-"
-        },
-        true,
-        None::<&str>,
-    )?;
-    let toggle_fullscreen_item = MenuItem::with_id(
-        app,
-        "toggle_fullscreen",
-        if is_mac {
-            "Toggle Full Screen"
-        } else {
-            "Toggle Full Screen\tF11"
-        },
-        true,
-        if is_mac {
-            Some("Ctrl+Cmd+F")
-        } else {
-            None::<&str>
-        },
-    )?;
-    let close_window_item =
-        MenuItem::with_id(app, "close_window", "Close", true, Some("CmdOrCtrl+W"))?;
-
     // Edit menu with predefined items for standard functionality
     let edit_menu = SubmenuBuilder::new(app, "Edit")
         .undo()
@@ -585,48 +242,27 @@ fn build_menu(app: &AppHandle) -> tauri::Result<()> {
 
     // View menu
     let view_menu = SubmenuBuilder::new(app, "View")
-        .item(&reload_item)
-        .item(&force_reload_item)
-        .item(&toggle_devtools_item)
+        .text("reload", "Reload")
+        .text("force_reload", "Force Reload")
+        .text("toggle_devtools", "Toggle Developer Tools")
         .separator()
-        .item(&reset_zoom_item)
-        .item(&zoom_in_item)
-        .item(&zoom_out_item)
+
         .separator()
-        .item(&toggle_fullscreen_item)
+        .text("toggle_fullscreen", "Toggle Full Screen")
         .build()?;
     submenus.push(view_menu);
 
     // Window menu
-    let window_menu = if is_linux {
-        SubmenuBuilder::new(app, "Window")
-            .text("minimize", "Minimize")
-            .text("zoom", "Zoom")
-            .separator()
-            .item(&close_window_item)
-            .build()?
-    } else if is_mac {
-        SubmenuBuilder::new(app, "Window")
-            .minimize()
-            .maximize()
-            .build()?
-    } else {
-        SubmenuBuilder::new(app, "Window")
-            .minimize()
-            .maximize()
-            .separator()
-            .close_window()
-            .build()?
-    };
+    let window_menu = SubmenuBuilder::new(app, "Window")
+        .text("minimize", "Minimize")
+        .text("zoom", "Zoom")
+        .build()?;
     submenus.push(window_menu);
 
     // Build the main menu with all submenus
-    let submenu_refs: Vec<&dyn tauri::menu::IsMenuItem<_>> = submenus
-        .iter()
-        .map(|s| s as &dyn tauri::menu::IsMenuItem<_>)
-        .collect();
+    let submenu_refs: Vec<&dyn tauri::menu::IsMenuItem<_>> = submenus.iter().map(|s| s as &dyn tauri::menu::IsMenuItem<_>).collect();
     let menu = MenuBuilder::new(app).items(&submenu_refs).build()?;
-
+    
     app.set_menu(menu)?;
     Ok(())
 }

packages/tauri-app/src-tauri/tauri.conf.json

@@ -1,13 +1,16 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "CodeNomad",
-  "version": "0.13.3",
-  "identifier": "ai.neuralnomads.codenomad.client",
+  "version": "0.1.0",
+  "identifier": "ai.opencode.client",
   "build": {
     "beforeDevCommand": "npm run dev:bootstrap",
     "beforeBuildCommand": "npm run bundle:server",
     "frontendDist": "resources/ui-loading"
   },
+
+ 
+
   "app": {
     "withGlobalTauri": true,
     "windows": [
@@ -30,13 +33,9 @@
     ],
     "security": {
       "assetProtocol": {
-        "scope": [
-          "**"
-        ]
+        "scope": ["**"]
       },
-      "capabilities": [
-        "main-window-native-dialogs"
-      ]
+      "capabilities": ["main-window-native-dialogs"]
     }
   },
   "bundle": {
@@ -45,17 +44,7 @@
       "resources/server",
       "resources/ui-loading"
     ],
-    "icon": [
-      "icon.icns",
-      "icon.ico",
-      "icon.png"
-    ],
-    "targets": [
-      "app",
-      "appimage",
-      "deb",
-      "rpm",
-      "nsis"
-    ]
+    "icon": ["icon.icns", "icon.ico", "icon.png"],
+    "targets": ["app", "appimage", "deb", "rpm", "nsis"]
   }
 }

packages/ui/.gitignore

@@ -1,5 +1,3 @@
 node_modules/
 dist/
 .vite/
-src/renderer/public/logo.png
-src/renderer/public/monaco/

