fix(server): prefer LAN remote addresses over public IPs

Keep the Change password control on the same row as the username and password-status copy in the settings card, so the summary reads as one horizontal unit instead of stacked text followed by a separate action row.

.github/workflows/build-and-upload.yml

@@ -53,7 +53,7 @@ on:
 # least-privilege (e.g. dev CI uses read-only; releases grant write).
 
 env:
-  NODE_VERSION: 22
+  NODE_VERSION: 20
 
 jobs:
   build-macos:
@@ -212,7 +212,7 @@ jobs:
         run: |
           set -euo pipefail
           shopt -s nullglob
-          for file in packages/electron-app/release/*.zip packages/electron-app/release/*.AppImage; do
+          for file in packages/electron-app/release/*.zip; do
             [ -f "$file" ] || continue
             echo "Uploading $file"
             gh release upload "$TAG" "$file" --clobber
@@ -313,7 +313,7 @@ jobs:
         run: |
           set -euo pipefail
           shopt -s nullglob
-          for file in packages/electron-app/release/*.zip packages/electron-app/release/*.AppImage; do
+          for file in packages/electron-app/release/*.zip; do
             [ -f "$file" ] || continue
             echo "Uploading $file"
             gh release upload "$TAG" "$file" --clobber
@@ -324,9 +324,7 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: ${{ inputs.actions_artifacts_name_prefix }}electron-linux
-          path: |
-            packages/electron-app/release/*.zip
-            packages/electron-app/release/*.AppImage
+          path: packages/electron-app/release/*.zip
           retention-days: ${{ inputs.actions_artifacts_retention_days }}
           if-no-files-found: error
 
@@ -372,7 +370,7 @@ jobs:
             if [ "$attempt" -gt 1 ]; then
               echo "Retrying Tauri CLI install (attempt $attempt)..."
             fi
-            npm install @tauri-apps/cli@2.10.1 @tauri-apps/cli-darwin-x64@2.10.1 --no-save --no-audit --no-fund --workspaces=false
+            npm install @tauri-apps/cli@2.9.4 @tauri-apps/cli-darwin-x64@2.9.4 --no-save --no-audit --no-fund --workspaces=false
             node -e "require('@tauri-apps/cli'); console.log('Tauri CLI loaded')" && exit 0
           done
           echo "Tauri CLI failed to load after retries" >&2
@@ -456,7 +454,7 @@ jobs:
             if [ "$attempt" -gt 1 ]; then
               echo "Retrying Tauri CLI install (attempt $attempt)..."
             fi
-            npm install @tauri-apps/cli@2.10.1 @tauri-apps/cli-darwin-arm64@2.10.1 --no-save --no-audit --no-fund --workspaces=false
+            npm install @tauri-apps/cli@2.9.4 @tauri-apps/cli-darwin-arm64@2.9.4 --no-save --no-audit --no-fund --workspaces=false
             node -e "require('@tauri-apps/cli'); console.log('Tauri CLI loaded')" && exit 0
           done
           echo "Tauri CLI failed to load after retries" >&2
@@ -542,7 +540,7 @@ jobs:
             if [ "$attempt" -gt 1 ]; then
               echo "Retrying Tauri CLI install (attempt $attempt)..."
             fi
-            npm install @tauri-apps/cli@2.10.1 @tauri-apps/cli-win32-x64-msvc@2.10.1 --no-save --no-audit --no-fund --workspaces=false
+            npm install @tauri-apps/cli@2.9.4 @tauri-apps/cli-win32-x64-msvc@2.9.4 --no-save --no-audit --no-fund --workspaces=false
             node -e "require('@tauri-apps/cli'); console.log('Tauri CLI loaded')" && exit 0
           done
           echo "Tauri CLI failed to load after retries" >&2
@@ -614,7 +612,6 @@ jobs:
           sudo apt-get install -y \
             build-essential \
             pkg-config \
-            xdg-utils \
             libgtk-3-dev \
             libglib2.0-dev \
             libwebkit2gtk-4.1-dev \
@@ -643,7 +640,6 @@ jobs:
             if [ "$attempt" -gt 1 ]; then
               echo "Retrying Tauri CLI install (attempt $attempt)..."
             fi
-            # Tauri CLI 2.10.1 regresses Linux AppImage bundling in CI; keep Linux on the last known-good CLI.
             npm install @tauri-apps/cli@2.9.4 @tauri-apps/cli-linux-x64-gnu@2.9.4 --no-save --no-audit --no-fund --workspaces=false
             node -e "require('@tauri-apps/cli'); console.log('Tauri CLI loaded')" && exit 0
           done
@@ -743,7 +739,6 @@ jobs:
           sudo apt-get install -y \
             build-essential \
             pkg-config \
-            xdg-utils \
             gcc-aarch64-linux-gnu \
             g++-aarch64-linux-gnu \
             libgtk-3-dev:arm64 \

.github/workflows/comment-pr-artifacts.yml

@@ -4,7 +4,6 @@ on:
   pull_request_target:
     types:
       - opened
-      - edited
       - synchronize
       - reopened
       - ready_for_review
@@ -20,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       ALLOWED_ACTORS: ${{ vars.ALLOWED_NON_DEV_PR_ACTORS }}
-      PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+      ACTOR: ${{ github.actor }}
       BASE_REF: ${{ github.event.pull_request.base.ref }}
       IS_DRAFT: ${{ github.event.pull_request.draft }}
       PR_NUMBER: ${{ github.event.pull_request.number }}
@@ -38,7 +37,7 @@ jobs:
           fi
 
           normalized=",${ALLOWED_ACTORS},"
-          if [[ "$normalized" == *",${PR_AUTHOR},"* ]]; then
+          if [[ "$normalized" == *",${ACTOR},"* ]]; then
             echo "allowed=true" >> "$GITHUB_OUTPUT"
           else
             echo "allowed=false" >> "$GITHUB_OUTPUT"

.github/workflows/manual-npm-publish.yml

@@ -46,8 +46,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     env:
-      NODE_VERSION: 22
-      PUBLISH_NPM_VERSION: 11.5.1
+      NODE_VERSION: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -60,24 +59,17 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: https://registry.npmjs.org
 
-      - name: Prepare pinned npm CLI
-        shell: bash
-        run: |
-          set -euo pipefail
-          tool_dir="$RUNNER_TEMP/publish-npm"
-          mkdir -p "$tool_dir"
-          npm install --prefix "$tool_dir" "npm@${PUBLISH_NPM_VERSION}" --no-audit --no-fund
-          echo "PINNED_NPM_CLI=$tool_dir/node_modules/npm/bin/npm-cli.js" >> "$GITHUB_ENV"
-          node "$tool_dir/node_modules/npm/bin/npm-cli.js" --version
+      - name: Ensure npm >=11.5.1
+        run: npm install -g npm@latest
 
       - name: Install dependencies
-        run: node "$PINNED_NPM_CLI" ci --workspaces
+        run: npm ci --workspaces
 
       - name: Ensure rollup native binary
-        run: node "$PINNED_NPM_CLI" install @rollup/rollup-linux-x64-gnu --no-save
+        run: npm install @rollup/rollup-linux-x64-gnu --no-save
 
       - name: Build server package (includes UI bundling)
-        run: node "$PINNED_NPM_CLI" run build --workspace packages/server
+        run: npm run build --workspace packages/server
 
       - name: Set publish metadata
         shell: bash
@@ -91,7 +83,7 @@ jobs:
           echo "PACKAGE_NAME=${{ inputs.package_name }}" >> "$GITHUB_ENV"
 
       - name: Bump package version for publish
-        run: node "$PINNED_NPM_CLI" version ${VERSION} --workspaces --include-workspace-root --no-git-tag-version --allow-same-version
+        run: npm version ${VERSION} --workspaces --include-workspace-root --no-git-tag-version --allow-same-version
 
       - name: Set server package name for publish
         shell: bash
@@ -115,4 +107,4 @@ jobs:
           else
             echo "Using NPM_TOKEN authentication"
           fi
-          node "$PINNED_NPM_CLI" publish --workspace packages/server --access public --tag ${DIST_TAG} --provenance
+          npm publish --workspace packages/server --access public --tag ${DIST_TAG} --provenance

.github/workflows/pr-build.yml

@@ -4,7 +4,6 @@ on:
   pull_request:
     types:
       - opened
-      - edited
       - synchronize
       - reopened
       - ready_for_review
@@ -24,7 +23,7 @@ jobs:
       allowed: ${{ steps.auth.outputs.allowed }}
     env:
       ALLOWED_ACTORS: ${{ vars.ALLOWED_NON_DEV_PR_ACTORS }}
-      PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+      ACTOR: ${{ github.actor }}
       BASE_REF: ${{ github.event.pull_request.base.ref }}
     steps:
       - name: Check PR authorization
@@ -38,11 +37,11 @@ jobs:
           fi
 
           normalized=",${ALLOWED_ACTORS},"
-          if [[ "$normalized" == *",${PR_AUTHOR},"* ]]; then
+          if [[ "$normalized" == *",${ACTOR},"* ]]; then
             echo "allowed=true" >> "$GITHUB_OUTPUT"
           else
             echo "allowed=false" >> "$GITHUB_OUTPUT"
-            echo "Skipping builds for PR by unauthorized author targeting $BASE_REF" >&2
+            echo "Skipping builds for unauthorized PR targeting $BASE_REF" >&2
           fi
 
   build:

.github/workflows/release-ui.yml

@@ -14,7 +14,7 @@ permissions:
   contents: read
 
 env:
-  NODE_VERSION: 22
+  NODE_VERSION: 20
 
 jobs:
   release-ui:

.github/workflows/restrict-non-dev-prs.yml

@@ -4,7 +4,6 @@ on:
   pull_request_target:
     types:
       - opened
-      - edited
       - reopened
       - synchronize
 
@@ -18,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       ALLOWED_ACTORS: ${{ vars.ALLOWED_NON_DEV_PR_ACTORS }}
-      PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+      ACTOR: ${{ github.actor }}
       PR_NUMBER: ${{ github.event.pull_request.number }}
       BASE_REF: ${{ github.event.pull_request.base.ref }}
     steps:
@@ -28,7 +27,7 @@ jobs:
         run: |
           set -euo pipefail
           normalized=",${ALLOWED_ACTORS},"
-          if [[ "$normalized" == *",${PR_AUTHOR},"* ]]; then
+          if [[ "$normalized" == *",${ACTOR},"* ]]; then
             echo "authorized=true" >> "$GITHUB_OUTPUT"
           else
             echo "authorized=false" >> "$GITHUB_OUTPUT"
@@ -51,5 +50,5 @@ jobs:
       - name: Fail unauthorized PR
         if: ${{ steps.auth.outputs.authorized != 'true' }}
         run: |
-          echo "PR author $PR_AUTHOR is not allowed to open PRs targeting $BASE_REF" >&2
+          echo "Actor $ACTOR is not allowed to open PRs targeting $BASE_REF" >&2
           exit 1

.github/workflows/reusable-release.yml

@@ -39,7 +39,7 @@ permissions:
   contents: write
 
 env:
-  NODE_VERSION: 22
+  NODE_VERSION: 20
 
 jobs:
   prepare-release:

README.md

@@ -1,182 +1,128 @@
 # CodeNomad
 
-## The AI Coding Cockpit for OpenCode
+## A fast, multi-instance workspace for running OpenCode sessions.
 
-CodeNomad transforms OpenCode from a terminal tool into a **premium desktop workspace** — built for developers who live inside AI coding sessions for hours and need control, speed, and clarity.
-
-> OpenCode gives you the engine. CodeNomad gives you the cockpit.
+CodeNomad is built for people who live inside OpenCode for hours on end and need a cockpit, not a kiosk. It delivers a premium, low-latency workspace that favors speed, clarity, and direct control.
 
 ![Multi-instance workspace](docs/screenshots/newSession.png)
+_Manage multiple OpenCode sessions side-by-side._
 
----
+<details>
+<summary>📸 More Screenshots</summary>
 
-## Features
+![Command palette overlay](docs/screenshots/command-palette.png)
+_Global command palette for keyboard-first control._
 
-- **🚀 Multi-Instance Workspace**
-- **🌐 Remote Access**
-- **🧠 Session Management**
-- **🎙️ Voice Input & Speech**
-- **🌳 Git Worktrees**
-- **💬 Rich Message Experience**
-- **🧩 SideCars**
-- **⌨️ Command Palette**
-- **📁 File System Browser**
-- **🔐 Authentication & Security**
-- **🔔 Notifications**
-- **🎨 Theming**
-- **🌍 Internationalization**
+![Image Previews](docs/screenshots/image-previews.png)
+_Rich media previews for images and assets._
 
----
+![Browser Support](docs/screenshots/browser-support.png)
+_Browser support via CodeNomad Server._
+
+</details>
 
 ## Getting Started
 
-### 🖥️ Desktop App
+Choose the way that fits your workflow:
 
-Available as both Electron and Tauri builds — choose based on your preference.
+### 🖥️ Desktop App (Recommended)
+The best experience. A native application (Electron-based) with global shortcuts, deeper system integration, and a dedicated window.
 
-Download the latest installer for your platform from [Releases](https://github.com/shantur/CodeNomad/releases).
+- **Download**: Grab the latest installer for macOS, Windows, or Linux from the [Releases Page](https://github.com/shantur/CodeNomad/releases).
+- **Run**: Install and launch like any other app.
 
-| Platform | Formats |
-|----------|---------|
-| macOS | DMG, ZIP (Universal: Intel + Apple Silicon) |
-| Windows | NSIS Installer, ZIP (x64, ARM64) |
-| Linux | AppImage, deb, tar.gz (x64, ARM64) |
+### 🦀 Tauri App (Experimental)
+We are also working on a lightweight, high-performance version built with [Tauri](https://tauri.app). It is currently in active development.
+
+- **Download**: Experimental builds are available on the [Releases Page](https://github.com/shantur/CodeNomad/releases).
+- **Source**: Check out `packages/tauri-app` if you're interested in contributing.
 
 ### 💻 CodeNomad Server
-
-Run as a local server and access via browser. Perfect for remote development.
+Run CodeNomad as a local server and access it via your web browser. Perfect for remote development (SSH/VPN) or running as a service.
 
 ```bash
 npx @neuralnomads/codenomad --launch
 ```
 
-See [Server Documentation](packages/server/README.md) for flags, TLS, auth, and remote access.
+Full server/CLI documentation (flags + env vars, TLS, auth, remote access):
+- [packages/server/README.md](packages/server/README.md)
+
+To see all available options:
+
+```bash
+npx @neuralnomads/codenomad --help
+```
 
 ### 🧪 Dev Releases
-
-Bleeding-edge builds from the `dev` branch:
+Bleeding-edge builds are published as GitHub pre-releases and are generated automatically from the `dev` branch.
 
 ```bash
 npx @neuralnomads/codenomad-dev --launch
 ```
 
----
+## Highlights
 
-## SideCars
-
-SideCars let you open local web tools inside CodeNomad as tabs.
-
-<details>
-<summary><strong>Configuration</strong></summary>
-
-- **Name**: Display name used in CodeNomad
-- **Port**: Local HTTP or HTTPS service running on `127.0.0.1:<port>`
-- **Base path**: Mounted under `/sidecars/:id`
-- **Prefix mode**:
-  - **Preserve prefix** forwards the full `/sidecars/:id/...` path upstream
-  - **Strip prefix** removes `/sidecars/:id` before forwarding the request upstream
-
-</details>
-
-<details>
-<summary><strong>VSCode (OpenVSCode Server)</strong></summary>
-
-Run with Docker:
-
-```bash
-docker run -it --init -p 8000:3000 -v "${HOME}:${HOME}:cached" -e HOME=${HOME} gitpod/openvscode-server --server-base-path /sidecars/vscode
-```
-
-Add SideCar as:
-
-- **Name**: `VSCode`
-- **Port**: `http://127.0.0.1:8000`
-- **Base path**: `/sidecars/vscode`
-- **Prefix mode**: `Preserve prefix`
-
-</details>
-
-<details>
-<summary><strong>Terminal (ttyd)</strong></summary>
-
-Run with:
-
-```bash
-ttyd --writable zsh
-```
-
-Add SideCar as:
-
-- **Name**: `Terminal`
-- **Port**: `http://127.0.0.1:7681`
-- **Base path**: `/sidecars/terminal`
-- **Prefix mode**: `Strip prefix`
-
-</details>
-
----
+- **Multi-Instance**: Juggle several OpenCode sessions side-by-side with tabs.
+- **Long-Session Native**: Scroll through massive transcripts without hitches.
+- **Command Palette**: A single global palette to jump tabs, launch tools, and control everything.
+- **Deep Task Awareness**: Monitor background tasks and child sessions without losing flow.
 
 ## Requirements
 
-- **[OpenCode CLI](https://opencode.ai)** — must be installed and in your `PATH`
-- **Node.js 18+** — for server mode or building from source
-
----
-
-## Development
-
-CodeNomad is a monorepo built with:
-
-| Package | Description |
-|---------|-------------|
-| **[packages/server](packages/server/README.md)** | Core logic & CLI — workspaces, OpenCode proxy, API, auth, speech |
-| **[packages/ui](packages/ui/README.md)** | SolidJS frontend — reactive, fast, beautiful |
-| **[packages/electron-app](packages/electron-app/README.md)** | Desktop shell — process management, IPC, native dialogs |
-| **[packages/tauri-app](packages/tauri-app)** | Tauri desktop shell (experimental) |
-
-### Quick Start
-
-```bash
-git clone https://github.com/NeuralNomadsAI/CodeNomad.git
-cd CodeNomad
-npm install
-npm run dev
-```
-
----
+- **[OpenCode CLI](https://opencode.ai)**: Must be installed and available in your `PATH`.
+- **Node.js 18+**: Required if running the CLI server or building from source.
 
 ## Troubleshooting
 
-<details>
-<summary><strong>macOS: "CodeNomad.app is damaged and can't be opened"</strong></summary>
-
-Gatekeeper flag due to missing notarization. Clear the quarantine attribute:
+### macOS says the app is damaged
+If macOS reports that "CodeNomad.app is damaged and can't be opened," Gatekeeper flagged the download because the app is not yet notarized. You can clear the quarantine flag after moving CodeNomad into `/Applications`:
 
 ```bash
+xattr -l /Applications/CodeNomad.app
 xattr -dr com.apple.quarantine /Applications/CodeNomad.app
 ```
 
-On Intel Macs, also check **System Settings → Privacy & Security** on first launch.
-</details>
+After removing the quarantine attribute, launch the app normally. On Intel Macs you may also need to approve CodeNomad from **System Settings → Privacy & Security** the first time you run it.
 
-<details>
-<summary><strong>Linux (Wayland + NVIDIA): Tauri App closes immediately</strong></summary>
+### Linux (Wayland + NVIDIA): Tauri AppImage closes immediately
+On some Wayland compositor + NVIDIA driver setups, WebKitGTK can fail to initialize its DMA-BUF/GBM path and the Tauri build may exit right away.
 
-WebKitGTK DMA-BUF/GBM issue. Run with:
+Try running with one of these environment variables:
 
 ```bash
+# Most reliable workaround (can reduce rendering performance)
 WEBKIT_DISABLE_DMABUF_RENDERER=1 codenomad
+
+# Alternative for some Wayland setups
+__NV_DISABLE_EXPLICIT_SYNC=1 codenomad
 ```
 
-See full workaround in the original README.
-</details>
+If you're running the Tauri AppImage and want the workaround applied every time, create a tiny wrapper script on your `PATH`:
 
----
+```bash
+#!/bin/bash
+export WEBKIT_DISABLE_DMABUF_RENDERER=1
+exec ~/.local/share/bauh/appimage/installed/codenomad/CodeNomad-Tauri-0.4.0-linux-x64.AppImage "$@"
+```
 
-## Community
+Upstream tracking: https://github.com/tauri-apps/tauri/issues/10702
 
-[![Star History](https://api.star-history.com/svg?repos=NeuralNomadsAI/CodeNomad&type=Date)](https://star-history.com/#NeuralNomadsAI/CodeNomad&Date)
+## Architecture & Development
 
----
+CodeNomad is a monorepo split into specialized packages. If you want to contribute or build from source, check out the individual package documentation:
+
+| Package | Description |
+|---------|-------------|
+| **[packages/electron-app](packages/electron-app/README.md)** | The native desktop application shell. Wraps the UI and Server. |
+| **[packages/server](packages/server/README.md)** | The core logic and CLI. Manages workspaces, proxies OpenCode, and serves the API. |
+| **[packages/ui](packages/ui/README.md)** | The SolidJS-based frontend. Fast, reactive, and beautiful. |
+
+### Quick Build
+To build the Desktop App from source:
+
+1.  Clone the repo.
+2.  Run `npm install` (requires pnpm or npm 7+ for workspaces).
+3.  Run `npm run build --workspace @neuralnomads/codenomad-electron-app`.
+
+[![Star History Chart](https://api.star-history.com/svg?repos=NeuralNomadsAI/CodeNomad&type=Date)](https://star-history.com/#NeuralNomadsAI/CodeNomad&Date)
 
-**Built with ♥ by [Neural Nomads](https://github.com/NeuralNomadsAI)** · [MIT License](LICENSE)

docs/features/wake-lock/SPECIFICATION.md

@@ -1,17 +0,0 @@
-# Wake Lock Behavior
-
-## Product Rule
-
-CodeNomad only requests a wake lock for qualifying active work that is already running and can continue without continuous foreground interaction. The goal is to prevent idle system sleep where the platform supports that behavior without intentionally keeping the display awake.
-
-Wake lock must not be held when work is idle, paused, completed, cancelled, failed, or waiting for new user input or permission before it can continue.
-
-## Platform Behavior
-
-- **Electron:** request system-sleep-only behavior with `prevent-app-suspension`.
-- **Tauri:** request the native keep-awake mode with `display: false`, `idle: true`, and `sleep: false`.
-- **Web:** do not fall back to `navigator.wakeLock.request("screen")`; if a true system-sleep-only primitive is unavailable, CodeNomad degrades to no wake lock.
-
-## Release Expectations
-
-Wake lock should be released promptly when qualifying active work ends or when the app cleans up the active session lifecycle.

docs/scrs/SCR-2026-04-21-001-wake-lock-system-sleep-only.md

@@ -1,79 +0,0 @@
----
-id: SCR-2026-04-21-001
-title: Wake lock should allow screen lock while preventing system sleep
-status: draft
----
-
-# Summary
-
-Refine wake-lock behavior so the product protects long-running active work from device/system sleep without intentionally keeping the display awake. The desired product experience is: users may lock the screen or let the display sleep, and in-platform work should continue whenever the platform can support that behavior.
-
-# Problem
-
-Current wake-lock behavior on desktop is oriented around display wake, which prevents normal screen lock or display sleep behavior on macOS and does not match the requested product outcome. The Product Owner wants wake lock to protect only against system/device sleep during active work, not against display sleep or screen lock. Scope includes Electron, Tauri, and web, with documented best-effort degradation where platform APIs cannot provide a system-sleep-only capability.
-
-# Requested Outcome
-
-- Allow the screen/display to sleep or lock normally while qualifying work is in progress.
-- Prevent only system/device sleep during qualifying active work on platforms that support a system-sleep-only hold.
-- Keep platform behavior aligned to a single product rule: never intentionally keep the display awake as a fallback for this feature.
-- Apply the behavior across Electron, Tauri, and web using best-effort platform support with explicit limitation handling.
-
-# Product Scope
-
-## Active Work Definition
-
-For this change, **active work** means a user-initiated or product-initiated in-app operation that:
-
-- has started execution,
-- is represented by the product as still in progress,
-- is expected to continue without continuous foreground interaction, and
-- would lose reliability or stop early if the device enters normal system sleep.
-
-Active work does **not** include:
-
-- the app merely being open or focused,
-- idle viewing or reading states,
-- paused, completed, failed, or cancelled work,
-- states waiting indefinitely for new user input before further execution, or
-- generic background presence without a currently running task.
-
-## Product Behavior Rule
-
-- When active work starts, the product may request a wake lock only if the platform can do so **without intentionally blocking screen lock or display sleep**.
-- When active work ends, pauses, fails, is cancelled, or no longer needs protection, the product must release the wake lock promptly.
-- The product intent is consistent across platforms, but implementation is **best-effort by platform capability**, not strict-identical by mechanism.
-
-## Fallback Policy
-
-- If a platform can provide **system-sleep-only** protection, the product should use it.
-- If a platform can only provide a **display/screen wake** lock that keeps the screen awake, the product must **not** use that mode as a fallback for this feature.
-- In unsupported or partially supported environments, the product should fall back to **no wake lock** rather than preserving the old display-wake behavior.
-- Unsupported behavior must be treated as a documented platform limitation, not as a product failure.
-
-## Platform Expectations
-
-- **Electron:** In scope to use a system-sleep-only mode if available.
-- **Tauri:** In scope to use a system-sleep-only mode if available through the chosen Tauri/native path.
-- **Web:** Default expectation is unsupported or partially supported for this exact behavior unless a browser/runtime exposes a true system-sleep-only primitive. A screen wake lock that keeps the display awake is not an acceptable substitute.
-
-## Non-Goals
-
-- Keeping the display continuously awake during long-running work.
-- Preserving current display-wake behavior on platforms where that is the only available wake-lock mode.
-- Inventing platform-specific user settings to choose between display wake and system-sleep-only behavior as part of this SCR.
-
-# Acceptance Criteria
-
-- AC-1: The specification defines **active work** in user-observable product terms, including the states that do and do not qualify for wake-lock protection.
-- AC-2: The specification defines a single cross-platform product rule: qualifying active work should protect against system sleep where possible, while screen lock and display sleep remain allowed.
-- AC-3: The specification defines the fallback policy for unsupported platforms: if system-sleep-only protection is unavailable, the product must not substitute display/screen wake behavior and must instead degrade to no wake lock.
-- AC-4: Platform expectations are documented for Electron, Tauri, and web, including the explicit expectation that web is best-effort and may remain unsupported for this exact behavior.
-- AC-5: The specification defines wake-lock release expectations so protection ends promptly when qualifying active work is no longer running.
-- AC-6: Any implementation derived from this SCR must document user-visible limitations for unsupported platforms in the appropriate product-facing documentation if final technical validation confirms those limitations.
-
-# Implementation Notes For Follow-On Technical Assessment
-
-- Electron and Tauri feasibility still requires technical validation of the exact API mode, lifecycle reliability, and background-execution behavior.
-- Web feasibility still requires confirmation of browser/runtime support, permission constraints, visibility restrictions, and whether any supported runtime offers a true system-sleep-only primitive.
-- If technical validation shows a desktop platform cannot provide system-sleep-only behavior safely, implementation should follow the fallback policy above rather than retaining display-wake behavior.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codenomad-workspace",
-  "version": "0.14.0",
+  "version": "0.13.1",
   "private": true,
   "description": "CodeNomad monorepo workspace",
   "license": "MIT",
@@ -22,7 +22,7 @@
     "build:mac-x64": "npm run build:mac-x64 --workspace @neuralnomads/codenomad-electron-app",
     "build:binaries": "npm run build:binaries --workspace @neuralnomads/codenomad-electron-app",
     "typecheck": "npm run typecheck --workspace @codenomad/ui && npm run typecheck --workspace @neuralnomads/codenomad-electron-app",
-    "bumpVersion": "node ./scripts/bump-version.js"
+    "bumpVersion": "npm version --workspaces --include-workspace-root --no-git-tag-version"
   },
   "dependencies": {
     "7zip-bin": "^5.2.0",
@@ -30,13 +30,5 @@
   },
   "devDependencies": {
     "baseline-browser-mapping": "^2.9.11"
-  },
-  "optionalDependencies": {
-    "@rollup/rollup-darwin-arm64": "4.52.5",
-    "@rollup/rollup-darwin-x64": "4.52.5",
-    "@rollup/rollup-linux-arm64-gnu": "4.52.5",
-    "@rollup/rollup-linux-x64-gnu": "4.52.5",
-    "@rollup/rollup-win32-arm64-msvc": "4.52.5",
-    "@rollup/rollup-win32-x64-msvc": "4.52.5"
   }
 }

packages/cloudflare/release-config.json

@@ -1,4 +1,4 @@
 {
-  "minServerVersion": "0.14.0",
+  "minServerVersion": "0.13.1",
   "latestServerUrl": "https://github.com/NeuralNomadsAI/CodeNomad/releases/latest"
 }

packages/cloudflare/src/index.ts

@@ -4,23 +4,6 @@ export interface Env {
 
 export default {
   async fetch(request: Request, env: Env): Promise<Response> {
-    const url = new URL(request.url)
-
-    if (url.pathname === "/version.json") {
-      const response = await env.ASSETS.fetch(request)
-
-      const newHeaders = new Headers(response.headers)
-      newHeaders.set("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate")
-      newHeaders.set("Pragma", "no-cache")
-      newHeaders.set("Expires", "0")
-
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: newHeaders,
-      })
-    }
-
     return env.ASSETS.fetch(request)
   },
 }

packages/electron-app/.gitignore

@@ -2,4 +2,3 @@ node_modules/
 dist/
 release/
 .vite/
-electron/resources/server/

packages/electron-app/electron/main/ipc.ts

@@ -1,6 +1,5 @@
 import { BrowserWindow, Notification, dialog, ipcMain, powerSaveBlocker, type OpenDialogOptions } from "electron"
 import fs from "fs"
-import { requestMicrophoneAccess } from "./permissions"
 import type { CliProcessManager, CliStatus } from "./process-manager"
 
 let wakeLockId: number | null = null
@@ -92,7 +91,7 @@ export function setupCliIPC(mainWindow: BrowserWindow, cliManager: CliProcessMan
         return { enabled: true }
       }
       try {
-        wakeLockId = powerSaveBlocker.start("prevent-app-suspension")
+        wakeLockId = powerSaveBlocker.start("prevent-display-sleep")
       } catch {
         wakeLockId = null
         return { enabled: false }
@@ -112,33 +111,6 @@ export function setupCliIPC(mainWindow: BrowserWindow, cliManager: CliProcessMan
     return { enabled: false }
   })
 
-  ipcMain.handle(
-    "media:requestMicrophoneAccess",
-    async (): Promise<{ granted: boolean }> => ({ granted: await requestMicrophoneAccess() }),
-  )
-
-  ipcMain.handle(
-    "remote:openWindow",
-    async (
-      _event,
-      payload: { id: string; name: string; baseUrl: string; skipTlsVerify: boolean },
-    ): Promise<{ ok: boolean }> => {
-      const opener = (mainWindow as BrowserWindow & {
-        __codenomadOpenRemoteWindow?: (payload: {
-          id: string
-          name: string
-          baseUrl: string
-          skipTlsVerify: boolean
-        }) => Promise<void>
-      }).__codenomadOpenRemoteWindow
-      if (!opener) {
-        throw new Error("Remote window opening is not available")
-      }
-      await opener(payload)
-      return { ok: true }
-    },
-  )
-
   ipcMain.handle(
     "notifications:show",
     async (_event, payload: { title?: unknown; body?: unknown }): Promise<{ ok: boolean; reason?: string }> => {

packages/electron-app/electron/main/main.ts

@@ -1,12 +1,11 @@
 import { app, BrowserView, BrowserWindow, nativeImage, session, shell } from "electron"
 import http from "node:http"
 import https from "node:https"
-import { existsSync, mkdirSync } from "fs"
+import { existsSync } from "fs"
 import { dirname, join } from "path"
 import { fileURLToPath } from "url"
 import { createApplicationMenu } from "./menu"
 import { setupCliIPC } from "./ipc"
-import { configureMediaPermissionHandlers } from "./permissions"
 import { CliProcessManager } from "./process-manager"
 
 const mainFilename = fileURLToPath(import.meta.url)
@@ -14,31 +13,6 @@ const mainDirname = dirname(mainFilename)
 
 const isMac = process.platform === "darwin"
 
-function configureDevStoragePaths() {
-  if (app.isPackaged) {
-    return
-  }
-
-  const appName = "CodeNomad"
-
-  try {
-    app.setName(appName)
-
-    const userDataPath = join(app.getPath("appData"), appName)
-    const sessionDataPath = join(userDataPath, "session-data")
-
-    mkdirSync(userDataPath, { recursive: true })
-    mkdirSync(sessionDataPath, { recursive: true })
-
-    app.setPath("userData", userDataPath)
-    app.setPath("sessionData", sessionDataPath)
-  } catch (error) {
-    console.warn("[cli] failed to configure dev storage paths", error)
-  }
-}
-
-configureDevStoragePaths()
-
 const cliManager = new CliProcessManager()
 let mainWindow: BrowserWindow | null = null
 let currentCliUrl: string | null = null
@@ -46,8 +20,6 @@ let pendingCliUrl: string | null = null
 let pendingBootstrapToken: string | null = null
 let showingLoadingScreen = false
 let preloadingView: BrowserView | null = null
-const remoteWindowOrigins = new Map<number, Set<string>>()
-const insecureWindowOrigins = new Map<number, Set<string>>()
 
 if (isMac) {
   app.commandLine.appendSwitch("disable-spell-checking")
@@ -118,17 +90,10 @@ function loadLoadingScreen(window: BrowserWindow) {
   loader.catch((error) => {
     console.error("[cli] failed to load loading screen:", error)
   })
-
-  return loader
 }
 
-function getAllowedRendererOrigins(window?: BrowserWindow | null): string[] {
+function getAllowedRendererOrigins(): string[] {
   const origins = new Set<string>()
-  if (window) {
-    for (const origin of remoteWindowOrigins.get(window.id) ?? []) {
-      origins.add(origin)
-    }
-  }
   const rendererCandidates = [currentCliUrl, process.env.VITE_DEV_SERVER_URL, process.env.ELECTRON_RENDERER_URL]
   for (const candidate of rendererCandidates) {
     if (!candidate) {
@@ -143,13 +108,13 @@ function getAllowedRendererOrigins(window?: BrowserWindow | null): string[] {
   return Array.from(origins)
 }
 
-function shouldOpenExternally(url: string, window?: BrowserWindow | null): boolean {
+function shouldOpenExternally(url: string): boolean {
   try {
     const parsed = new URL(url)
     if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
       return true
     }
-    const allowedOrigins = getAllowedRendererOrigins(window)
+    const allowedOrigins = getAllowedRendererOrigins()
     return !allowedOrigins.includes(parsed.origin)
   } catch {
     return false
@@ -162,7 +127,7 @@ function setupNavigationGuards(window: BrowserWindow) {
   }
 
   window.webContents.setWindowOpenHandler(({ url }) => {
-    if (shouldOpenExternally(url, window)) {
+    if (shouldOpenExternally(url)) {
       handleExternal(url)
       return { action: "deny" }
     }
@@ -170,54 +135,13 @@ function setupNavigationGuards(window: BrowserWindow) {
   })
 
   window.webContents.on("will-navigate", (event, url) => {
-    if (shouldOpenExternally(url, window)) {
+    if (shouldOpenExternally(url)) {
       event.preventDefault()
       handleExternal(url)
     }
   })
 }
 
-function setWindowAllowedOrigin(window: BrowserWindow, url: string) {
-  try {
-    const origin = new URL(url).origin
-    remoteWindowOrigins.set(window.id, new Set([origin]))
-  } catch (error) {
-    console.warn("[cli] failed to store allowed origin", url, error)
-  }
-}
-
-function clearWindowAllowedOrigin(window: BrowserWindow) {
-  remoteWindowOrigins.delete(window.id)
-}
-
-function addWindowInsecureOrigin(window: BrowserWindow, url: string) {
-  try {
-    const origin = new URL(url).origin
-    insecureWindowOrigins.set(window.id, new Set([origin]))
-  } catch (error) {
-    console.warn("[cli] failed to store insecure origin", url, error)
-  }
-}
-
-function clearWindowInsecureOrigin(window: BrowserWindow) {
-  insecureWindowOrigins.delete(window.id)
-}
-
-function isInsecureOriginAllowed(url: string) {
-  try {
-    const targetOrigin = new URL(url).origin
-    for (const origins of insecureWindowOrigins.values()) {
-      if (origins.has(targetOrigin)) {
-        return true
-      }
-    }
-  } catch {
-    return false
-  }
-
-  return false
-}
-
 let cachedPreloadPath: string | null = null
 function getPreloadPath() {
   if (cachedPreloadPath && existsSync(cachedPreloadPath)) {
@@ -279,41 +203,39 @@ function createWindow() {
       contextIsolation: true,
       nodeIntegration: false,
       spellcheck: !isMac,
-      additionalArguments: ["--codenomad-window-context=local"],
     },
   })
 
-  const window = mainWindow
-
-  setupNavigationGuards(window)
+  setupNavigationGuards(mainWindow)
 
   if (isMac) {
-    window.webContents.session.setSpellCheckerEnabled(false)
+    mainWindow.webContents.session.setSpellCheckerEnabled(false)
   }
 
   showingLoadingScreen = true
   currentCliUrl = null
-  clearWindowAllowedOrigin(window)
-  const loadingReady = loadLoadingScreen(window)
+  loadLoadingScreen(mainWindow)
 
   if (process.env.NODE_ENV === "development") {
-    window.webContents.openDevTools({ mode: "detach" })
+    mainWindow.webContents.openDevTools({ mode: "detach" })
   }
 
-  createApplicationMenu(window)
-  setupCliIPC(window, cliManager)
+  createApplicationMenu(mainWindow)
+  setupCliIPC(mainWindow, cliManager)
 