packages/ui/package.json

@@ -1,8 +1,7 @@
 {
   "name": "@codenomad/ui",
-  "version": "0.13.3",
+  "version": "0.9.2",
   "private": true,
-  "license": "MIT",
   "type": "module",
   "scripts": {
     "dev": "vite dev",
@@ -13,36 +12,27 @@
   "dependencies": {
     "@git-diff-view/solid": "^0.0.8",
     "@kobalte/core": "0.13.11",
-    "@opencode-ai/sdk": "1.2.6",
+    "@opencode-ai/sdk": "1.1.11",
     "@solidjs/router": "^0.13.0",
     "@suid/icons-material": "^0.9.0",
     "@suid/material": "^0.19.0",
     "@suid/system": "^0.14.0",
-    "@tauri-apps/api": "^2.10.1",
-    "@tauri-apps/plugin-dialog": "^2.6.0",
-    "@tauri-apps/plugin-notification": "^2.3.3",
-    "@tauri-apps/plugin-opener": "^2.5.3",
     "ansi-sequence-parser": "^1.1.3",
     "debug": "^4.4.3",
     "github-markdown-css": "^5.8.1",
     "lucide-solid": "^0.300.0",
     "marked": "^12.0.0",
-    "monaco-editor": "^0.52.2",
     "qrcode": "^1.5.3",
     "shiki": "^3.13.0",
     "solid-js": "^1.8.0",
-    "solid-toast": "^0.5.0",
-    "virtua": "^0.48.8",
-    "yaml": "^2.4.2"
+    "solid-toast": "^0.5.0"
   },
   "devDependencies": {
-    "@vite-pwa/assets-generator": "^1.0.2",
     "autoprefixer": "10.4.21",
     "postcss": "8.5.6",
     "tailwindcss": "3",
     "typescript": "^5.3.0",
     "vite": "^5.0.0",
-    "vite-plugin-pwa": "^1.2.0",
     "vite-plugin-solid": "^2.10.0"
   }
 }

packages/ui/scripts/monaco-public-assets.d.ts

@@ -1,7 +0,0 @@
-export type CopyMonacoPublicAssetsParams = {
-  uiRendererRoot: string
-  warn?: (message: string) => void
-  sourceRoots?: string[]
-}
-
-export function copyMonacoPublicAssets(params: CopyMonacoPublicAssetsParams): void

packages/ui/scripts/monaco-public-assets.js

@@ -1,97 +0,0 @@
-import fs from "fs"
-import { resolve } from "path"
-
-/**
- * Copy Monaco's AMD `min/vs` assets into the UI renderer public folder.
- *
- * Monaco is loaded at runtime via `/monaco/vs/loader.js`. These assets are gitignored
- * and generated on demand in dev/build so the repo stays clean.
- *
- * @param {object} params
- * @param {string} params.uiRendererRoot Absolute path to `packages/ui/src/renderer`.
- * @param {(message: string) => void} [params.warn] Warning logger.
- * @param {string[]} [params.sourceRoots] Optional override list of `.../monaco-editor/min/vs` roots.
- */
-export function copyMonacoPublicAssets(params) {
-  const uiRendererRoot = params?.uiRendererRoot
-  if (!uiRendererRoot) {
-    throw new Error("copyMonacoPublicAssets: uiRendererRoot is required")
-  }
-
-  const warn = params?.warn ?? ((message) => console.warn(message))
-  const publicDir = resolve(uiRendererRoot, "public")
-  const destRoot = resolve(publicDir, "monaco/vs")
-
-  const candidates =
-    params?.sourceRoots?.length > 0
-      ? params.sourceRoots
-      : [
-          // Workspace root hoisted deps.
-          resolve(process.cwd(), "node_modules/monaco-editor/min/vs"),
-          // UI package local deps (covers non-hoisted installs).
-          resolve(process.cwd(), "packages/ui/node_modules/monaco-editor/min/vs"),
-        ]
-
-  const sourceRoot = candidates.find((p) => fs.existsSync(resolve(p, "loader.js")))
-  if (!sourceRoot) {
-    warn("Monaco source directory not found; skipping copy")
-    return
-  }
-
-  const copyRecursive = (src, dest) => {
-    const stat = fs.statSync(src)
-    if (stat.isDirectory()) {
-      fs.mkdirSync(dest, { recursive: true })
-      for (const entry of fs.readdirSync(src)) {
-        copyRecursive(resolve(src, entry), resolve(dest, entry))
-      }
-      return
-    }
-    fs.copyFileSync(src, dest)
-  }
-
-  // Keep the working tree clean; these assets are generated.
-  try {
-    fs.rmSync(destRoot, { recursive: true, force: true })
-  } catch {
-    // ignore
-  }
-  fs.mkdirSync(destRoot, { recursive: true })
-
-  // Copy core Monaco runtime.
-  for (const dir of ["base", "editor", "platform"]) {
-    const src = resolve(sourceRoot, dir)
-    if (fs.existsSync(src)) {
-      copyRecursive(src, resolve(destRoot, dir))
-    }
-  }
-
-  // loader.js is required.
-  copyRecursive(resolve(sourceRoot, "loader.js"), resolve(destRoot, "loader.js"))
-
-  // Copy baseline rich language packages + workers.
-  for (const lang of ["typescript", "html", "json", "css"]) {
-    const src = resolve(sourceRoot, "language", lang)
-    if (fs.existsSync(src)) {
-      copyRecursive(src, resolve(destRoot, "language", lang))
-    }
-  }
-
-  // Copy baseline basic tokenizers.
-  for (const lang of ["python", "markdown", "cpp", "kotlin"]) {
-    const src = resolve(sourceRoot, "basic-languages", lang)
-    if (fs.existsSync(src)) {
-      copyRecursive(src, resolve(destRoot, "basic-languages", lang))
-    }
-  }
-
-  // Copy monaco.contribution.js entrypoints (needed by some loads).
-  const monacoContribution = resolve(sourceRoot, "basic-languages", "monaco.contribution.js")
-  if (fs.existsSync(monacoContribution)) {
-    copyRecursive(monacoContribution, resolve(destRoot, "basic-languages", "monaco.contribution.js"))
-  }
-  const underscoreContribution = resolve(sourceRoot, "basic-languages", "_.contribution.js")
-  if (fs.existsSync(underscoreContribution)) {
-    copyRecursive(underscoreContribution, resolve(destRoot, "basic-languages", "_.contribution.js"))
-  }
-}