-  window.on("closed", () => {
+  mainWindow.on("closed", () => {
     destroyPreloadingView()
-    clearWindowAllowedOrigin(window)
-    clearWindowInsecureOrigin(window)
     mainWindow = null
     currentCliUrl = null
     pendingCliUrl = null
     showingLoadingScreen = false
   })
 
-  return loadingReady
+  if (pendingCliUrl) {
+    const url = pendingCliUrl
+    pendingCliUrl = null
+    startCliPreload(url)
+  }
 }
 
 function showLoadingScreen(force = false) {
@@ -399,67 +321,10 @@ function finalizeCliSwap(url: string) {
     return
   }
 
-  const window = mainWindow
   showingLoadingScreen = false
   currentCliUrl = url
-  setWindowAllowedOrigin(window, url)
   pendingCliUrl = null
-  window.loadURL(url).catch((error) => console.error("[cli] failed to load CLI view:", error))
-}
-
-function buildRemoteWindowTitle(name: string, baseUrl: string) {
-  try {
-    const parsed = new URL(baseUrl)
-    return `${name} - ${parsed.host}`
-  } catch {
-    return `${name} - ${baseUrl}`
-  }
-}
-
-function buildRemoteErrorHtml(name: string, baseUrl: string, message: string) {
-  const escapedName = name.replace(/[&<>"]/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[char] ?? char))
-  const escapedUrl = baseUrl.replace(/[&<>"]/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[char] ?? char))
-  const escapedMessage = message.replace(/[&<>"]/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[char] ?? char))
-  return `<!doctype html><html><head><meta charset="utf-8" /><title>${escapedName}</title><style>body{margin:0;background:#111827;color:#f9fafb;font-family:Inter,system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;padding:24px}main{max-width:560px;width:100%;background:rgba(17,24,39,.88);border:1px solid rgba(255,255,255,.08);border-radius:20px;padding:28px;box-shadow:0 25px 60px rgba(0,0,0,.45)}h1{margin:0 0 10px;font-size:1.5rem}p{margin:0 0 10px;color:#cbd5e1;line-height:1.5}code{display:block;margin-top:16px;padding:12px 14px;border-radius:12px;background:#0f172a;color:#bfdbfe;overflow:auto}</style></head><body><main><h1>${escapedName}</h1><p>Could not connect to the remote server.</p><p>${escapedMessage}</p><code>${escapedUrl}</code></main></body></html>`
-}
-
-async function openRemoteWindow(payload: { id: string; name: string; baseUrl: string; skipTlsVerify: boolean }) {
-  const targetUrl = new URL(payload.baseUrl)
-  const title = buildRemoteWindowTitle(payload.name, payload.baseUrl)
-  const window = new BrowserWindow({
-    width: 1400,
-    height: 900,
-    minWidth: 800,
-    minHeight: 600,
-    backgroundColor: "#1a1a1a",
-    icon: getIconPath(),
-    title,
-    webPreferences: {
-      preload: getPreloadPath(),
-      contextIsolation: true,
-      nodeIntegration: false,
-      spellcheck: !isMac,
-      additionalArguments: ["--codenomad-window-context=remote"],
-    },
-  })
-
-  setWindowAllowedOrigin(window, targetUrl.toString())
-  if (payload.skipTlsVerify) {
-    addWindowInsecureOrigin(window, targetUrl.toString())
-  }
-
-  setupNavigationGuards(window)
-  window.on("closed", () => {
-    clearWindowAllowedOrigin(window)
-    clearWindowInsecureOrigin(window)
-  })
-
-  try {
-    await window.loadURL(targetUrl.toString())
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error)
-    await window.loadURL(`data:text/html;charset=utf-8,${encodeURIComponent(buildRemoteErrorHtml(payload.name, payload.baseUrl, message))}`)
-  }
+  mainWindow.loadURL(url).catch((error) => console.error("[cli] failed to load CLI view:", error))
 }
 
 let bootstrapExchangeInFlight = false
@@ -620,12 +485,10 @@ app.whenReady().then(() => {
     // ignore
   }
 
-  const loadingReady = createWindow()
-  ;(mainWindow as BrowserWindow & { __codenomadOpenRemoteWindow?: typeof openRemoteWindow }).__codenomadOpenRemoteWindow = openRemoteWindow
+  startCli()
 
   if (isMac) {
     session.defaultSession.setSpellCheckerEnabled(false)
-    configureMediaPermissionHandlers(getAllowedRendererOrigins)
     app.on("browser-window-created", (_, window) => {
       window.webContents.session.setSpellCheckerEnabled(false)
     })
@@ -638,21 +501,7 @@ app.whenReady().then(() => {
     }
   }
 
-  void loadingReady.finally(() => {
-    setTimeout(() => {
-      void startCli()
-    }, 0)
-  })
-
-  app.on("certificate-error", (event, _webContents, url, error, _certificate, callback) => {
-    if (isInsecureOriginAllowed(url)) {
-      event.preventDefault()
-      console.warn("[cli] allowing insecure remote certificate for", url, error)
-      callback(true)
-      return
-    }
-    callback(false)
-  })
+  createWindow()
 
   app.on("activate", () => {
     if (BrowserWindow.getAllWindows().length === 0) {

packages/electron-app/electron/main/permissions.ts

@@ -1,58 +0,0 @@
-import { session, systemPreferences } from "electron"
-
-const isMac = process.platform === "darwin"
-
-export function isAllowedRendererOrigin(origin: string | undefined | null, allowedOrigins: string[]): boolean {
-  if (!origin) {
-    return false
-  }
-
-  try {
-    const normalized = new URL(origin).origin
-    return allowedOrigins.includes(normalized)
-  } catch {
-    return false
-  }
-}
-
-export function configureMediaPermissionHandlers(getAllowedOrigins: () => string[]) {
-  const isAudioMediaRequest = (permission: string, details?: unknown) => {
-    if (permission !== "media") {
-      return false
-    }
-
-    const mediaTypes = (details as { mediaTypes?: string[] } | undefined)?.mediaTypes ?? []
-    return mediaTypes.length === 0 || mediaTypes.includes("audio")
-  }
-
-  session.defaultSession.setPermissionCheckHandler((_webContents, permission, requestingOrigin, details) => {
-    if (!isAudioMediaRequest(permission, details)) {
-      return false
-    }
-
-    return isAllowedRendererOrigin(requestingOrigin, getAllowedOrigins())
-  })
-
-  session.defaultSession.setPermissionRequestHandler((webContents, permission, callback, details) => {
-    if (!isAudioMediaRequest(permission, details)) {
-      callback(false)
-      return
-    }
-
-    const requestingOrigin = (details as { requestingOrigin?: string } | undefined)?.requestingOrigin || webContents.getURL()
-    callback(isAllowedRendererOrigin(requestingOrigin, getAllowedOrigins()))
-  })
-}
-
-export async function requestMicrophoneAccess(): Promise<boolean> {
-  if (!isMac) {
-    return true
-  }
-
-  const status = systemPreferences.getMediaAccessStatus("microphone")
-  if (status === "granted") {
-    return true
-  }
-
-  return systemPreferences.askForMediaAccess("microphone")
-}

packages/electron-app/electron/main/process-manager.ts

@@ -1,17 +1,14 @@
 import { spawn, spawnSync, type ChildProcess } from "child_process"
-import { app, utilityProcess, type UtilityProcess } from "electron"
+import { app } from "electron"
 import { createRequire } from "module"
 import { EventEmitter } from "events"
 import { existsSync, readFileSync } from "fs"
 import os from "os"
 import path from "path"
-import { fileURLToPath } from "url"
 import { parse as parseYaml } from "yaml"
 import { buildUserShellCommand, getUserShellEnv, supportsUserShell } from "./user-shell"
 
 const nodeRequire = createRequire(import.meta.url)
-const mainFilename = fileURLToPath(import.meta.url)
-const mainDirname = path.dirname(mainFilename)
 
 const BOOTSTRAP_TOKEN_PREFIX = "CODENOMAD_BOOTSTRAP_TOKEN:"
 const SESSION_COOKIE_NAME_PREFIX = "codenomad_session"
@@ -38,13 +35,10 @@ interface StartOptions {
 
 interface CliEntryResolution {
   entry: string
-  runner: "node" | "tsx" | "standalone"
+  runner: "node" | "tsx"
   runnerPath?: string
 }
 
-type ManagedChild = ChildProcess | UtilityProcess
-type ChildLaunchMode = "spawn" | "utility"
-
 const DEFAULT_CONFIG_PATH = "~/.config/codenomad/config.json"
 
 function isYamlPath(filePath: string): boolean {
@@ -124,8 +118,7 @@ export declare interface CliProcessManager {
 }
 
 export class CliProcessManager extends EventEmitter {
-  private child?: ManagedChild
-  private childLaunchMode: ChildLaunchMode = "spawn"
+  private child?: ChildProcess
   private status: CliStatus = { state: "stopped" }
   private stdoutBuffer = ""
   private stderrBuffer = ""
@@ -145,68 +138,33 @@ export class CliProcessManager extends EventEmitter {
     this.requestedStop = false
     this.updateStatus({ state: "starting", port: undefined, pid: undefined, url: undefined, error: undefined })
 
+    const cliEntry = this.resolveCliEntry(options)
     const listeningMode = this.resolveListeningMode()
     const host = resolveHostForMode(listeningMode)
     const args = this.buildCliArgs(options, host)
-    const cliEntry = this.resolveCliEntry(options)
 
-    let child: ManagedChild
+    console.info(
+      `[cli] launching CodeNomad CLI (${options.dev ? "dev" : "prod"}) using ${cliEntry.runner} at ${cliEntry.entry} (host=${host})`,
+    )
 
-    if (this.shouldUsePackagedShellSupervisor(options, cliEntry)) {
-      const supervisorPath = this.resolveCliSupervisorPath()
-      const shellEnv = supportsUserShell() ? getUserShellEnv() : { ...process.env }
-      const shellTarget = cliEntry.runner === "standalone" ? this.buildExecutableCommand(cliEntry.entry, args) : this.buildCommand(cliEntry, args)
-      const shellCommand = buildUserShellCommand(`exec ${shellTarget}`)
-      const supervisorPayload = JSON.stringify({
-        command: shellCommand.command,
-        args: shellCommand.args,
-        cwd: process.cwd(),
-      })
+    const env = supportsUserShell() ? getUserShellEnv() : { ...process.env }
+    env.ELECTRON_RUN_AS_NODE = "1"
 
-      console.info(
-        `[cli] launching CodeNomad CLI (${options.dev ? "dev" : "prod"}) via utility supervisor using ${cliEntry.runner} at ${cliEntry.entry} (host=${host})`,
-      )
-      console.info(`[cli] utility supervisor: ${supervisorPath}`)
-      console.info(`[cli] shell command: ${shellCommand.command} ${shellCommand.args.join(" ")}`)
+    const spawnDetails = supportsUserShell()
+      ? buildUserShellCommand(`ELECTRON_RUN_AS_NODE=1 exec ${this.buildCommand(cliEntry, args)}`)
+      : this.buildDirectSpawn(cliEntry, args)
 
-      child = utilityProcess.fork(supervisorPath, [supervisorPayload], {
-        env: cliEntry.runner === "standalone" ? shellEnv : { ...shellEnv, ELECTRON_RUN_AS_NODE: "1" },
-        stdio: "pipe",
-        serviceName: "CodeNomad CLI Supervisor",
-      })
-      this.childLaunchMode = "utility"
-    } else {
-      console.info(
-        `[cli] launching CodeNomad CLI (${options.dev ? "dev" : "prod"}) using ${cliEntry.runner} at ${cliEntry.entry} (host=${host})`,
-      )
+    const detached = process.platform !== "win32"
+    const child = spawn(spawnDetails.command, spawnDetails.args, {
+      cwd: process.cwd(),
+      stdio: ["ignore", "pipe", "pipe"],
+      env,
+      shell: false,
+      detached,
+    })
 
-      const env = supportsUserShell() ? getUserShellEnv() : { ...process.env }
-      if (cliEntry.runner !== "standalone") {
-        env.ELECTRON_RUN_AS_NODE = "1"
-      }
-
-      const spawnDetails = supportsUserShell()
-        ? buildUserShellCommand(
-            `${cliEntry.runner === "standalone" ? "" : "ELECTRON_RUN_AS_NODE=1 "}exec ${
-              cliEntry.runner === "standalone" ? this.buildExecutableCommand(cliEntry.entry, args) : this.buildCommand(cliEntry, args)
-            }`,
-          )
-        : this.buildDirectSpawn(cliEntry, args)
-
-      const detached = process.platform !== "win32"
-      child = spawn(spawnDetails.command, spawnDetails.args, {
-        cwd: process.cwd(),
-        stdio: ["ignore", "pipe", "pipe"],
-        env,
-        shell: false,
-        detached,
-      })
-
-      console.info(`[cli] spawn command: ${spawnDetails.command} ${spawnDetails.args.join(" ")}`)
-      this.childLaunchMode = "spawn"
-    }
-
-    if (this.childLaunchMode === "spawn" && !child.pid) {
+    console.info(`[cli] spawn command: ${spawnDetails.command} ${spawnDetails.args.join(" ")}`)
+    if (!child.pid) {
       console.error("[cli] spawn failed: no pid")
     }
 
@@ -221,48 +179,23 @@ export class CliProcessManager extends EventEmitter {
       this.handleStream(data.toString(), "stderr")
     })
 
-    if (this.childLaunchMode === "utility") {
-      const utilityChild = child as UtilityProcess
+    child.on("error", (error) => {
+      console.error("[cli] failed to start CLI:", error)
+      this.updateStatus({ state: "error", error: error.message })
+      this.emit("error", error)
+    })
 
-      utilityChild.on("error", (error) => {
-        const message = this.describeUtilityProcessError(error)
-        console.error("[cli] utility supervisor failed:", error)
-        this.updateStatus({ state: "error", error: message })
-        this.emit("error", new Error(message))
-      })
-
-      utilityChild.on("exit", (code) => {
-        const failed = this.status.state !== "ready"
-        const error = failed ? this.status.error ?? `CLI exited with code ${code ?? 0}` : undefined
-        console.info(`[cli] exit (code=${code ?? ""})${error ? ` error=${error}` : ""}`)
-        this.updateStatus({ state: failed ? "error" : "stopped", error })
-        if (failed && error) {
-          this.emit("error", new Error(error))
-        }
-        this.emit("exit", this.status)
-        this.child = undefined
-      })
-    } else {
-      const spawnedChild = child as ChildProcess
-
-      spawnedChild.on("error", (error) => {
-        console.error("[cli] failed to start CLI:", error)
-        this.updateStatus({ state: "error", error: error.message })
-        this.emit("error", error)
-      })
-
-      spawnedChild.on("exit", (code, signal) => {
-        const failed = this.status.state !== "ready"
-        const error = failed ? this.status.error ?? `CLI exited with code ${code ?? 0}${signal ? ` (${signal})` : ""}` : undefined
-        console.info(`[cli] exit (code=${code}, signal=${signal || ""})${error ? ` error=${error}` : ""}`)
-        this.updateStatus({ state: failed ? "error" : "stopped", error })
-        if (failed && error) {
-          this.emit("error", new Error(error))
-        }
-        this.emit("exit", this.status)
-        this.child = undefined
-      })
-    }
+    child.on("exit", (code, signal) => {
+      const failed = this.status.state !== "ready"
+      const error = failed ? this.status.error ?? `CLI exited with code ${code ?? 0}${signal ? ` (${signal})` : ""}` : undefined
+      console.info(`[cli] exit (code=${code}, signal=${signal || ""})${error ? ` error=${error}` : ""}`)
+      this.updateStatus({ state: failed ? "error" : "stopped", error })
+      if (failed && error) {
+        this.emit("error", new Error(error))
+      }
+      this.emit("exit", this.status)
+      this.child = undefined
+    })
 
     return new Promise<CliStatus>((resolve, reject) => {
       const timeout = setTimeout(() => {
@@ -289,22 +222,16 @@ export class CliProcessManager extends EventEmitter {
       return
     }
 
-    if (this.childLaunchMode === "utility") {
-      return this.stopUtilityChild(child as UtilityProcess)
-    }
-
-    const spawnedChild = child as ChildProcess
-
     this.requestedStop = true
 
-    const pid = spawnedChild.pid
+    const pid = child.pid
     if (!pid) {
       this.child = undefined
       this.updateStatus({ state: "stopped" })
       return
     }
 
-    const isAlreadyExited = () => spawnedChild.exitCode !== null || spawnedChild.signalCode !== null
+    const isAlreadyExited = () => child.exitCode !== null || child.signalCode !== null
 
     const tryKillPosixGroup = (signal: NodeJS.Signals) => {
       try {
@@ -380,7 +307,7 @@ export class CliProcessManager extends EventEmitter {
         sendStopSignal("SIGKILL")
       }, 30000)
 
-      spawnedChild.on("exit", () => {
+      child.on("exit", () => {
         clearTimeout(killTimeout)
         this.child = undefined
         console.info("[cli] CLI process exited")
@@ -400,46 +327,6 @@ export class CliProcessManager extends EventEmitter {
     })
   }
 
-  private stopUtilityChild(child: UtilityProcess): Promise<void> {
-    this.requestedStop = true
-
-    const pid = child.pid
-    if (!pid) {
-      this.child = undefined
-      this.updateStatus({ state: "stopped" })
-      return Promise.resolve()
-    }
-
-    return new Promise((resolve) => {
-      const killTimeout = setTimeout(() => {
-        console.warn(`[cli] stop timed out after 30000ms; sending SIGKILL (pid=${pid})`)
-        try {
-          process.kill(pid, "SIGKILL")
-        } catch {
-          // no-op
-        }
-      }, 30000)
-
-      child.once("exit", () => {
-        clearTimeout(killTimeout)
-        this.child = undefined
-        console.info("[cli] CLI process exited")
-        this.updateStatus({ state: "stopped" })
-        resolve()
-      })
-
-      if (child.pid === undefined) {
-        clearTimeout(killTimeout)
-        this.child = undefined
-        this.updateStatus({ state: "stopped" })
-        resolve()
-        return
-      }
-
-      child.kill()
-    })
-  }
-
   getStatus(): CliStatus {
     return { ...this.status }
   }
@@ -455,22 +342,14 @@ export class CliProcessManager extends EventEmitter {
   private handleTimeout() {
     if (this.child) {
       const pid = this.child.pid
-      if (this.childLaunchMode === "utility") {
-        if (pid) {
-          try {
-            process.kill(pid, "SIGKILL")
-          } catch {
-            // no-op
-          }
-        }
-      } else if (pid && process.platform !== "win32") {
+      if (pid && process.platform !== "win32") {
         try {
           process.kill(-pid, "SIGKILL")
         } catch {
-          ;(this.child as ChildProcess).kill("SIGKILL")
+          this.child.kill("SIGKILL")
         }
       } else {
-        ;(this.child as ChildProcess).kill("SIGKILL")
+        this.child.kill("SIGKILL")
       }
       this.child = undefined
     }
@@ -544,7 +423,7 @@ export class CliProcessManager extends EventEmitter {
   }
 
   private buildCliArgs(options: StartOptions, host: string): string[] {
-    const args = ["serve", "--host", host, "--generate-token", "--auth-cookie-name", this.authCookieName, "--unrestricted-root"]
+    const args = ["serve", "--host", host, "--generate-token", "--auth-cookie-name", this.authCookieName]
 
     if (options.dev) {
       // Dev: run plain HTTP + Vite dev server proxy.
@@ -568,10 +447,6 @@ export class CliProcessManager extends EventEmitter {
   }
 
   private buildCommand(cliEntry: CliEntryResolution, args: string[]): string {
-    if (cliEntry.runner === "standalone") {
-      return this.buildExecutableCommand(cliEntry.entry, args)
-    }
-
     const parts = [JSON.stringify(process.execPath)]
     if (cliEntry.runner === "tsx" && cliEntry.runnerPath) {
       parts.push(JSON.stringify(cliEntry.runnerPath))
@@ -581,15 +456,7 @@ export class CliProcessManager extends EventEmitter {
     return parts.join(" ")
   }
 
-  private buildExecutableCommand(command: string, args: string[]): string {
-    return [JSON.stringify(command), ...args.map((arg) => JSON.stringify(arg))].join(" ")
-  }
-
   private buildDirectSpawn(cliEntry: CliEntryResolution, args: string[]) {
-    if (cliEntry.runner === "standalone") {
-      return { command: cliEntry.entry, args }
-    }
-
     if (cliEntry.runner === "tsx") {
       return { command: process.execPath, args: [cliEntry.runnerPath!, cliEntry.entry, ...args] }
     }
@@ -606,8 +473,9 @@ export class CliProcessManager extends EventEmitter {
       const devEntry = this.resolveDevEntry()
       return { entry: devEntry, runner: "tsx", runnerPath: tsxPath }
     }
-
-    return { entry: this.resolveStandaloneProdEntry(), runner: "standalone" }
+ 
+    const distEntry = this.resolveProdEntry()
+    return { entry: distEntry, runner: "node" }
   }
  
   private resolveTsx(): string | null {
@@ -647,54 +515,15 @@ export class CliProcessManager extends EventEmitter {
     return entry
   }
  
-  private resolveStandaloneProdEntry(): string {
-    const executableName = process.platform === "win32" ? "codenomad-server.exe" : "codenomad-server"
-    const candidates = [
-      path.join(process.resourcesPath, "server", "dist", executableName),
-      path.join(mainDirname, "../resources/server/dist", executableName),
-      path.resolve(process.cwd(), "..", "server", "dist", executableName),
-    ]
-
-    for (const candidate of candidates) {
-      if (existsSync(candidate)) {
-        return candidate
+  private resolveProdEntry(): string {
+    try {
+      const entry = nodeRequire.resolve("@neuralnomads/codenomad/dist/bin.js")
+      if (existsSync(entry)) {
+        return entry
       }
+    } catch {
+      // fall through to error below
     }
-
-    throw new Error(`Unable to locate standalone CodeNomad server executable (${executableName}). Run npm run build:standalone --workspace @neuralnomads/codenomad.`)
-  }
-
-  private shouldUsePackagedShellSupervisor(options: StartOptions, cliEntry: CliEntryResolution): boolean {
-    return !options.dev && app.isPackaged && process.platform === "darwin" && cliEntry.runner !== "standalone"
-  }
-
-  private resolveCliSupervisorPath(): string {
-    const candidates = [
-      path.join(process.resourcesPath, "cli-supervisor.cjs"),
-      path.join(mainDirname, "../resources/cli-supervisor.cjs"),
-    ]
-
-    for (const candidate of candidates) {
-      if (existsSync(candidate)) {
-        return candidate
-      }
-    }
-
-    throw new Error("Unable to locate CodeNomad CLI supervisor script.")
-  }
-
-  private describeUtilityProcessError(error: unknown): string {
-    if (error instanceof Error && error.message) {
-      return error.message
-    }
-
-    if (error && typeof error === "object") {
-      const typed = error as { type?: unknown; location?: unknown }
-      if (typeof typed.type === "string") {
-        return typeof typed.location === "string" ? `${typed.type} at ${typed.location}` : typed.type
-      }
-    }
-
-    return String(error)
+    throw new Error("Unable to locate CodeNomad CLI build (dist/bin.js). Run npm run build --workspace @neuralnomads/codenomad.")
   }
 }

packages/electron-app/electron/preload/index.cjs

@@ -1,19 +1,6 @@
 const { contextBridge, ipcRenderer, webUtils } = require("electron")
 
-function resolveWindowContext() {
-  const prefix = "--codenomad-window-context="
-  const arg = process.argv.find((value) => typeof value === "string" && value.startsWith(prefix))
-  const context = arg ? arg.slice(prefix.length) : "local"
-  return context === "remote" ? "remote" : "local"
-}
-
-function resolveRuntimeHost(windowContext) {
-  return "electron"
-}
-
-const windowContext = resolveWindowContext()
-
-const localElectronAPI = {
+const electronAPI = {
   onCliStatus: (callback) => {
     ipcRenderer.on("cli:status", (_, data) => callback(data))
     return () => ipcRenderer.removeAllListeners("cli:status")
@@ -33,21 +20,8 @@ const localElectronAPI = {
       return null
     }
   },
-  requestMicrophoneAccess: () => ipcRenderer.invoke("media:requestMicrophoneAccess"),
   setWakeLock: (enabled) => ipcRenderer.invoke("power:setWakeLock", Boolean(enabled)),
   showNotification: (payload) => ipcRenderer.invoke("notifications:show", payload),
-  openRemoteWindow: (payload) => ipcRenderer.invoke("remote:openWindow", payload),
 }
 
-const remoteElectronAPI = {
-  requestMicrophoneAccess: localElectronAPI.requestMicrophoneAccess,
-  setWakeLock: localElectronAPI.setWakeLock,
-  showNotification: localElectronAPI.showNotification,
-}
-
-contextBridge.exposeInMainWorld(
-  "electronAPI",
-  windowContext === "local" ? localElectronAPI : remoteElectronAPI,
-)
-contextBridge.exposeInMainWorld("__CODENOMAD_WINDOW_CONTEXT__", windowContext)
-contextBridge.exposeInMainWorld("__CODENOMAD_RUNTIME_HOST__", resolveRuntimeHost(windowContext))
+contextBridge.exposeInMainWorld("electronAPI", electronAPI)

packages/electron-app/electron/resources/cli-supervisor.cjs

@@ -1,131 +0,0 @@
-#!/usr/bin/env node
-
-const { spawn } = require("child_process")
-
-const SHUTDOWN_GRACE_MS = 30_000
-
-let child = null
-let shutdownTimer = null
-
-function log(message, error) {
-  if (error) {
-    console.error(`[cli-supervisor] ${message}`, error)
-    return
-  }
-  console.log(`[cli-supervisor] ${message}`)
-}
-
-function clearShutdownTimer() {
-  if (shutdownTimer) {
-    clearTimeout(shutdownTimer)
-    shutdownTimer = null
-  }
-}
-
-function forwardStream(stream, target) {
-  if (!stream) return
-  stream.on("data", (chunk) => {
-    target.write(chunk)
-  })
-}
-
-function terminateChild(force) {
-  if (!child || child.exitCode !== null || child.signalCode !== null) {
-    return
-  }
-
-  try {
-    child.kill(force ? "SIGKILL" : "SIGTERM")
-  } catch {
-    // no-op
-  }
-}
-
-function requestShutdown(force = false) {
-  if (!child) {
-    process.exit(force ? 1 : 0)
-    return
-  }
-
-  terminateChild(force)
-  if (force) {
-    process.exit(1)
-    return
-  }
-
-  clearShutdownTimer()
-  shutdownTimer = setTimeout(() => {
-    log(`shutdown timed out after ${SHUTDOWN_GRACE_MS}ms; forcing child termination`)
-    terminateChild(true)
-  }, SHUTDOWN_GRACE_MS)
-  shutdownTimer.unref()
-}
-
-function installShutdownHandlers() {
-  process.on("SIGTERM", () => requestShutdown(false))
-  process.on("SIGINT", () => requestShutdown(false))
-  process.on("disconnect", () => requestShutdown(false))
-  process.on("uncaughtException", (error) => {
-    log("uncaught exception", error)
-    requestShutdown(true)
-  })
-  process.on("unhandledRejection", (error) => {
-    log("unhandled rejection", error)
-    requestShutdown(true)
-  })
-}
-
-function parsePayload() {
-  const raw = process.argv[2]
-  if (!raw) {
-    throw new Error("Supervisor payload is required")
-  }
-
-  const parsed = JSON.parse(raw)
-  if (!parsed || typeof parsed !== "object") {
-    throw new Error("Supervisor payload must be an object")
-  }
-  if (typeof parsed.command !== "string" || parsed.command.trim().length === 0) {
-    throw new Error("Supervisor payload command is required")
-  }
-  if (!Array.isArray(parsed.args) || !parsed.args.every((value) => typeof value === "string")) {
-    throw new Error("Supervisor payload args must be a string array")
-  }
-
-  return {
-    command: parsed.command,
-    args: parsed.args,
-    cwd: typeof parsed.cwd === "string" && parsed.cwd.trim().length > 0 ? parsed.cwd : process.cwd(),
-  }
-}
-
-function main() {
-  installShutdownHandlers()
-
-  const payload = parsePayload()
-  log(`launching shell command: ${payload.command} ${payload.args.join(" ")}`)
-
-  child = spawn(payload.command, payload.args, {
-    cwd: payload.cwd,
-    env: process.env,
-    shell: false,
-    stdio: ["ignore", "pipe", "pipe"],
-  })
-
-  forwardStream(child.stdout, process.stdout)
-  forwardStream(child.stderr, process.stderr)
-
-  child.on("error", (error) => {
-    log("failed to spawn shell command", error)
-    process.exit(1)
-  })
-
-  child.on("exit", (code, signal) => {
-    clearShutdownTimer()
-    log(`child exited code=${code ?? ""} signal=${signal ?? ""}`)
-    process.exitCode = typeof code === "number" ? code : signal ? 1 : 0
-    process.exit()
-  })
-}
-
-main()

packages/electron-app/electron/resources/entitlements.mac.plist

@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>com.apple.security.cs.allow-jit</key>
-  <true/>
-  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-  <true/>
-  <key>com.apple.security.cs.disable-library-validation</key>
-  <true/>
-  <key>com.apple.security.device.audio-input</key>
-  <true/>
-</dict>
-</plist>

packages/electron-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neuralnomads/codenomad-electron-app",
-  "version": "0.14.0",
+  "version": "0.13.1",
   "description": "CodeNomad - AI coding assistant",
   "license": "MIT",
   "author": {
@@ -20,8 +20,6 @@
     "dev:debug": "cross-env CLI_LOG_LEVEL=debug electron-vite dev",
     "dev:trace": "cross-env CLI_LOG_LEVEL=trace electron-vite dev",
     "dev:electron": "NODE_ENV=development ELECTRON_ENABLE_LOGGING=1 NODE_OPTIONS=\"--import tsx\" electron electron/main/main.ts",
-    "prepare:resources": "node scripts/prepare-resources.js",
-    "prebuild": "npm run prepare:resources",
     "build": "electron-vite build",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "preview": "electron-vite preview",
@@ -35,11 +33,8 @@
     "build:linux-arm64": "node scripts/build.js linux-arm64",
     "build:linux-rpm": "node scripts/build.js linux-rpm",
     "build:all": "node scripts/build.js all",
-    "prepackage:mac": "npm run prepare:resources",
     "package:mac": "electron-builder --mac",
-    "prepackage:win": "npm run prepare:resources",
     "package:win": "electron-builder --win",
-    "prepackage:linux": "npm run prepare:resources",
     "package:linux": "electron-builder --linux"
   },
   "dependencies": {
@@ -62,7 +57,7 @@
     "vite-plugin-solid": "^2.10.0"
   },
   "build": {
-    "appId": "ai.neuralnomads.codenomad.client",
+    "appId": "ai.opencode.client",
     "productName": "CodeNomad",
     "directories": {
       "output": "release",
@@ -87,12 +82,6 @@
       }
     ],
     "mac": {
-      "entitlements": "electron/resources/entitlements.mac.plist",
-      "entitlementsInherit": "electron/resources/entitlements.mac.plist",
-      "extendInfo": {
-        "NSMicrophoneUsageDescription": "CodeNomad needs microphone access for speech-to-text prompt input.",
-        "NSLocalNetworkUsageDescription": "CodeNomad needs local network access to connect to locally hosted AI and speech services."
-      },
       "category": "public.app-category.developer-tools",
       "target": [
         {
@@ -147,13 +136,6 @@
             "x64",
             "arm64"
           ]
-        },
-        {
-          "target": "AppImage",
-          "arch": [
-            "x64",
-            "arm64"
-          ]
         }
       ],
       "artifactName": "CodeNomad-${version}-${os}-${arch}.${ext}",

packages/electron-app/scripts/build.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { spawn } from "child_process"
-import { existsSync, readFileSync } from "fs"
+import { existsSync } from "fs"
 import path, { join } from "path"
 import { fileURLToPath } from "url"
 
@@ -14,46 +14,6 @@ const npxCmd = process.platform === "win32" ? "npx.cmd" : "npx"
 const nodeModulesPath = join(appDir, "node_modules")
 const workspaceNodeModulesPath = join(workspaceRoot, "node_modules")
 
-function getPlatformEsbuildPackage() {
-  const platformKey = `${process.platform}-${process.arch}`
-  const platformPackages = {
-    "linux-x64": "@esbuild/linux-x64",
-    "linux-arm64": "@esbuild/linux-arm64",
-    "darwin-arm64": "@esbuild/darwin-arm64",
-    "darwin-x64": "@esbuild/darwin-x64",
-    "win32-arm64": "@esbuild/win32-arm64",
-    "win32-x64": "@esbuild/win32-x64",
-  }
-
-  return platformPackages[platformKey] ?? null
-}
-
-async function ensureEsbuildPlatformBinary() {
-  const pkgName = getPlatformEsbuildPackage()
-  if (!pkgName) {
-    return
-  }
-
-  const platformPackagePath = join(workspaceNodeModulesPath, ...pkgName.split("/"))
-  if (existsSync(platformPackagePath)) {
-    return
-  }
-
-  let esbuildVersion = ""
-  try {
-    esbuildVersion = JSON.parse(readFileSync(join(workspaceNodeModulesPath, "esbuild", "package.json"), "utf-8")).version ?? ""
-  } catch {
-    // leave version empty; fallback install will use latest compatible
-  }
-
-  const packageSpec = esbuildVersion ? `${pkgName}@${esbuildVersion}` : pkgName
-  console.log("📦 Step 0/3: Restoring esbuild platform binary...\n")
-  await run(npmCmd, ["install", packageSpec, "--no-save", "--ignore-scripts", "--fund=false", "--audit=false"], {
-    cwd: workspaceRoot,
-    env: { NODE_PATH: workspaceNodeModulesPath },
-  })
-}
-
 const platforms = {
   mac: {
     args: ["--mac", "--x64", "--arm64"],
@@ -145,20 +105,12 @@ async function build(platform) {
   console.log(`\n🔨 Building for: ${config.description}\n`)
 
   try {
-    await ensureEsbuildPlatformBinary()
-
     console.log("📦 Step 1/3: Building CLI dependency...\n")
     await run(npmCmd, ["run", "build", "--workspace", "@neuralnomads/codenomad"], {
       cwd: workspaceRoot,
       env: { NODE_PATH: workspaceNodeModulesPath },
     })
 