packages/ui/src/App.tsx

@@ -1,27 +1,24 @@
 import { Component, For, Show, createMemo, createEffect, createSignal, onMount, onCleanup } from "solid-js"
 import { Dialog } from "@kobalte/core/dialog"
 import { Toaster } from "solid-toast"
-import useMediaQuery from "@suid/material/useMediaQuery"
-import { Minimize2 } from "lucide-solid"
 import AlertDialog from "./components/alert-dialog"
 import FolderSelectionView from "./components/folder-selection-view"
 import { showConfirmDialog } from "./stores/alerts"
 import InstanceTabs from "./components/instance-tabs"
 import InstanceDisconnectedModal from "./components/instance-disconnected-modal"
 import InstanceShell from "./components/instance/instance-shell2"
-import { SettingsScreen } from "./components/settings-screen"
+import { RemoteAccessOverlay } from "./components/remote-access-overlay"
 import { InstanceMetadataProvider } from "./lib/contexts/instance-metadata-context"
+import { initMarkdown } from "./lib/markdown"
 import { initGithubStars } from "./stores/github-stars"
 
+import { useTheme } from "./lib/theme"
 import { useCommands } from "./lib/hooks/use-commands"
 import { useAppLifecycle } from "./lib/hooks/use-app-lifecycle"
 import { getLogger } from "./lib/logger"
-import { launchError, showLaunchError, clearLaunchError } from "./stores/launch-errors"
-import { formatLaunchErrorMessage, isMissingBinaryMessage } from "./lib/launch-errors"
 import { initReleaseNotifications } from "./stores/releases"
 import { runtimeEnv } from "./lib/runtime-env"
 import { useI18n } from "./lib/i18n"
-import { setWakeLockDesired } from "./lib/native/wake-lock"
 import {
   hasInstances,
   isSelectingFolder,
@@ -51,160 +48,48 @@ import {
   updateSessionModel,
 } from "./stores/sessions"
 
-import { getInstanceSessionIndicatorStatus } from "./stores/session-status"
-import { openSettings } from "./stores/settings-screen"
-
 const log = getLogger("actions")
 
 const App: Component = () => {
+  const { isDark } = useTheme()
   const { t } = useI18n()
   const {
     preferences,
-    serverSettings,
     recordWorkspaceLaunch,
     toggleShowThinkingBlocks,
-    toggleKeyboardShortcutHints,
     toggleShowTimelineTools,
     toggleAutoCleanupBlankSessions,
     toggleUsageMetrics,
-    togglePromptSubmitOnEnter,
-    toggleShowPromptVoiceInput,
     setDiffViewMode,
     setToolOutputExpansion,
     setDiagnosticsExpansion,
     setThinkingBlocksExpansion,
-    setToolInputsVisibility,
   } = useConfig()
   const [escapeInDebounce, setEscapeInDebounce] = createSignal(false)
+  interface LaunchErrorState {
+    message: string
+    binaryPath: string
+    missingBinary: boolean
+  }
+  const [launchError, setLaunchError] = createSignal<LaunchErrorState | null>(null)
+  const [isAdvancedSettingsOpen, setIsAdvancedSettingsOpen] = createSignal(false)
+  const [remoteAccessOpen, setRemoteAccessOpen] = createSignal(false)
   const [instanceTabBarHeight, setInstanceTabBarHeight] = createSignal(0)
 