-    console.log("\n📦 Step 1.5/3: Preparing packaged server resources...\n")
-    await run(process.execPath, [join(appDir, "scripts", "prepare-resources.js")], {
-      cwd: workspaceRoot,
-      env: { NODE_PATH: workspaceNodeModulesPath },
-    })
-
     console.log("\n📦 Step 2/3: Building Electron app...\n")
     await run(npmCmd, ["run", "build"])
 

packages/electron-app/scripts/prepare-resources.js

@@ -1,208 +0,0 @@
-#!/usr/bin/env node
-
-import fs from "fs"
-import path, { join } from "path"
-import { spawnSync } from "child_process"
-import { fileURLToPath } from "url"
-
-const __dirname = fileURLToPath(new URL(".", import.meta.url))
-const appDir = join(__dirname, "..")
-const workspaceRoot = join(appDir, "..", "..")
-const serverRoot = join(appDir, "..", "server")
-const resourcesRoot = join(appDir, "electron", "resources")
-const serverDest = join(resourcesRoot, "server")
-const npmExecPath = process.env.npm_execpath
-const npmNodeExecPath = process.env.npm_node_execpath
-
-const serverSources = ["dist", "public", "node_modules", "package.json"]
-const serverDepsMarker = join(serverRoot, "node_modules", "fastify", "package.json")
-const standaloneMarker = join(serverRoot, "dist", process.platform === "win32" ? "codenomad-server.exe" : "codenomad-server")
-
-function log(message) {
-  console.log(`[prepare-resources] ${message}`)
-}
-
-function ensureServerBuild() {
-  const distPath = join(serverRoot, "dist")
-  const publicPath = join(serverRoot, "public")
-  if (!fs.existsSync(distPath) || !fs.existsSync(publicPath)) {
-    throw new Error("Server build artifacts are missing. Run the server build before packaging Electron.")
-  }
-}
-
-function ensureStandaloneServerBuild() {
-  log("building standalone server executable")
-  const result = spawnSync(
-    "npm",
-    ["run", "build:standalone", "--workspace", "@neuralnomads/codenomad"],
-    {
-      cwd: workspaceRoot,
-      stdio: "inherit",
-      env: {
-        ...process.env,
-        PATH: `${join(workspaceRoot, "node_modules", ".bin")}${path.delimiter}${process.env.PATH ?? ""}`,
-      },
-      shell: process.platform === "win32",
-    },
-  )
-
-  if (result.status !== 0) {
-    if (result.error) {
-      throw result.error
-    }
-    throw new Error(`standalone server build exited with code ${result.status ?? 1}`)
-  }
-
-  if (!fs.existsSync(standaloneMarker)) {
-    throw new Error(`Standalone server executable missing after build: ${standaloneMarker}`)
-  }
-}
-
-function ensureServerDependencies() {
-  if (fs.existsSync(serverDepsMarker)) {
-    return
-  }
-
-  log("installing production server dependencies")
-  const npmArgs = [
-    "install",
-    "--omit=dev",
-    "--ignore-scripts",
-    "--workspaces=false",
-    "--package-lock=false",
-    "--install-strategy=shallow",
-    "--fund=false",
-    "--audit=false",
-  ]
-
-  const env = {
-    ...process.env,
-    PATH: `${join(workspaceRoot, "node_modules", ".bin")}${path.delimiter}${process.env.PATH ?? ""}`,
-    npm_config_workspaces: "false",
-  }
-
-  const npmCli = npmExecPath && npmNodeExecPath ? [npmNodeExecPath, [npmExecPath, ...npmArgs]] : null
-  const result = npmCli
-    ? spawnSync(npmCli[0], npmCli[1], { cwd: serverRoot, stdio: "inherit", env })
-    : spawnSync("npm", npmArgs, { cwd: serverRoot, stdio: "inherit", env, shell: process.platform === "win32" })
-
-  if (result.status !== 0) {
-    if (result.error) {
-      throw result.error
-    }
-    throw new Error(`npm install exited with code ${result.status ?? 1}`)
-  }
-}
-
-function ensureEsbuildPlatformBinary() {
-  const platformKey = `${process.platform}-${process.arch}`
-  const platformPackages = {
-    "linux-x64": "@esbuild/linux-x64",
-    "linux-arm64": "@esbuild/linux-arm64",
-    "darwin-arm64": "@esbuild/darwin-arm64",
-    "darwin-x64": "@esbuild/darwin-x64",
-    "win32-arm64": "@esbuild/win32-arm64",
-    "win32-x64": "@esbuild/win32-x64",
-  }
-
-  const pkgName = platformPackages[platformKey]
-  if (!pkgName) {
-    return
-  }
-
-  const platformPackagePath = join(workspaceRoot, "node_modules", ...pkgName.split("/"))
-  if (fs.existsSync(platformPackagePath)) {
-    return
-  }
-
-  let esbuildVersion = ""
-  try {
-    esbuildVersion = JSON.parse(fs.readFileSync(join(workspaceRoot, "node_modules", "esbuild", "package.json"), "utf-8")).version ?? ""
-  } catch {
-    // leave version empty; fallback install will use latest compatible
-  }
-
-  const packageSpec = esbuildVersion ? `${pkgName}@${esbuildVersion}` : pkgName
-  log("installing esbuild platform binary (optional dep workaround)")
-
-  const result = spawnSync("npm", ["install", packageSpec, "--no-save", "--ignore-scripts", "--fund=false", "--audit=false"], {
-    cwd: workspaceRoot,
-    stdio: "inherit",
-    shell: process.platform === "win32",
-  })
-
-  if (result.status !== 0) {
-    if (result.error) {
-      throw result.error
-    }
-    throw new Error(`esbuild platform install exited with code ${result.status ?? 1}`)
-  }
-}
-
-function copyServerArtifacts() {
-  fs.rmSync(serverDest, { recursive: true, force: true })
-  fs.mkdirSync(serverDest, { recursive: true })
-
-  for (const name of serverSources) {
-    const from = join(serverRoot, name)
-    const to = join(serverDest, name)
-    if (!fs.existsSync(from)) {
-      throw new Error(`Missing required server artifact: ${from}`)
-    }
-    fs.cpSync(from, to, { recursive: true, dereference: true })
-    log(`copied ${name} to Electron resources`) 
-  }
-}
-
-function stripNodeModuleBins() {
-  const root = join(serverDest, "node_modules")
-  if (!fs.existsSync(root)) {
-    return
-  }
-
-  const stack = [root]
-  let removed = 0
-
-  while (stack.length > 0) {
-    const current = stack.pop()
-    if (!current) break
-
-    let entries
-    try {
-      entries = fs.readdirSync(current, { withFileTypes: true })
-    } catch {
-      continue
-    }
-
-    for (const entry of entries) {
-      const full = join(current, entry.name)
-      if (entry.name === ".bin") {
-        fs.rmSync(full, { recursive: true, force: true })
-        removed += 1
-        continue
-      }
-
-      if (entry.isDirectory()) {
-        stack.push(full)
-      }
-    }
-  }
-
-  if (removed > 0) {
-    log(`removed ${removed} node_modules/.bin directories`)
-  }
-}
-
-async function main() {
-  ensureServerBuild()
-  ensureStandaloneServerBuild()
-  ensureServerDependencies()
-  ensureEsbuildPlatformBinary()
-  copyServerArtifacts()
-  stripNodeModuleBins()
-}
-
-main().catch((error) => {
-  console.error("[prepare-resources] failed:", error)
-  process.exit(1)
-})

packages/electron-app/tsconfig.json

@@ -14,5 +14,5 @@
     "noEmit": true
   },
   "include": ["electron/**/*.ts", "electron.vite.config.ts"],
-  "exclude": ["node_modules", "dist", "electron/resources/server"]
+  "exclude": ["node_modules", "dist"]
 }

packages/opencode-config/package.json

@@ -4,6 +4,6 @@
   "private": true,
   "license": "MIT",
   "dependencies": {
-    "@opencode-ai/plugin": "1.14.19"
+    "@opencode-ai/plugin": "1.3.2"
   }
-}
+}

packages/opencode-config/plugin/codenomad.ts

@@ -2,8 +2,6 @@ import type { PluginInput } from "@opencode-ai/plugin"
 import { createCodeNomadClient, getCodeNomadConfig } from "./lib/client"
 import { createBackgroundProcessTools } from "./lib/background-process"
 
-let voiceModeEnabled = false
-
 export async function CodeNomadPlugin(input: PluginInput) {
   const config = getCodeNomadConfig()
   const client = createCodeNomadClient(config)
@@ -18,11 +16,6 @@ export async function CodeNomadPlugin(input: PluginInput) {
           pingTs: (event.properties as any)?.ts,
         },
       }).catch(() => {})
-      return
-    }
-
-    if (event.type === "codenomad.voiceMode") {
-      voiceModeEnabled = Boolean((event.properties as { enabled?: unknown } | undefined)?.enabled)
     }
   })
 
@@ -30,13 +23,6 @@ export async function CodeNomadPlugin(input: PluginInput) {
     tool: {
       ...backgroundProcessTools,
     },
-    async "chat.message"(_input: { sessionID: string }, output: { message: { system?: string } }) {
-      if (!voiceModeEnabled) {
-        return
-      }
-
-      output.message.system = [output.message.system, buildVoiceModePrompt()].filter(Boolean).join("\n\n")
-    },
     async event(input: { event: any }) {
       const opencodeEvent = input?.event
       if (!opencodeEvent || typeof opencodeEvent !== "object") return
@@ -44,19 +30,3 @@ export async function CodeNomadPlugin(input: PluginInput) {
     },
   }
 }
-
-function buildVoiceModePrompt(): string {
-  return [
-    "Voice conversation mode is enabled.",
-    "Prepend your reply with a fenced code block using language `spoken`.",
-    "The `spoken` block should be the natural conversational reply you would say out loud to the user. It should be a concise spoken gist of the full response in 2 to 4 natural sentences.",
-    "In the spoken block, summarize the main outcome, recommendation, or next step. Sound conversational and natural, not like a document summary.",
-    "Do not include code, bullet lists, markdown formatting, or long technical detail in the spoken block.",
-    "Do not add generic phrases about whether the user should read more.",
-    "Only mention additional written detail when there is something specific that may matter for the user's next response, such as a tradeoff, caveat, risk, open question, exact diff, or test result.",
-    "When referring to that written detail, say `below` or `in the message` rather than `detailed section`.",
-    "After the `spoken` block, continue with your normal detailed response.",
-    "Example:",
-    "```spoken\nI implemented the relay-based voice-mode flow and it works with the current plugin bridge. The reconnect caveat is explained below.\n```",
-  ].join("\n\n")
-}

packages/opencode-config/plugin/lib/background-process.ts

@@ -13,11 +13,6 @@ type BackgroundProcess = {
   outputSizeBytes?: number
 }
 
-type BackgroundProcessNotificationRequest = {
-  sessionID: string
-  directory: string
-}
-
 type BackgroundProcessOptions = {
   baseDir: string
 }
@@ -41,19 +36,12 @@ export function createBackgroundProcessTools(config: CodeNomadConfig, options: B
       args: {
         title: tool.schema.string().describe("Short label for the process (e.g. Dev server, DB server)"),
         command: tool.schema.string().describe("Shell command to run in the workspace"),
-        notify: tool.schema.boolean().optional().describe("Notify the current session when the process ends"),
       },
-      async execute(args, context) {
+      async execute(args) {
         assertCommandWithinBase(args.command, options.baseDir)
-        const notification: BackgroundProcessNotificationRequest | undefined = args.notify
-          ? {
-              sessionID: context.sessionID,
-              directory: context.directory,
-            }
-          : undefined
         const process = await request<BackgroundProcess>("", {
           method: "POST",
-          body: JSON.stringify({ title: args.title, command: args.command, notify: args.notify, notification }),
+          body: JSON.stringify({ title: args.title, command: args.command }),
         })
 
         return `Started background process ${process.id} (${process.title})\nStatus: ${process.status}\nCommand: ${process.command}`

packages/server/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@neuralnomads/codenomad",
-  "version": "0.14.0",
+  "version": "0.13.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@neuralnomads/codenomad",
-      "version": "0.14.0",
+      "version": "0.13.1",
       "dependencies": {
         "@fastify/cors": "^8.5.0",
         "@fastify/reply-from": "^9.8.0",

packages/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neuralnomads/codenomad",
-  "version": "0.14.0",
+  "version": "0.13.1",
   "description": "CodeNomad Server",
   "license": "MIT",
   "author": {
@@ -18,7 +18,6 @@
   },
   "scripts": {
     "build": "npm run build:ui && npm run prepare-ui && tsc -p tsconfig.json && node ./scripts/copy-auth-pages.mjs && npm run prepare-config",
-    "build:standalone": "node ./scripts/build-standalone.mjs",
     "build:ui": "npm run build --prefix ../ui",
     "prepare-ui": "node ./scripts/copy-ui-dist.mjs",
     "prepare-config": "node ./scripts/copy-opencode-config.mjs",
@@ -26,16 +25,16 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@fastify/cors": "^11.2.0",
-    "@fastify/reply-from": "^12.6.2",
-    "@fastify/static": "^9.1.1",
+    "@fastify/cors": "^8.5.0",
+    "@fastify/reply-from": "^9.8.0",
+    "@fastify/static": "^7.0.4",
     "commander": "^12.1.0",
-    "fastify": "^5.8.5",
+    "fastify": "^4.28.1",
     "fuzzysort": "^2.0.4",
     "node-forge": "^1.3.3",
     "openai": "^6.27.0",
     "pino": "^9.4.0",
-    "undici": "^8.1.0",
+    "undici": "^6.19.8",
     "yaml": "^2.4.2",
     "yauzl": "^2.10.0",
     "zod": "^3.23.8"
@@ -43,7 +42,6 @@
   "devDependencies": {
     "@types/node-forge": "^1.3.14",
     "@types/yauzl": "^2.10.0",
-    "bun": "^1.3.13",
     "cross-env": "^7.0.3",
     "ts-node": "^10.9.2",
     "tsx": "^4.20.6",

packages/server/scripts/build-standalone.mjs

@@ -1,99 +0,0 @@
-#!/usr/bin/env node
-import fs from "fs"
-import path from "path"
-import { spawnSync } from "child_process"
-import { fileURLToPath } from "url"
-
-const __filename = fileURLToPath(import.meta.url)
-const __dirname = path.dirname(__filename)
-const cliRoot = path.resolve(__dirname, "..")
-const distDir = path.join(cliRoot, "dist")
-const publicDir = path.join(cliRoot, "public")
-const authPagesSourceDir = path.join(distDir, "server", "routes", "auth-pages")
-const authPagesTargetDir = path.join(distDir, "auth-pages")
-const explicitTarget = process.env.CODENOMAD_STANDALONE_TARGET?.trim()
-const outputName = (explicitTarget?.includes("windows") || process.platform === "win32") ? "codenomad-server.exe" : "codenomad-server"
-const outputPath = path.join(distDir, outputName)
-const packageJsonPath = path.join(cliRoot, "package.json")
-
-function resolveBunCommand() {
-  const executableName = process.platform === "win32" ? "bun.exe" : "bun"
-  const localBinName = process.platform === "win32" ? "bun.cmd" : "bun"
-  const candidates = [
-    path.join(cliRoot, "node_modules", ".bin", localBinName),
-    path.join(cliRoot, "..", "..", "node_modules", ".bin", localBinName),
-    path.join(cliRoot, "node_modules", "bun", "bin", executableName),
-    path.join(cliRoot, "..", "..", "node_modules", "bun", "bin", executableName),
-  ]
-
-  for (const candidate of candidates) {
-    if (fs.existsSync(candidate)) {
-      return candidate
-    }
-  }
-
-  return "bun"
-}
-
-function fail(message) {
-  console.error(`[build-standalone] ${message}`)
-  process.exit(1)
-}
-
-function ensureArtifacts() {
-  const requiredPaths = [distDir, publicDir, authPagesSourceDir, packageJsonPath]
-  const missing = requiredPaths.filter((filePath) => !fs.existsSync(filePath))
-  if (missing.length > 0) {
-    fail(`Missing required build artifacts: ${missing.join(", ")}. Run npm run build first.`)
-  }
-
-  const bunResult = spawnSync(resolveBunCommand(), ["-v"], { cwd: cliRoot, encoding: "utf-8", shell: process.platform === "win32" })
-  if (bunResult.status !== 0) {
-    fail("Bun is required to build the standalone server executable. Install dependencies so the local Bun binary is available.")
-  }
-}
-
-function syncStandaloneAuthPages() {
-  fs.rmSync(authPagesTargetDir, { recursive: true, force: true })
-  fs.mkdirSync(path.dirname(authPagesTargetDir), { recursive: true })
-  fs.cpSync(authPagesSourceDir, authPagesTargetDir, { recursive: true })
-}
-
-function buildStandaloneExecutable() {
-  fs.rmSync(outputPath, { force: true })
-  const bunCommand = resolveBunCommand()
-
-  const args = ["build", "--compile"]
-  if (explicitTarget) {
-    args.push(`--target=${explicitTarget}`)
-  }
-  args.push(path.join(cliRoot, "src", "index.ts"), "--outfile", outputPath)
-
-  const result = spawnSync(bunCommand, args, {
-    cwd: cliRoot,
-    stdio: "inherit",
-    shell: process.platform === "win32",
-  })
-
-  if (result.status !== 0) {
-    if (result.error) {
-      throw result.error
-    }
-    throw new Error(`bun build --compile exited with code ${result.status ?? 1}`)
-  }
-}
-
-function main() {
-  ensureArtifacts()
-  syncStandaloneAuthPages()
-
-  buildStandaloneExecutable()
-  console.log(`[build-standalone] built ${outputPath}`)
-}
-
-try {
-  main()
-} catch (error) {
-  console.error("[build-standalone] failed:", error)
-  process.exit(1)
-}

packages/server/scripts/copy-opencode-config.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { spawnSync } from "child_process"
-import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from "fs"
+import { cpSync, existsSync, mkdirSync, rmSync } from "fs"
 import path from "path"
 import { fileURLToPath } from "url"
 
@@ -14,67 +14,6 @@ const selfLinkDir = path.resolve(nodeModulesDir, "@codenomad", "opencode-config"
 const npmExecPath = process.env.npm_execpath
 const npmNodeExecPath = process.env.npm_node_execpath
 
-function stripNodeModuleBins(rootDir) {
-  const root = path.join(rootDir, "node_modules")
-  if (!existsSync(root)) {
-    return 0
-  }
-
-  const stack = [root]
-  let removed = 0
-
-  while (stack.length > 0) {
-    const current = stack.pop()
-    if (!current) break
-
-    let entries
-    try {
-      entries = readdirSync(current, { withFileTypes: true })
-    } catch {
-      continue
-    }
-
-    for (const entry of entries) {
-      const full = path.join(current, entry.name)
-      if (entry.name === ".bin") {
-        rmSync(full, { recursive: true, force: true })
-        removed += 1
-        continue
-      }
-
-      if (entry.isDirectory()) {
-        stack.push(full)
-      }
-    }
-  }
-
-  return removed
-}
-
-function stripOptionalNativeAddons(rootDir) {
-  const nodeModulesRoot = path.join(rootDir, "node_modules")
-  if (!existsSync(nodeModulesRoot)) {
-    return 0
-  }
-
-  const removablePaths = [
-    path.join(nodeModulesRoot, "@msgpackr-extract"),
-    path.join(nodeModulesRoot, "msgpackr-extract"),
-  ]
-
-  let removed = 0
-  for (const targetPath of removablePaths) {
-    if (!existsSync(targetPath)) {
-      continue
-    }
-
-    rmSync(targetPath, { recursive: true, force: true })
-    removed += 1
-  }
-
-  return removed
-}
-
 if (!existsSync(sourceDir)) {
   console.error(`[copy-opencode-config] Missing source directory at ${sourceDir}`)
   process.exit(1)
@@ -119,14 +58,4 @@ rmSync(targetDir, { recursive: true, force: true })
 mkdirSync(path.dirname(targetDir), { recursive: true })
 cpSync(sourceDir, targetDir, { recursive: true })
 
-const removedBins = stripNodeModuleBins(targetDir)
-if (removedBins > 0) {
-  console.log(`[copy-opencode-config] Removed ${removedBins} node_modules/.bin directories`)
-}
-
-const removedNativeAddons = stripOptionalNativeAddons(targetDir)
-if (removedNativeAddons > 0) {
-  console.log(`[copy-opencode-config] Removed ${removedNativeAddons} optional native addon package paths`)
-}
-
 console.log(`[copy-opencode-config] Copied ${sourceDir} -> ${targetDir}`)

packages/server/src/api-types.ts

@@ -81,55 +81,6 @@ export interface WorktreeMap {
   parentSessionWorktreeSlug: Record<string, string>
 }
 
-export type GitChangeKind = "added" | "modified" | "deleted" | "renamed" | "copied" | "untracked" | "unmerged"
-
-export interface WorktreeGitStatusEntry {
-  path: string
-  originalPath?: string | null
-  stagedStatus: GitChangeKind | null
-  stagedAdditions: number
-  stagedDeletions: number
-  unstagedStatus: GitChangeKind | null
-  unstagedAdditions: number
-  unstagedDeletions: number
-}
-
-export type WorktreeGitStatusResponse = WorktreeGitStatusEntry[]
-
-export type WorktreeGitDiffScope = "staged" | "unstaged"
-
-export interface WorktreeGitPathsRequest {
-  paths: string[]
-}
-
-export interface WorktreeGitMutationResponse {
-  ok: true
-}
-
-export interface WorktreeGitCommitRequest {
-  message: string
-}
-
-export interface WorktreeGitCommitResponse {
-  ok: true
-  commitSha?: string
-}
-
-export interface WorktreeGitDiffResponse {
-  path: string
-  originalPath?: string | null
-  scope: WorktreeGitDiffScope
-  before: string
-  after: string
-  isBinary?: boolean
-}
-
-export interface WorktreeGitDiffRequest {
-  path: string
-  originalPath?: string | null
-  scope: WorktreeGitDiffScope
-}
-
 export type LogLevel = "debug" | "info" | "warn" | "error"
 
 export interface WorkspaceLogEntry {
@@ -219,24 +170,6 @@ export interface InstanceStreamEvent {
   [key: string]: unknown
 }
 
-export type SideCarKind = "port"
-
-export type SideCarPrefixMode = "strip" | "preserve"
-
-export type SideCarStatus = "running" | "stopped"
-
-export interface SideCar {
-  id: string
-  kind: SideCarKind
-  name: string
-  port: number
-  insecure: boolean
-  prefixMode: SideCarPrefixMode
-  status: SideCarStatus
-  createdAt: string
-  updatedAt: string
-}
-
 export interface BinaryRecord {
   id: string
   path: string
@@ -307,54 +240,12 @@ export interface SpeechSynthesisResponse {
   mimeType: string
 }
 
-export interface VoiceModeStateResponse {
-  enabled: boolean
-}
-
-export interface RemoteServerProfile {
-  id: string
-  name: string
-  baseUrl: string
-  skipTlsVerify: boolean
-  createdAt: string
-  updatedAt: string
-  lastConnectedAt?: string
-}
-
-export interface RemoteServerProbeRequest {
-  baseUrl: string
-  skipTlsVerify?: boolean
-}
-
-export interface RemoteServerProbeResponse {
-  ok: boolean
-  reachable: boolean
-  normalizedUrl: string
-  skipTlsVerify: boolean
-  requiresAuth: boolean
-  authenticated: boolean
-  error?: string
-  errorCode?: string
-}
-
-export interface RemoteProxySessionCreateRequest {
-  baseUrl: string
-  skipTlsVerify?: boolean
-}
-
-export interface RemoteProxySessionCreateResponse {
-  sessionId: string
-  windowUrl: string
-}
-
 export type WorkspaceEventType =
   | "workspace.created"
   | "workspace.started"
   | "workspace.error"
   | "workspace.stopped"
   | "workspace.log"
-  | "sidecar.updated"
-  | "sidecar.removed"
   | "storage.configChanged"
   | "storage.stateChanged"
   | "instance.dataChanged"
@@ -367,8 +258,6 @@ export type WorkspaceEventPayload =
   | { type: "workspace.error"; workspace: WorkspaceDescriptor }
   | { type: "workspace.stopped"; workspaceId: string }
   | { type: "workspace.log"; entry: WorkspaceLogEntry }
-  | { type: "sidecar.updated"; sidecar: SideCar }
-  | { type: "sidecar.removed"; sidecarId: string }
   | { type: "storage.configChanged"; owner: SettingsOwner; value: SettingsBucket }
   | { type: "storage.stateChanged"; owner: SettingsOwner; value: SettingsBucket }
   | { type: "instance.dataChanged"; instanceId: string; data: InstanceData }
@@ -435,8 +324,6 @@ export interface ServerMeta {
 
 export type BackgroundProcessStatus = "running" | "stopped" | "error"
 
-export type BackgroundProcessTerminalReason = "finished" | "failed" | "user_stopped" | "user_terminated"
-
 export interface BackgroundProcess {
   id: string
   workspaceId: string
@@ -449,8 +336,6 @@ export interface BackgroundProcess {
   stoppedAt?: string
   exitCode?: number
   outputSizeBytes?: number
-  terminalReason?: BackgroundProcessTerminalReason
-  notifyEnabled?: boolean
 }
 
 export interface BackgroundProcessListResponse {

packages/server/src/auth/manager.ts

@@ -104,18 +104,13 @@ export class AuthManager {
   }
 
   getSessionFromRequest(request: FastifyRequest): { username: string; sessionId: string } | null {
-    return this.getSessionFromHeaders(request.headers)
-  }
-
-  getSessionFromHeaders(headers: { cookie?: string | string[] | undefined }): { username: string; sessionId: string } | null {
     if (!this.authEnabled) {
       // When auth is disabled, treat all requests as authenticated.
       // We still return a stable username so callers can display it.
       return { username: this.init.username, sessionId: "auth-disabled" }
     }
 
-    const cookieHeader = Array.isArray(headers.cookie) ? headers.cookie.join("; ") : headers.cookie
-    const cookies = parseCookies(cookieHeader)
+    const cookies = parseCookies(request.headers.cookie)
     const sessionId = cookies[this.cookieName]
     const session = this.sessionManager.getSession(sessionId)
     if (!session) return null

packages/server/src/background-processes/manager.ts

@@ -5,7 +5,7 @@ import { randomBytes } from "crypto"
 import type { EventBus } from "../events/bus"
 import type { WorkspaceManager } from "../workspaces/manager"
 import type { Logger } from "../logger"
-import type { BackgroundProcess, BackgroundProcessStatus, BackgroundProcessTerminalReason } from "../api-types"
+import type { BackgroundProcess, BackgroundProcessStatus } from "../api-types"
 
 const ROOT_DIR = ".codenomad/background_processes"
 const INDEX_FILE = "index.json"
@@ -27,31 +27,6 @@ interface RunningProcess {
   outputPath: string
   exitPromise: Promise<void>
   workspaceId: string
-  completion?: ProcessCompletion
-}
-
-interface ProcessCompletion {
-  reason: BackgroundProcessTerminalReason
-  endContext: "normal" | "workspace_cleanup"
-  removeAfterFinalize?: boolean
-}
-
-interface BackgroundProcessNotificationState {
-  sessionID: string
-  directory: string
-  sentAt?: string
-}
-
-interface PersistedBackgroundProcess extends BackgroundProcess {
-  notify?: BackgroundProcessNotificationState
-}
-
-interface StartOptions {
-  notify?: boolean
-  notification?: {
-    sessionID: string
-    directory: string
-  }
 }
 
 export class BackgroundProcessManager {
@@ -66,14 +41,14 @@ export class BackgroundProcessManager {
     const records = await this.readIndex(workspaceId)
     const enriched = await Promise.all(
       records.map(async (record) => ({
-        ...this.toPublicProcess(record),
+        ...record,
         outputSizeBytes: await this.getOutputSize(workspaceId, record.id),
       })),
     )
     return enriched
   }
 
-  async start(workspaceId: string, title: string, command: string, options: StartOptions = {}): Promise<BackgroundProcess> {
+  async start(workspaceId: string, title: string, command: string): Promise<BackgroundProcess> {
     const workspace = this.deps.workspaceManager.get(workspaceId)
     if (!workspace) {
       throw new Error("Workspace not found")
@@ -98,7 +73,8 @@ export class BackgroundProcessManager {
       this.killProcessTree(child, "SIGTERM")
     })
 
-    const record: PersistedBackgroundProcess = {
+    const record: BackgroundProcess = {
+
       id,
       workspaceId,
       title,
@@ -108,20 +84,6 @@ export class BackgroundProcessManager {
       pid: child.pid,
       startedAt: new Date().toISOString(),
       outputSizeBytes: 0,
-      notify: options.notify && options.notification
-        ? {
-            sessionID: options.notification.sessionID,
-            directory: options.notification.directory,
-          }
-        : undefined,
-    }
-
-    const runningState: RunningProcess = {
-      id,
-      child,
-      outputPath,
-      exitPromise: Promise.resolve(),
-      workspaceId,
     }
 
     const exitPromise = new Promise<void>((resolve) => {
@@ -129,21 +91,18 @@ export class BackgroundProcessManager {
         await new Promise<void>((resolve) => outputStream.end(resolve))
         this.running.delete(id)
 
-        const completion = runningState.completion ?? this.completionFromExit(code)
-
-        record.terminalReason = completion.reason
-        record.status = this.statusFromReason(completion.reason)
+        record.status = this.statusFromExit(code)
         record.exitCode = code === null ? undefined : code
         record.stoppedAt = new Date().toISOString()
 
-        await this.finalizeRecord(workspaceId, record, completion)
+        await this.upsertIndex(workspaceId, record)
+        record.outputSizeBytes = await this.getOutputSize(workspaceId, record.id)
+        this.publishUpdate(workspaceId, record)
         resolve()
       })
     })
 
-    runningState.exitPromise = exitPromise
-
-    this.running.set(id, runningState)
+    this.running.set(id, { id, child, outputPath, exitPromise, workspaceId })
 
     let lastPublishAt = 0
     const maybePublishSize = () => {
@@ -169,7 +128,7 @@ export class BackgroundProcessManager {
     await this.upsertIndex(workspaceId, record)
     record.outputSizeBytes = await this.getOutputSize(workspaceId, record.id)
     this.publishUpdate(workspaceId, record)
-    return this.toPublicProcess(record)
+    return record
   }
 
   async stop(workspaceId: string, processId: string): Promise<BackgroundProcess | null> {
@@ -180,21 +139,19 @@ export class BackgroundProcessManager {
 
     const running = this.running.get(processId)
     if (running?.child && !running.child.killed) {
-      running.completion = { reason: "user_stopped", endContext: "normal" }
       this.killProcessTree(running.child, "SIGTERM")
       await this.waitForExit(running)
-      const updated = await this.findProcess(workspaceId, processId)
-      return updated ? this.toPublicProcess(updated) : this.toPublicProcess(record)
     }
 
     if (record.status === "running") {
       record.status = "stopped"
-      record.terminalReason = "user_stopped"
       record.stoppedAt = new Date().toISOString()
-      await this.finalizeRecord(workspaceId, record, { reason: "user_stopped", endContext: "normal" })
+      await this.upsertIndex(workspaceId, record)
+      record.outputSizeBytes = await this.getOutputSize(workspaceId, record.id)
+      this.publishUpdate(workspaceId, record)
     }
 
-    return this.toPublicProcess(record)
+    return record
   }
 
   async terminate(workspaceId: string, processId: string): Promise<void> {
@@ -203,19 +160,17 @@ export class BackgroundProcessManager {
 
     const running = this.running.get(processId)
     if (running?.child && !running.child.killed) {
-      running.completion = { reason: "user_terminated", endContext: "normal", removeAfterFinalize: true }
       this.killProcessTree(running.child, "SIGTERM")
       await this.waitForExit(running)
-      return
     }
 
-    record.status = "stopped"
-    record.terminalReason = "user_terminated"
-    record.stoppedAt = new Date().toISOString()
-    await this.finalizeRecord(workspaceId, record, {
-      reason: "user_terminated",
-      endContext: "normal",
-      removeAfterFinalize: true,
+    await this.removeFromIndex(workspaceId, processId)
+    await this.removeProcessDir(workspaceId, processId)
+
+    this.deps.eventBus.publish({
+      type: "instance.event",
+      instanceId: workspaceId,
+      event: { type: "background.process.removed", properties: { processId } },
     })
   }
 
@@ -311,11 +266,6 @@ export class BackgroundProcessManager {
   private async cleanupWorkspace(workspaceId: string) {
     for (const [, running] of this.running.entries()) {
       if (running.workspaceId !== workspaceId) continue
-      running.completion = {
-        reason: "user_terminated",
-        endContext: "workspace_cleanup",
-        removeAfterFinalize: true,
-      }
       this.killProcessTree(running.child, "SIGTERM")
       await this.waitForExit(running)
     }
@@ -406,17 +356,10 @@ export class BackgroundProcessManager {
     return args
   }
 
-  private completionFromExit(code: number | null): ProcessCompletion {
-    if (code === 0) {
-      return { reason: "finished", endContext: "normal" }
-    }
-
-    return { reason: "failed", endContext: "normal" }
-  }
-
-  private statusFromReason(reason: BackgroundProcessTerminalReason): BackgroundProcessStatus {
-    if (reason === "failed") return "error"
-    return "stopped"
+  private statusFromExit(code: number | null): BackgroundProcessStatus {
+    if (code === null) return "stopped"
+    if (code === 0) return "stopped"
+    return "error"
   }
 
   private async readOutputBytes(outputPath: string, sizeBytes: number, maxBytes?: number): Promise<string> {
@@ -480,25 +423,25 @@ export class BackgroundProcessManager {
     return path.join(workspace.path, ROOT_DIR, workspaceId, processId, OUTPUT_FILE)
   }
 
-  private async findProcess(workspaceId: string, processId: string): Promise<PersistedBackgroundProcess | null> {
+  private async findProcess(workspaceId: string, processId: string): Promise<BackgroundProcess | null> {
     const records = await this.readIndex(workspaceId)
     return records.find((entry) => entry.id === processId) ?? null
   }
 
-  private async readIndex(workspaceId: string): Promise<PersistedBackgroundProcess[]> {
+  private async readIndex(workspaceId: string): Promise<BackgroundProcess[]> {
     const indexPath = await this.getIndexPath(workspaceId)
     if (!existsSync(indexPath)) return []
 
     try {
       const raw = await fs.readFile(indexPath, "utf-8")
       const parsed = JSON.parse(raw)
-      return Array.isArray(parsed) ? (parsed as PersistedBackgroundProcess[]) : []
+      return Array.isArray(parsed) ? (parsed as BackgroundProcess[]) : []
     } catch {
       return []
     }
   }
 
-  private async upsertIndex(workspaceId: string, record: PersistedBackgroundProcess) {
+  private async upsertIndex(workspaceId: string, record: BackgroundProcess) {
     const records = await this.readIndex(workspaceId)
     const index = records.findIndex((entry) => entry.id === record.id)
     if (index >= 0) {
@@ -515,7 +458,7 @@ export class BackgroundProcessManager {
     await this.writeIndex(workspaceId, next)
   }
 
-  private async writeIndex(workspaceId: string, records: PersistedBackgroundProcess[]) {
+  private async writeIndex(workspaceId: string, records: BackgroundProcess[]) {
     const indexPath = await this.getIndexPath(workspaceId)
     await fs.mkdir(path.dirname(indexPath), { recursive: true })
     await fs.writeFile(indexPath, JSON.stringify(records, null, 2))
@@ -560,139 +503,14 @@ export class BackgroundProcessManager {
     }
   }
 
-  private publishUpdate(workspaceId: string, record: PersistedBackgroundProcess) {
+  private publishUpdate(workspaceId: string, record: BackgroundProcess) {
     this.deps.eventBus.publish({
       type: "instance.event",
       instanceId: workspaceId,
-      event: { type: "background.process.updated", properties: { process: this.toPublicProcess(record) } },
+      event: { type: "background.process.updated", properties: { process: record } },
     })
   }
 