-  const phoneQuery = useMediaQuery("(max-width: 767px)")
-  const isPhoneLayout = createMemo(() => phoneQuery())
-
-  // In-memory only: hides chrome on phone; may also request browser fullscreen.
-  const [mobileFullscreenMode, setMobileFullscreenMode] = createSignal(false)
-  const [browserFullscreenActive, setBrowserFullscreenActive] = createSignal(false)
-
-  const fullscreenSupported = () => {
-    if (typeof document === "undefined") return false
-    const el = document.documentElement as any
-    return Boolean(document.fullscreenEnabled) && typeof el?.requestFullscreen === "function"
-  }
-
-  const syncBrowserFullscreenState = () => {
-    if (typeof document === "undefined") return
-    setBrowserFullscreenActive(Boolean(document.fullscreenElement))
-  }
-
-  const enterMobileFullscreen = async () => {
-    if (!isPhoneLayout()) return
-    setMobileFullscreenMode(true)
-    if (!fullscreenSupported()) return
-    try {
-      await document.documentElement.requestFullscreen()
-    } catch {
-      // Ignore: immersive mode still works without browser fullscreen.
-    }
-  }
-
-  const exitMobileFullscreen = async () => {
-    if (typeof document !== "undefined" && document.fullscreenElement && typeof document.exitFullscreen === "function") {
-      try {
-        await document.exitFullscreen()
-      } catch {
-        // Ignore
-      }
-    }
-    setMobileFullscreenMode(false)
-  }
-
-  createEffect(() => {
-    if (typeof document === "undefined") return
-    const shouldShow =
-      runtimeEnv.host !== "web" && runtimeEnv.platform !== "mobile" && (preferences().showKeyboardShortcutHints ?? true)
-    document.documentElement.dataset.keyboardHints = shouldShow ? "show" : "hide"
-  })
-
   const updateInstanceTabBarHeight = () => {
     if (typeof document === "undefined") return
     const element = document.querySelector<HTMLElement>(".tab-bar-instance")
     setInstanceTabBarHeight(element?.offsetHeight ?? 0)
   }
 
-  onMount(() => {
-    if (typeof document === "undefined") return
-    syncBrowserFullscreenState()
-    document.addEventListener("fullscreenchange", syncBrowserFullscreenState)
-    onCleanup(() => document.removeEventListener("fullscreenchange", syncBrowserFullscreenState))
-  })
-
-  onMount(() => {
-    if (typeof window === "undefined") return
-    const vv = window.visualViewport
-    if (!vv) return
-
-    const updateKeyboardOffset = () => {
-      // visualViewport shrinks when the OSK is visible. Use the delta as a bottom inset.
-      const inset = Math.max(0, window.innerHeight - vv.height - vv.offsetTop)
-      document.documentElement.style.setProperty("--keyboard-offset", `${Math.floor(inset)}px`)
-    }
-
-    const schedule = () => requestAnimationFrame(updateKeyboardOffset)
-    schedule()
-    vv.addEventListener("resize", schedule)
-    vv.addEventListener("scroll", schedule)
-    window.addEventListener("orientationchange", schedule)
-
-    onCleanup(() => {
-      vv.removeEventListener("resize", schedule)
-      vv.removeEventListener("scroll", schedule)
-      window.removeEventListener("orientationchange", schedule)
-      document.documentElement.style.removeProperty("--keyboard-offset")
-    })
-  })
-
-  // If the user exits browser fullscreen via browser UI, restore chrome.
-  let lastBrowserFullscreen = false
   createEffect(() => {
-    const active = browserFullscreenActive()
-    const mode = mobileFullscreenMode()
-    if (mode && lastBrowserFullscreen && !active) {
-      setMobileFullscreenMode(false)
-    }
-    lastBrowserFullscreen = active
-  })
-
-  // If we leave phone layout (rotation / resize), restore chrome.
-  createEffect(() => {
-    if (!isPhoneLayout() && mobileFullscreenMode()) {
-      void exitMobileFullscreen()
-    }
+    void initMarkdown(isDark()).catch((error) => log.error("Failed to initialize markdown", error))
   })
 
   createEffect(() => {
     initReleaseNotifications()
   })
 
-  const shouldHoldWakeLock = createMemo(() => {
-    const map = instances()
-    for (const id of map.keys()) {
-      const status = getInstanceSessionIndicatorStatus(id)
-      if (status !== "idle") {
-        return true
-      }
-    }
-    return false
-  })
-
-  createEffect(() => {
-    const hold = shouldHoldWakeLock()
-    void setWakeLockDesired(hold)
-  })
-
-  onCleanup(() => {
-    void setWakeLockDesired(false)
-  })
-
   createEffect(() => {
     instances()
     hasInstances()
@@ -234,26 +119,60 @@ const App: Component = () => {
 
   const launchErrorMessage = () => launchError()?.message ?? ""
 