-  private toPublicProcess(record: PersistedBackgroundProcess): BackgroundProcess {
-    return {
-      id: record.id,
-      workspaceId: record.workspaceId,
-      title: record.title,
-      command: record.command,
-      cwd: record.cwd,
-      status: record.status,
-      pid: record.pid,
-      startedAt: record.startedAt,
-      stoppedAt: record.stoppedAt,
-      exitCode: record.exitCode,
-      outputSizeBytes: record.outputSizeBytes,
-      terminalReason: record.terminalReason,
-      notifyEnabled: Boolean(record.notify),
-    }
-  }
-
-  private async finalizeRecord(workspaceId: string, record: PersistedBackgroundProcess, completion: ProcessCompletion) {
-    if (this.shouldSendCompletionPrompt(record, completion)) {
-      try {
-        await this.sendCompletionPrompt(workspaceId, record)
-        if (record.notify) {
-          record.notify.sentAt = new Date().toISOString()
-        }
-      } catch (error) {
-        this.deps.logger.warn({ err: error, workspaceId, processId: record.id }, "Failed to send background process completion prompt")
-      }
-    }
-
-    if (completion.removeAfterFinalize) {
-      await this.removeFromIndex(workspaceId, record.id)
-      await this.removeProcessDir(workspaceId, record.id)
-
-      this.deps.eventBus.publish({
-        type: "instance.event",
-        instanceId: workspaceId,
-        event: { type: "background.process.removed", properties: { processId: record.id } },
-      })
-      return
-    }
-
-    await this.upsertIndex(workspaceId, record)
-    record.outputSizeBytes = await this.getOutputSize(workspaceId, record.id)
-    this.publishUpdate(workspaceId, record)
-  }
-
-  private shouldSendCompletionPrompt(record: PersistedBackgroundProcess, completion: ProcessCompletion) {
-    if (completion.endContext === "workspace_cleanup") return false
-    if (!record.notify) return false
-    return !record.notify.sentAt
-  }
-
-  private async sendCompletionPrompt(workspaceId: string, record: PersistedBackgroundProcess) {
-    const notify = record.notify
-    if (!notify || !record.terminalReason) return
-
-    if (!this.deps.workspaceManager.get(workspaceId)) {
-      throw new Error("Workspace not found")
-    }
-
-    const port = this.deps.workspaceManager.getInstancePort(workspaceId)
-    if (!port) {
-      throw new Error("Workspace instance is not ready")
-    }
-
-    const targetUrl = `http://127.0.0.1:${port}/session/${encodeURIComponent(notify.sessionID)}/prompt_async`
-    const headers: Record<string, string> = {
-      "content-type": "application/json",
-      "x-opencode-directory": /[^\x00-\x7F]/.test(notify.directory) ? encodeURIComponent(notify.directory) : notify.directory,
-    }
-
-    const authorization = this.deps.workspaceManager.getInstanceAuthorizationHeader(workspaceId)
-    if (authorization) {
-      headers.authorization = authorization
-    }
-
-    const response = await fetch(targetUrl, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        parts: [
-          {
-            type: "text",
-            text: this.buildSyntheticCompletionPrompt(record),
-            synthetic: true,
-          },
-        ],
-      }),
-    })
-
-    if (!response.ok) {
-      const message = await response.text().catch(() => "")
-      throw new Error(message || `Prompt request failed with ${response.status}`)
-    }
-  }
-
-  private buildCompletionPrompt(record: PersistedBackgroundProcess): string {
-    const ref = `Background process "${record.title}" (${record.id})`
-
-    switch (record.terminalReason) {
-      case "finished":
-        return `${ref} finished successfully.`
-      case "failed":
-        return record.exitCode === undefined ? `${ref} failed.` : `${ref} failed with exit code ${record.exitCode}.`
-      case "user_stopped":
-        return `${ref} was stopped by user.`
-      case "user_terminated":
-        return `${ref} was terminated by user.`
-    }
-
-    return `${ref} ended.`
-  }
-
-  private buildSyntheticCompletionPrompt(record: PersistedBackgroundProcess): string {
-    return `<system-message>${this.escapeTaggedText(this.buildCompletionPrompt(record))}</system-message>`
-  }
-
-  private escapeTaggedText(input: string): string {
-    return input
-      .replace(/&/g, "&amp;")
-      .replace(/</g, "&lt;")
-      .replace(/>/g, "&gt;")
-  }
-
   private generateId(): string {
     const timestamp = new Date().toISOString().replace(/[:.]/g, "").slice(0, 15)
     const random = randomBytes(3).toString("hex")

packages/server/src/clients/connection-manager.ts

@@ -1,128 +0,0 @@
-import type { Logger } from "../logger"
-
-const STALE_CONNECTION_TIMEOUT_MS = 45000
-const STALE_SWEEP_INTERVAL_MS = 5000
-
-export interface ClientConnectionRef {
-  clientId: string
-  connectionId: string
-}
-
-export interface ClientConnectionRecord extends ClientConnectionRef {
-  key: string
-  connectedAt: number
-  lastSeenAt: number
-}
-
-type ConnectionChangeEvent = {
-  type: "connected" | "disconnected"
-  connection: ClientConnectionRecord
-  reason?: string
-}
-
-interface RegisteredConnection extends ClientConnectionRecord {
-  close: () => void
-}
-
-export class ClientConnectionManager {
-  private readonly connections = new Map<string, RegisteredConnection>()
-  private readonly subscribers = new Set<(event: ConnectionChangeEvent) => void>()
-  private readonly sweepTimer: NodeJS.Timeout
-
-  constructor(private readonly logger: Logger) {
-    this.sweepTimer = setInterval(() => this.sweepStaleConnections(), STALE_SWEEP_INTERVAL_MS)
-    this.sweepTimer.unref?.()
-  }
-
-  shutdown(): void {
-    clearInterval(this.sweepTimer)
-    for (const connection of Array.from(this.connections.values())) {
-      this.disconnect(connection.key, "shutdown", false)
-    }
-  }
-
-  subscribe(listener: (event: ConnectionChangeEvent) => void): () => void {
-    this.subscribers.add(listener)
-    return () => this.subscribers.delete(listener)
-  }
-
-  register(input: ClientConnectionRef & { close: () => void }): () => void {
-    const key = getConnectionKey(input)
-    const now = Date.now()
-    const existing = this.connections.get(key)
-
-    if (existing) {
-      this.logger.debug({ clientId: input.clientId, connectionId: input.connectionId }, "Replacing existing client connection")
-      this.disconnect(key, "replaced")
-    }
-
-    const connection: RegisteredConnection = {
-      key,
-      clientId: input.clientId,
-      connectionId: input.connectionId,
-      connectedAt: now,
-      lastSeenAt: now,
-      close: input.close,
-    }
-    this.connections.set(key, connection)
-    this.logger.debug({ clientId: input.clientId, connectionId: input.connectionId }, "Client connected")
-    this.notify({ type: "connected", connection })
-    return () => this.disconnect(key, "closed")
-  }
-
-  pong(input: ClientConnectionRef): boolean {
-    const key = getConnectionKey(input)
-    const connection = this.connections.get(key)
-    if (!connection) {
-      this.logger.debug({ clientId: input.clientId, connectionId: input.connectionId }, "Ignoring pong for unknown client connection")
-      return false
-    }
-
-    connection.lastSeenAt = Date.now()
-    return true
-  }
-
-  isConnected(input: ClientConnectionRef): boolean {
-    return this.connections.has(getConnectionKey(input))
-  }
-
-  private sweepStaleConnections(): void {
-    const cutoff = Date.now() - STALE_CONNECTION_TIMEOUT_MS
-    for (const connection of Array.from(this.connections.values())) {
-      if (connection.lastSeenAt > cutoff) continue
-      this.logger.debug({ clientId: connection.clientId, connectionId: connection.connectionId }, "Client connection timed out")
-      this.disconnect(connection.key, "timeout")
-    }
-  }
-
-  private disconnect(key: string, reason: string, invokeClose = true): void {
-    const connection = this.connections.get(key)
-    if (!connection) return
-    this.connections.delete(key)
-    this.logger.debug({ clientId: connection.clientId, connectionId: connection.connectionId, reason }, "Client disconnected")
-
-    if (invokeClose) {
-      try {
-        connection.close()
-      } catch (error) {
-        this.logger.warn({ err: error, clientId: connection.clientId, connectionId: connection.connectionId }, "Failed to close stale client connection")
-      }
-    }
-
-    this.notify({ type: "disconnected", connection, reason })
-  }
-
-  private notify(event: ConnectionChangeEvent): void {
-    for (const subscriber of this.subscribers) {
-      try {
-        subscriber(event)
-      } catch (error) {
-        this.logger.warn({ err: error, eventType: event.type }, "Client connection subscriber failed")
-      }
-    }
-  }
-}
-
-function getConnectionKey(input: ClientConnectionRef): string {
-  return `${input.clientId}:${input.connectionId}`
-}

packages/server/src/config/schema.ts

@@ -26,7 +26,6 @@ const PreferencesSchema = z
   showUsageMetrics: z.boolean().default(true),
   autoCleanupBlankSessions: z.boolean().default(true),
   listeningMode: z.enum(["local", "all"]).default("local"),
-  logLevel: z.enum(["DEBUG", "INFO", "WARN", "ERROR"]).default("DEBUG"),
 
   // OS notifications
   osNotificationsEnabled: z.boolean().default(false),

packages/server/src/events/bus.ts

@@ -24,8 +24,6 @@ export class EventBus extends EventEmitter {
     this.on("workspace.error", handler)
     this.on("workspace.stopped", handler)
     this.on("workspace.log", handler)
-    this.on("sidecar.updated", handler)
-    this.on("sidecar.removed", handler)
     this.on("storage.configChanged", handler)
     this.on("storage.stateChanged", handler)
     this.on("instance.dataChanged", handler)
@@ -37,8 +35,6 @@ export class EventBus extends EventEmitter {
       this.off("workspace.error", handler)
       this.off("workspace.stopped", handler)
       this.off("workspace.log", handler)
-      this.off("sidecar.updated", handler)
-      this.off("sidecar.removed", handler)
       this.off("storage.configChanged", handler)
       this.off("storage.stateChanged", handler)
       this.off("instance.dataChanged", handler)

packages/server/src/filesystem/browser.ts

@@ -81,14 +81,6 @@ export class FileSystemBrowser {
     return { path: relativePath, absolutePath }
   }
 
-  writeFile(relativePath: string, contents: string): void {
-    if (this.unrestricted) {
-      throw new Error("writeFile is not available in unrestricted mode")
-    }
-    const resolved = this.toRestrictedAbsolute(relativePath)
-    fs.writeFileSync(resolved, contents, "utf-8")
-  }
-
   readFile(relativePath: string): string {
     if (this.unrestricted) {
       throw new Error("readFile is not available in unrestricted mode")

packages/server/src/index.ts

@@ -21,22 +21,16 @@ import { launchInBrowser } from "./launcher"
 import { resolveUi } from "./ui/remote-ui"
 import { AuthManager, BOOTSTRAP_TOKEN_STDOUT_PREFIX, DEFAULT_AUTH_COOKIE_NAME, DEFAULT_AUTH_USERNAME } from "./auth/manager"
 import { resolveHttpsOptions } from "./server/tls"
-import { RemoteProxySessionManager } from "./server/remote-proxy"
 import { resolveNetworkAddresses, resolveRemoteAddresses } from "./server/network-addresses"
 import { startDevReleaseMonitor } from "./releases/dev-release-monitor"
 import { SpeechService } from "./speech/service"
-import { SideCarManager } from "./sidecars/manager"
-import { ClientConnectionManager } from "./clients/connection-manager"
-import { PluginChannelManager } from "./plugins/channel"
-import { VoiceModeManager } from "./plugins/voice-mode"
-import { readServerPackageVersion, resolveServerPublicDir } from "./runtime-paths"
 
 const require = createRequire(import.meta.url)
 
-const packageJson = { version: readServerPackageVersion(import.meta.url) }
+const packageJson = require("../package.json") as { version: string }
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = path.dirname(__filename)
-const DEFAULT_UI_STATIC_DIR = resolveServerPublicDir(import.meta.url)
+const DEFAULT_UI_STATIC_DIR = path.resolve(__dirname, "../public")
 
 interface CliOptions {
   host: string
@@ -321,11 +315,6 @@ async function main() {
   const fileSystemBrowser = new FileSystemBrowser({ rootDir: options.rootDir, unrestricted: options.unrestrictedRoot })
   const instanceStore = new InstanceStore(configLocation.instancesDir)
   const speechService = new SpeechService(settings, logger.child({ component: "speech" }))
-  const sidecarManager = new SideCarManager({
-    settings,
-    eventBus,
-    logger: logger.child({ component: "sidecars" }),
-  })
   const instanceEventBridge = new InstanceEventBridge({
     workspaceManager,
     eventBus,
@@ -377,20 +366,11 @@ async function main() {
       })
     : null
 
-  const remoteAccessEnabled = options.host === "0.0.0.0" || !isLoopbackHost(options.host)
+  if (uiResolution.uiDevServerUrl && options.https) {
+    throw new InvalidArgumentError("UI dev proxy is only supported with --https=false --http=true")
+  }
 
-  const clientConnectionManager = new ClientConnectionManager(logger.child({ component: "client-connections" }))
-  const pluginChannel = new PluginChannelManager(logger.child({ component: "plugin-channel" }))
-  const remoteProxySessionManager = new RemoteProxySessionManager({
-    authManager,
-    logger: logger.child({ component: "remote-proxy" }),
-    httpsOptions: tlsResolution?.httpsOptions,
-  })
-  const voiceModeManager = new VoiceModeManager({
-    connections: clientConnectionManager,
-    channel: pluginChannel,
-    logger: logger.child({ component: "voice-mode" }),
-  })
+  const remoteAccessEnabled = options.host === "0.0.0.0" || !isLoopbackHost(options.host)
 
   const httpsPortExplicit = programHasArg(process.argv.slice(2), "--https-port") || Boolean(process.env.CLI_HTTPS_PORT)
   const httpPortExplicit = programHasArg(process.argv.slice(2), "--http-port") || Boolean(process.env.CLI_HTTP_PORT)
@@ -420,12 +400,7 @@ async function main() {
         serverMeta,
         instanceStore,
         speechService,
-        sidecarManager,
         authManager,
-        clientConnectionManager,
-        pluginChannel,
-        voiceModeManager,
-        remoteProxySessionManager,
         uiStaticDir: uiResolution.uiStaticDir ?? DEFAULT_UI_STATIC_DIR,
         uiDevServerUrl: uiResolution.uiDevServerUrl,
         logger,
@@ -446,12 +421,7 @@ async function main() {
         serverMeta,
         instanceStore,
         speechService,
-        sidecarManager,
         authManager,
-        clientConnectionManager,
-        pluginChannel,
-        voiceModeManager,
-        remoteProxySessionManager,
         uiStaticDir: uiResolution.uiStaticDir ?? DEFAULT_UI_STATIC_DIR,
         uiDevServerUrl: undefined,
         logger,
@@ -550,18 +520,6 @@ async function main() {
         logger.warn({ err: error }, "Instance event bridge shutdown failed")
       }
 
-      try {
-        await sidecarManager.shutdown()
-      } catch (error) {
-        logger.error({ err: error }, "SideCar manager shutdown failed")
-      }
-
-      try {
-        clientConnectionManager.shutdown()
-      } catch (error) {
-        logger.warn({ err: error }, "Client connection manager shutdown failed")
-      }
-
       try {
         await workspaceManager.shutdown()
         logger.info("Workspace manager shutdown complete")

packages/server/src/opencode-config.ts

@@ -1,11 +1,22 @@
 import { existsSync } from "fs"
+import path from "path"
+import { fileURLToPath } from "url"
 import { createLogger } from "./logger"
-import { resolveOpencodeTemplateDir } from "./runtime-paths"
 
 const log = createLogger({ component: "opencode-config" })
-const templateDir = resolveOpencodeTemplateDir(import.meta.url)
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = path.dirname(__filename)
+const devTemplateDir = path.resolve(__dirname, "../../opencode-config")
+const resourcesPath = (process as NodeJS.Process & { resourcesPath?: string }).resourcesPath
+const prodTemplateDirs = [
+  resourcesPath ? path.resolve(resourcesPath, "opencode-config") : undefined,
+  path.resolve(__dirname, "opencode-config"),
+].filter((dir): dir is string => Boolean(dir))
 
-const isDevBuild = Boolean(process.env.CODENOMAD_DEV ?? process.env.CLI_UI_DEV_SERVER)
+const isDevBuild = Boolean(process.env.CODENOMAD_DEV ?? process.env.CLI_UI_DEV_SERVER) || existsSync(devTemplateDir)
+const templateDir = isDevBuild
+  ? devTemplateDir
+  : prodTemplateDirs.find((dir) => existsSync(dir)) ?? prodTemplateDirs[0]
 
 export function getOpencodeConfigDir(): string {
   if (!existsSync(templateDir)) {

packages/server/src/plugins/voice-mode.ts

@@ -1,100 +0,0 @@
-import type { Logger } from "../logger"
-import type { ClientConnectionManager, ClientConnectionRef } from "../clients/connection-manager"
-import type { PluginChannelManager } from "./channel"
-
-interface VoiceModeManagerOptions {
-  connections: ClientConnectionManager
-  channel: PluginChannelManager
-  logger: Logger
-}
-
-export class VoiceModeManager {
-  private readonly enabledConnectionsByInstance = new Map<string, Set<string>>()
-  private readonly aggregateByInstance = new Map<string, boolean>()
-
-  constructor(private readonly options: VoiceModeManagerOptions) {
-    this.options.connections.subscribe((event) => {
-      if (event.type !== "disconnected") return
-      this.clearConnection(event.connection)
-    })
-  }
-
-  setEnabled(instanceId: string, connection: ClientConnectionRef, enabled: boolean): boolean {
-    if (enabled && !this.options.connections.isConnected(connection)) {
-      this.options.logger.debug(
-        { instanceId, clientId: connection.clientId, connectionId: connection.connectionId },
-        "Ignoring voice mode enable for disconnected client connection",
-      )
-      return false
-    }
-
-    const key = getConnectionKey(connection)
-    const current = this.enabledConnectionsByInstance.get(instanceId) ?? new Set<string>()
-
-    if (enabled) {
-      current.add(key)
-      this.enabledConnectionsByInstance.set(instanceId, current)
-    } else if (current.delete(key)) {
-      if (current.size === 0) {
-        this.enabledConnectionsByInstance.delete(instanceId)
-      } else {
-        this.enabledConnectionsByInstance.set(instanceId, current)
-      }
-    }
-
-    this.options.logger.debug({ instanceId, clientId: connection.clientId, connectionId: connection.connectionId, enabled }, "Voice mode updated for client connection")
-    this.publishIfChanged(instanceId)
-    return true
-  }
-
-  syncInstance(instanceId: string): void {
-    this.options.channel.send(instanceId, buildVoiceModeEvent(this.isEnabled(instanceId)))
-  }
-
-  isEnabled(instanceId: string): boolean {
-    return this.aggregateByInstance.get(instanceId) === true
-  }
-
-  private clearConnection(connection: ClientConnectionRef): void {
-    const key = getConnectionKey(connection)
-    for (const [instanceId, enabledConnections] of Array.from(this.enabledConnectionsByInstance.entries())) {
-      if (!enabledConnections.delete(key)) continue
-      if (enabledConnections.size === 0) {
-        this.enabledConnectionsByInstance.delete(instanceId)
-      }
-      this.publishIfChanged(instanceId)
-    }
-  }
-
-  private publishIfChanged(instanceId: string): void {
-    const enabled = (this.enabledConnectionsByInstance.get(instanceId)?.size ?? 0) > 0
-    const previous = this.aggregateByInstance.get(instanceId) === true
-    if (enabled === previous) return
-
-    if (enabled) {
-      this.aggregateByInstance.set(instanceId, true)
-    } else {
-      this.aggregateByInstance.delete(instanceId)
-    }
-
-    this.options.logger.debug(
-      { instanceId, enabled },
-      "Broadcasting aggregate voice mode",
-    )
-    this.options.channel.send(instanceId, buildVoiceModeEvent(enabled))
-  }
-}
-
-function buildVoiceModeEvent(enabled: boolean) {
-  return {
-    type: "codenomad.voiceMode",
-    properties: {
-      enabled,
-      formatVersion: "v1",
-    },
-  }
-}
-
-function getConnectionKey(connection: ClientConnectionRef): string {
-  return `${connection.clientId}:${connection.connectionId}`
-}

packages/server/src/runtime-paths.ts

@@ -1,79 +0,0 @@
-import fs from "fs"
-import path from "path"
-import { fileURLToPath } from "url"
-
-function safeModuleDir(importMetaUrl: string): string | null {
-  try {
-    return path.dirname(fileURLToPath(importMetaUrl))
-  } catch {
-    return null
-  }
-}
-
-function firstExistingPath(candidates: Array<string | null | undefined>, predicate: (value: string) => boolean): string | null {
-  for (const candidate of candidates) {
-    if (!candidate) continue
-    if (predicate(candidate)) {
-      return candidate
-    }
-  }
-  return null
-}
-
-export function getPackagedDistDir(): string {
-  return path.dirname(process.execPath)
-}
-
-export function resolveServerPackageRoot(importMetaUrl: string): string {
-  const moduleDir = safeModuleDir(importMetaUrl)
-  const configuredRoot = process.env.CODENOMAD_SERVER_ROOT?.trim()
-  const candidates = [
-    configuredRoot ? path.resolve(configuredRoot) : null,
-    moduleDir ? path.resolve(moduleDir, "..") : null,
-    path.resolve(getPackagedDistDir(), ".."),
-  ]
-
-  return (
-    firstExistingPath(candidates, (value) => fs.existsSync(path.join(value, "package.json"))) ??
-    candidates.find((value): value is string => Boolean(value)) ??
-    process.cwd()
-  )
-}
-
-export function resolveServerPublicDir(importMetaUrl: string): string {
-  const moduleDir = safeModuleDir(importMetaUrl)
-  const candidates = [moduleDir ? path.resolve(moduleDir, "../public") : null, path.join(resolveServerPackageRoot(importMetaUrl), "public")]
-
-  return firstExistingPath(candidates, (value) => fs.existsSync(value)) ?? candidates[candidates.length - 1]!
-}
-
-export function resolveAuthTemplatePath(importMetaUrl: string, fileName: string): string {
-  const moduleDir = safeModuleDir(importMetaUrl)
-  const distDir = getPackagedDistDir()
-  const candidates = [
-    moduleDir ? path.join(moduleDir, "auth-pages", fileName) : null,
-    path.join(distDir, "auth-pages", fileName),
-    path.join(distDir, "server", "routes", "auth-pages", fileName),
-  ]
-
-  return firstExistingPath(candidates, (value) => fs.existsSync(value)) ?? candidates[0]!
-}
-
-export function resolveOpencodeTemplateDir(importMetaUrl: string): string {
-  const moduleDir = safeModuleDir(importMetaUrl)
-  const resourcesPath = (process as NodeJS.Process & { resourcesPath?: string }).resourcesPath
-  const candidates = [
-    moduleDir ? path.resolve(moduleDir, "../../opencode-config") : null,
-    resourcesPath ? path.resolve(resourcesPath, "opencode-config") : null,
-    moduleDir ? path.resolve(moduleDir, "opencode-config") : null,
-    path.join(getPackagedDistDir(), "opencode-config"),
-  ]
-
-  return firstExistingPath(candidates, (value) => fs.existsSync(value)) ?? candidates[candidates.length - 1]!
-}
-
-export function readServerPackageVersion(importMetaUrl: string): string {
-  const packageJsonPath = path.join(resolveServerPackageRoot(importMetaUrl), "package.json")
-  const parsed = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8")) as { version?: unknown }
-  return typeof parsed.version === "string" && parsed.version.trim().length > 0 ? parsed.version : "0.0.0"
-}

packages/server/src/server/__tests__/remote-proxy.test.ts

@@ -1,248 +0,0 @@
-import assert from "node:assert/strict"
-import { after, afterEach, describe, it } from "node:test"
-import fs from "node:fs"
-import http, { type IncomingMessage, type ServerResponse } from "node:http"
-import os from "node:os"
-import path from "node:path"
-
-import { Agent, fetch } from "undici"
-
-import type { AuthManager } from "../../auth/manager"
-import type { Logger } from "../../logger"
-import { RemoteProxySessionManager } from "../remote-proxy"
-import { resolveHttpsOptions } from "../tls"
-
-const sharedTempDir = fs.mkdtempSync(path.join(os.tmpdir(), "codenomad-remote-proxy-test-"))
-const sharedTls = resolveHttpsOptions({
-  enabled: true,
-  configDir: sharedTempDir,
-  host: "127.0.0.1",
-  logger: createStubLogger(),
-})
-
-if (!sharedTls) {
-  throw new Error("Failed to generate HTTPS options for remote proxy tests")
-}
-
-const sharedHttpsOptions = sharedTls.httpsOptions
-
-const httpsDispatcher = new Agent({ connect: { rejectUnauthorized: false } })
-const managers = new Set<RemoteProxySessionManager>()
-
-afterEach(async () => {
-  for (const manager of managers) {
-    await disposeManager(manager)
-  }
-  managers.clear()
-})
-
-after(() => {
-  fs.rmSync(sharedTempDir, { recursive: true, force: true })
-  httpsDispatcher.close().catch(() => {})
-})
-
-describe("RemoteProxySessionManager", () => {
-  it("blocks proxying before activation and keeps bootstrap tokens scoped per session", async () => {
-    await withUpstreamServer(async (upstreamBaseUrl) => {
-      const manager = createSessionManager()
-      const session1 = await createSession(manager, `${upstreamBaseUrl}/base`)
-      const session2 = await createSession(manager, `${upstreamBaseUrl}/base`)
-
-      const blocked = await proxyFetch(`${session1.proxyOrigin}/status`)
-      assert.equal(blocked.status, 403)
-
-      const wrongTokenResponse = await proxyFetch(`${session1.proxyOrigin}/__codenomad/api/auth/token`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ token: session2.token }),
-      })
-      assert.equal(wrongTokenResponse.status, 401)
-
-      assert.equal(await activateSession(session1), true)
-      assert.equal(await activateSession(session2), true)
-    }, (req, res) => {
-      res.writeHead(200, { "content-type": "text/plain" })
-      res.end(req.url ?? "")
-    })
-  })
-
-  it("preserves remote base paths and rewrites same-origin redirects to the local proxy origin", async () => {
-    await withUpstreamServer(async (upstreamBaseUrl) => {
-      const manager = createSessionManager()
-      const session = await createSession(manager, `${upstreamBaseUrl}/base`)
-
-      await activateSession(session)
-
-      const apiResponse = await proxyFetch(`${session.proxyOrigin}/api/auth/status?foo=bar`)
-      assert.equal(apiResponse.status, 200)
-      assert.equal(await apiResponse.text(), "/base/api/auth/status?foo=bar")
-
-      const redirectResponse = await proxyFetch(`${session.proxyOrigin}/redirect`, { redirect: "manual" })
-      assert.equal(redirectResponse.status, 302)
-      assert.equal(redirectResponse.headers.get("location"), `${session.proxyOrigin}/base/after?ok=1`)
-    }, (req, res) => {
-      const requestUrl = req.url ?? ""
-      if (requestUrl === "/base/redirect") {
-        res.writeHead(302, { location: "/base/after?ok=1" })
-        res.end()
-        return
-      }
-
-      res.writeHead(200, { "content-type": "text/plain" })
-      res.end(requestUrl)
-    })
-  })
-
-  it("rewrites set-cookie names for the proxy and restores cookie names on proxied requests", async () => {
-    await withUpstreamServer(async (upstreamBaseUrl) => {
-      const manager = createSessionManager()
-      const session = await createSession(manager, `${upstreamBaseUrl}/base`)
-
-      await activateSession(session)
-
-      const loginResponse = await proxyFetch(`${session.proxyOrigin}/login`)
-      assert.equal(loginResponse.status, 200)
-      const setCookie = getSetCookie(loginResponse)[0]
-
-      assert.match(setCookie, /^cnrp_[0-9a-f]+_session=abc123/i)
-      assert.doesNotMatch(setCookie, /domain=/i)
-
-      const cookieHeader = setCookie.split(";", 1)[0]
-      const whoamiResponse = await proxyFetch(`${session.proxyOrigin}/whoami`, {
-        headers: { cookie: cookieHeader },
-      })
-
-      assert.equal(await whoamiResponse.text(), "session=abc123")
-    }, (req, res) => {
-      const requestUrl = req.url ?? ""
-      if (requestUrl === "/base/login") {
-        res.writeHead(200, {
-          "content-type": "text/plain",
-          "set-cookie": "session=abc123; Path=/; Secure; HttpOnly; Domain=127.0.0.1",
-        })
-        res.end("ok")
-        return
-      }
-
-      if (requestUrl === "/base/whoami") {
-        res.writeHead(200, { "content-type": "text/plain" })
-        res.end(req.headers.cookie ?? "")
-        return
-      }
-
-      res.writeHead(404, { "content-type": "text/plain" })
-      res.end(requestUrl)
-    })
-  })
-
-  it("supports explicit deletion and idle cleanup of sessions", async () => {
-    await withUpstreamServer(async (upstreamBaseUrl) => {
-      const manager = createSessionManager()
-      const session = await createSession(manager, `${upstreamBaseUrl}/base`)
-
-      assert.equal(await manager.deleteSession(session.sessionId), true)
-      assert.equal(await manager.deleteSession(session.sessionId), false)
-
-      const session3 = await createSession(manager, `${upstreamBaseUrl}/base`)
-      const internalSessions = (manager as any).sessions as Map<string, { lastAccessAt: number }>
-      const internalCleanup = (manager as any).cleanupExpiredSessions as () => Promise<void>
-
-      internalSessions.get(session3.sessionId)!.lastAccessAt = Date.now() - 31 * 60_000
-      await internalCleanup.call(manager)
-
-      assert.equal(internalSessions.has(session3.sessionId), false)
-      assert.equal(await manager.deleteSession(session3.sessionId), false)
-    }, (_req, res) => {
-      res.writeHead(200, { "content-type": "text/plain" })
-      res.end("ok")
-    })
-  })
-})
-
-function createSessionManager() {
-  const manager = new RemoteProxySessionManager({
-    authManager: {
-      isLoopbackRequest: () => true,
-    } as unknown as AuthManager,
-    logger: createStubLogger(),
-    httpsOptions: sharedHttpsOptions,
-  })
-  managers.add(manager)
-  return manager
-}
-
-async function createSession(manager: RemoteProxySessionManager, baseUrl: string) {
-  const created = await manager.createSession(baseUrl, false)
-  const windowUrl = new URL(created.windowUrl)
-  return {
-    sessionId: created.sessionId,
-    windowUrl,
-    proxyOrigin: windowUrl.origin,
-    token: decodeURIComponent(windowUrl.hash.replace(/^#/, "")),
-  }
-}
-
-async function activateSession(session: { proxyOrigin: string; token: string }) {
-  const response = await proxyFetch(`${session.proxyOrigin}/__codenomad/api/auth/token`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ token: session.token }),
-  })
-  if (!response.ok) {
-    return false
-  }
-  const body = (await response.json()) as { ok?: boolean }
-  return body.ok === true
-}
-
-function getSetCookie(response: Awaited<ReturnType<typeof fetch>>): string[] {
-  const values = (response.headers as any).getSetCookie?.() as string[] | undefined
-  if (Array.isArray(values) && values.length > 0) {
-    return values
-  }
-  const fallback = response.headers.get("set-cookie")
-  return fallback ? [fallback] : []
-}
-
-async function proxyFetch(url: string, init?: Parameters<typeof fetch>[1]) {
-  return fetch(url, { dispatcher: httpsDispatcher, ...init })
-}
-
-async function disposeManager(manager: RemoteProxySessionManager) {
-  const sessions = Array.from(((manager as any).sessions as Map<string, unknown>).keys())
-  for (const sessionId of sessions) {
-    await manager.deleteSession(sessionId)
-  }
-  clearInterval((manager as any).cleanupTimer as NodeJS.Timeout)
-}
-
-async function withUpstreamServer(
-  callback: (baseUrl: string) => Promise<void>,
-  handler: (req: IncomingMessage, res: ServerResponse<IncomingMessage>) => void,
-) {
-  const server = http.createServer(handler)
-  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", () => resolve()))
-
-  try {
-    const address = server.address()
-    if (!address || typeof address === "string") {
-      throw new Error("Failed to resolve upstream server address")
-    }
-    await callback(`http://127.0.0.1:${address.port}`)
-  } finally {
-    await new Promise<void>((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())))
-  }
-}
-
-function createStubLogger(): Logger {
-  const logger = {
-    info() {},
-    warn() {},
-    error() {},
-    child() {
-      return logger
-    },
-  }
-
-  return logger as unknown as Logger
-}

packages/server/src/server/http-server.ts

@@ -3,16 +3,11 @@ import cors from "@fastify/cors"
 import fastifyStatic from "@fastify/static"
 import replyFrom from "@fastify/reply-from"
 import fs from "fs"
-import { connect as connectTcp, type Socket } from "net"
 import path from "path"
-import { Readable } from "stream"
-import { pipeline } from "stream/promises"
-import { connect as connectTls, type TLSSocket } from "tls"
 import { fetch } from "undici"
 import type { Logger } from "../logger"
 import { WorkspaceManager } from "../workspaces/manager"
 import { isValidWorktreeSlug, listWorktrees, resolveRepoRoot } from "../workspaces/git-worktrees"
-import { resolveWorktreeDirectory } from "../workspaces/worktree-directory"
 
 import type { SettingsService } from "../settings/service"
 import { FileSystemBrowser } from "../filesystem/browser"
@@ -27,9 +22,6 @@ import { registerPluginRoutes } from "./routes/plugin"
 import { registerBackgroundProcessRoutes } from "./routes/background-processes"
 import { registerWorktreeRoutes } from "./routes/worktrees"
 import { registerSpeechRoutes } from "./routes/speech"
-import { registerRemoteServerRoutes } from "./routes/remote-servers"
-import { registerRemoteProxyRoutes } from "./routes/remote-proxy"
-import { registerSideCarRoutes } from "./routes/sidecars"
 import { ServerMeta } from "../api-types"
 import { InstanceStore } from "../storage/instance-store"
 import { BackgroundProcessManager } from "../background-processes/manager"
@@ -37,11 +29,6 @@ import type { AuthManager } from "../auth/manager"
 import { registerAuthRoutes } from "./routes/auth"
 import { sendUnauthorized, wantsHtml } from "../auth/http-auth"
 import type { SpeechService } from "../speech/service"
-import { ClientConnectionManager } from "../clients/connection-manager"
-import { PluginChannelManager } from "../plugins/channel"
-import { VoiceModeManager } from "../plugins/voice-mode"
-import type { SideCarManager } from "../sidecars/manager"
-import type { RemoteProxySessionManager } from "./remote-proxy"
 
 interface HttpServerDeps {
   bindHost: string
@@ -57,12 +44,7 @@ interface HttpServerDeps {
   serverMeta: ServerMeta
   instanceStore: InstanceStore
   speechService: SpeechService
-  sidecarManager: SideCarManager
   authManager: AuthManager
-  clientConnectionManager: ClientConnectionManager
-  pluginChannel: PluginChannelManager
-  voiceModeManager: VoiceModeManager
-  remoteProxySessionManager: RemoteProxySessionManager
   uiStaticDir: string
   uiDevServerUrl?: string
   logger: Logger
@@ -204,19 +186,14 @@ export function createHttpServer(deps: HttpServerDeps) {
       publicPagePaths.add("/auth/token")
     }
 
-    const isLoopbackRemoteProxyDelete =
-      request.method === "DELETE" &&
-      pathname.startsWith("/api/remote-proxy/sessions/") &&
-      deps.authManager.isLoopbackRequest(request)
-
-    if (publicApiPaths.has(pathname) || publicPagePaths.has(pathname) || isLoopbackRemoteProxyDelete) {
+    if (publicApiPaths.has(pathname) || publicPagePaths.has(pathname)) {
       done()
       return
     }
 
     const session = deps.authManager.getSessionFromRequest(request)
 
-    const requiresAuthForApi = pathname.startsWith("/api/") || pathname.startsWith("/workspaces/") || pathname.startsWith("/sidecars/")
+    const requiresAuthForApi = pathname.startsWith("/api/") || pathname.startsWith("/workspaces/")
     if (requiresAuthForApi && !session) {
       // Allow OpenCode plugin -> CodeNomad calls with per-instance basic auth.
       const pluginMatch = pathname.match(/^\/workspaces\/([^/]+)\/plugin(?:\/|$)/)
@@ -271,35 +248,15 @@ export function createHttpServer(deps: HttpServerDeps) {
   registerSettingsRoutes(app, { settings: deps.settings, logger: apiLogger })
   registerFilesystemRoutes(app, { fileSystemBrowser: deps.fileSystemBrowser })
   registerMetaRoutes(app, { serverMeta: deps.serverMeta })
-  registerEventRoutes(app, {
-    eventBus: deps.eventBus,
-    registerClient: registerSseClient,
-    logger: sseLogger,
-    connectionManager: deps.clientConnectionManager,
-  })
+  registerEventRoutes(app, { eventBus: deps.eventBus, registerClient: registerSseClient, logger: sseLogger })
   registerWorktreeRoutes(app, { workspaceManager: deps.workspaceManager })
   registerStorageRoutes(app, {
     instanceStore: deps.instanceStore,
     eventBus: deps.eventBus,
     workspaceManager: deps.workspaceManager,
   })
-  registerRemoteServerRoutes(app, { logger: apiLogger })
-  registerRemoteProxyRoutes(app, { logger: proxyLogger, sessionManager: deps.remoteProxySessionManager })
   registerSpeechRoutes(app, { speechService: deps.speechService })
-  registerSideCarRoutes(app, { sidecarManager: deps.sidecarManager })
-  registerSideCarProxyRoutes(app, { sidecarManager: deps.sidecarManager, logger: proxyLogger })
-  setupSideCarWebSocketProxy(app, {
-    sidecarManager: deps.sidecarManager,
-    authManager: deps.authManager,
-    logger: proxyLogger,
-  })
-  registerPluginRoutes(app, {
-    workspaceManager: deps.workspaceManager,
-    eventBus: deps.eventBus,
-    logger: proxyLogger,
-    channel: deps.pluginChannel,
-    voiceModeManager: deps.voiceModeManager,
-  })
+  registerPluginRoutes(app, { workspaceManager: deps.workspaceManager, eventBus: deps.eventBus, logger: proxyLogger })
   registerBackgroundProcessRoutes(app, { backgroundProcessManager })
   registerInstanceProxyRoutes(app, { workspaceManager: deps.workspaceManager, logger: proxyLogger })
 
@@ -374,68 +331,6 @@ interface InstanceProxyDeps {
   logger: Logger
 }
 
-interface SideCarProxyDeps {
-  sidecarManager: SideCarManager
-  logger: Logger
-}
-
-interface SideCarWebSocketProxyDeps extends SideCarProxyDeps {
-  authManager: AuthManager
-}
-
-function registerSideCarProxyRoutes(app: FastifyInstance, deps: SideCarProxyDeps) {
-  const proxyBaseHandler = async (
-    request: FastifyRequest<{ Params: { id: string } }>,
-    reply: FastifyReply,
-  ) => {
-    await proxySideCarRequest({
-      request,
-      reply,
-      sidecarManager: deps.sidecarManager,
-      logger: deps.logger,
-      pathSuffix: "",
-    })
-  }
-
-  const proxyWildcardHandler = async (
-    request: FastifyRequest<{ Params: { id: string; "*": string } }>,
-    reply: FastifyReply,
-  ) => {
-    await proxySideCarRequest({
-      request,
-      reply,
-      sidecarManager: deps.sidecarManager,
-      logger: deps.logger,
-      pathSuffix: request.params["*"] ?? "",
-    })
-  }
-
-  app.all("/sidecars/:id", proxyBaseHandler)
-  app.all("/sidecars/:id/*", proxyWildcardHandler)
-}
-
-function setupSideCarWebSocketProxy(app: FastifyInstance, deps: SideCarWebSocketProxyDeps) {
-  app.server.on("upgrade", (request, socket, head) => {
-    const rawUrl = request.url ?? "/"
-    const parsed = parseSideCarUpgradePath(rawUrl)
-    if (!parsed) {
-      return
-    }
-
-    void proxySideCarWebSocketUpgrade({
-      request,
-      socket: socket as Socket,
-      head,
-      sidecarId: parsed.sidecarId,
-      incomingPath: parsed.pathname,
-      search: parsed.search,
-      sidecarManager: deps.sidecarManager,
-      authManager: deps.authManager,
-      logger: deps.logger,
-    })
-  })
-}
-
 function registerInstanceProxyRoutes(app: FastifyInstance, deps: InstanceProxyDeps) {
   app.register(async (instance) => {
     instance.removeAllContentTypeParsers()
@@ -628,57 +523,57 @@ async function proxyWorkspaceRequest(args: {
     logger.trace({ workspaceId, targetUrl, body: request.body }, "Instance proxy payload")
   }
 
-  const headers = buildWorkspaceInstanceProxyHeaders(request.headers, instanceAuthHeader, directory)
+  return reply.from(targetUrl, {
+    rewriteRequestHeaders: (_originalRequest, headers) => {
+      if (instanceAuthHeader) {
+        headers.authorization = instanceAuthHeader
+      }
 
-  if (logger.isLevelEnabled("trace")) {
-    logger.trace(
-      {
-        workspaceId,
-        method: request.method,
-        targetUrl,
-        worktreeSlug,
-        directory,
-        contentType: request.headers["content-type"],
-        body: bodyToJson(request.body),
-        headers: redactProxyHeadersForLogs(headers),
-      },
-      "Proxy -> OpenCode request",
-    )
-  }
+      // OpenCode expects the *full* path; we send it via header to avoid query tampering.
+      const isNonASCII = /[^\x00-\x7F]/.test(directory)
+      const encodedDirectory = isNonASCII ? encodeURIComponent(directory) : directory
 