+  const formatLaunchErrorMessage = (error: unknown): string => {
+    if (!error) {
+      return t("app.launchError.fallbackMessage")
+    }
+    const raw = typeof error === "string" ? error : error instanceof Error ? error.message : String(error)
+    try {
+      const parsed = JSON.parse(raw)
+      if (parsed && typeof parsed.error === "string") {
+        return parsed.error
+      }
+    } catch {
+      // ignore JSON parse errors
+    }
+    return raw
+  }
+
+  const isMissingBinaryMessage = (message: string): boolean => {
+    const normalized = message.toLowerCase()
+    return (
+      normalized.includes("opencode binary not found") ||
+      normalized.includes("binary not found") ||
+      normalized.includes("no such file or directory") ||
+      normalized.includes("binary is not executable") ||
+      normalized.includes("enoent")
+    )
+  }
+
+  const clearLaunchError = () => setLaunchError(null)
+
   async function handleSelectFolder(folderPath: string, binaryPath?: string) {
     if (!folderPath) {
       return
     }
     setIsSelectingFolder(true)
-    const selectedBinary = binaryPath || serverSettings().opencodeBinary || "opencode"
+    const selectedBinary = binaryPath || preferences().lastUsedBinary || "opencode"
     try {
       recordWorkspaceLaunch(folderPath, selectedBinary)
       clearLaunchError()
       const instanceId = await createInstance(folderPath, selectedBinary)
       setShowFolderSelection(false)
+      setIsAdvancedSettingsOpen(false)
 
       log.info("Created instance", {
         instanceId,
         port: instances().get(instanceId)?.port,
       })
     } catch (error) {
-      const message = formatLaunchErrorMessage(error, t("app.launchError.fallbackMessage"))
+      const message = formatLaunchErrorMessage(error)
       const missingBinary = isMissingBinaryMessage(message)
-      showLaunchError({ source: "create", message, binaryPath: selectedBinary, missingBinary })
+      setLaunchError({
+        message,
+        binaryPath: selectedBinary,
+        missingBinary,
+      })
       log.error("Failed to create instance", error)
     } finally {
       setIsSelectingFolder(false)
@@ -266,7 +185,7 @@ const App: Component = () => {
 
   function handleLaunchErrorAdvanced() {
     clearLaunchError()
-    openSettings("opencode")
+    setIsAdvancedSettingsOpen(true)
   }
 
   function handleNewInstanceRequest() {
@@ -350,16 +269,12 @@ const App: Component = () => {
     preferences,
     toggleAutoCleanupBlankSessions,
     toggleShowThinkingBlocks,
-    toggleKeyboardShortcutHints,
     toggleShowTimelineTools,
     toggleUsageMetrics,
-    togglePromptSubmitOnEnter,
-    toggleShowPromptVoiceInput,
     setDiffViewMode,
     setToolOutputExpansion,
     setDiagnosticsExpansion,
     setThinkingBlocksExpansion,
-    setToolInputsVisibility,
     handleNewInstanceRequest,
     handleCloseInstance,
     handleNewSession,
@@ -414,34 +329,32 @@ const App: Component = () => {
       <Dialog open={Boolean(launchError())} modal>
         <Dialog.Portal>
           <Dialog.Overlay class="modal-overlay" />
-           <div class="fixed inset-0 z-50 flex items-center justify-center p-4">
-             <Dialog.Content class="modal-surface w-full max-w-3xl p-6 flex flex-col gap-6 max-h-[80vh] min-h-0 overflow-hidden">
-               <div>
-                 <Dialog.Title class="text-xl font-semibold text-primary">{t("app.launchError.title")}</Dialog.Title>
-                 <Dialog.Description class="text-sm text-secondary mt-2 break-words">
-                   {t("app.launchError.description")}
-                 </Dialog.Description>
-               </div>
+          <div class="fixed inset-0 z-50 flex items-center justify-center p-4">
+            <Dialog.Content class="modal-surface w-full max-w-md p-6 flex flex-col gap-6">
+              <div>
+                <Dialog.Title class="text-xl font-semibold text-primary">{t("app.launchError.title")}</Dialog.Title>
+                <Dialog.Description class="text-sm text-secondary mt-2 break-words">
+                  {t("app.launchError.description")}
+                </Dialog.Description>
+              </div>
 