-  const init: any = {
-    method: request.method,
-    headers,
-    redirect: "manual",
-  }
+      // Overwrite any client-provided value (case-insensitive headers are normalized by Node).
+      ;(headers as Record<string, unknown>)["x-opencode-directory"] = encodedDirectory
 
-  if (request.method !== "GET" && request.method !== "HEAD") {
-    const body = toProxyRequestBody(request.body)
-    if (body !== undefined) {
-      init.body = body
-      init.duplex = "half"
-    }
-  }
+      if (logger.isLevelEnabled("trace")) {
+        const outgoing: Record<string, unknown> = {}
+        for (const [key, value] of Object.entries(headers as Record<string, unknown>)) {
+          outgoing[key] = value
+        }
 
-  try {
-    const response = await fetch(targetUrl, init)
-    reply.code(response.status)
-    applyInstanceProxyResponseHeaders(reply, response)
+        // Redact sensitive headers.
+        for (const key of Object.keys(outgoing)) {
+          const lower = key.toLowerCase()
+          if (lower === "authorization" || lower === "cookie" || lower === "set-cookie") {
+            outgoing[key] = "<redacted>"
+          }
+        }
 
-    if (!response.body || request.method === "HEAD") {
-      reply.send()
-      return
-    }
+        logger.trace(
+          {
+            workspaceId,
+            method: request.method,
+            targetUrl,
+            worktreeSlug,
+            directory,
+            contentType: request.headers["content-type"],
+            body: bodyToJson(request.body),
+            headers: outgoing,
+          },
+          "Proxy -> OpenCode request",
+        )
+      }
 
-    reply.hijack()
-    reply.raw.writeHead(reply.statusCode, toOutgoingHeaders(reply.getHeaders()))
-    await pipeline(Readable.fromWeb(response.body as any), reply.raw)
-  } catch (error) {
-    logger.error({ err: error, workspaceId, targetUrl }, "Failed to proxy workspace request")
-    if (!reply.sent) {
-      reply.code(502).send({ error: "Workspace instance proxy failed" })
-    }
-  }
+      return headers
+    },
+    onError: (proxyReply, { error }) => {
+      logger.error({ err: error, workspaceId, targetUrl }, "Failed to proxy workspace request")
+      if (!proxyReply.sent) {
+        proxyReply.code(502).send({ error: "Workspace instance proxy failed" })
+      }
+    },
+  })
 }
 
 function extractOpencodeDirectoryOverride(pathSuffix: string | undefined): {
@@ -772,6 +667,52 @@ function normalizeInstanceSuffix(pathSuffix: string | undefined) {
   return trimmed.length === 0 ? "/" : `/${trimmed}`
 }
 
+type WorktreeCacheEntry = {
+  expiresAt: number
+  repoRoot: string
+  worktrees: Array<{ slug: string; directory: string }>
+}
+
+const WORKTREE_CACHE_TTL_MS = 2000
+const worktreeCache = new Map<string, WorktreeCacheEntry>()
+
+async function getCachedWorktrees(params: { workspaceId: string; workspacePath: string; logger: Logger }) {
+  const cached = worktreeCache.get(params.workspaceId)
+  const now = Date.now()
+  if (cached && cached.expiresAt > now) {
+    return cached
+  }
+
+  const { repoRoot } = await resolveRepoRoot(params.workspacePath, params.logger)
+  const worktrees = await listWorktrees({ repoRoot, workspaceFolder: params.workspacePath, logger: params.logger })
+  const entry: WorktreeCacheEntry = {
+    expiresAt: now + WORKTREE_CACHE_TTL_MS,
+    repoRoot,
+    worktrees: worktrees.map((wt) => ({ slug: wt.slug, directory: wt.directory })),
+  }
+  worktreeCache.set(params.workspaceId, entry)
+  return entry
+}
+
+async function resolveWorktreeDirectory(params: {
+  workspaceId: string
+  workspacePath: string
+  worktreeSlug: string
+  logger: Logger
+}): Promise<string | null> {
+  const { worktreeSlug } = params
+  const cached = await getCachedWorktrees({ workspaceId: params.workspaceId, workspacePath: params.workspacePath, logger: params.logger })
+  const match = cached.worktrees.find((wt) => wt.slug === worktreeSlug)
+  if (match) {
+    return match.directory
+  }
+
+  // If the slug is new (e.g., created moments ago), refresh once.
+  worktreeCache.delete(params.workspaceId)
+  const refreshed = await getCachedWorktrees({ workspaceId: params.workspaceId, workspacePath: params.workspacePath, logger: params.logger })
+  return refreshed.worktrees.find((wt) => wt.slug === worktreeSlug)?.directory ?? null
+}
+
 function setupStaticUi(app: FastifyInstance, uiDir: string, authManager: AuthManager) {
   if (!uiDir) {
     app.log.warn("UI static directory not provided; API endpoints only")
@@ -869,364 +810,8 @@ function isApiRequest(rawUrl: string | null | undefined) {
 function buildProxyHeaders(headers: FastifyRequest["headers"]): Record<string, string> {
   const result: Record<string, string> = {}
   for (const [key, value] of Object.entries(headers ?? {})) {
-    const lower = key.toLowerCase()
-    if (!value || lower === "host" || isHopByHopHeader(lower)) continue
+    if (!value || key.toLowerCase() === "host") continue
     result[key] = Array.isArray(value) ? value.join(",") : value
   }
   return result
 }
-
-function toProxyRequestBody(body: unknown): any {
-  if (body == null) {
-    return undefined
-  }
-  if (typeof (body as { pipe?: unknown }).pipe === "function") {
-    return body
-  }
-  if (typeof (body as { [Symbol.asyncIterator]?: unknown })[Symbol.asyncIterator] === "function") {
-    return body
-  }
-  if (Buffer.isBuffer(body) || typeof body === "string" || body instanceof Uint8Array) {
-    return body
-  }
-  return JSON.stringify(body)
-}
-
-function buildWorkspaceInstanceProxyHeaders(
-  headers: FastifyRequest["headers"],
-  instanceAuthHeader: string | undefined,
-  directory: string,
-): Record<string, string> {
-  const next = buildProxyHeaders(headers)
-  if (instanceAuthHeader) {
-    next.authorization = instanceAuthHeader
-  }
-
-  const isNonASCII = /[^\x00-\x7F]/.test(directory)
-  next["x-opencode-directory"] = isNonASCII ? encodeURIComponent(directory) : directory
-  return next
-}
-
-function redactProxyHeadersForLogs(headers: Record<string, string>): Record<string, string> {
-  const outgoing = { ...headers }
-  for (const key of Object.keys(outgoing)) {
-    const lower = key.toLowerCase()
-    if (lower === "authorization" || lower === "cookie" || lower === "set-cookie") {
-      outgoing[key] = "<redacted>"
-    }
-  }
-  return outgoing
-}
-
-function applyInstanceProxyResponseHeaders(reply: FastifyReply, response: any) {
-  response.headers.forEach((value: string, key: string) => {
-    const lower = key.toLowerCase()
-    if (isHopByHopHeader(lower) || lower === "content-length" || lower === "content-encoding") {
-      return
-    }
-
-    reply.header(key, value)
-  })
-}
-
-function toOutgoingHeaders(headers: ReturnType<FastifyReply["getHeaders"]>): Record<string, string | string[]> {
-  const next: Record<string, string | string[]> = {}
-  for (const [key, value] of Object.entries(headers)) {
-    if (value === undefined) {
-      continue
-    }
-    next[key] = Array.isArray(value) ? value.map(String) : String(value)
-  }
-  return next
-}
-
-function isHopByHopHeader(name: string): boolean {
-  return new Set([
-    "connection",
-    "keep-alive",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "te",
-    "trailer",
-    "transfer-encoding",
-    "upgrade",
-  ]).has(name)
-}
-
-async function proxySideCarRequest(args: {
-  request: FastifyRequest
-  reply: FastifyReply
-  sidecarManager: SideCarManager
-  logger: Logger
-  pathSuffix?: string
-}) {
-  const sidecarId = (args.request.params as { id?: string }).id ?? ""
-  const sidecar = await args.sidecarManager.get(sidecarId)
-  if (!sidecar) {
-    args.reply.code(404).send({ error: "SideCar not found" })
-    return
-  }
-
-  const pathname = (args.request.raw.url ?? args.request.url ?? "").split("?")[0] ?? ""
-  const queryIndex = (args.request.raw.url ?? args.request.url ?? "").indexOf("?")
-  const search = queryIndex >= 0 ? (args.request.raw.url ?? args.request.url ?? "").slice(queryIndex) : ""
-  const pathSuffix = args.pathSuffix ?? ""
-  const requestPath = pathSuffix ? `${args.sidecarManager.buildProxyBasePath(sidecarId)}/${pathSuffix.replace(/^\/+/, "")}` : args.sidecarManager.buildProxyBasePath(sidecarId)
-  const targetPath = args.sidecarManager.buildTargetPath(sidecarId, requestPath, search)
-  const targetOrigin = args.sidecarManager.buildTargetOrigin(sidecar)
-  const targetUrl = `${targetOrigin}${targetPath}`
-  args.logger.debug({ sidecarId: sidecar.id, targetUrl, pathname, prefixMode: sidecar.prefixMode }, "Proxying request to SideCar")
-
-  await args.reply.from(targetUrl, {
-    rewriteRequestHeaders: (_originalRequest, headers) =>
-      sanitizeSideCarProxyRequestHeaders(headers as Record<string, string | string[] | undefined>, targetOrigin),
-    rewriteHeaders: (headers) => rewriteSideCarResponseHeaders(headers, sidecarId, targetOrigin, sidecar.prefixMode),
-    onError: (reply, { error }) => {
-      args.logger.error({ sidecarId: sidecar.id, err: error, targetUrl }, "Failed to proxy SideCar request")
-      if (!reply.sent) {
-        reply.code(502).send({ error: "SideCar proxy failed" })
-      }
-    },
-  })
-}
-
-function parseSideCarUpgradePath(rawUrl: string): { sidecarId: string; pathname: string; search: string } | null {
-  let parsed: URL
-  try {
-    parsed = new URL(rawUrl, "http://localhost")
-  } catch {
-    return null
-  }
-
-  const match = parsed.pathname.match(/^\/sidecars\/([^/]+)(?:\/.*)?$/)
-  if (!match) {
-    return null
-  }
-
-  try {
-    return {
-      sidecarId: decodeURIComponent(match[1] ?? ""),
-      pathname: parsed.pathname,
-      search: parsed.search,
-    }
-  } catch {
-    return null
-  }
-}
-
-async function proxySideCarWebSocketUpgrade(args: {
-  request: import("http").IncomingMessage
-  socket: Socket
-  head: Buffer
-  sidecarId: string
-  incomingPath: string
-  search: string
-  sidecarManager: SideCarManager
-  authManager: AuthManager
-  logger: Logger
-}) {
-  const { request, socket, head, sidecarId, incomingPath, search, sidecarManager, authManager, logger } = args
-
-  if (!isWebSocketUpgradeRequest(request)) {
-    rejectUpgrade(socket, 400, "Bad Request")
-    return
-  }
-
-  const session = authManager.getSessionFromHeaders(request.headers)
-  if (!session) {
-    rejectUpgrade(socket, 401, "Unauthorized")
-    return
-  }
-
-  const sidecar = await sidecarManager.get(sidecarId)
-  if (!sidecar) {
-    rejectUpgrade(socket, 404, "Not Found")
-    return
-  }
-
-  const targetOrigin = sidecarManager.buildTargetOrigin(sidecar)
-  const targetPath = sidecarManager.buildTargetPath(sidecarId, incomingPath, search)
-  const targetUrl = new URL(`${targetOrigin}${targetPath}`)
-  logger.debug({ sidecarId, targetUrl: targetUrl.toString(), prefixMode: sidecar.prefixMode }, "Proxying websocket to SideCar")
-
-  const { socket: upstream, readyEvent } = createSideCarUpstreamSocket(targetUrl)
-
-  const closeBoth = () => {
-    if (!socket.destroyed) {
-      socket.destroy()
-    }
-    if (!upstream.destroyed) {
-      upstream.destroy()
-    }
-  }
-
-  upstream.once("error", (error) => {
-    logger.error({ sidecarId, err: error, targetUrl: targetUrl.toString() }, "Failed to proxy SideCar websocket")
-    rejectUpgrade(socket, 502, "Bad Gateway")
-    if (!upstream.destroyed) {
-      upstream.destroy()
-    }
-  })
-
-  socket.once("error", (error) => {
-    logger.debug({ sidecarId, err: error }, "SideCar websocket client socket errored")
-    if (!upstream.destroyed) {
-      upstream.destroy()
-    }
-  })
-
-  upstream.once(readyEvent, () => {
-    try {
-      upstream.write(buildSideCarWebSocketRequest(request, targetUrl))
-      if (head.length > 0) {
-        upstream.write(head)
-      }
-      upstream.pipe(socket)
-      socket.pipe(upstream)
-    } catch (error) {
-      logger.error({ sidecarId, err: error, targetUrl: targetUrl.toString() }, "Failed to forward SideCar websocket upgrade")
-      closeBoth()
-    }
-  })
-
-  upstream.once("close", () => {
-    if (!socket.destroyed) {
-      socket.end()
-    }
-  })
-
-  socket.once("close", () => {
-    if (!upstream.destroyed) {
-      upstream.end()
-    }
-  })
-}
-
-function createSideCarUpstreamSocket(targetUrl: URL): { socket: Socket | TLSSocket; readyEvent: "connect" | "secureConnect" } {
-  const port = Number(targetUrl.port || (targetUrl.protocol === "https:" ? 443 : 80))
-  if (targetUrl.protocol === "https:") {
-    return {
-      socket: connectTls({
-        host: targetUrl.hostname,
-        port,
-        servername: targetUrl.hostname,
-      }),
-      readyEvent: "secureConnect",
-    }
-  }
-  return {
-    socket: connectTcp(port, targetUrl.hostname),
-    readyEvent: "connect",
-  }
-}
-
-function buildSideCarWebSocketRequest(request: import("http").IncomingMessage, targetUrl: URL): string {
-  const pathWithQuery = `${targetUrl.pathname}${targetUrl.search}`
-  const requestLine = `${request.method ?? "GET"} ${pathWithQuery} HTTP/${request.httpVersion}\r\n`
-  const headerLines: string[] = []
-  const rawHeaders = request.rawHeaders ?? []
-  const blockedHeaders = getBlockedSideCarRequestHeaders()
-
-  for (let index = 0; index < rawHeaders.length; index += 2) {
-    const key = rawHeaders[index]
-    const value = rawHeaders[index + 1]
-    if (!key || value === undefined) continue
-    const lower = key.toLowerCase()
-    if (blockedHeaders.has(lower)) continue
-    if (lower === "origin") {
-      headerLines.push(`Origin: ${targetUrl.origin}\r\n`)
-      continue
-    }
-    headerLines.push(`${key}: ${value}\r\n`)
-  }
-
-  const hostValue = targetUrl.port ? `${targetUrl.hostname}:${targetUrl.port}` : targetUrl.hostname
-  headerLines.push(`Host: ${hostValue}\r\n`)
-  headerLines.push("\r\n")
-
-  return requestLine + headerLines.join("")
-}
-
-function isWebSocketUpgradeRequest(request: import("http").IncomingMessage): boolean {
-  const upgrade = request.headers.upgrade
-  if (typeof upgrade !== "string" || upgrade.toLowerCase() !== "websocket") {
-    return false
-  }
-  const connection = request.headers.connection
-  const connectionValue = Array.isArray(connection) ? connection.join(",") : connection ?? ""
-  return connectionValue.toLowerCase().split(",").map((part) => part.trim()).includes("upgrade")
-}
-
-function rejectUpgrade(socket: Socket, statusCode: number, statusText: string) {
-  if (socket.destroyed) {
-    return
-  }
-  socket.write(`HTTP/1.1 ${statusCode} ${statusText}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`)
-  socket.destroy()
-}
-
-function rewriteSideCarResponseHeaders(
-  headers: Record<string, string | string[] | undefined>,
-  sidecarId: string,
-  targetOrigin: string,
-  prefixMode: "strip" | "preserve",
-) {
-  if (prefixMode === "preserve") {
-    return headers
-  }
-
-  const next = { ...headers }
-  const locationHeader = next.location
-  const location = Array.isArray(locationHeader) ? locationHeader[0] : locationHeader
-  if (!location) {
-    return next
-  }
-
-  const publicBase = `/sidecars/${encodeURIComponent(sidecarId)}`
-
-  if (location.startsWith("/")) {
-    next.location = `${publicBase}${location}`
-    return next
-  }
-
-  try {
-    const parsed = new URL(location)
-    if (parsed.origin === targetOrigin) {
-      next.location = `${publicBase}${parsed.pathname}${parsed.search}${parsed.hash}`
-    }
-  } catch {
-    // Relative redirects should continue to resolve against the public sidecar path.
-  }
-
-  return next
-}
-
-function sanitizeSideCarProxyRequestHeaders(
-  headers: Record<string, string | string[] | undefined>,
-  targetOrigin: string,
-): Record<string, string | string[] | undefined> {
-  const blockedHeaders = getBlockedSideCarRequestHeaders()
-  const next: Record<string, string | string[] | undefined> = {}
-
-  for (const [key, value] of Object.entries(headers)) {
-    if (!value) continue
-    if (blockedHeaders.has(key.toLowerCase())) continue
-    next[key] = value
-  }
-
-  next.origin = targetOrigin
-  return next
-}
-
-function getBlockedSideCarRequestHeaders(): Set<string> {
-  return new Set([
-    "host",
-    "authorization",
-    "proxy-authorization",
-    "forwarded",
-    "x-forwarded-for",
-    "x-forwarded-host",
-    "x-forwarded-port",
-    "x-forwarded-proto",
-  ])
-}

packages/server/src/server/remote-proxy.ts

@@ -1,566 +0,0 @@
-import Fastify, { type FastifyInstance, type FastifyReply, type FastifyRequest } from "fastify"
-import { randomBytes, randomUUID } from "crypto"
-import { Readable } from "stream"
-import { pipeline } from "stream/promises"
-import { Agent, fetch } from "undici"
-import type { AuthManager } from "../auth/manager"
-import type { Logger } from "../logger"
-
-const LOOPBACK_HOST = "127.0.0.1"
-const BOOTSTRAP_PAGE_PATH = "/__codenomad/auth/token"
-const BOOTSTRAP_EXCHANGE_PATH = "/__codenomad/api/auth/token"
-const SESSION_IDLE_TTL_MS = 30 * 60_000
-
-interface RemoteProxySession {
-  id: string
-  bootstrapToken: string
-  targetBaseUrl: URL
-  skipTlsVerify: boolean
-  localBaseUrl: URL
-  entryUrl: URL
-  bootstrapUrl: string
-  activated: boolean
-  cookiePrefix: string
-  app: FastifyInstance
-  dispatcher?: Agent
-  createdAt: number
-  lastAccessAt: number
-}
-
-export interface RemoteProxySessionManagerOptions {
-  authManager: AuthManager
-  logger: Logger
-  httpsOptions?: { key: string | Buffer; cert: string | Buffer; ca?: string | Buffer }
-}
-
-export interface RemoteProxySessionCreateResult {
-  sessionId: string
-  windowUrl: string
-}
-
-export class RemoteProxySessionManager {
-  private readonly sessions = new Map<string, RemoteProxySession>()
-  private readonly cleanupTimer: NodeJS.Timeout
-
-  constructor(private readonly options: RemoteProxySessionManagerOptions) {
-    this.cleanupTimer = setInterval(() => {
-      void this.cleanupExpiredSessions()
-    }, 60_000)
-    this.cleanupTimer.unref()
-  }
-
-  async createSession(baseUrl: string, skipTlsVerify: boolean): Promise<RemoteProxySessionCreateResult> {
-    if (!this.options.httpsOptions) {
-      throw new Error("Local HTTPS is required for remote proxy sessions")
-    }
-
-    const targetBaseUrl = normalizeBaseUrl(baseUrl)
-    const sessionId = randomUUID()
-    const bootstrapToken = randomBytes(32).toString("base64url")
-    const dispatcher = skipTlsVerify ? new Agent({ connect: { rejectUnauthorized: false } }) : undefined
-    const app = Fastify({ logger: false, https: this.options.httpsOptions })
-    let session: RemoteProxySession | null = null
-
-    app.removeAllContentTypeParsers()
-    // Preserve raw request bodies for proxying while still letting token JSON parse from Buffer.
-    app.addContentTypeParser("*", { parseAs: "buffer" }, (_req, body, done) => done(null, body))
-
-    app.get(BOOTSTRAP_PAGE_PATH, async (request, reply) => {
-      if (!this.options.authManager.isLoopbackRequest(request)) {
-        reply.code(404).send({ error: "Not found" })
-        return
-      }
-
-      reply.header("Cache-Control", "no-store")
-      reply.header("Pragma", "no-cache")
-      reply.header("Expires", "0")
-      reply.type("text/html").send(buildBootstrapPageHtml())
-    })
-
-    app.post(BOOTSTRAP_EXCHANGE_PATH, async (request, reply) => {
-      if (!this.options.authManager.isLoopbackRequest(request)) {
-        reply.code(404).send({ error: "Not found" })
-        return
-      }
-
-      if (!session) {
-        reply.code(503).send({ error: "Remote proxy session is unavailable" })
-        return
-      }
-
-      const body = parseTokenBody(request.body)
-      if (body.token !== session.bootstrapToken) {
-        reply.code(401).send({ error: "Invalid token" })
-        return
-      }
-
-      session.activated = true
-      session.lastAccessAt = Date.now()
-      reply.send({ ok: true })
-    })
-
-    app.all("/*", async (request, reply) => {
-      if (!session) {
-        reply.code(503).send({ error: "Remote proxy session is unavailable" })
-        return
-      }
-
-      if (!session.activated) {
-        reply.code(403).send({ error: "Remote proxy session is not activated" })
-        return
-      }
-
-      session.lastAccessAt = Date.now()
-      await proxyRequest({ request, reply, session, logger: this.options.logger })
-    })
-
-    app.setNotFoundHandler(async (request, reply) => {
-      if (!session) {
-        reply.code(503).send({ error: "Remote proxy session is unavailable" })
-        return
-      }
-
-      if (!session.activated) {
-        reply.code(403).send({ error: "Remote proxy session is not activated" })
-        return
-      }
-
-      session.lastAccessAt = Date.now()
-      await proxyRequest({ request, reply, session, logger: this.options.logger })
-    })
-
-    const addressInfo = await app.listen({ host: LOOPBACK_HOST, port: 0 })
-    const address = new URL(addressInfo)
-    const localBaseUrl = new URL(`https://${LOOPBACK_HOST}:${address.port}`)
-    const entryUrl = new URL(targetBaseUrl.pathname || "/", localBaseUrl)
-    const returnTo = buildReturnToTarget(entryUrl)
-
-    session = {
-      id: sessionId,
-      bootstrapToken,
-      targetBaseUrl,
-      skipTlsVerify,
-      localBaseUrl,
-      entryUrl,
-      bootstrapUrl: `${localBaseUrl.origin}${BOOTSTRAP_PAGE_PATH}?returnTo=${encodeURIComponent(returnTo)}#${encodeURIComponent(bootstrapToken)}`,
-      activated: false,
-      cookiePrefix: `cnrp_${randomBytes(6).toString("hex")}_`,
-      app,
-      dispatcher,
-      createdAt: Date.now(),
-      lastAccessAt: Date.now(),
-    }
-
-    this.sessions.set(sessionId, session)
-    this.options.logger.info(
-      { sessionId, targetBaseUrl: targetBaseUrl.toString(), localBaseUrl: localBaseUrl.toString() },
-      "Created remote proxy session",
-    )
-
-    return { sessionId, windowUrl: session.bootstrapUrl }
-  }
-
-  async deleteSession(sessionId: string): Promise<boolean> {
-    return this.disposeSession(sessionId)
-  }
-
-  private async cleanupExpiredSessions() {
-    const now = Date.now()
-    for (const session of Array.from(this.sessions.values())) {
-      if (now - session.lastAccessAt <= SESSION_IDLE_TTL_MS) {
-        continue
-      }
-      await this.disposeSession(session.id)
-    }
-  }
-
-  private async disposeSession(sessionId: string): Promise<boolean> {
-    const session = this.sessions.get(sessionId)
-    if (!session) {
-      return false
-    }
-
-    this.sessions.delete(sessionId)
-    session.dispatcher?.close().catch(() => {})
-    await session.app.close().catch(() => {})
-    this.options.logger.info({ sessionId }, "Disposed remote proxy session")
-    return true
-  }
-}
-
-function normalizeBaseUrl(input: string): URL {
-  const parsed = new URL(input.trim())
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error("Server URL must use http:// or https://")
-  }
-
-  parsed.hash = ""
-  parsed.search = ""
-  parsed.pathname = parsed.pathname === "/" ? "/" : parsed.pathname.replace(/\/+$/, "") || "/"
-  return parsed
-}
-
-function buildReturnToTarget(entryUrl: URL): string {
-  const query = entryUrl.search ? entryUrl.search : ""
-  return `${entryUrl.pathname || "/"}${query}`
-}
-
-function buildBootstrapPageHtml(): string {
-  return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>CodeNomad</title>
-    <style>
-      body { font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial; background: #0b0b0f; color: #fff; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; }
-      .card { width: 420px; max-width: calc(100vw - 32px); background: #14141c; border: 1px solid rgba(255,255,255,0.08); border-radius: 14px; padding: 24px; }
-      h1 { font-size: 18px; margin: 0 0 12px; }
-      p { margin: 0; color: rgba(255,255,255,0.7); font-size: 13px; line-height: 1.4; }
-      .error { margin-top: 12px; color: #ff6b6b; font-size: 13px; display: none; }
-    </style>
-  </head>
-  <body>
-    <div class="card">
-      <h1>Connecting...</h1>
-      <p>Finalizing local authentication.</p>
-      <div id="error" class="error"></div>
-    </div>
-    <script>
-      const token = decodeURIComponent((location.hash || "").replace(/^#/, "").trim())
-      const params = new URLSearchParams(location.search)
-      const returnTo = sanitizeReturnTo(params.get("returnTo"))
-      const errorEl = document.getElementById("error")
-
-      function sanitizeReturnTo(value) {
-        if (!value || typeof value !== "string") return "/"
-        if (!value.startsWith("/")) return "/"
-        if (value.startsWith("//")) return "/"
-        return value
-      }
-
-      function showError(message) {
-        errorEl.textContent = message
-        errorEl.style.display = "block"
-      }
-
-      async function run() {
-        if (!token) {
-          showError("Missing bootstrap token.")
-          return
-        }
-
-        try {
-          const res = await fetch("${BOOTSTRAP_EXCHANGE_PATH}", {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ token }),
-            credentials: "include",
-          })
-
-          if (!res.ok) {
-            let message = ""
-            try {
-              const json = await res.json()
-              message = json && json.error ? String(json.error) : ""
-            } catch {
-              message = ""
-            }
-            showError(message || "Token exchange failed (" + res.status + ")")
-            return
-          }
-
-          window.location.replace(returnTo)
-        } catch (error) {
-          showError(error && error.message ? error.message : String(error))
-        }
-      }
-
-      run()
-    </script>
-  </body>
-</html>`
-}
-
-function parseTokenBody(body: unknown): { token: string } {
-  const value = normalizeJsonBody(body) as { token?: unknown } | null | undefined
-  const token = typeof value?.token === "string" ? value.token.trim() : ""
-  if (!token) {
-    throw new Error("Missing bootstrap token")
-  }
-  return { token }
-}
-
-function normalizeJsonBody(body: unknown): unknown {
-  if (Buffer.isBuffer(body)) {
-    return JSON.parse(body.toString("utf-8"))
-  }
-  if (typeof body === "string") {
-    return JSON.parse(body)
-  }
-  return body
-}
-
-function toRequestBody(body: unknown): any {
-  if (body == null) {
-    return undefined
-  }
-  if (Buffer.isBuffer(body) || typeof body === "string" || body instanceof Uint8Array) {
-    return body
-  }
-  return JSON.stringify(body)
-}
-
-async function proxyRequest(args: {
-  request: FastifyRequest
-  reply: FastifyReply
-  session: RemoteProxySession
-  logger: Logger
-}) {
-  const { request, reply, session, logger } = args
-  const upstreamUrl = buildUpstreamUrl(session.targetBaseUrl, request.raw.url ?? request.url)
-  const headers = filterRequestHeaders(request.headers, session)
-
-  const init: any = {
-    method: request.method,
-    headers,
-    dispatcher: session.dispatcher,
-    redirect: "manual",
-  }
-
-  if (request.method !== "GET" && request.method !== "HEAD") {
-    const body = toRequestBody(request.body)
-    if (body !== undefined) {
-      init.body = body
-      init.duplex = "half"
-    }
-  }
-
-  try {
-    const response = await fetch(upstreamUrl, init as any)
-    reply.code(response.status)
-    applyResponseHeaders(reply, response, session)
-
-    if (!response.body || request.method === "HEAD") {
-      reply.send()
-      return
-    }
-
-    reply.hijack()
-    reply.raw.writeHead(reply.statusCode, toOutgoingHeaders(reply.getHeaders()))
-    await pipeline(Readable.fromWeb(response.body as any), reply.raw)
-  } catch (error) {
-    logger.error({ err: error, upstreamUrl }, "Failed to proxy remote session request")
-    if (!reply.sent) {
-      reply.code(502).send({ error: "Remote proxy request failed" })
-    }
-  }
-}
-
-function buildUpstreamUrl(baseUrl: URL, rawUrl: string): string {
-  const parsed = new URL(rawUrl, "https://localhost")
-  const url = new URL(baseUrl.toString())
-  url.pathname = rewriteRequestPath(baseUrl, parsed.pathname)
-  url.search = stripInternalQuery(parsed.search)
-  url.hash = ""
-  return url.toString()
-}
-
-function rewriteRequestPath(baseUrl: URL, requestPath: string): string {
-  const basePath = normalizedBasePath(baseUrl)
-  if (basePath === "/") {
-    return requestPath
-  }
-
-  if (requestPath === "/") {
-    return basePath
-  }
-
-  if (pathHasBasePrefix(basePath, requestPath)) {
-    return requestPath
-  }
-
-  return `${basePath}${requestPath}`
-}
-
-function normalizedBasePath(baseUrl: URL): string {
-  return baseUrl.pathname || "/"
-}
-
-function pathHasBasePrefix(basePath: string, requestPath: string): boolean {
-  return requestPath === basePath || requestPath.startsWith(`${basePath}/`)
-}
-
-function stripInternalQuery(search: string): string {
-  if (!search || search === "?") {
-    return ""
-  }
-  return search
-}
-
-function filterRequestHeaders(
-  headers: FastifyRequest["headers"],
-  session: RemoteProxySession,
-): Record<string, string> {
-  const next: Record<string, string> = {}
-  for (const [key, value] of Object.entries(headers ?? {})) {
-    if (!value) continue
-    const lower = key.toLowerCase()
-    if (
-      isHopByHopHeader(lower) ||
-      lower === "host" ||
-      lower === "content-length" ||
-      lower === "accept-encoding"
-    ) {
-      continue
-    }
-    if (lower === "origin") {
-      next[key] = session.targetBaseUrl.origin
-      continue
-    }
-    if (lower === "referer") {
-      const rewritten = rewriteRefererHeader(Array.isArray(value) ? value[0] : value, session.targetBaseUrl)
-      if (rewritten) {
-        next[key] = rewritten
-      }
-      continue
-    }
-    if (lower === "cookie") {
-      const rewritten = rewriteRequestCookieHeader(Array.isArray(value) ? value.join("; ") : value, session.cookiePrefix)
-      if (rewritten) {
-        next[key] = rewritten
-      }
-      continue
-    }
-    next[key] = Array.isArray(value) ? value.join(",") : value
-  }
-
-  next.host = session.targetBaseUrl.port ? `${session.targetBaseUrl.hostname}:${session.targetBaseUrl.port}` : session.targetBaseUrl.hostname
-  if (!next.origin) {
-    next.origin = session.targetBaseUrl.origin
-  }
-  return next
-}
-
-function rewriteRefererHeader(referer: string | undefined, targetBaseUrl: URL): string | null {
-  if (!referer) {
-    return null
-  }
-
-  try {
-    const parsed = new URL(referer)
-    const rewritten = new URL(targetBaseUrl.toString())
-    rewritten.pathname = rewriteRequestPath(targetBaseUrl, parsed.pathname)
-    rewritten.search = parsed.search
-    rewritten.hash = parsed.hash
-    return rewritten.toString()
-  } catch {
-    return null
-  }
-}
-
-function applyResponseHeaders(reply: FastifyReply, response: any, session: RemoteProxySession) {
-  const setCookie = (response.headers as any).getSetCookie?.() as string[] | undefined
-  if (Array.isArray(setCookie)) {
-    for (const cookie of setCookie) {
-      reply.header("set-cookie", rewriteSetCookie(cookie, session.cookiePrefix))
-    }
-  }
-
-  response.headers.forEach((value: string, key: string) => {
-    const lower = key.toLowerCase()
-    if (
-      isHopByHopHeader(lower) ||
-      lower === "set-cookie" ||
-      lower === "content-length" ||
-      lower === "content-encoding"
-    ) {
-      return
-    }
-
-    if (lower === "location") {
-      reply.header(key, rewriteLocation(value, session.targetBaseUrl, session.localBaseUrl))
-      return
-    }
-
-    reply.header(key, value)
-  })
-}
-
-function toOutgoingHeaders(headers: ReturnType<FastifyReply["getHeaders"]>): Record<string, string | string[]> {
-  const next: Record<string, string | string[]> = {}
-  for (const [key, value] of Object.entries(headers)) {
-    if (value === undefined) {
-      continue
-    }
-    next[key] = Array.isArray(value) ? value.map(String) : String(value)
-  }
-  return next
-}
-
-function rewriteSetCookie(cookie: string, cookiePrefix: string): string {
-  const parts = cookie.split(";").map((part) => part.trim())
-  const first = parts.shift() ?? ""
-  const separator = first.indexOf("=")
-  if (separator <= 0) {
-    return cookie
-  }
-
-  const name = first.slice(0, separator).trim()
-  const value = first.slice(separator + 1)
-  const rewritten = [`${cookiePrefix}${name}=${value}`]
-  for (const part of parts) {
-    if (part.slice(0, 7).toLowerCase().startsWith("domain=")) {
-      continue
-    }
-    rewritten.push(part)
-  }
-  return rewritten.join("; ")
-}
-
-function rewriteRequestCookieHeader(cookieHeader: string, cookiePrefix: string): string {
-  const next: string[] = []
-  for (const rawPart of cookieHeader.split(";")) {
-    const part = rawPart.trim()
-    if (!part) continue
-    const separator = part.indexOf("=")
-    if (separator <= 0) continue
-    const name = part.slice(0, separator).trim()
-    const value = part.slice(separator + 1)
-    if (!name.startsWith(cookiePrefix)) {
-      continue
-    }
-    next.push(`${name.slice(cookiePrefix.length)}=${value}`)
-  }
-  return next.join("; ")
-}
-
-function rewriteLocation(location: string, targetBaseUrl: URL, localBaseUrl: URL): string {
-  try {
-    const parsed = new URL(location, targetBaseUrl)
-    if (parsed.origin !== targetBaseUrl.origin) {
-      return location
-    }
-
-    const rewritten = new URL(localBaseUrl.toString())
-    rewritten.pathname = parsed.pathname
-    rewritten.search = parsed.search
-    rewritten.hash = parsed.hash
-    return rewritten.toString()
-  } catch {
-    return location
-  }
-}
-
-function isHopByHopHeader(name: string): boolean {
-  return new Set([
-    "connection",
-    "keep-alive",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "te",
-    "trailer",
-    "transfer-encoding",
-    "upgrade",
-  ]).has(name)
-}

packages/server/src/server/routes/auth.ts

@@ -3,7 +3,6 @@ import fs from "fs"
 import { z } from "zod"
 import type { AuthManager } from "../../auth/manager"
 import { isLoopbackAddress } from "../../auth/http-auth"
-import { resolveAuthTemplatePath } from "../../runtime-paths"
 
 interface RouteDeps {
   authManager: AuthManager
@@ -22,21 +21,21 @@ const PasswordSchema = z.object({
   password: z.string().min(8),
 })
 
-const LOGIN_TEMPLATE_PATH = resolveAuthTemplatePath(import.meta.url, "login.html")
-const TOKEN_TEMPLATE_PATH = resolveAuthTemplatePath(import.meta.url, "token.html")
+const LOGIN_TEMPLATE_URL = new URL("./auth-pages/login.html", import.meta.url)
+const TOKEN_TEMPLATE_URL = new URL("./auth-pages/token.html", import.meta.url)
 
 let cachedLoginTemplate: string | null = null
 let cachedTokenTemplate: string | null = null
 
-function readTemplate(filePath: string, cache: string | null): string {
+function readTemplate(url: URL, cache: string | null): string {
   if (cache) return cache
-  const content = fs.readFileSync(filePath, "utf-8")
+  const content = fs.readFileSync(url, "utf-8")
   return content
 }
 
 function getLoginHtml(defaultUsername: string): string {
   if (!cachedLoginTemplate) {
-    cachedLoginTemplate = readTemplate(LOGIN_TEMPLATE_PATH, null)
+    cachedLoginTemplate = readTemplate(LOGIN_TEMPLATE_URL, null)
   }
 
   const escapedUsername = escapeHtml(defaultUsername)
@@ -45,7 +44,7 @@ function getLoginHtml(defaultUsername: string): string {
 
 function getTokenHtml(): string {
   if (!cachedTokenTemplate) {
-    cachedTokenTemplate = readTemplate(TOKEN_TEMPLATE_PATH, null)
+    cachedTokenTemplate = readTemplate(TOKEN_TEMPLATE_URL, null)
   }
 
   return cachedTokenTemplate

packages/server/src/server/routes/background-processes.ts

@@ -9,21 +9,6 @@ interface RouteDeps {
 const StartSchema = z.object({
   title: z.string().trim().min(1),
   command: z.string().trim().min(1),
-  notify: z.boolean().optional(),
-  notification: z
-    .object({
-      sessionID: z.string().trim().min(1),
-      directory: z.string().trim().min(1),
-    })
-    .optional(),
-}).superRefine((value, ctx) => {
-  if (value.notify && !value.notification) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      message: "Notification metadata is required when notify is enabled",
-      path: ["notification"],
-    })
-  }
 })
 
 const OutputQuerySchema = z.object({
@@ -42,10 +27,7 @@ export function registerBackgroundProcessRoutes(app: FastifyInstance, deps: Rout
 
   app.post<{ Params: { id: string } }>("/workspaces/:id/plugin/background-processes", async (request, reply) => {
     const payload = StartSchema.parse(request.body ?? {})
-    const process = await deps.backgroundProcessManager.start(request.params.id, payload.title, payload.command, {
-      notify: payload.notify,
-      notification: payload.notification,
-    })
+    const process = await deps.backgroundProcessManager.start(request.params.id, payload.title, payload.command)
     reply.code(201)
     return process
   })

packages/server/src/server/routes/events.ts

@@ -1,32 +1,19 @@
 import { FastifyInstance } from "fastify"
-import { z } from "zod"
 import { EventBus } from "../../events/bus"
 import { WorkspaceEventPayload } from "../../api-types"
-import type { ClientConnectionManager } from "../../clients/connection-manager"
 import { Logger } from "../../logger"
 
 interface RouteDeps {
   eventBus: EventBus
   registerClient: (cleanup: () => void) => () => void
   logger: Logger
-  connectionManager: ClientConnectionManager
 }
 
 let nextClientId = 0
 
-const ConnectionQuerySchema = z.object({
-  clientId: z.string().trim().min(1),
-  connectionId: z.string().trim().min(1),
-})
-
-const PongBodySchema = ConnectionQuerySchema.extend({
-  pingTs: z.number().optional(),
-})
-
 export function registerEventRoutes(app: FastifyInstance, deps: RouteDeps) {
   app.get("/api/events", (request, reply) => {
     const clientId = ++nextClientId
-    const connection = ConnectionQuerySchema.parse(request.query ?? {})
     deps.logger.debug({ clientId }, "SSE client connected")
 
     const origin = request.headers.origin ?? "*"
@@ -48,8 +35,7 @@ export function registerEventRoutes(app: FastifyInstance, deps: RouteDeps) {
 
     const unsubscribe = deps.eventBus.onEvent(send)
     const heartbeat = setInterval(() => {
-      const ping = { ts: Date.now() }
-      reply.raw.write(`event: codenomad.client.ping\ndata: ${JSON.stringify(ping)}\n\n`)
+      reply.raw.write(`:hb ${Date.now()}\n\n`)
     }, 15000)
 
     let closed = false
@@ -63,27 +49,13 @@ export function registerEventRoutes(app: FastifyInstance, deps: RouteDeps) {
     }
 
     const unregister = deps.registerClient(close)
-    const unregisterConnection = deps.connectionManager.register({
-      ...connection,
-      close,
-    })
 
     const handleClose = () => {
       close()
       unregister()
-      unregisterConnection()
     }
 
     request.raw.on("close", handleClose)
     request.raw.on("error", handleClose)
   })
-
-  app.post("/api/client-connections/pong", (request, reply) => {
-    const body = PongBodySchema.parse(request.body ?? {})
-    if (!deps.connectionManager.pong(body)) {
-      reply.code(404).send({ error: "Client connection not found" })
-      return
-    }
-    reply.code(204).send()
-  })
 }

packages/server/src/server/routes/plugin.ts

@@ -1,19 +1,15 @@
 import { FastifyInstance } from "fastify"
 import { z } from "zod"
-import type { VoiceModeStateResponse } from "../../api-types"
 import type { WorkspaceManager } from "../../workspaces/manager"
 import type { EventBus } from "../../events/bus"
 import type { Logger } from "../../logger"
 import { PluginChannelManager } from "../../plugins/channel"
 import { buildPingEvent, handlePluginEvent } from "../../plugins/handlers"
-import { VoiceModeManager } from "../../plugins/voice-mode"
 
 interface RouteDeps {
   workspaceManager: WorkspaceManager
   eventBus: EventBus
   logger: Logger
-  channel: PluginChannelManager
-  voiceModeManager: VoiceModeManager
 }
 
 const PluginEventSchema = z.object({
@@ -21,13 +17,9 @@ const PluginEventSchema = z.object({
   properties: z.record(z.unknown()).optional(),
 })
 
-const VoiceModeStateSchema = z.object({
-  enabled: z.boolean(),
-  clientId: z.string().trim().min(1),
-  connectionId: z.string().trim().min(1),
-})
-
 export function registerPluginRoutes(app: FastifyInstance, deps: RouteDeps) {
+  const channel = new PluginChannelManager(deps.logger.child({ component: "plugin-channel" }))
+
   app.get<{ Params: { id: string } }>("/workspaces/:id/plugin/events", (request, reply) => {
     const workspace = deps.workspaceManager.get(request.params.id)
     if (!workspace) {
@@ -41,11 +33,10 @@ export function registerPluginRoutes(app: FastifyInstance, deps: RouteDeps) {
     reply.raw.flushHeaders?.()
     reply.hijack()
 
-    const registration = deps.channel.register(request.params.id, reply)
-    deps.voiceModeManager.syncInstance(request.params.id)
+    const registration = channel.register(request.params.id, reply)
 
     const heartbeat = setInterval(() => {
-      deps.channel.send(request.params.id, buildPingEvent())
+      channel.send(request.params.id, buildPingEvent())
     }, 15000)
 
     const close = () => {
@@ -58,28 +49,6 @@ export function registerPluginRoutes(app: FastifyInstance, deps: RouteDeps) {
     request.raw.on("error", close)
   })
 
-  app.post<{ Params: { id: string }; Body: VoiceModeStateResponse }>("/workspaces/:id/plugin/voice-mode", (request, reply) => {
-    const workspace = deps.workspaceManager.get(request.params.id)
-    if (!workspace) {
-      reply.code(404).send({ error: "Workspace not found" })
-      return
-    }
-
-    const payload = VoiceModeStateSchema.parse(request.body ?? {})
-    const applied = deps.voiceModeManager.setEnabled(
-      request.params.id,
-      { clientId: payload.clientId, connectionId: payload.connectionId },
-      payload.enabled,
-    )
-
-    if (payload.enabled && !applied) {
-      reply.code(409).send({ error: "Client connection not active for voice mode enable" })
-      return
-    }
-
-    return { enabled: payload.enabled }
-  })
-
   const handleWildcard = async (request: any, reply: any) => {
     const workspaceId = request.params.id as string
     const workspace = deps.workspaceManager.get(workspaceId)

packages/server/src/server/routes/remote-proxy.ts

@@ -1,54 +0,0 @@
-import type { FastifyInstance } from "fastify"
-import { z } from "zod"
-import type { RemoteProxySessionCreateResponse } from "../../api-types"
-import { isLoopbackAddress } from "../../auth/http-auth"
-import type { Logger } from "../../logger"
-import type { RemoteProxySessionManager } from "../remote-proxy"
-
-interface RouteDeps {
-  logger: Logger
-  sessionManager: RemoteProxySessionManager
-}
-
-const CreateSessionSchema = z.object({
-  baseUrl: z.string().min(1),
-  skipTlsVerify: z.boolean().optional(),
-})
-
-const SessionParamsSchema = z.object({
-  id: z.string().uuid(),
-})
-
-export function registerRemoteProxyRoutes(app: FastifyInstance, deps: RouteDeps) {
-  app.post("/api/remote-proxy/sessions", async (request, reply): Promise<RemoteProxySessionCreateResponse | { error: string }> => {
-    try {
-      const body = CreateSessionSchema.parse(request.body ?? {})
-      return await deps.sessionManager.createSession(body.baseUrl, Boolean(body.skipTlsVerify))
-    } catch (error) {
-      deps.logger.warn({ err: error }, "Failed to create remote proxy session")
-      reply.code(400)
-      return { error: error instanceof Error ? error.message : "Failed to create remote proxy session" }
-    }
-  })
-
-  app.delete("/api/remote-proxy/sessions/:id", async (request, reply): Promise<{ ok: boolean } | { error: string }> => {
-    if (!isLoopbackAddress(request.socket.remoteAddress)) {
-      reply.code(404)
-      return { error: "Not found" }
-    }
-
-    try {
-      const params = SessionParamsSchema.parse(request.params ?? {})
-      const deleted = await deps.sessionManager.deleteSession(params.id)
-      if (!deleted) {
-        reply.code(404)
-        return { error: "Remote proxy session not found" }
-      }
-      return { ok: true }
-    } catch (error) {
-      deps.logger.warn({ err: error }, "Failed to delete remote proxy session")
-      reply.code(400)
-      return { error: error instanceof Error ? error.message : "Failed to delete remote proxy session" }
-    }
-  })
-}

packages/server/src/server/routes/remote-servers.ts

@@ -1,166 +0,0 @@
-import { Agent, fetch } from "undici"
-import type { FastifyInstance } from "fastify"
-import { z } from "zod"
-import type { Logger } from "../../logger"
-import type { RemoteServerProbeResponse } from "../../api-types"
-
-interface RouteDeps {
-  logger: Logger
-}
-
-const ProbeSchema = z.object({
-  baseUrl: z.string().min(1),
-  skipTlsVerify: z.boolean().optional(),
-})
-
-const PROBE_TIMEOUT_MS = 8_000
-
-export function registerRemoteServerRoutes(app: FastifyInstance, deps: RouteDeps) {
-  app.post("/api/remote-servers/probe", async (request, reply) => {
-    try {
-      const body = ProbeSchema.parse(request.body ?? {})
-      return await probeRemoteServer(body.baseUrl, Boolean(body.skipTlsVerify))
-    } catch (error) {
-      deps.logger.warn({ err: error }, "Failed to probe remote server")
-      reply.code(400)
-      return { error: error instanceof Error ? error.message : "Invalid request" }
-    }
-  })
-}
-
-async function probeRemoteServer(baseUrl: string, skipTlsVerify: boolean): Promise<RemoteServerProbeResponse> {
-  const normalizedUrl = normalizeBaseUrl(baseUrl)
-  const probeUrl = new URL("./api/auth/status", `${normalizedUrl}/`)
-  const controller = new AbortController()
-  const timeout = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS)
-  const dispatcher = skipTlsVerify ? new Agent({ connect: { rejectUnauthorized: false } }) : undefined
-
-  try {
-    const response = await fetch(probeUrl, {
-      method: "GET",
-      dispatcher,
-      signal: controller.signal,
-      headers: {
-        Accept: "application/json",
-      },
-    })
-
-    if (!response.ok) {
-      return {
-        ok: false,
-        reachable: true,
-        normalizedUrl,
-        skipTlsVerify,
-        requiresAuth: false,
-        authenticated: false,
-        error: `Remote server returned HTTP ${response.status}`,
-        errorCode: "http_error",
-      }
-    }
-
-    const payload = (await response.json()) as { authenticated?: unknown }
-    if (typeof payload?.authenticated !== "boolean") {
-      return {
-        ok: false,
-        reachable: true,
-        normalizedUrl,
-        skipTlsVerify,
-        requiresAuth: false,
-        authenticated: false,
-        error: "Remote server did not return a valid CodeNomad auth response",
-        errorCode: "invalid_server",
-      }
-    }
-
-    return {
-      ok: true,
-      reachable: true,
-      normalizedUrl,
-      skipTlsVerify,
-      requiresAuth: !payload.authenticated,
-      authenticated: payload.authenticated,
-    }
-  } catch (error) {
-    const message = describeProbeError(error)
-    return {
-      ok: false,
-      reachable: false,
-      normalizedUrl,
-      skipTlsVerify,
-      requiresAuth: false,
-      authenticated: false,
-      error: message.message,
-      errorCode: message.code,
-    }
-  } finally {
-    clearTimeout(timeout)
-    await dispatcher?.close().catch(() => {})
-  }
-}
-
-function normalizeBaseUrl(input: string): string {
-  const parsed = new URL(input.trim())
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error("Server URL must use http:// or https://")
-  }
-
-  parsed.hash = ""
-  parsed.search = ""
-  parsed.pathname = parsed.pathname === "/" ? "/" : parsed.pathname.replace(/\/+$/, "") || "/"
-  const value = parsed.toString()
-  return parsed.pathname === "/" ? value.replace(/\/$/, "") : value.replace(/\/$/, "")
-}
-
-function describeProbeError(error: unknown): { code: string; message: string } {
-  const chain = unwrapErrorChain(error)
-  const detailed =
-    chain.find((entry) => {
-      const code = (entry?.code ?? "").toString()
-      return Boolean(code) && code !== "UND_ERR_RESPONSE_STATUS_CODE"
-    }) ?? chain[0]
-
-  const code = (detailed?.code ?? "").toString()
-  const exactMessage = detailed?.message?.trim() || chain.find((entry) => entry.message?.trim())?.message?.trim()
-
-  if (code === "DEPTH_ZERO_SELF_SIGNED_CERT" || code === "SELF_SIGNED_CERT_IN_CHAIN" || code === "CERT_HAS_EXPIRED") {
-    return {
-      code: "tls_error",
-      message: "Certificate check failed while connecting to the remote server.",
-    }
-  }
-
-  return {
-    code:
-      code === "ERR_INVALID_URL"
-        ? "invalid_url"
-        : code === "ECONNREFUSED"
-          ? "connection_refused"
-          : code === "ENOTFOUND"
-            ? "dns_error"
-            : code === "UND_ERR_CONNECT_TIMEOUT" || code === "ABORT_ERR"
-              ? "timeout"
-              : code
-                ? code.toLowerCase()
-                : "probe_failed",
-    message: exactMessage || "Failed to connect to the remote server.",
-  }
-}
-
-function unwrapErrorChain(error: unknown): Array<{ code?: unknown; message?: string }> {
-  const results: Array<{ code?: unknown; message?: string }> = []
-  let current: unknown = error
-  const seen = new Set<unknown>()
-
-  while (current && typeof current === "object" && !seen.has(current)) {
-    seen.add(current)
-    const entry = current as { code?: unknown; message?: string; cause?: unknown }
-    results.push({ code: entry.code, message: entry.message })
-    current = entry.cause
-  }
-
-  if (results.length === 0 && error instanceof Error) {
-    results.push({ message: error.message })
-  }
-
-  return results
-}

packages/server/src/server/routes/settings.ts

@@ -1,6 +1,6 @@
 import { FastifyInstance } from "fastify"
 import { z } from "zod"
-import { probeBinaryVersion } from "../../workspaces/spawn"
+import { probeBinaryVersion } from "../../workspaces/runtime"
 import type { SettingsService } from "../../settings/service"
 import type { Logger } from "../../logger"
 import { sanitizeConfigDoc, sanitizeConfigOwner } from "../../settings/public-config"

packages/server/src/server/routes/sidecars.ts

@@ -1,56 +0,0 @@
-import { FastifyInstance } from "fastify"
-import { z } from "zod"
-import type { SideCarManager } from "../../sidecars/manager"
-
-interface RouteDeps {
-  sidecarManager: SideCarManager
-}
-
-const SideCarCreateSchema = z.object({
-  kind: z.literal("port").default("port"),
-  name: z.string().trim().min(1),
-  port: z.number().int().min(1).max(65535),
-  insecure: z.boolean().default(false),
-  prefixMode: z.enum(["strip", "preserve"]).default("strip"),
-})
-
-const SideCarUpdateSchema = SideCarCreateSchema.omit({ kind: true }).partial().refine((value) => Object.keys(value).length > 0, {
-  message: "At least one field is required",
-})
-
-export function registerSideCarRoutes(app: FastifyInstance, deps: RouteDeps) {
-  app.get("/api/sidecars", async () => {
-    return { sidecars: await deps.sidecarManager.list() }
-  })
-
-  app.post("/api/sidecars", async (request, reply) => {
-    try {
-      const body = SideCarCreateSchema.parse(request.body ?? {})
-      const sidecar = await deps.sidecarManager.create(body)
-      reply.code(201)
-      return sidecar
-    } catch (error) {
-      reply.code(400)
-      return { error: error instanceof Error ? error.message : "Failed to create SideCar" }
-    }
-  })
-
-  app.put<{ Params: { id: string } }>("/api/sidecars/:id", async (request, reply) => {
-    try {
-      const body = SideCarUpdateSchema.parse(request.body ?? {})
-      return await deps.sidecarManager.update(request.params.id, body)
-    } catch (error) {
-      reply.code(400)
-      return { error: error instanceof Error ? error.message : "Failed to update SideCar" }
-    }
-  })
-
-  app.delete<{ Params: { id: string } }>("/api/sidecars/:id", async (request, reply) => {
-    const removed = await deps.sidecarManager.delete(request.params.id)
-    if (!removed) {
-      reply.code(404)
-      return { error: "SideCar not found" }
-    }
-    reply.code(204)
-  })
-}

packages/server/src/server/routes/workspaces.ts

@@ -1,10 +1,6 @@
 import { FastifyInstance, FastifyReply } from "fastify"
 import { z } from "zod"
 import { WorkspaceManager } from "../../workspaces/manager"
-import { getWorktreeGitDiff, getWorktreeGitStatus } from "../../workspaces/git-status"
-import { commitWorktreeChanges, isGitMutationError, stageWorktreePaths, unstageWorktreePaths } from "../../workspaces/git-mutations"
-import { isGitAvailable, resolveRepoRoot } from "../../workspaces/git-worktrees"
-import { resolveWorktreeDirectory } from "../../workspaces/worktree-directory"
 
 interface RouteDeps {
   workspaceManager: WorkspaceManager
@@ -23,24 +19,6 @@ const WorkspaceFileContentQuerySchema = z.object({
   path: z.string(),
 })
 
-const WorkspaceFileContentBodySchema = z.object({
-  contents: z.string(),
-})
-
-const WorktreeGitDiffQuerySchema = z.object({
-  path: z.string().trim().min(1, "Path is required"),
-  originalPath: z.string().trim().optional(),
-  scope: z.enum(["staged", "unstaged"]),
-})
-
-const WorktreeGitPathsBodySchema = z.object({
-  paths: z.array(z.string().trim().min(1, "Path is required")).min(1, "At least one path is required"),
-})
-
-const WorktreeGitCommitBodySchema = z.object({
-  message: z.string().trim().min(1, "Commit message is required"),
-})
-
 const WorkspaceFileSearchQuerySchema = z.object({
   q: z.string().trim().min(1, "Query is required"),
   limit: z.coerce.number().int().positive().max(200).optional(),
@@ -122,152 +100,10 @@ export function registerWorkspaceRoutes(app: FastifyInstance, deps: RouteDeps) {
       return handleWorkspaceError(error, reply)
     }
   })
-
-  app.put<{
-    Params: { id: string }
-    Querystring: { path?: string }
-  }>("/api/workspaces/:id/files/content", async (request, reply) => {
-    try {
-      const query = WorkspaceFileContentQuerySchema.parse(request.query ?? {})
-      const body = WorkspaceFileContentBodySchema.parse(request.body ?? {})
-      deps.workspaceManager.writeFile(request.params.id, query.path, body.contents)
-      reply.code(204)
-    } catch (error) {
-      return handleWorkspaceError(error, reply)
-    }
-  })
-
-  app.get<{
-    Params: { id: string; slug: string }
-  }>("/api/workspaces/:id/worktrees/:slug/git-status", async (request, reply) => {
-    try {
-      const directory = await resolveGitWorktreeDirectory(deps.workspaceManager, request.params.id, request.params.slug, request.log, reply)
-      if (!directory) return
-
-      return await getWorktreeGitStatus({ workspaceFolder: directory, logger: request.log })
-    } catch (error) {
-      return handleWorkspaceError(error, reply)
-    }
-  })
-
-  app.get<{
-    Params: { id: string; slug: string }
-    Querystring: { path: string; originalPath?: string; scope: "staged" | "unstaged" }
-  }>("/api/workspaces/:id/worktrees/:slug/git-diff", async (request, reply) => {
-    try {
-      const query = WorktreeGitDiffQuerySchema.parse(request.query ?? {})
-      const directory = await resolveGitWorktreeDirectory(deps.workspaceManager, request.params.id, request.params.slug, request.log, reply)
-      if (!directory) return
-
-      return await getWorktreeGitDiff({
-        workspaceFolder: directory,
-        path: query.path,
-        originalPath: query.originalPath,
-        scope: query.scope,
-      })
-    } catch (error) {
-      return handleWorkspaceError(error, reply)
-    }
-  })
-
-  app.post<{
-    Params: { id: string; slug: string }
-    Body: { paths: string[] }
-  }>("/api/workspaces/:id/worktrees/:slug/git-stage", async (request, reply) => {
-    try {
-      const body = WorktreeGitPathsBodySchema.parse(request.body ?? {})
-      const directory = await resolveGitWorktreeDirectory(deps.workspaceManager, request.params.id, request.params.slug, request.log, reply)
-      if (!directory) return
-
-      await stageWorktreePaths({ workspaceFolder: directory, paths: body.paths })
-      return { ok: true as const }
-    } catch (error) {
-      return handleWorkspaceError(error, reply)
-    }
-  })
-
-  app.post<{
-    Params: { id: string; slug: string }
-    Body: { paths: string[] }
-  }>("/api/workspaces/:id/worktrees/:slug/git-unstage", async (request, reply) => {
-    try {
-      const body = WorktreeGitPathsBodySchema.parse(request.body ?? {})
-      const directory = await resolveGitWorktreeDirectory(deps.workspaceManager, request.params.id, request.params.slug, request.log, reply)
-      if (!directory) return
-
-      await unstageWorktreePaths({ workspaceFolder: directory, paths: body.paths })
-      return { ok: true as const }
-    } catch (error) {
-      return handleWorkspaceError(error, reply)
-    }
-  })
-
-  app.post<{
-    Params: { id: string; slug: string }
-    Body: { message: string }
-  }>("/api/workspaces/:id/worktrees/:slug/git-commit", async (request, reply) => {
-    try {
-      const body = WorktreeGitCommitBodySchema.parse(request.body ?? {})
-      const directory = await resolveGitWorktreeDirectory(deps.workspaceManager, request.params.id, request.params.slug, request.log, reply)
-      if (!directory) return
-
-      const result = await commitWorktreeChanges({ workspaceFolder: directory, message: body.message })
-      return { ok: true as const, ...result }
-    } catch (error) {
-      return handleWorkspaceError(error, reply)
-    }
-  })
-}
-
-async function resolveGitWorktreeDirectory(
-  workspaceManager: WorkspaceManager,
-  workspaceId: string,
-  worktreeSlug: string,
-  logger: { debug?: (obj: any, msg?: string) => void; warn?: (obj: any, msg?: string) => void },
-  reply: FastifyReply,
-): Promise<string | null> {
-  const workspace = workspaceManager.get(workspaceId)
-  if (!workspace) {
-    reply.code(404)
-    reply.send({ error: "Workspace not found" })
-    return null
-  }
-
-  const gitAvailable = await isGitAvailable(workspace.path)
-  if (!gitAvailable) {
-    reply.code(503)
-    reply.send({ error: "Git is not installed or not available in PATH" })
-    return null
-  }
-
-  const { isGitRepo } = await resolveRepoRoot(workspace.path, logger)
-  if (!isGitRepo) {
-    reply.code(400)
-    reply.send({ error: "Workspace is not a Git repository" })
-    return null
-  }
-
-  const directory = await resolveWorktreeDirectory({
-    workspaceId: workspace.id,
-    workspacePath: workspace.path,
-    worktreeSlug,
-    logger,
-  })
-  if (!directory) {
-    reply.code(404)
-    reply.send({ error: "Worktree not found" })
-    return null
-  }
-
-  return directory
 }
 
 
 function handleWorkspaceError(error: unknown, reply: FastifyReply) {
-  if (isGitMutationError(error)) {
-    reply.code(error.statusCode)
-    return { error: error.message }
-  }
   if (error instanceof Error && error.message === "Workspace not found") {
     reply.code(404)
     return { error: "Workspace not found" }

packages/server/src/settings/migrate.ts

@@ -107,10 +107,6 @@ function mapLegacyToOwnerDocs(legacyConfig: unknown, legacyState: unknown): { co
     if (typeof listeningMode === "string") {
       serverConfig.listeningMode = listeningMode
     }
-    const logLevel = preferences.logLevel
-    if (typeof logLevel === "string") {
-      serverConfig.logLevel = logLevel
-    }
     const lastUsedBinary = preferences.lastUsedBinary
     if (typeof lastUsedBinary === "string") {
       serverConfig.opencodeBinary = lastUsedBinary
@@ -139,7 +135,6 @@ function mapLegacyToOwnerDocs(legacyConfig: unknown, legacyState: unknown): { co
     const moved = new Set([
       "environmentVariables",
       "listeningMode",
-      "logLevel",
       "lastUsedBinary",
       "modelRecents",
       "modelFavorites",

packages/server/src/settings/service.ts

@@ -1,7 +1,6 @@
 import type { Logger } from "../logger"
 import type { EventBus } from "../events/bus"
 import type { ConfigLocation } from "../config/location"
-import { z } from "zod"
 import { YamlDocStore, type SettingsDoc } from "./yaml-doc-store"
 import { migrateSettingsLayout } from "./migrate"
 import type { WorkspaceEventPayload } from "../api-types"
@@ -9,54 +8,6 @@ import { sanitizeConfigOwner } from "./public-config"
 
 export type DocKind = "config" | "state"
 
-const CanonicalLogLevelSchema = z.preprocess(
-  (value) => (typeof value === "string" ? value.trim().toUpperCase() : value),
-  z.enum(["DEBUG", "INFO", "WARN", "ERROR"]),
-)
-
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value)
-}
-
-function isDeepEqual(a: unknown, b: unknown): boolean {
-  if (a === b) return true
-  try {
-    return JSON.stringify(a) === JSON.stringify(b)
-  } catch {
-    return false
-  }
-}
-
-function normalizeServerConfigOwner(value: SettingsDoc): SettingsDoc {
-  if (!isPlainObject(value)) {
-    return {}
-  }
-
-  const next: SettingsDoc = { ...value }
-  const parsedLogLevel = CanonicalLogLevelSchema.safeParse(next.logLevel)
-  if (parsedLogLevel.success) {
-    next.logLevel = parsedLogLevel.data
-  } else if (next.logLevel !== undefined) {
-    next.logLevel = "DEBUG"
-  }
-  return next
-}
-
-function normalizeConfigDoc(doc: SettingsDoc): SettingsDoc {
-  if (!isPlainObject(doc)) {
-    return {}
-  }
-
-  if (!isPlainObject(doc.server)) {
-    return doc
-  }
-
-  return {
-    ...doc,
-    server: normalizeServerConfigOwner(doc.server as SettingsDoc),
-  }
-}
-
 export class SettingsService {
   private readonly configStore: YamlDocStore
   private readonly stateStore: YamlDocStore
@@ -72,44 +23,22 @@ export class SettingsService {
   }
 
   getDoc(kind: DocKind): SettingsDoc {
-    if (kind !== "config") {
-      return this.stateStore.get()
-    }
-
-    const current = this.configStore.get()
-    const normalized = normalizeConfigDoc(current)
-    if (!isDeepEqual(current, normalized)) {
-      this.configStore.replace(normalized)
-    }
-    return normalized
+    return kind === "config" ? this.configStore.get() : this.stateStore.get()
   }
 
   mergePatchDoc(kind: DocKind, patch: unknown): SettingsDoc {
-    const updated =
-      kind === "config"
-        ? this.configStore.replace(normalizeConfigDoc(this.configStore.mergePatch(patch)))
-        : this.stateStore.mergePatch(patch)
+    const updated = kind === "config" ? this.configStore.mergePatch(patch) : this.stateStore.mergePatch(patch)
     this.publish(kind, "*")
     return updated
   }
 
   getOwner(kind: DocKind, owner: string): SettingsDoc {
-    if (kind !== "config") {
-      return this.stateStore.getOwner(owner)
-    }
-
-    return owner === "server"
-      ? normalizeServerConfigOwner(this.getDoc("config").server as SettingsDoc)
-      : this.getDoc("config")[owner] as SettingsDoc
+    return kind === "config" ? this.configStore.getOwner(owner) : this.stateStore.getOwner(owner)
   }
 
   mergePatchOwner(kind: DocKind, owner: string, patch: unknown): SettingsDoc {
     const updated =
-      kind === "config"
-        ? owner === "server"
-          ? this.configStore.replaceOwner(owner, normalizeServerConfigOwner(this.configStore.mergePatchOwner(owner, patch)))
-          : this.configStore.mergePatchOwner(owner, patch)
-        : this.stateStore.mergePatchOwner(owner, patch)
+      kind === "config" ? this.configStore.mergePatchOwner(owner, patch) : this.stateStore.mergePatchOwner(owner, patch)
     this.publish(kind, owner, updated)
     return updated
   }

packages/server/src/sidecars/manager.ts

@@ -1,256 +0,0 @@
-import { connect } from "net"
-import type { EventBus } from "../events/bus"
-import type { Logger } from "../logger"
-import type { SettingsService } from "../settings/service"
-import type { SideCar, SideCarKind, SideCarPrefixMode, SideCarStatus } from "../api-types"
-
-interface SideCarManagerOptions {
-  settings: SettingsService
-  eventBus: EventBus
-  logger: Logger
-}
-
-interface SideCarConfigRecord {
-  id: string
-  kind: SideCarKind
-  name: string
-  port: number
-  insecure: boolean
-  prefixMode: SideCarPrefixMode
-  createdAt: string
-  updatedAt: string
-}
-
-interface SideCarRuntimeRecord {
-  status: SideCarStatus
-}
-
-export class SideCarManager {
-  private readonly configs = new Map<string, SideCarConfigRecord>()
-  private readonly runtime = new Map<string, SideCarRuntimeRecord>()
-
-  constructor(private readonly options: SideCarManagerOptions) {
-    for (const record of this.loadConfiguredSideCars()) {
-      this.configs.set(record.id, record)
-      this.runtime.set(record.id, { status: "stopped" })
-    }
-
-    queueMicrotask(() => {
-      for (const record of this.configs.values()) {
-        void this.refreshPortSideCar(record.id).catch((error) => {
-          this.options.logger.warn({ sidecarId: record.id, err: error }, "Failed to probe sidecar port")
-        })
-      }
-    })
-  }
-
-  async list(): Promise<SideCar[]> {
-    await this.refreshPortStatuses()
-    return Array.from(this.configs.values()).map((record) => this.toSideCar(record))
-  }
-
-  async get(id: string): Promise<SideCar | undefined> {
-    if (!this.configs.has(id)) return undefined
-    await this.refreshPortSideCar(id)
-    return this.toSideCar(this.requireConfig(id))
-  }
-
-  async create(input: {
-    kind: SideCarKind
-    name: string
-    port: number
-    insecure: boolean
-    prefixMode: SideCarPrefixMode
-  }): Promise<SideCar> {
-    const normalizedName = input.name.trim()
-    const id = this.buildSideCarId(normalizedName)
-    if (this.configs.has(id)) {
-      throw new Error(`SideCar '${id}' already exists`)
-    }
-
-    const now = new Date().toISOString()
-    const record: SideCarConfigRecord = {
-      id,
-      kind: input.kind,
-      name: normalizedName,
-      port: input.port,
-      insecure: input.insecure,
-      prefixMode: input.prefixMode,
-      createdAt: now,
-      updatedAt: now,
-    }
-
-    this.configs.set(record.id, record)
-    this.runtime.set(record.id, { status: "stopped" })
-    this.persistConfigs()
-    await this.refreshPortSideCar(record.id)
-    return this.toSideCar(record)
-  }
-
-  async update(
-    id: string,
-    input: Partial<{
-      name: string
-      port: number
-      insecure: boolean
-      prefixMode: SideCarPrefixMode
-    }>,
-  ): Promise<SideCar> {
-    const record = this.requireConfig(id)
-
-    record.name = typeof input.name === "string" ? input.name.trim() : record.name
-    record.port = typeof input.port === "number" ? input.port : record.port
-    record.insecure = typeof input.insecure === "boolean" ? input.insecure : record.insecure
-    record.prefixMode = typeof input.prefixMode === "string" ? input.prefixMode : record.prefixMode
-    record.updatedAt = new Date().toISOString()
-
-    this.persistConfigs()
-    await this.refreshPortSideCar(id)
-    return this.toSideCar(record)
-  }
-
-  async delete(id: string): Promise<boolean> {
-    const record = this.configs.get(id)
-    if (!record) return false
-
-    this.configs.delete(id)
-    this.runtime.delete(id)
-    this.persistConfigs()
-    this.options.eventBus.publish({ type: "sidecar.removed", sidecarId: id })
-    return true
-  }
-
-  async shutdown() {
-    return
-  }
-
-  buildTargetOrigin(sidecar: Pick<SideCar, "port" | "insecure">): string {
-    const protocol = sidecar.insecure ? "http" : "https"
-    return `${protocol}://127.0.0.1:${sidecar.port}`
-  }
-
-  buildProxyBasePath(id: string): string {
-    return `/sidecars/${encodeURIComponent(id)}`
-  }
-
-  buildTargetPath(id: string, incomingPath: string, search = ""): string {
-    const record = this.requireConfig(id)
-    const publicBase = this.buildProxyBasePath(id)
-    const normalizedPath = incomingPath || publicBase
-
-    if (record.prefixMode === "preserve") {
-      return `${normalizedPath}${search}`
-    }
-
-    let stripped = normalizedPath.startsWith(publicBase) ? normalizedPath.slice(publicBase.length) : normalizedPath
-    if (!stripped || stripped === "/") {
-      stripped = "/"
-    } else if (!stripped.startsWith("/")) {
-      stripped = `/${stripped}`
-    }
-    return `${stripped}${search}`
-  }
-
-  private async refreshPortStatuses() {
-    await Promise.all(Array.from(this.configs.values()).map((record) => this.refreshPortSideCar(record.id)))
-  }
-
-  private async refreshPortSideCar(id: string) {
-    const record = this.configs.get(id)
-    if (!record) return
-    const isAvailable = await this.isPortAvailable(record.port)
-    const current = this.runtime.get(id)
-    const nextStatus: SideCarStatus = isAvailable ? "running" : "stopped"
-    if (current?.status === nextStatus) {
-      return
-    }
-
-    this.runtime.set(id, { status: nextStatus })
-    record.updatedAt = new Date().toISOString()
-    this.publish(id)
-  }
-
-  private publish(id: string) {
-    const record = this.configs.get(id)
-    if (!record) return
-    this.options.eventBus.publish({ type: "sidecar.updated", sidecar: this.toSideCar(record) })
-  }
-
-  private toSideCar(record: SideCarConfigRecord): SideCar {
-    const runtime = this.runtime.get(record.id)
-    return {
-      id: record.id,
-      kind: record.kind,
-      name: record.name,
-      port: record.port,
-      insecure: record.insecure,
-      prefixMode: record.prefixMode,
-      status: runtime?.status ?? "stopped",
-      createdAt: record.createdAt,
-      updatedAt: record.updatedAt,
-    }
-  }
-
-  private requireConfig(id: string): SideCarConfigRecord {
-    const record = this.configs.get(id)
-    if (!record) {
-      throw new Error("SideCar not found")
-    }
-    return record
-  }
-
-  private persistConfigs() {
-    const sidecars = Array.from(this.configs.values()).map((record) => ({ ...record }))
-    this.options.settings.mergePatchOwner("config", "server", { sidecars })
-  }
-
-  private loadConfiguredSideCars(): SideCarConfigRecord[] {
-    const serverConfig = this.options.settings.getOwner("config", "server") as { sidecars?: unknown }
-    const list = Array.isArray(serverConfig?.sidecars) ? serverConfig.sidecars : []
-    const records: SideCarConfigRecord[] = []
-    for (const item of list) {
-      if (!item || typeof item !== "object") continue
-      const record = item as Record<string, unknown>
-      const kind = record.kind === "port" ? "port" : null
-      const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : null
-      const name = typeof record.name === "string" && record.name.trim() ? record.name.trim() : null
-      const port = typeof record.port === "number" && Number.isInteger(record.port) ? record.port : null
-      if (!kind || !id || !name || !port) continue
-
-      const insecure = record.insecure === true
-      const prefixMode = record.prefixMode === "preserve" ? "preserve" : "strip"
-      const createdAt = typeof record.createdAt === "string" && record.createdAt ? record.createdAt : new Date().toISOString()
-      const updatedAt = typeof record.updatedAt === "string" && record.updatedAt ? record.updatedAt : createdAt
-      records.push({ id, kind, name, port, insecure, prefixMode, createdAt, updatedAt })
-    }
-    return records
-  }
-
-  private isPortAvailable(port: number): Promise<boolean> {
-    return new Promise((resolve) => {
-      const socket = connect({ port, host: "127.0.0.1" }, () => {
-        socket.end()
-        resolve(true)
-      })
-      socket.once("error", () => {
-        socket.destroy()
-        resolve(false)
-      })
-    })
-  }
-
-  private buildSideCarId(name: string): string {
-    const normalized = name
-      .trim()
-      .toLowerCase()
-      .replace(/[^a-z0-9]+/g, "-")
-      .replace(/-{2,}/g, "-")
-      .replace(/^-|-$/g, "")
-
-    if (!normalized) {
-      throw new Error("SideCar name must include letters or numbers")
-    }
-
-    return normalized
-  }
-}

packages/server/src/speech/providers/openai-compatible.ts

@@ -147,49 +147,19 @@ export class OpenAICompatibleSpeechProvider {
     }
 
     const endpoint = new URL("audio/speech", ensureTrailingSlash(settings.baseUrl ?? "https://api.openai.com/v1"))
-    let response: Response
-    try {
-      response = await fetch(endpoint, {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${settings.apiKey}`,
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-          model: settings.ttsModel,
-          voice: settings.ttsVoice,
-          input: text,
-          response_format: format,
-        }),
-      })
-    } catch (error) {
-      const detailedError = error as Error & {
-        cause?: unknown
-        code?: string
-        errno?: number | string
-        syscall?: string
-        address?: string
-        port?: number
-      }
-      this.options.logger.error(
-        {
-          err: error,
-          endpoint: endpoint.toString(),
-          baseUrl: settings.baseUrl,
-          model: settings.ttsModel,
-          voice: settings.ttsVoice,
-          format,
-          cause: detailedError.cause,
-          code: detailedError.code,
-          errno: detailedError.errno,
-          syscall: detailedError.syscall,
-          address: detailedError.address,
-          port: detailedError.port,
-        },
-        "speech.synthesize fetch failed",
-      )
-      throw error
-    }
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${settings.apiKey}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        model: settings.ttsModel,
+        voice: settings.ttsVoice,
+        input: text,
+        response_format: format,
+      }),
+    })
 
     if (!response.ok) {
       const detail = await response.text()

packages/server/src/ui/__tests__/remote-ui.test.ts

@@ -55,31 +55,4 @@ describe("resolveUi local version preference", () => {
     assert.equal(result.uiStaticDir, bundledDir)
     assert.equal(result.uiVersion, "0.8.1")
   })
-
-  it("prefers bundled when bundled and downloaded versions are equal", async () => {
-    const bundledDir = path.join(tempRoot, "bundled")
-    const configDir = path.join(tempRoot, "config")
-    const currentDir = path.join(configDir, "ui", "current")
-
-    await mkdir(bundledDir, { recursive: true })
-    await mkdir(currentDir, { recursive: true })
-
-    writeFileSync(path.join(bundledDir, "index.html"), "<html>bundled</html>")
-    writeFileSync(path.join(bundledDir, "ui-version.json"), JSON.stringify({ uiVersion: "0.8.1" }))
-
-    writeFileSync(path.join(currentDir, "index.html"), "<html>current</html>")
-    writeFileSync(path.join(currentDir, "ui-version.json"), JSON.stringify({ uiVersion: "0.8.1" }))
-
-    const result = await resolveUi({
-      serverVersion: "0.8.1",
-      bundledUiDir: bundledDir,
-      autoUpdate: false,
-      configDir,
-      logger: noopLogger,
-    })
-
-    assert.equal(result.source, "bundled")
-    assert.equal(result.uiStaticDir, bundledDir)
-    assert.equal(result.uiVersion, "0.8.1")
-  })
 })

packages/server/src/ui/remote-ui.ts

@@ -250,7 +250,7 @@ async function pickBestLocalUi(args: {
       uiStaticDir: currentResolved,
       source: "downloaded",
       uiVersion: await readUiVersion(currentResolved),
-      priority: 1,
+      priority: 2,
     })
   }
 