-               <div class={`flex flex-col gap-4 ${launchErrorMessage() ? "flex-1 min-h-0" : ""}`}>
-                 <div class="rounded-lg border border-base bg-surface-secondary p-4 flex-shrink-0">
-                   <p class="text-xs font-medium text-muted uppercase tracking-wide mb-1">{t("app.launchError.binaryPathLabel")}</p>
-                   <p class="text-sm font-mono text-primary break-all">{launchErrorPath()}</p>
-                 </div>
- 
-                 <Show when={launchErrorMessage()}>
-                   <div class="rounded-lg border border-base bg-surface-secondary p-4 flex flex-col gap-2 flex-1 min-h-0">
-                     <p class="text-xs font-medium text-muted uppercase tracking-wide">{t("app.launchError.errorOutputLabel")}</p>
-                     <pre class="text-sm font-mono text-primary whitespace-pre-wrap break-words overflow-auto flex-1 min-h-0">{launchErrorMessage()}</pre>
-                   </div>
-                 </Show>
-               </div>
+              <div class="rounded-lg border border-base bg-surface-secondary p-4">
+                <p class="text-xs font-medium text-muted uppercase tracking-wide mb-1">{t("app.launchError.binaryPathLabel")}</p>
+                <p class="text-sm font-mono text-primary break-all">{launchErrorPath()}</p>
+              </div>
 
-               <div class="flex justify-end gap-2">
-                 <Show when={launchError()?.missingBinary}>
-                   <button
-                     type="button"
-                     class="selector-button selector-button-secondary"
+              <Show when={launchErrorMessage()}>
+                <div class="rounded-lg border border-base bg-surface-secondary p-4">
+                  <p class="text-xs font-medium text-muted uppercase tracking-wide mb-1">{t("app.launchError.errorOutputLabel")}</p>
+                  <pre class="text-sm font-mono text-primary whitespace-pre-wrap break-words max-h-48 overflow-y-auto">{launchErrorMessage()}</pre>
+                </div>
+              </Show>
+
+              <div class="flex justify-end gap-2">
+                <Show when={launchError()?.missingBinary}>
+                  <button
+                    type="button"
+                    class="selector-button selector-button-secondary"
                     onClick={handleLaunchErrorAdvanced}
                   >
                     {t("app.launchError.openAdvancedSettings")}
@@ -455,61 +368,37 @@ const App: Component = () => {
           </div>
         </Dialog.Portal>
       </Dialog>
-      <div class="h-screen w-screen flex flex-col" style={{ height: "100dvh", "padding-bottom": "var(--keyboard-offset, 0px)" }}>
-        <Show when={isPhoneLayout() && mobileFullscreenMode()}>
-          <div class="mobile-fullscreen-exit-wrapper">
-            <button
-              type="button"
-              class="message-scroll-button mobile-fullscreen-exit-button"
-              onClick={() => void exitMobileFullscreen()}
-              aria-label={t("instanceShell.fullscreen.exit")}
-              title={t("instanceShell.fullscreen.exit")}
-            >
-              <Minimize2 class="h-5 w-5" aria-hidden="true" />
-            </button>
-          </div>
-        </Show>
+      <div class="h-screen w-screen flex flex-col">
         <Show
           when={!hasInstances()}
           fallback={
             <>
-              <Show when={!isPhoneLayout() || !mobileFullscreenMode()}>
-                <InstanceTabs
-                  instances={instances()}
-                  activeInstanceId={activeInstanceId()}
-                  onSelect={setActiveInstanceId}
-                  onClose={handleCloseInstance}
-                  onNew={handleNewInstanceRequest}
-                />
-              </Show>
+              <InstanceTabs
+                instances={instances()}
+                activeInstanceId={activeInstanceId()}
+                onSelect={setActiveInstanceId}
+                onClose={handleCloseInstance}
+                onNew={handleNewInstanceRequest}
+                onOpenRemoteAccess={() => setRemoteAccessOpen(true)}
+              />
  
               <For each={Array.from(instances().values())}>
                 {(instance) => {
                   const isActiveInstance = () => activeInstanceId() === instance.id
                   const isVisible = () => isActiveInstance() && !showFolderSelection()
                     return (
-                       <div
-                         class="flex-1 min-h-0 overflow-hidden"
-                         style={{ display: isVisible() ? "flex" : "none" }}
-                         data-instance-id={instance.id}
-                         data-instance-active={isActiveInstance() ? "true" : "false"}
-                         data-instance-visible={isVisible() ? "true" : "false"}
-                       >
-                         <InstanceMetadataProvider instance={instance}>
-                           <InstanceShell
-                             instance={instance}
-                             isActiveInstance={isActiveInstance()}
-                             escapeInDebounce={escapeInDebounce()}
-                             paletteCommands={paletteCommands}
-                             onCloseSession={(sessionId) => handleCloseSession(instance.id, sessionId)}
-                             onNewSession={() => handleNewSession(instance.id)}
-                             handleSidebarAgentChange={(sessionId, agent) => handleSidebarAgentChange(instance.id, sessionId, agent)}
-                             handleSidebarModelChange={(sessionId, model) => handleSidebarModelChange(instance.id, sessionId, model)}
-                             onExecuteCommand={executeCommand}
-                            tabBarOffset={isPhoneLayout() && mobileFullscreenMode() ? 0 : instanceTabBarHeight()}
-                            mobileFullscreenMode={isPhoneLayout() && mobileFullscreenMode()}
-                            onEnterMobileFullscreen={() => void enterMobileFullscreen()}
-                            onExitMobileFullscreen={() => void exitMobileFullscreen()}
+                      <div class="flex-1 min-h-0 overflow-hidden" style={{ display: isVisible() ? "flex" : "none" }}>
+                        <InstanceMetadataProvider instance={instance}>
+                          <InstanceShell
+                            instance={instance}
+                            escapeInDebounce={escapeInDebounce()}
+                            paletteCommands={paletteCommands}
+                            onCloseSession={(sessionId) => handleCloseSession(instance.id, sessionId)}
+                            onNewSession={() => handleNewSession(instance.id)}
+                            handleSidebarAgentChange={(sessionId, agent) => handleSidebarAgentChange(instance.id, sessionId, agent)}
+                            handleSidebarModelChange={(sessionId, model) => handleSidebarModelChange(instance.id, sessionId, model)}
+                            onExecuteCommand={executeCommand}
+                            tabBarOffset={instanceTabBarHeight()}
                           />
                         </InstanceMetadataProvider>
 
@@ -525,25 +414,41 @@ const App: Component = () => {
           <FolderSelectionView
             onSelectFolder={handleSelectFolder}
             isLoading={isSelectingFolder()}
+            advancedSettingsOpen={isAdvancedSettingsOpen()}
+            onAdvancedSettingsOpen={() => setIsAdvancedSettingsOpen(true)}
+            onAdvancedSettingsClose={() => setIsAdvancedSettingsOpen(false)}
+            onOpenRemoteAccess={() => setRemoteAccessOpen(true)}
           />
         </Show>
 
         <Show when={showFolderSelection()}>
           <div class="fixed inset-0 bg-black/50 z-50 flex items-center justify-center">
             <div class="w-full h-full relative">
+              <button
+                onClick={() => {
+                  setShowFolderSelection(false)
+                  setIsAdvancedSettingsOpen(false)
+                  clearLaunchError()
+                }}
+                class="absolute top-4 right-4 z-10 p-2 bg-white dark:bg-gray-800 rounded-lg shadow-lg hover:bg-gray-100 dark:hover:bg-gray-700 transition-colors"
+                title={t("app.launchError.closeTitle")}
+              >
+                <svg class="w-5 h-5 text-gray-600 dark:text-gray-300" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+                </svg>
+              </button>
               <FolderSelectionView
                 onSelectFolder={handleSelectFolder}
                 isLoading={isSelectingFolder()}
-                onClose={() => {
-                  setShowFolderSelection(false)
-                  clearLaunchError()
-                }}
+                advancedSettingsOpen={isAdvancedSettingsOpen()}
+                onAdvancedSettingsOpen={() => setIsAdvancedSettingsOpen(true)}
+                onAdvancedSettingsClose={() => setIsAdvancedSettingsOpen(false)}
               />
             </div>
           </div>
         </Show>
  
-        <SettingsScreen />
+        <RemoteAccessOverlay open={remoteAccessOpen()} onClose={() => setRemoteAccessOpen(false)} />
  
         <AlertDialog />
 

packages/ui/src/components/agent-selector.tsx

@@ -5,6 +5,7 @@ import { ChevronDown } from "lucide-solid"
 import type { Agent } from "../types/session"
 import { useI18n } from "../lib/i18n"
 import { getLogger } from "../lib/logger"
+import Kbd from "./kbd"
 const log = getLogger("session")
 
 
@@ -31,10 +32,10 @@ export default function AgentSelector(props: AgentSelectorProps) {
   const availableAgents = createMemo(() => {
     const allAgents = instanceAgents()
     if (isChildSession()) {
-      return allAgents.filter((agent) => !agent.hidden)
+      return allAgents
     }
 
-    const filtered = allAgents.filter((agent) => !agent.hidden && agent.mode !== "subagent")
+    const filtered = allAgents.filter((agent) => agent.mode !== "subagent")
 
     const currentAgent = allAgents.find((a) => a.name === props.currentAgent)
     if (currentAgent && !filtered.find((a) => a.name === props.currentAgent)) {
@@ -103,15 +104,18 @@ export default function AgentSelector(props: AgentSelectorProps) {
         >
           <div class="flex-1 min-w-0">
             <Select.Value<Agent>>
-              {() => (
+              {(state) => (
                 <div class="selector-trigger-label selector-trigger-label--stacked">
                   <span class="selector-trigger-primary selector-trigger-primary--align-left">
-                    {t("agentSelector.trigger.primary", { agent: props.currentAgent || t("agentSelector.none") })}
+                    {t("agentSelector.trigger.primary", { agent: state.selectedOption()?.name ?? t("agentSelector.none") })}
                   </span>
                 </div>
               )}
             </Select.Value>
           </div>
+          <span class="selector-trigger-hint selector-trigger-hint--top" aria-hidden="true">
+            <Kbd shortcut="cmd+shift+a" />
+          </span>
           <Select.Icon class="selector-trigger-icon">
             <ChevronDown class="w-3 h-3" />
           </Select.Icon>