@@ -260,7 +260,7 @@ async function pickBestLocalUi(args: {
       uiStaticDir: bundledResolved,
       source: "bundled",
       uiVersion: await readUiVersion(bundledResolved),
-      priority: 2,
+      priority: 1,
     })
   }
 

packages/server/src/workspaces/__tests__/spawn.test.ts

@@ -1,193 +0,0 @@
-import assert from "node:assert/strict"
-import { describe, it } from "node:test"
-
-import { buildWindowsSpawnSpec, buildWslSignalSpec, parseWslUncPath, resolveWslWorkingDirectory } from "../spawn"
-
-describe("parseWslUncPath", () => {
-  it("parses WSL UNC paths into distro and linux path", () => {
-    assert.deepEqual(parseWslUncPath(String.raw`\\wsl.localhost\Ubuntu\home\dev\.opencode\bin\opencode`), {
-      distro: "Ubuntu",
-      linuxPath: "/home/dev/.opencode/bin/opencode",
-    })
-  })
-
-  it("supports the legacy wsl$ UNC prefix", () => {
-    assert.deepEqual(parseWslUncPath(String.raw`\\wsl$\Ubuntu\home\dev`), {
-      distro: "Ubuntu",
-      linuxPath: "/home/dev",
-    })
-  })
-})
-
-describe("resolveWslWorkingDirectory", () => {
-  it("keeps WSL workspace folders in the same distro", () => {
-    assert.equal(
-      JSON.stringify(resolveWslWorkingDirectory(String.raw`\\wsl.localhost\Ubuntu\home\dev\workspace`, "Ubuntu")),
-      JSON.stringify({ kind: "linux", path: "/home/dev/workspace" }),
-    )
-  })
-
-  it("keeps Windows drive paths so WSL can resolve them with wslpath", () => {
-    assert.equal(
-      JSON.stringify(resolveWslWorkingDirectory(String.raw`C:\Users\dev\workspace`, "Ubuntu")),
-      JSON.stringify({ kind: "windows", path: String.raw`C:\Users\dev\workspace` }),
-    )
-  })
-
-  it("keeps UNC network paths so WSL can resolve them with wslpath", () => {
-    assert.equal(
-      JSON.stringify(resolveWslWorkingDirectory(String.raw`\\server\share\workspace`, "Ubuntu")),
-      JSON.stringify({ kind: "windows", path: String.raw`\\server\share\workspace` }),
-    )
-  })
-
-  it("rejects WSL workspace folders from a different distro", () => {
-    assert.equal(resolveWslWorkingDirectory(String.raw`\\wsl.localhost\Debian\home\dev\workspace`, "Ubuntu"), null)
-  })
-})
-
-describe("buildWindowsSpawnSpec", () => {
-  it("wraps WSL binaries with wsl.exe and propagates required env vars", () => {
-    const spec = buildWindowsSpawnSpec(
-      String.raw`\\wsl.localhost\Ubuntu\home\dev\.opencode\bin\opencode`,
-      ["serve", "--port", "0"],
-      {
-        cwd: String.raw`\\wsl.localhost\Ubuntu\home\dev\workspace`,
-        env: {
-          OPENCODE_CONFIG_DIR: String.raw`C:\Users\dev\AppData\Roaming\CodeNomad\opencode-config`,
-          CODENOMAD_INSTANCE_ID: "workspace-123",
-          OPENCODE_SERVER_PASSWORD: "secret",
-        },
-        propagateEnvKeys: ["OPENCODE_CONFIG_DIR", "CODENOMAD_INSTANCE_ID", "OPENCODE_SERVER_PASSWORD"],
-      },
-    )
-
-    assert.equal(spec.command, "wsl.exe")
-    assert.deepEqual(spec.args, [
-      "--distribution",
-      "Ubuntu",
-      "--cd",
-      "/home/dev/workspace",
-      "--exec",
-      "/home/dev/.opencode/bin/opencode",
-      "serve",
-      "--port",
-      "0",
-    ])
-    assert.equal(spec.cwd, undefined)
-    assert.equal(spec.env?.WSLENV, "OPENCODE_CONFIG_DIR/p:CODENOMAD_INSTANCE_ID:OPENCODE_SERVER_PASSWORD")
-  })
-
-  it("upgrades existing WSLENV path entries to include /p", () => {
-    const spec = buildWindowsSpawnSpec(
-      String.raw`\\wsl.localhost\Ubuntu\home\dev\.opencode\bin\opencode`,
-      ["serve"],
-      {
-        env: {
-          OPENCODE_CONFIG_DIR: String.raw`C:\Users\dev\AppData\Roaming\CodeNomad\opencode-config`,
-          WSLENV: "OPENCODE_CONFIG_DIR:CODENOMAD_INSTANCE_ID/u",
-        },
-        propagateEnvKeys: ["OPENCODE_CONFIG_DIR", "CODENOMAD_INSTANCE_ID"],
-      },
-    )
-
-    assert.equal(spec.env?.WSLENV, "OPENCODE_CONFIG_DIR/p:CODENOMAD_INSTANCE_ID/u")
-  })
-
-  it("propagates inherited known path variables even when they are not explicitly requested", () => {
-    const spec = buildWindowsSpawnSpec(
-      String.raw`\\wsl.localhost\Ubuntu\home\dev\.opencode\bin\opencode`,
-      ["serve"],
-      {
-        env: {
-          NODE_EXTRA_CA_CERTS: String.raw`C:\certs\root.pem`,
-        },
-      },
-    )
-
-    assert.equal(spec.env?.WSLENV, "NODE_EXTRA_CA_CERTS/p")
-  })
-
-  it("uses wslpath for Windows workspace folders instead of assuming /mnt", () => {
-    const spec = buildWindowsSpawnSpec(
-      String.raw`\\wsl.localhost\Ubuntu\home\dev\.opencode\bin\opencode`,
-      ["serve", "--port", "0"],
-      {
-        cwd: String.raw`C:\Users\dev\workspace`,
-      },
-    )
-
-    assert.equal(spec.command, "wsl.exe")
-    assert.deepEqual(spec.args, [
-      "--distribution",
-      "Ubuntu",
-      "--exec",
-      "sh",
-      "-lc",
-      'cd "$(wslpath -au "$1")" && shift && exec "$@"',
-      "codenomad-wsl-launch",
-      String.raw`C:\Users\dev\workspace`,
-      "/home/dev/.opencode/bin/opencode",
-      "serve",
-      "--port",
-      "0",
-    ])
-  })
-
-  it("uses wslpath for UNC network workspace folders", () => {
-    const spec = buildWindowsSpawnSpec(
-      String.raw`\\wsl.localhost\Ubuntu\home\dev\.opencode\bin\opencode`,
-      ["serve"],
-      {
-        cwd: String.raw`\\server\share\workspace`,
-      },
-    )
-
-    assert.equal(spec.command, "wsl.exe")
-    assert.deepEqual(spec.args, [
-      "--distribution",
-      "Ubuntu",
-      "--exec",
-      "sh",
-      "-lc",
-      'cd "$(wslpath -au "$1")" && shift && exec "$@"',
-      "codenomad-wsl-launch",
-      String.raw`\\server\share\workspace`,
-      "/home/dev/.opencode/bin/opencode",
-      "serve",
-    ])
-  })
-
-  it("can wrap WSL launches to emit the Linux PID marker", () => {
-    const spec = buildWindowsSpawnSpec(
-      String.raw`\\wsl.localhost\Ubuntu\home\dev\.opencode\bin\opencode`,
-      ["serve"],
-      {
-        cwd: String.raw`\\wsl.localhost\Ubuntu\home\dev\workspace`,
-        wslPidMarker: "__CODENOMAD_WSL_PID__:",
-      },
-    )
-
-    assert.equal(spec.command, "wsl.exe")
-    assert.deepEqual(spec.args, [
-      "--distribution",
-      "Ubuntu",
-      "--exec",
-      "sh",
-      "-lc",
-      `printf '%s%s\\n' '__CODENOMAD_WSL_PID__:' "$$" && cd "$1" && shift && exec "$@"`,
-      "codenomad-wsl-launch",
-      "/home/dev/workspace",
-      "/home/dev/.opencode/bin/opencode",
-      "serve",
-    ])
-    assert.equal(spec.wsl?.pidMarker, "__CODENOMAD_WSL_PID__:")
-  })
-
-  it("builds the WSL kill command for tracked Linux PIDs", () => {
-    const spec = buildWslSignalSpec("Ubuntu", 4321, "SIGTERM")
-
-    assert.equal(spec.command, "wsl.exe")
-    assert.deepEqual(spec.args, ["--distribution", "Ubuntu", "--exec", "kill", "-TERM", "4321"])
-  })
-})

packages/server/src/workspaces/git-mutations.ts

@@ -1,121 +0,0 @@
-import { spawn } from "child_process"
-import path from "path"
-
-type GitResult = { ok: true; stdout: string } | { ok: false; error: Error; stdout?: string; stderr?: string }
-
-class GitMutationError extends Error {
-  statusCode: number
-
-  constructor(message: string, statusCode = 400) {
-    super(message)
-    this.name = "GitMutationError"
-    this.statusCode = statusCode
-  }
-}
-
-function runGit(args: string[], cwd: string): Promise<GitResult> {
-  return new Promise((resolve) => {
-    const child = spawn("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] })
-    let stdout = ""
-    let stderr = ""
-
-    child.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString()
-    })
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString()
-    })
-    child.once("error", (error) => {
-      resolve({ ok: false, error, stdout, stderr })
-    })
-    child.once("close", (code) => {
-      if (code === 0) {
-        resolve({ ok: true, stdout })
-      } else {
-        const error = new Error(stderr.trim() || `git ${args.join(" ")} failed with code ${code}`)
-        resolve({ ok: false, error, stdout, stderr })
-      }
-    })
-  })
-}
-
-export function normalizeGitWorktreeRelativePath(input: string): string {
-  const normalized = input.trim().replace(/\\+/g, "/").replace(/^\.\//, "")
-  if (!normalized) {
-    throw new GitMutationError("Path is required", 400)
-  }
-  if (path.posix.isAbsolute(normalized) || path.win32.isAbsolute(normalized)) {
-    throw new GitMutationError(`Absolute paths are not allowed: ${input}`, 400)
-  }
-  if (normalized === "." || normalized === "..") {
-    throw new GitMutationError(`Invalid path: ${input}`, 400)
-  }
-  if (normalized.startsWith("../") || normalized.includes("/../") || normalized.endsWith("/..")) {
-    throw new GitMutationError(`Path traversal is not allowed: ${input}`, 400)
-  }
-  return normalized
-}
-
-function normalizeGitMutationPaths(paths: string[]): string[] {
-  const deduped = new Set<string>()
-  for (const rawPath of paths) {
-    deduped.add(normalizeGitWorktreeRelativePath(rawPath))
-  }
-  const normalized = Array.from(deduped)
-  if (normalized.length === 0) {
-    throw new GitMutationError("At least one path is required", 400)
-  }
-  return normalized
-}
-
-async function ensureGitCommandSucceeded(resultPromise: Promise<GitResult>, fallbackMessage: string): Promise<string> {
-  const result = await resultPromise
-  if (!result.ok) {
-    const message = result.stderr?.trim() || result.error.message || fallbackMessage
-    throw new GitMutationError(message, 409)
-  }
-  return result.stdout
-}
-
-export function isGitMutationError(error: unknown): error is GitMutationError {
-  return error instanceof GitMutationError
-}
-
-export async function stageWorktreePaths(params: { workspaceFolder: string; paths: string[] }): Promise<void> {
-  const paths = normalizeGitMutationPaths(params.paths)
-  await ensureGitCommandSucceeded(runGit(["add", "--", ...paths], params.workspaceFolder), "Failed to stage files")
-}
-
-export async function unstageWorktreePaths(params: { workspaceFolder: string; paths: string[] }): Promise<void> {
-  const paths = normalizeGitMutationPaths(params.paths)
-  const headResult = await runGit(["rev-parse", "--verify", "HEAD"], params.workspaceFolder)
-  if (headResult.ok) {
-    await ensureGitCommandSucceeded(
-      runGit(["restore", "--staged", "--", ...paths], params.workspaceFolder),
-      "Failed to unstage files",
-    )
-    return
-  }
-
-  await ensureGitCommandSucceeded(
-    runGit(["rm", "--cached", "--quiet", "--", ...paths], params.workspaceFolder),
-    "Failed to unstage files",
-  )
-}
-
-export async function commitWorktreeChanges(params: { workspaceFolder: string; message: string }): Promise<{ commitSha?: string }> {
-  const message = params.message.trim()
-  if (!message) {
-    throw new GitMutationError("Commit message is required", 400)
-  }
-
-  await ensureGitCommandSucceeded(runGit(["commit", "-m", message], params.workspaceFolder), "Failed to create commit")
-
-  const shaResult = await runGit(["rev-parse", "HEAD"], params.workspaceFolder)
-  if (!shaResult.ok) {
-    return {}
-  }
-
-  const commitSha = shaResult.stdout.trim()
-  return commitSha ? { commitSha } : {}
-}

packages/server/src/workspaces/git-status.ts

@@ -1,385 +0,0 @@
-import { spawn } from "child_process"
-import { readFile } from "fs/promises"
-import path from "path"
-
-import type { GitChangeKind, WorktreeGitDiffResponse, WorktreeGitDiffScope, WorktreeGitStatusEntry } from "../api-types"
-import type { LogLike } from "./git-worktrees"
-import { normalizeGitWorktreeRelativePath } from "./git-mutations"
-
-type GitResult = { ok: true; stdout: string } | { ok: false; error: Error; stdout?: string; stderr?: string }
-type GitSuccessResult = Extract<GitResult, { ok: true }>
-
-async function readFileAsDiffText(filePath: string): Promise<string> {
-  return readFile(filePath, "utf-8")
-}
-
-async function readGitBlobAsDiffText(resultPromise: Promise<GitResult>, missingOk = false): Promise<string> {
-  const result = await resultPromise
-  if (!result.ok) {
-    return decodeGitShowResult(result, missingOk)
-  }
-  return result.stdout
-}
-
-function runGit(args: string[], cwd: string, acceptedExitCodes: number[] = [0]): Promise<GitResult> {
-  return new Promise((resolve) => {
-    const child = spawn("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] })
-    let stdout = ""
-    let stderr = ""
-
-    child.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString()
-    })
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString()
-    })
-    child.once("error", (error) => {
-      resolve({ ok: false, error, stdout, stderr })
-    })
-    child.once("close", (code) => {
-      if (acceptedExitCodes.includes(code ?? 0)) {
-        resolve({ ok: true, stdout })
-      } else {
-        const error = new Error(stderr.trim() || `git ${args.join(" ")} failed with code ${code}`)
-        resolve({ ok: false, error, stdout, stderr })
-      }
-    })
-  })
-}
-
-function ensureEntry(map: Map<string, WorktreeGitStatusEntry>, path: string): WorktreeGitStatusEntry {
-  const existing = map.get(path)
-  if (existing) return existing
-  const next: WorktreeGitStatusEntry = {
-    path,
-    originalPath: null,
-    stagedStatus: null,
-    stagedAdditions: 0,
-    stagedDeletions: 0,
-    unstagedStatus: null,
-    unstagedAdditions: 0,
-    unstagedDeletions: 0,
-  }
-  map.set(path, next)
-  return next
-}
-
-function normalizeGitStatusPath(value: string): string {
-  return value.trim().replace(/\\+/g, "/")
-}
-
-function parseGitChangeKind(code: string): GitChangeKind | null {
-  const normalized = code.trim().toUpperCase()
-  if (!normalized) return null
-  if (normalized === "A") return "added"
-  if (normalized === "M") return "modified"
-  if (normalized === "D") return "deleted"
-  if (normalized.startsWith("R")) return "renamed"
-  if (normalized.startsWith("C")) return "copied"
-  if (normalized === "U") return "unmerged"
-  return null
-}
-
-function applyNameStatusOutput(
-  map: Map<string, WorktreeGitStatusEntry>,
-  output: string,
-  target: "stagedStatus" | "unstagedStatus",
-) {
-  const tokens = output.split("\0")
-  let index = 0
-
-  while (index < tokens.length) {
-    const record = tokens[index++] ?? ""
-    if (!record) continue
-
-    const parts = record.split("\t")
-    const statusCode = parseGitChangeKind(parts[0] ?? "")
-    if (!statusCode) continue
-
-    const inlinePath = parts.slice(1).join("\t")
-    const firstPath = inlinePath || tokens[index++] || ""
-    const secondPath = statusCode === "renamed" || statusCode === "copied" ? tokens[index++] || "" : ""
-    const path = statusCode === "renamed" || statusCode === "copied" ? secondPath || firstPath : firstPath
-    const normalizedPath = normalizeGitStatusPath(path)
-    if (!normalizedPath) continue
-    const entry = ensureEntry(map, normalizedPath)
-    entry[target] = statusCode
-    if (statusCode === "renamed" || statusCode === "copied") {
-      const originalPath = normalizeGitStatusPath(firstPath)
-      entry.originalPath = originalPath || entry.originalPath || null
-    }
-  }
-}
-
-function applyUntrackedOutput(map: Map<string, WorktreeGitStatusEntry>, output: string) {
-  for (const rawLine of output.split(/\r?\n/)) {
-    const path = normalizeGitStatusPath(rawLine)
-    if (!path) continue
-    ensureEntry(map, path).unstagedStatus = "untracked"
-  }
-}
-
-function parseSingleNumstat(output: string): { additions: number; deletions: number; isBinary: boolean; found: boolean } {
-  for (const rawLine of output.split(/\r?\n/)) {
-    const line = rawLine.trim()
-    if (!line) continue
-    const parts = rawLine.split("\t")
-    const isBinary = parts[0] === "-" || parts[1] === "-"
-    return {
-      additions: isBinary ? 0 : Number.parseInt(parts[0] ?? "0", 10) || 0,
-      deletions: isBinary ? 0 : Number.parseInt(parts[1] ?? "0", 10) || 0,
-      isBinary,
-      found: true,
-    }
-  }
-
-  return { additions: 0, deletions: 0, isBinary: false, found: false }
-}
-
-async function getUntrackedFileNumstat(workspaceFolder: string, relativePath: string): Promise<{ additions: number; deletions: number }> {
-  const absolutePath = path.join(workspaceFolder, relativePath)
-  const result = await runGit(["diff", "--numstat", "--no-index", "--", "/dev/null", absolutePath], workspaceFolder, [0, 1])
-  if (!result.ok) {
-    throw result.error
-  }
-
-  const parsed = parseSingleNumstat(result.stdout)
-  return { additions: parsed.additions, deletions: parsed.deletions }
-}
-
-async function applyUntrackedFileStats(map: Map<string, WorktreeGitStatusEntry>, workspaceFolder: string) {
-  const pending = Array.from(map.values())
-    .filter((entry) => entry.unstagedStatus === "untracked")
-    .map(async (entry) => {
-      try {
-        const stats = await getUntrackedFileNumstat(workspaceFolder, entry.path)
-        entry.unstagedAdditions = stats.additions
-        entry.unstagedDeletions = stats.deletions
-      } catch {
-        entry.unstagedAdditions = 0
-        entry.unstagedDeletions = 0
-      }
-    })
-  await Promise.all(pending)
-}
-
-function applyNumstatOutput(
-  map: Map<string, WorktreeGitStatusEntry>,
-  output: string,
-  target: "staged" | "unstaged",
-) {
-  const tokens = output.split("\0")
-  let index = 0
-
-  while (index < tokens.length) {
-    const record = tokens[index++] ?? ""
-    if (!record) continue
-
-    const parts = record.split("\t")
-    if (parts.length < 3) continue
-
-    const additions = parts[0] === "-" ? 0 : Number.parseInt(parts[0] ?? "0", 10)
-    const deletions = parts[1] === "-" ? 0 : Number.parseInt(parts[1] ?? "0", 10)
-    const inlinePath = parts.slice(2).join("\t")
-    const isRenameLike = inlinePath === ""
-    const originalPath = isRenameLike ? normalizeGitStatusPath(tokens[index++] ?? "") : null
-    const normalizedPath = normalizeGitStatusPath(isRenameLike ? tokens[index++] ?? "" : inlinePath)
-    if (!normalizedPath) continue
-
-    const entry = ensureEntry(map, normalizedPath)
-    if (originalPath) {
-      entry.originalPath = originalPath
-    }
-
-    if (target === "staged") {
-      entry.stagedAdditions = Number.isFinite(additions) ? additions : 0
-      entry.stagedDeletions = Number.isFinite(deletions) ? deletions : 0
-    } else {
-      entry.unstagedAdditions = Number.isFinite(additions) ? additions : 0
-      entry.unstagedDeletions = Number.isFinite(deletions) ? deletions : 0
-    }
-  }
-}
-
-export async function getWorktreeGitStatus(params: {
-  workspaceFolder: string
-  logger?: LogLike
-}): Promise<WorktreeGitStatusEntry[]> {
-  const { workspaceFolder, logger } = params
-  const [stagedResult, unstagedResult, untrackedResult, stagedNumstatResult, unstagedNumstatResult] = await Promise.all([
-    runGit(["diff", "--name-status", "-z", "--cached", "--find-renames", "--find-copies"], workspaceFolder),
-    runGit(["diff", "--name-status", "-z", "--find-renames", "--find-copies"], workspaceFolder),
-    runGit(["ls-files", "--others", "--exclude-standard"], workspaceFolder),
-    runGit(["diff", "--numstat", "-z", "--cached", "--find-renames", "--find-copies"], workspaceFolder),
-    runGit(["diff", "--numstat", "-z", "--find-renames", "--find-copies"], workspaceFolder),
-  ])
-
-  for (const result of [stagedResult, unstagedResult, untrackedResult, stagedNumstatResult, unstagedNumstatResult]) {
-    if (!result.ok) {
-      logger?.warn?.({ workspaceFolder, err: result.error }, "Failed to read git status for worktree")
-      throw result.error
-    }
-  }
-
-  const stagedOutput = (stagedResult as GitSuccessResult).stdout
-  const unstagedOutput = (unstagedResult as GitSuccessResult).stdout
-  const untrackedOutput = (untrackedResult as GitSuccessResult).stdout
-  const stagedNumstatOutput = (stagedNumstatResult as GitSuccessResult).stdout
-  const unstagedNumstatOutput = (unstagedNumstatResult as GitSuccessResult).stdout
-
-  const entries = new Map<string, WorktreeGitStatusEntry>()
-  applyNameStatusOutput(entries, stagedOutput, "stagedStatus")
-  applyNameStatusOutput(entries, unstagedOutput, "unstagedStatus")
-  applyUntrackedOutput(entries, untrackedOutput)
-  applyNumstatOutput(entries, stagedNumstatOutput, "staged")
-  applyNumstatOutput(entries, unstagedNumstatOutput, "unstaged")
-  await applyUntrackedFileStats(entries, workspaceFolder)
-
-  return Array.from(entries.values()).sort((a, b) => a.path.localeCompare(b.path))
-}
-
-function decodeGitShowResult(result: GitResult, missingOk = false): string {
-  if (result.ok) return result.stdout
-  const message = result.stderr?.trim() || result.error.message || ""
-  if (
-    missingOk &&
-    (message.includes("exists on disk, but not in") ||
-      message.includes("Path '") ||
-      message.includes("does not exist") ||
-      message.includes("unknown revision or path not in the working tree"))
-  ) {
-    return ""
-  }
-  throw result.error
-}
-
-async function readGitIndexBlob(workspaceFolder: string, normalizedPath: string): Promise<GitResult> {
-  return runGit(["cat-file", "-p", `:${normalizedPath}`], workspaceFolder)
-}
-
-async function getTrackedDiffMetadata(params: {
-  workspaceFolder: string
-  scope: WorktreeGitDiffScope
-  normalizedPath: string
-  normalizedOriginalPath: string | null
-}): Promise<{ isBinary: boolean; found: boolean }> {
-  const args = ["diff", "--numstat"]
-  if (params.scope === "staged") {
-    args.push("--cached")
-  }
-  args.push("--find-renames", "--find-copies", "--")
-  args.push(params.normalizedPath)
-  if (params.normalizedOriginalPath && params.normalizedOriginalPath !== params.normalizedPath) {
-    args.push(params.normalizedOriginalPath)
-  }
-
-  const result = await runGit(args, params.workspaceFolder)
-  if (!result.ok) {
-    throw result.error
-  }
-
-  const parsed = parseSingleNumstat(result.stdout)
-  return { isBinary: parsed.isBinary, found: parsed.found }
-}
-
-async function getUntrackedDiffMetadata(params: {
-  workspaceFolder: string
-  normalizedPath: string
-}): Promise<{ isBinary: boolean }> {
-  const absolutePath = path.join(params.workspaceFolder, params.normalizedPath)
-  const result = await runGit(["diff", "--numstat", "--no-index", "--", "/dev/null", absolutePath], params.workspaceFolder, [0, 1])
-  if (!result.ok) {
-    throw result.error
-  }
-
-  return { isBinary: parseSingleNumstat(result.stdout).isBinary }
-}
-
-async function resolveUnstagedBeforePath(params: {
-  workspaceFolder: string
-  normalizedPath: string
-  normalizedOriginalPath: string | null
-}): Promise<GitResult> {
-  const currentPathResult = await readGitIndexBlob(params.workspaceFolder, params.normalizedPath)
-  if (currentPathResult.ok || !params.normalizedOriginalPath || params.normalizedOriginalPath === params.normalizedPath) {
-    return currentPathResult
-  }
-  return readGitIndexBlob(params.workspaceFolder, params.normalizedOriginalPath)
-}
-
-export async function getWorktreeGitDiff(params: {
-  workspaceFolder: string
-  path: string
-  originalPath?: string | null
-  scope: WorktreeGitDiffScope
-}): Promise<WorktreeGitDiffResponse> {
-  const normalizedPath = normalizeGitWorktreeRelativePath(params.path)
-  const normalizedOriginalPath = params.originalPath ? normalizeGitWorktreeRelativePath(params.originalPath) : null
-
-  const trackedMetadata = await getTrackedDiffMetadata({
-    workspaceFolder: params.workspaceFolder,
-    scope: params.scope,
-    normalizedPath,
-    normalizedOriginalPath,
-  })
-
-  const diffMetadata =
-    params.scope === "unstaged" && !trackedMetadata.found
-      ? await getUntrackedDiffMetadata({
-          workspaceFolder: params.workspaceFolder,
-          normalizedPath,
-        })
-      : trackedMetadata
-
-  if (diffMetadata.isBinary) {
-    return {
-      path: normalizedPath,
-      originalPath: normalizedOriginalPath,
-      scope: params.scope,
-      before: "",
-      after: "",
-      isBinary: true,
-    }
-  }
-
-  if (params.scope === "staged") {
-    const [beforeResult, afterResult] = await Promise.all([
-      readGitBlobAsDiffText(runGit(["show", `HEAD:${normalizedOriginalPath ?? normalizedPath}`], params.workspaceFolder), true),
-      readGitBlobAsDiffText(readGitIndexBlob(params.workspaceFolder, normalizedPath), true),
-    ])
-
-    return {
-      path: normalizedPath,
-      originalPath: normalizedOriginalPath,
-      scope: params.scope,
-      before: beforeResult,
-      after: afterResult,
-      isBinary: false,
-    }
-  }
-
-  const indexResult = await resolveUnstagedBeforePath({
-    workspaceFolder: params.workspaceFolder,
-    normalizedPath,
-    normalizedOriginalPath,
-  })
-
-  const beforeResult = await readGitBlobAsDiffText(Promise.resolve(indexResult), true)
-  let after = beforeResult
-
-  const fsPath = path.join(params.workspaceFolder, normalizedPath)
-  try {
-    after = await readFileAsDiffText(fsPath)
-  } catch {
-    after = ""
-  }
-
-  return {
-    path: normalizedPath,
-    originalPath: normalizedOriginalPath,
-    scope: params.scope,
-    before: beforeResult,
-    after,
-    isBinary: false,
-  }
-}

packages/server/src/workspaces/git-worktrees.ts

@@ -10,10 +10,6 @@ export interface LogLike {
 
 type GitResult = { ok: true; stdout: string } | { ok: false; error: Error; stdout?: string; stderr?: string }
 
-function isGitUnavailableResult(result: GitResult): boolean {
-  return !result.ok && (result.error as NodeJS.ErrnoException | undefined)?.code === "ENOENT"
-}
-
 function runGit(args: string[], cwd: string): Promise<GitResult> {
   return new Promise((resolve) => {
     const child = spawn("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"] })
@@ -42,9 +38,6 @@ function runGit(args: string[], cwd: string): Promise<GitResult> {
 
 export async function resolveRepoRoot(folder: string, logger?: LogLike): Promise<{ repoRoot: string; isGitRepo: boolean }> {
   const result = await runGit(["rev-parse", "--show-toplevel"], folder)
-  if (isGitUnavailableResult(result)) {
-    throw new Error("Git is not installed or not available in PATH")
-  }
   if (!result.ok) {
     logger?.debug?.({ folder, err: result.error }, "Folder is not a Git repository; using workspace folder as root")
     return { repoRoot: folder, isGitRepo: false }
@@ -56,11 +49,6 @@ export async function resolveRepoRoot(folder: string, logger?: LogLike): Promise
   return { repoRoot, isGitRepo: true }
 }
 
-export async function isGitAvailable(folder: string): Promise<boolean> {
-  const result = await runGit(["--version"], folder)
-  return result.ok || !isGitUnavailableResult(result)
-}
-
 function parseWorktreePorcelain(output: string): Array<{ worktree: string; branch?: string; head?: string; detached?: boolean }> {
   const records: Array<{ worktree: string; branch?: string; head?: string; detached?: boolean }> = []
   const lines = output.split(/\r?\n/)
@@ -102,22 +90,15 @@ export async function listWorktrees(params: {
   logger?: LogLike
 }): Promise<WorktreeDescriptor[]> {
   const { repoRoot, workspaceFolder, logger } = params
+  const rootDescriptor: WorktreeDescriptor = { slug: "root", directory: repoRoot, kind: "root" }
 
   const result = await runGit(["worktree", "list", "--porcelain"], workspaceFolder)
   if (!result.ok) {
-    const rootDescriptor: WorktreeDescriptor = { slug: "root", directory: repoRoot, kind: "root" }
     logger?.debug?.({ repoRoot, err: result.error }, "Failed to list git worktrees; returning root only")
     return [rootDescriptor]
   }
 
   const records = parseWorktreePorcelain(result.stdout)
-  const rootRecord = records.find((record) => path.resolve(record.worktree) === path.resolve(repoRoot))
-  const rootDescriptor: WorktreeDescriptor = {
-    slug: "root",
-    directory: repoRoot,
-    kind: "root",
-    branch: rootRecord?.branch,
-  }
 
   const worktrees: WorktreeDescriptor[] = [rootDescriptor]
   const seen = new Set<string>(["root"])

packages/server/src/workspaces/manager.ts

@@ -21,70 +21,6 @@ import {
 
 const STARTUP_STABILITY_DELAY_MS = 1500
 
-function defaultShellPath(): string {
-  const configured = process.env.SHELL?.trim()
-  if (configured) {
-    return configured
-  }
-
-  return process.platform === "darwin" ? "/bin/zsh" : "/bin/bash"
-}
-
-function shellEscape(input: string): string {
-  if (!input) return "''"
-  return `'${input.replace(/'/g, `'\\''`)}'`
-}
-
-function wrapCommandForShell(command: string, shellPath: string): string {
-  const shellName = path.basename(shellPath).toLowerCase()
-
-  if (shellName.includes("bash")) {
-    return `if [ -f ~/.bashrc ]; then source ~/.bashrc >/dev/null 2>&1; fi; ${command}`
-  }
-
-  if (shellName.includes("zsh")) {
-    return `if [ -f ~/.zshrc ]; then source ~/.zshrc >/dev/null 2>&1; fi; ${command}`
-  }
-
-  return command
-}
-
-function buildShellArgs(shellPath: string, command: string): string[] {
-  const shellName = path.basename(shellPath).toLowerCase()
-  if (shellName.includes("zsh")) {
-    return ["-l", "-i", "-c", command]
-  }
-  return ["-l", "-c", command]
-}
-
-function resolveBinaryPathFromUserShell(identifier: string): string | null {
-  if (process.platform === "win32") {
-    return null
-  }
-
-  const shellPath = defaultShellPath()
-  const lookupCommand = wrapCommandForShell(`command -v ${shellEscape(identifier)}`, shellPath)
-  const result = spawnSync(shellPath, buildShellArgs(shellPath, lookupCommand), {
-    encoding: "utf8",
-    env: {
-      ...process.env,
-      npm_config_prefix: undefined,
-      NPM_CONFIG_PREFIX: undefined,
-    },
-  })
-
-  if (result.status !== 0) {
-    return null
-  }
-
-  const resolved = String(result.stdout ?? "")
-    .split(/\r?\n/)
-    .map((line) => line.trim())
-    .find((line) => line.length > 0)
-
-  return resolved ?? null
-}
-
 interface WorkspaceManagerOptions {
   rootDir: string
   settings: SettingsService
@@ -147,12 +83,6 @@ export class WorkspaceManager {
     }
   }
 
-  writeFile(workspaceId: string, relativePath: string, contents: string): void {
-    const workspace = this.requireWorkspace(workspaceId)
-    const browser = new FileSystemBrowser({ rootDir: workspace.path })
-    browser.writeFile(relativePath, contents)
-  }
-
   async create(folder: string, name?: string): Promise<WorkspaceDescriptor> {
  
     const id = `${Date.now().toString(36)}`
@@ -206,15 +136,12 @@ export class WorkspaceManager {
       [OPENCODE_SERVER_PASSWORD_ENV]: opencodePassword,
     }
 