packages/ui/src/components/alert-dialog.tsx

@@ -108,43 +108,42 @@ const AlertDialog: Component = () => {
             open
             modal
             onOpenChange={(open) => {
-              // Only handle dismiss if dialog is dismissible (default: true)
-              if (!open && payload.dismissible !== false) {
+              if (!open) {
                 dismiss(false, payload)
               }
             }}
           >
             <Dialog.Portal>
-              <Dialog.Overlay class="modal-overlay z-[60]" />
-              <Dialog.Content class="modal-surface fixed left-1/2 top-1/2 z-[1310] w-full max-w-sm -translate-x-1/2 -translate-y-1/2 p-6 border border-base shadow-2xl" tabIndex={-1}>
-                   <div class="flex items-start gap-3">
-                     <div
-                       class="flex h-12 w-12 shrink-0 items-center justify-center rounded-xl border text-base font-semibold"
-                       style={{
-                         "background-color": accent.badgeBg,
-                         "border-color": accent.badgeBorder,
-                         color: accent.badgeText,
-                       }}
-                       aria-hidden
-                     >
-                       {accent.symbol}
-                     </div>
-                     <div class="flex-1 min-w-0">
-                       <Dialog.Title class="text-lg font-semibold text-primary">{title}</Dialog.Title>
-                       <Dialog.Description class="text-sm text-secondary mt-1 whitespace-pre-line break-words">
-                         {payload.message}
-                         {payload.detail && <p class="mt-2 text-secondary">{payload.detail}</p>}
-                       </Dialog.Description>
-                     </div>
-                   </div>
+              <Dialog.Overlay class="modal-overlay" />
+              <div class="fixed inset-0 z-50 flex items-center justify-center p-4">
+                <Dialog.Content class="modal-surface w-full max-w-sm p-6 border border-base shadow-2xl" tabIndex={-1}>
+                  <div class="flex items-start gap-3">
+                    <div
+                      class="flex h-12 w-12 shrink-0 items-center justify-center rounded-xl border text-base font-semibold"
+                      style={{
+                        "background-color": accent.badgeBg,
+                        "border-color": accent.badgeBorder,
+                        color: accent.badgeText,
+                      }}
+                      aria-hidden
+                    >
+                      {accent.symbol}
+                    </div>
+                    <div class="flex-1 min-w-0">
+                      <Dialog.Title class="text-lg font-semibold text-primary">{title}</Dialog.Title>
+                      <Dialog.Description class="text-sm text-secondary mt-1 whitespace-pre-line break-words">
+                        {payload.message}
+                        {payload.detail && <p class="mt-2 text-secondary">{payload.detail}</p>}
+                      </Dialog.Description>
+                    </div>
+                  </div>
 
                     <Show when={isPrompt}>
                       <div class="mt-4">
-                        <label for="prompt-input" class="text-sm font-medium text-secondary">
+                        <label class="text-sm font-medium text-secondary">
                           {payload.inputLabel || t("alertDialog.prompt.inputLabel")}
                         </label>
                         <input
-                          id="prompt-input"
                           ref={(el) => {
                             promptInputRef = el
                           }}
@@ -185,14 +184,15 @@ const AlertDialog: Component = () => {
                      >
                        {confirmLabel}
                      </button>
-                    </div>
-                  </Dialog.Content>
-                </Dialog.Portal>
-              </Dialog>
-         )
-       }}
-     </Show>
-   )
- }
+                   </div>
+                </Dialog.Content>
+              </div>
+            </Dialog.Portal>
+          </Dialog>
+        )
+      }}
+    </Show>
+  )
+}
 
 export default AlertDialog

packages/ui/src/components/code-block-inline.tsx

@@ -1,8 +1,7 @@
 import { createSignal, onMount, Show, createEffect } from "solid-js"
 import type { Highlighter } from "shiki/bundle/full"
 import { useTheme } from "../lib/theme"
-import { getSharedHighlighter } from "../lib/markdown"
-import { escapeHtml } from "../lib/text-render-utils"
+import { getSharedHighlighter, escapeHtml } from "../lib/markdown"
 import { copyToClipboard } from "../lib/clipboard"
 import { useI18n } from "../lib/i18n"
 
@@ -56,7 +55,7 @@ export function CodeBlockInline(props: CodeBlockInlineProps) {
 
       const highlighted = highlighter.codeToHtml(props.code, {
         lang: props.language as CodeToHtmlOptions["lang"],
-        theme: isDark() ? "github-dark" : "github-light-high-contrast",
+        theme: isDark() ? "github-dark" : "github-light",
       })
       setHtml(highlighted)
     } catch {