-    const logLevel = (serverConfig as any)?.logLevel
-
     try {
       const { pid, port, exitPromise, getLastOutput } = await this.runtime.launch({
         workspaceId: id,
         folder: workspacePath,
         binaryPath: resolvedBinaryPath,
         environment,
-        logLevel,
         onExit: (info) => this.handleProcessExit(info.workspaceId, info),
       })
 
@@ -330,12 +257,6 @@ export class WorkspaceManager {
       this.options.logger.warn({ identifier, err: error }, "Failed to resolve binary path from system PATH")
     }
 
-    const shellResolved = resolveBinaryPathFromUserShell(identifier)
-    if (shellResolved) {
-      this.options.logger.debug({ identifier, resolved: shellResolved }, "Resolved binary path from user shell")
-      return shellResolved
-    }
-
     return identifier
   }
 

packages/server/src/workspaces/runtime.ts

@@ -4,10 +4,100 @@ import path from "path"
 import { EventBus } from "../events/bus"
 import { LogLevel, WorkspaceLogEntry } from "../api-types"
 import { Logger } from "../logger"
-import { buildSpawnSpec, buildWslSignalSpec } from "./spawn"
+
+export const WINDOWS_CMD_EXTENSIONS = new Set([".cmd", ".bat"])
+export const WINDOWS_POWERSHELL_EXTENSIONS = new Set([".ps1"])
+
+const VERSION_REGEX = /([0-9]+\.[0-9]+\.[0-9A-Za-z.-]+)/
+
+export function buildSpawnSpec(binaryPath: string, args: string[]) {
+  if (process.platform !== "win32") {
+    return { command: binaryPath, args, options: {} as const }
+  }
+
+  const extension = path.extname(binaryPath).toLowerCase()
+
+  if (WINDOWS_CMD_EXTENSIONS.has(extension)) {
+    const comspec = process.env.ComSpec || "cmd.exe"
+    // cmd.exe requires the full command as a single string.
+    // Using the ""<script> <args>"" pattern ensures paths with spaces are handled.
+    const commandLine = `""${binaryPath}" ${args.join(" ")}"`
+
+    return {
+      command: comspec,
+      args: ["/d", "/s", "/c", commandLine],
+      options: { windowsVerbatimArguments: true } as const,
+    }
+  }
+
+  if (WINDOWS_POWERSHELL_EXTENSIONS.has(extension)) {
+    // powershell.exe ships with Windows. (pwsh may not.)
+    return {
+      command: "powershell.exe",
+      args: ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", binaryPath, ...args],
+      options: {} as const,
+    }
+  }
+
+  return { command: binaryPath, args, options: {} as const }
+}
+
+export function probeBinaryVersion(binaryPath: string): {
+  valid: boolean
+  version?: string
+  reported?: string
+  error?: string
+} {
+  if (!binaryPath) {
+    return { valid: false, error: "Missing binary path" }
+  }
+
+  const spec = buildSpawnSpec(binaryPath, ["--version"])
+
+  try {
+    const result = spawnSync(spec.command, spec.args, {
+      encoding: "utf8",
+      windowsVerbatimArguments: Boolean(
+        (spec.options as { windowsVerbatimArguments?: boolean }).windowsVerbatimArguments,
+      ),
+    })
+
+    if (result.error) {
+      return { valid: false, error: result.error.message }
+    }
+
+    if (result.status !== 0) {
+      const stderr = result.stderr?.trim()
+      const stdout = result.stdout?.trim()
+      const combined = stderr || stdout
+      const error = combined ? `Exited with code ${result.status}: ${combined}` : `Exited with code ${result.status}`
+      return { valid: false, error }
+    }
+
+    const stdoutLines = String(result.stdout ?? "")
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0)
+    const stderrLines = String(result.stderr ?? "")
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0)
+
+    // Prefer stdout; fall back to stderr (some tools report version there).
+    const reported = stdoutLines[0] ?? stderrLines[0]
+    if (!reported) {
+      return { valid: true }
+    }
+
+    const versionMatch = reported.match(VERSION_REGEX)
+    const version = versionMatch?.[1]
+    return { valid: true, version, reported }
+  } catch (error) {
+    return { valid: false, error: error instanceof Error ? error.message : String(error) }
+  }
+}
 
 const SENSITIVE_ENV_KEY = /(PASSWORD|TOKEN|SECRET)/i
-const WSL_PID_MARKER = "__CODENOMAD_WSL_PID__:"
 
 function redactEnvironment(env: Record<string, string | undefined>): Record<string, string | undefined> {
   const redacted: Record<string, string | undefined> = {}
@@ -26,7 +116,6 @@ interface LaunchOptions {
   folder: string
   binaryPath: string
   environment?: Record<string, string>
-  logLevel?: string
   onExit?: (info: ProcessExitInfo) => void
 }
 
@@ -40,10 +129,6 @@ export interface ProcessExitInfo {
 interface ManagedProcess {
   child: ChildProcess
   requestedStop: boolean
-  wsl?: {
-    distro: string
-    linuxPid: number | null
-  }
 }
 
 export class WorkspaceRuntime {
@@ -54,8 +139,7 @@ export class WorkspaceRuntime {
   async launch(options: LaunchOptions): Promise<{ pid: number; port: number; exitPromise: Promise<ProcessExitInfo>; getLastOutput: () => string }> {
     this.validateFolder(options.folder)
 
-    const logLevel = typeof options.logLevel === "string" ? options.logLevel.toUpperCase() : "DEBUG"
-    const args = ["serve", "--port", "0", "--print-logs", "--log-level", logLevel]
+    const args = ["serve", "--port", "0", "--print-logs", "--log-level", "DEBUG"]
     const env = { ...process.env, ...(options.environment ?? {}) }
 
     let exitResolve: ((info: ProcessExitInfo) => void) | null = null
@@ -81,13 +165,7 @@ export class WorkspaceRuntime {
     }
 
     return new Promise((resolve, reject) => {
-      const propagatedEnvKeys = Object.keys(options.environment ?? {})
-      const spec = buildSpawnSpec(options.binaryPath, args, {
-        cwd: options.folder,
-        env,
-        propagateEnvKeys: propagatedEnvKeys,
-        wslPidMarker: WSL_PID_MARKER,
-      })
+      const spec = buildSpawnSpec(options.binaryPath, args)
       const commandLine = [spec.command, ...spec.args].join(" ")
       this.logger.info(
         {
@@ -117,18 +195,14 @@ export class WorkspaceRuntime {
       )
       const detached = process.platform !== "win32"
       const child = spawn(spec.command, spec.args, {
-        cwd: spec.cwd,
-        env: spec.env,
+        cwd: options.folder,
+        env,
         stdio: ["ignore", "pipe", "pipe"],
         detached,
         ...spec.options,
       })
 
-      const managed: ManagedProcess = {
-        child,
-        requestedStop: false,
-        ...(spec.wsl ? { wsl: { distro: spec.wsl.distro, linuxPid: null } } : {}),
-      }
+      const managed: ManagedProcess = { child, requestedStop: false }
       this.processes.set(options.workspaceId, managed)
 
       let stdoutBuffer = ""
@@ -208,15 +282,6 @@ export class WorkspaceRuntime {
           const trimmed = line.trim()
           if (!trimmed) continue
 
-          if (managed.wsl && trimmed.startsWith(WSL_PID_MARKER)) {
-            const linuxPid = Number.parseInt(trimmed.slice(WSL_PID_MARKER.length), 10)
-            if (Number.isFinite(linuxPid) && linuxPid > 0) {
-              managed.wsl.linuxPid = linuxPid
-              this.logger.debug({ workspaceId: options.workspaceId, linuxPid }, "Captured WSL OpenCode PID")
-            }
-            continue
-          }
-
           recentStdout.push(trimmed)
           if (recentStdout.length > MAX_OUTPUT_LINES) {
             recentStdout.shift()
@@ -331,44 +396,11 @@ export class WorkspaceRuntime {
       }
     }
 
-    const trySignalWslProcess = (signal: NodeJS.Signals) => {
-      if (process.platform !== "win32" || !managed.wsl?.linuxPid) {
-        return false
-      }
-
-      try {
-        const spec = buildWslSignalSpec(managed.wsl.distro, managed.wsl.linuxPid, signal)
-        const result = spawnSync(spec.command, spec.args, { encoding: "utf8" })
-        const exitCode = result.status
-        if (exitCode === 0) {
-          return true
-        }
-
-        const stderr = (result.stderr ?? "").toString().toLowerCase()
-        const stdout = (result.stdout ?? "").toString().toLowerCase()
-        const combined = `${stdout}\n${stderr}`
-        if (combined.includes("no such process") || combined.includes("not found")) {
-          return true
-        }
-
-        this.logger.debug(
-          { workspaceId, pid, linuxPid: managed.wsl.linuxPid, distro: managed.wsl.distro, exitCode, stderr: result.stderr, stdout: result.stdout },
-          "WSL kill failed",
-        )
-        return false
-      } catch (error) {
-        this.logger.debug({ workspaceId, pid, linuxPid: managed.wsl.linuxPid, distro: managed.wsl.distro, err: error }, "WSL kill failed to execute")
-        return false
-      }
-    }
-
     const sendStopSignal = (signal: NodeJS.Signals) => {
       if (process.platform === "win32") {
-        // WSL-backed launches need a Linux signal first because the tracked Windows PID belongs to wsl.exe.
-        if (!trySignalWslProcess(signal)) {
-          // Fallback to the Windows process tree rooted at pid. Use /F only for escalation.
-          tryTaskkill(signal === "SIGKILL")
-        }
+        // Best-effort: terminate the whole process tree rooted at pid.
+        // Use /F only for escalation.
+        tryTaskkill(signal === "SIGKILL")
         return
       }
 

packages/server/src/workspaces/spawn.ts

@@ -1,307 +0,0 @@
-import { spawnSync } from "child_process"
-import path from "path"
-
-export const WINDOWS_CMD_EXTENSIONS = new Set([".cmd", ".bat"])
-export const WINDOWS_POWERSHELL_EXTENSIONS = new Set([".ps1"])
-
-const VERSION_REGEX = /([0-9]+\.[0-9]+\.[0-9A-Za-z.-]+)/
-const WSL_UNC_PATH_REGEX = /^\\\\wsl(?:\.localhost|\$)\\([^\\/]+)(?:[\\/](.*))?$/i
-const WSL_PATH_ENV_KEYS = new Set(["OPENCODE_CONFIG_DIR", "NODE_EXTRA_CA_CERTS"])
-
-export interface SpawnSpec {
-  command: string
-  args: string[]
-  options: {
-    windowsVerbatimArguments?: boolean
-  }
-  cwd?: string
-  env?: NodeJS.ProcessEnv
-  wsl?: {
-    distro: string
-    pidMarker?: string
-  }
-}
-
-interface BuildSpawnSpecOptions {
-  cwd?: string
-  env?: NodeJS.ProcessEnv
-  propagateEnvKeys?: string[]
-  wslPidMarker?: string
-}
-
-interface WslPath {
-  distro: string
-  linuxPath: string
-}
-
-export type WslWorkingDirectory =
-  | { kind: "linux"; path: string }
-  | { kind: "windows"; path: string }
-
-export function parseWslUncPath(input: string): WslPath | null {
-  const normalized = input.trim().replace(/\//g, "\\")
-  const match = normalized.match(WSL_UNC_PATH_REGEX)
-  if (!match) {
-    return null
-  }
-
-  const distro = match[1] ?? ""
-  const remainder = match[2] ?? ""
-  const segments = remainder.split(/\\+/).filter((segment) => segment.length > 0)
-
-  return {
-    distro,
-    linuxPath: segments.length > 0 ? `/${segments.join("/")}` : "/",
-  }
-}
-
-export function resolveWslWorkingDirectory(folder: string, distro: string): WslWorkingDirectory | null {
-  const wslFolder = parseWslUncPath(folder)
-  if (wslFolder) {
-    return wslFolder.distro.toLowerCase() === distro.toLowerCase() ? { kind: "linux", path: wslFolder.linuxPath } : null
-  }
-
-  const windowsFolder = normalizeWindowsPath(folder)
-  return windowsFolder ? { kind: "windows", path: windowsFolder } : null
-}
-
-export function buildWindowsSpawnSpec(binaryPath: string, args: string[], options: BuildSpawnSpecOptions = {}): SpawnSpec {
-  const wslPath = parseWslUncPath(binaryPath)
-  if (wslPath) {
-    return buildWslSpawnSpec(wslPath, args, options)
-  }
-
-  const extension = path.extname(binaryPath).toLowerCase()
-
-  if (WINDOWS_CMD_EXTENSIONS.has(extension)) {
-    const comspec = process.env.ComSpec || "cmd.exe"
-    // cmd.exe requires the full command as a single string.
-    // Using the ""<script> <args>"" pattern ensures paths with spaces are handled.
-    const commandLine = `""${binaryPath}" ${args.join(" ")}"`
-
-    return {
-      command: comspec,
-      args: ["/d", "/s", "/c", commandLine],
-      options: { windowsVerbatimArguments: true },
-      cwd: options.cwd,
-      env: options.env,
-    }
-  }
-
-  if (WINDOWS_POWERSHELL_EXTENSIONS.has(extension)) {
-    // powershell.exe ships with Windows. (pwsh may not.)
-    return {
-      command: "powershell.exe",
-      args: ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", binaryPath, ...args],
-      options: {},
-      cwd: options.cwd,
-      env: options.env,
-    }
-  }
-
-  return {
-    command: binaryPath,
-    args,
-    options: {},
-    cwd: options.cwd,
-    env: options.env,
-  }
-}
-
-export function buildSpawnSpec(binaryPath: string, args: string[], options: BuildSpawnSpecOptions = {}): SpawnSpec {
-  if (process.platform !== "win32") {
-    return {
-      command: binaryPath,
-      args,
-      options: {},
-      cwd: options.cwd,
-      env: options.env,
-    }
-  }
-
-  return buildWindowsSpawnSpec(binaryPath, args, options)
-}
-
-export function buildWslSignalSpec(distro: string, linuxPid: number, signal: NodeJS.Signals): SpawnSpec {
-  return {
-    command: "wsl.exe",
-    args: ["--distribution", distro, "--exec", "kill", signal === "SIGKILL" ? "-KILL" : "-TERM", String(linuxPid)],
-    options: {},
-    wsl: { distro },
-  }
-}
-
-export function probeBinaryVersion(binaryPath: string): {
-  valid: boolean
-  version?: string
-  reported?: string
-  error?: string
-} {
-  if (!binaryPath) {
-    return { valid: false, error: "Missing binary path" }
-  }
-
-  try {
-    const spec = buildSpawnSpec(binaryPath, ["--version"])
-    const result = spawnSync(spec.command, spec.args, {
-      encoding: "utf8",
-      cwd: spec.cwd,
-      env: spec.env,
-      windowsVerbatimArguments: Boolean(spec.options.windowsVerbatimArguments),
-    })
-
-    if (result.error) {
-      return { valid: false, error: result.error.message }
-    }
-
-    if (result.status !== 0) {
-      const stderr = result.stderr?.trim()
-      const stdout = result.stdout?.trim()
-      const combined = stderr || stdout
-      const error = combined ? `Exited with code ${result.status}: ${combined}` : `Exited with code ${result.status}`
-      return { valid: false, error }
-    }
-
-    const stdoutLines = String(result.stdout ?? "")
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter((line) => line.length > 0)
-    const stderrLines = String(result.stderr ?? "")
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter((line) => line.length > 0)
-
-    // Prefer stdout; fall back to stderr (some tools report version there).
-    const reported = stdoutLines[0] ?? stderrLines[0]
-    if (!reported) {
-      return { valid: true }
-    }
-
-    const versionMatch = reported.match(VERSION_REGEX)
-    const version = versionMatch?.[1]
-    return { valid: true, version, reported }
-  } catch (error) {
-    return { valid: false, error: error instanceof Error ? error.message : String(error) }
-  }
-}
-
-function buildWslSpawnSpec(wslPath: WslPath, args: string[], options: BuildSpawnSpecOptions): SpawnSpec {
-  const workingDirectory = options.cwd ? resolveWslWorkingDirectory(options.cwd, wslPath.distro) : undefined
-  if (options.cwd && !workingDirectory) {
-    throw new Error(
-      `Unable to translate workspace folder for WSL binary in distro "${wslPath.distro}": ${options.cwd}`,
-    )
-  }
-
-  const wslArgs = ["--distribution", wslPath.distro]
-  const shouldWrapWithShell = Boolean(options.wslPidMarker) || workingDirectory?.kind === "windows"
-
-  if (!shouldWrapWithShell && workingDirectory?.kind === "linux") {
-    wslArgs.push("--cd", workingDirectory.path)
-  }
-
-  if (shouldWrapWithShell) {
-    const launchScript = buildWslLaunchScript(workingDirectory ?? undefined, options.wslPidMarker)
-    wslArgs.push(
-      "--exec",
-      "sh",
-      "-lc",
-      launchScript,
-      "codenomad-wsl-launch",
-    )
-    if (workingDirectory) {
-      wslArgs.push(workingDirectory.path)
-    }
-    wslArgs.push(
-      wslPath.linuxPath,
-      ...args,
-    )
-  } else {
-    wslArgs.push("--exec", wslPath.linuxPath, ...args)
-  }
-
-  return {
-    command: "wsl.exe",
-    args: wslArgs,
-    options: {},
-    env: buildWslEnvironment(options.env, options.propagateEnvKeys),
-    wsl: { distro: wslPath.distro, pidMarker: options.wslPidMarker },
-  }
-}
-
-function buildWslLaunchScript(workingDirectory: WslWorkingDirectory | undefined, pidMarker: string | undefined): string {
-  const steps: string[] = []
-
-  if (pidMarker) {
-    steps.push(`printf '%s%s\\n' '${pidMarker}' "$$"`)
-  }
-
-  if (workingDirectory?.kind === "linux") {
-    steps.push('cd "$1"')
-    steps.push("shift")
-  } else if (workingDirectory?.kind === "windows") {
-    steps.push('cd "$(wslpath -au "$1")"')
-    steps.push("shift")
-  }
-
-  steps.push('exec "$@"')
-  return steps.join(" && ")
-}
-
-function normalizeWindowsPath(input: string): string | null {
-  const normalized = path.win32.normalize(input.trim().replace(/\//g, "\\"))
-  if (!normalized) {
-    return null
-  }
-
-  if (/^[A-Za-z]:/.test(normalized) || normalized.startsWith("\\\\")) {
-    return normalized
-  }
-
-  return null
-}
-
-function buildWslEnvironment(env: NodeJS.ProcessEnv | undefined, propagateEnvKeys: string[] | undefined): NodeJS.ProcessEnv | undefined {
-  if (!env) {
-    return env
-  }
-
-  const keysToPropagate = Array.from(
-    new Set([
-      ...(propagateEnvKeys ?? []).filter((key) => env[key] !== undefined),
-      ...Array.from(WSL_PATH_ENV_KEYS).filter((key) => env[key] !== undefined),
-    ]),
-  )
-  if (keysToPropagate.length === 0) {
-    return env
-  }
-
-  const next = { ...env }
-  const entries = (next.WSLENV ?? "").split(":").filter((entry) => entry.length > 0)
-  const byName = new Map(entries.map((entry) => [entry.split("/")[0] ?? entry, entry]))
-
-  for (const key of keysToPropagate) {
-    const existingEntry = byName.get(key)
-    if (existingEntry) {
-      byName.set(key, ensureWslenvEntry(existingEntry, WSL_PATH_ENV_KEYS.has(key)))
-      continue
-    }
-    byName.set(key, WSL_PATH_ENV_KEYS.has(key) ? `${key}/p` : key)
-  }
-
-  next.WSLENV = Array.from(byName.values()).join(":")
-  return next
-}
-
-function ensureWslenvEntry(entry: string, requiresPathTranslation: boolean): string {
-  if (!requiresPathTranslation) {
-    return entry
-  }
-
-  const [name, rawFlags = ""] = entry.split("/")
-  if (rawFlags.includes("p")) {
-    return entry
-  }
-
-  return rawFlags.length > 0 ? `${name}/${rawFlags}p` : `${name}/p`
-}

packages/server/src/workspaces/worktree-directory.ts

@@ -1,99 +0,0 @@
-import { realpath } from "fs/promises"
-import type { LogLike } from "./git-worktrees"
-import { listWorktrees, resolveRepoRoot } from "./git-worktrees"
-
-type WorktreeCacheEntry = {
-  expiresAt: number
-  repoRoot: string
-  worktrees: Array<{ slug: string; directory: string; normalizedDirectory: string }>
-}
-
-const WORKTREE_CACHE_TTL_MS = 2000
-const worktreeCache = new Map<string, WorktreeCacheEntry>()
-
-async function normalizeDirectoryPath(directory: string): Promise<string> {
-  const trimmed = (directory ?? "").trim()
-  if (!trimmed) return ""
-  try {
-    return await realpath(trimmed)
-  } catch {
-    return trimmed
-  }
-}
-
-async function getCachedWorktrees(params: { workspaceId: string; workspacePath: string; logger?: LogLike }) {
-  const cached = worktreeCache.get(params.workspaceId)
-  const now = Date.now()
-  if (cached && cached.expiresAt > now) {
-    return cached
-  }
-
-  const { repoRoot } = await resolveRepoRoot(params.workspacePath, params.logger)
-  const worktrees = await listWorktrees({ repoRoot, workspaceFolder: params.workspacePath, logger: params.logger })
-  const entry: WorktreeCacheEntry = {
-    expiresAt: now + WORKTREE_CACHE_TTL_MS,
-    repoRoot,
-    worktrees: await Promise.all(
-      worktrees.map(async (wt) => ({
-        slug: wt.slug,
-        directory: wt.directory,
-        normalizedDirectory: await normalizeDirectoryPath(wt.directory),
-      })),
-    ),
-  }
-  worktreeCache.set(params.workspaceId, entry)
-  return entry
-}
-
-export async function resolveWorktreeDirectory(params: {
-  workspaceId: string
-  workspacePath: string
-  worktreeSlug: string
-  logger?: LogLike
-}): Promise<string | null> {
-  const cached = await getCachedWorktrees({
-    workspaceId: params.workspaceId,
-    workspacePath: params.workspacePath,
-    logger: params.logger,
-  })
-  const match = cached.worktrees.find((wt) => wt.slug === params.worktreeSlug)
-  if (match) {
-    return match.directory
-  }
-
-  worktreeCache.delete(params.workspaceId)
-  const refreshed = await getCachedWorktrees({
-    workspaceId: params.workspaceId,
-    workspacePath: params.workspacePath,
-    logger: params.logger,
-  })
-  return refreshed.worktrees.find((wt) => wt.slug === params.worktreeSlug)?.directory ?? null
-}
-
-export async function resolveWorktreeSlugForDirectory(params: {
-  workspaceId: string
-  workspacePath: string
-  directory: string
-  logger?: LogLike
-}): Promise<string | null> {
-  const target = await normalizeDirectoryPath(params.directory ?? "")
-  if (!target) return null
-
-  const cached = await getCachedWorktrees({
-    workspaceId: params.workspaceId,
-    workspacePath: params.workspacePath,
-    logger: params.logger,
-  })
-  const match = cached.worktrees.find((wt) => wt.normalizedDirectory === target)
-  if (match) {
-    return match.slug
-  }
-
-  worktreeCache.delete(params.workspaceId)
-  const refreshed = await getCachedWorktrees({
-    workspaceId: params.workspaceId,
-    workspacePath: params.workspacePath,
-    logger: params.logger,
-  })
-  return refreshed.worktrees.find((wt) => wt.normalizedDirectory === target)?.slug ?? null
-}

packages/tauri-app/Cargo.lock

@@ -213,28 +213,6 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
-[[package]]
-name = "aws-lc-rs"
-version = "1.16.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc"
-dependencies = [
- "aws-lc-sys",
- "zeroize",
-]
-
-[[package]]
-name = "aws-lc-sys"
-version = "0.39.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83a25cf98105baa966497416dbd42565ce3a8cf8dbfd59803ec9ad46f3126399"
-dependencies = [
- "cc",
- "cmake",
- "dunce",
- "fs_extra",
-]
-
 [[package]]
 name = "base64"
 version = "0.21.7"
@@ -430,8 +408,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a0dd1ca384932ff3641c8718a02769f1698e7563dc6974ffd03346116310423"
 dependencies = [
  "find-msvc-tools",
- "jobserver",
- "libc",
  "shlex",
 ]
 
@@ -468,12 +444,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-
 [[package]]
 name = "chrono"
 version = "0.4.44"
@@ -486,28 +456,17 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
-[[package]]
-name = "cmake"
-version = "0.1.58"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "codenomad-tauri"
-version = "0.14.0"
+version = "0.12.3"
 dependencies = [
  "anyhow",
- "base64 0.22.1",
  "dirs 5.0.1",
  "keepawake",
  "libc",
+ "once_cell",
  "parking_lot",
  "regex",
- "reqwest 0.12.28",
- "rustls",
  "serde",
  "serde_json",
  "serde_yaml",
@@ -517,8 +476,8 @@ dependencies = [
  "tauri-plugin-global-shortcut",
  "tauri-plugin-notification",
  "tauri-plugin-opener",
+ "thiserror 1.0.69",
  "url",
- "webkit2gtk",
  "which",
  "windows-sys 0.59.0",
 ]
@@ -1010,15 +969,6 @@ version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7"
 
-[[package]]
-name = "encoding_rs"
-version = "0.8.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
-dependencies = [
- "cfg-if",
-]
-
 [[package]]
 name = "endi"
 version = "1.1.1"
@@ -1189,12 +1139,6 @@ dependencies = [
  "percent-encoding",
 ]
 
-[[package]]
-name = "fs_extra"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
-
 [[package]]
 name = "futf"
 version = "0.1.5"
@@ -1435,10 +1379,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -1448,11 +1390,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -1634,25 +1574,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "h2"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
-dependencies = [
- "atomic-waker",
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "http",
- "indexmap 2.13.0",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -1778,7 +1699,6 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
- "h2",
  "http",
  "http-body",
  "httparse",
@@ -1790,23 +1710,6 @@ dependencies = [
  "want",
 ]
 
-[[package]]
-name = "hyper-rustls"
-version = "0.27.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
-dependencies = [
- "http",
- "hyper",
- "hyper-util",
- "rustls",
- "rustls-pki-types",
- "tokio",
- "tokio-rustls",
- "tower-service",
- "webpki-roots",
-]
-
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
@@ -2096,16 +1999,6 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
 
-[[package]]
-name = "jobserver"
-version = "0.1.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
-dependencies = [
- "getrandom 0.3.4",
- "libc",
-]
-
 [[package]]
 name = "js-sys"
 version = "0.3.91"
@@ -2264,12 +2157,6 @@ version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
-[[package]]
-name = "lru-slab"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
-
 [[package]]
 name = "mac"
 version = "0.1.1"
@@ -3108,61 +2995,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "quinn"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
-dependencies = [
- "bytes",
- "cfg_aliases",
- "pin-project-lite",
- "quinn-proto",
- "quinn-udp",
- "rustc-hash",
- "rustls",
- "socket2",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-proto"
-version = "0.11.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
-dependencies = [
- "bytes",
- "getrandom 0.3.4",
- "lru-slab",
- "rand 0.9.2",
- "ring",
- "rustc-hash",
- "rustls",
- "rustls-pki-types",
- "slab",
- "thiserror 2.0.18",
- "tinyvec",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-udp"
-version = "0.5.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
-dependencies = [
- "cfg_aliases",
- "libc",
- "once_cell",
- "socket2",
- "tracing",
- "windows-sys 0.60.2",
-]
-
 [[package]]
 name = "quote"
 version = "1.0.45"
@@ -3380,50 +3212,6 @@ version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
-[[package]]
-name = "reqwest"
-version = "0.12.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "encoding_rs",
- "futures-core",
- "futures-util",
- "h2",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-rustls",
- "hyper-util",
- "js-sys",
- "log",
- "mime",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-rustls",
- "tokio-util",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "wasm-streams 0.4.2",
- "web-sys",
- "webpki-roots",
-]
-
 [[package]]
 name = "reqwest"
 version = "0.13.2"
@@ -3454,7 +3242,7 @@ dependencies = [
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
- "wasm-streams 0.5.0",
+ "wasm-streams",
  "web-sys",
 ]
 
@@ -3482,20 +3270,6 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
-[[package]]
-name = "ring"
-version = "0.17.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
-dependencies = [
- "cc",
- "cfg-if",
- "getrandom 0.2.17",
- "libc",
- "untrusted",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "rustc-hash"
 version = "2.1.1"
@@ -3537,44 +3311,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "rustls"
-version = "0.23.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
-dependencies = [
- "aws-lc-rs",
- "log",
- "once_cell",
- "ring",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-pki-types"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
-dependencies = [
- "web-time",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
-dependencies = [
- "aws-lc-rs",
- "ring",
- "rustls-pki-types",
- "untrusted",
-]
-
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -3795,18 +3531,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "serde_urlencoded"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
-dependencies = [
- "form_urlencoded",
- "itoa",
- "ryu",
- "serde",
-]
-
 [[package]]
 name = "serde_with"
 version = "3.18.0"
@@ -4068,12 +3792,6 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
-[[package]]
-name = "subtle"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
-
 [[package]]
 name = "swift-rs"
 version = "1.0.7"
@@ -4225,7 +3943,7 @@ dependencies = [
  "percent-encoding",
  "plist",
  "raw-window-handle",
- "reqwest 0.13.2",
+ "reqwest",
  "serde",
  "serde_json",
  "serde_repr",
@@ -4649,21 +4367,6 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "tinyvec"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
 [[package]]
 name = "tokio"
 version = "1.50.0"
@@ -4678,16 +4381,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
-dependencies = [
- "rustls",
- "tokio",
-]
-
 [[package]]
 name = "tokio-util"
 version = "0.7.18"
@@ -4998,12 +4691,6 @@ version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
 
-[[package]]
-name = "untrusted"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
-
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -5215,19 +4902,6 @@ dependencies = [
  "wasmparser",
 ]
 
-[[package]]
-name = "wasm-streams"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
-dependencies = [
- "futures-util",
- "js-sys",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
-]
-
 [[package]]
 name = "wasm-streams"
 version = "0.5.0"
@@ -5263,16 +4937,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "web-time"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
 [[package]]
 name = "web_atoms"
 version = "0.2.3"
@@ -5329,15 +4993,6 @@ dependencies = [
  "system-deps",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cfaf3c063993ff62e73cb4311efde4db1efb31ab78a3e5c457939ad5cc0bed"
-dependencies = [
- "rustls-pki-types",
-]
-
 [[package]]
 name = "webview2-com"
 version = "0.38.2"
@@ -5631,15 +5286,6 @@ dependencies = [
  "windows-targets 0.48.5",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.59.0"
@@ -6281,12 +5927,6 @@ dependencies = [
  "synstructure",
 ]
 
-[[package]]
-name = "zeroize"
-version = "1.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
-
 [[package]]
 name = "zerotrie"
 version = "0.2.3"

packages/tauri-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codenomad/tauri-app",
-  "version": "0.14.0",
+  "version": "0.13.1",
   "private": true,
   "license": "MIT",
   "scripts": {
@@ -8,12 +8,11 @@
     "dev:ui": "npm run dev --workspace @codenomad/ui",
     "dev:prep": "node ./scripts/dev-prep.js",
     "dev:bootstrap": "npm run dev:prep && npm run dev:ui",
-    "sync:version": "node ./scripts/sync-tauri-version.js",
     "prebuild": "node ./scripts/prebuild.js",
     "bundle:server": "npm run prebuild",
     "build": "tauri build"
   },
   "devDependencies": {
-    "@tauri-apps/cli": "^2.10.1"
+    "@tauri-apps/cli": "^2.9.4"
   }
 }

packages/tauri-app/scripts/prebuild.js

@@ -21,7 +21,6 @@ const serverDevInstallCommand =
 const uiDevInstallCommand =
   "npm install --workspace @codenomad/ui --include-workspace-root=false --install-strategy=nested --fund=false --audit=false"
 const serverPrepareUiCommand = "npm run prepare-ui --workspace @neuralnomads/codenomad"
-const serverStandaloneBuildCommand = "npm run build:standalone --workspace @neuralnomads/codenomad"
 
 const envWithRootBin = {
   ...process.env,
@@ -38,12 +37,6 @@ const braceExpansionPath = path.join(
   "package.json",
 )
 
-const serverBuildDependencyPaths = [
-  path.join(serverRoot, "node_modules", "typescript", "package.json"),
-  path.join(serverRoot, "node_modules", "@types", "node-forge", "package.json"),
-  path.join(serverRoot, "node_modules", "@types", "yauzl", "package.json"),
-]
-
 const viteBinPath = path.join(uiRoot, "node_modules", ".bin", "vite")
 
 async function ensureMonacoAssets() {
@@ -63,7 +56,11 @@ async function ensureMonacoAssets() {
 function ensureServerBuild() {
   const distPath = path.join(serverRoot, "dist")
   const publicPath = path.join(serverRoot, "public")
-  console.log("[prebuild] rebuilding server workspace for desktop packaging...")
+  if (fs.existsSync(distPath) && fs.existsSync(publicPath)) {
+    return
+  }
+
+  console.log("[prebuild] server build missing; running workspace build...")
   execSync("npm --workspace @neuralnomads/codenomad run build", {
     cwd: workspaceRoot,
     stdio: "inherit",
@@ -78,15 +75,6 @@ function ensureServerBuild() {
   }
 }
 
-function ensureStandaloneServerBuild() {
-  console.log("[prebuild] building standalone server executable...")
-  execSync(serverStandaloneBuildCommand, {
-    cwd: workspaceRoot,
-    stdio: "inherit",
-    env: envWithRootBin,
-  })
-}
-
 function ensureUiBuild() {
   const loadingHtml = path.join(uiDist, "loading.html")
   if (fs.existsSync(loadingHtml)) {
@@ -114,7 +102,7 @@ function syncServerUiBundle() {
 }
 
 function ensureServerDevDependencies() {
-  if (serverBuildDependencyPaths.every((filePath) => fs.existsSync(filePath))) {
+  if (fs.existsSync(braceExpansionPath)) {
     return
   }
 
@@ -127,19 +115,15 @@ function ensureServerDevDependencies() {
 }
 
 function ensureServerDependencies() {
-  console.log("[prebuild] pruning server to production dependencies...")
-  execSync("npm prune --omit=dev --ignore-scripts --workspaces=false --fund=false --audit=false", {
+  if (fs.existsSync(braceExpansionPath)) {
+    return
+  }
+
+  console.log("[prebuild] ensuring server production dependencies...")
+  execSync(serverInstallCommand, {
     cwd: serverRoot,
     stdio: "inherit",
   })
-
-  if (!fs.existsSync(braceExpansionPath)) {
-    console.log("[prebuild] restoring missing server production dependencies...")
-    execSync(serverInstallCommand, {
-      cwd: serverRoot,
-      stdio: "inherit",
-    })
-  }
 }
 
 function ensureUiDevDependencies() {
@@ -162,7 +146,6 @@ function ensureRollupPlatformBinary() {
     "linux-arm64": "@rollup/rollup-linux-arm64-gnu",
     "darwin-arm64": "@rollup/rollup-darwin-arm64",
     "darwin-x64": "@rollup/rollup-darwin-x64",
-    "win32-arm64": "@rollup/rollup-win32-arm64-msvc",
     "win32-x64": "@rollup/rollup-win32-x64-msvc",
   }
 
@@ -192,47 +175,6 @@ function ensureRollupPlatformBinary() {
   })
 }
 
-function ensureEsbuildPlatformBinary() {
-  const platformKey = `${process.platform}-${process.arch}`
-  const platformPackages = {
-    "linux-x64": "@esbuild/linux-x64",
-    "linux-arm64": "@esbuild/linux-arm64",
-    "darwin-arm64": "@esbuild/darwin-arm64",
-    "darwin-x64": "@esbuild/darwin-x64",
-    "win32-arm64": "@esbuild/win32-arm64",
-    "win32-x64": "@esbuild/win32-x64",
-  }
-
-  const pkgName = platformPackages[platformKey]
-  if (!pkgName) {
-    return
-  }
-
-  const platformPackagePath = path.join(workspaceRoot, "node_modules", ...pkgName.split("/"))
-  if (fs.existsSync(platformPackagePath)) {
-    return
-  }
-
-  let esbuildVersion = ""
-  try {
-    esbuildVersion = require(path.join(workspaceRoot, "node_modules", "esbuild", "package.json")).version
-  } catch {
-    try {
-      esbuildVersion = require(path.join(workspaceRoot, "node_modules", "vite", "node_modules", "esbuild", "package.json")).version
-    } catch {
-      // leave version empty; fallback install will use latest compatible
-    }
-  }
-
-  const packageSpec = esbuildVersion ? `${pkgName}@${esbuildVersion}` : pkgName
-
-  console.log("[prebuild] installing esbuild platform binary (optional dep workaround)...")
-  execSync(`npm install ${packageSpec} --no-save --ignore-scripts --fund=false --audit=false`, {
-    cwd: workspaceRoot,
-    stdio: "inherit",
-  })
-}
-
 function copyServerArtifacts() {
   fs.rmSync(serverDest, { recursive: true, force: true })
   fs.mkdirSync(serverDest, { recursive: true })
@@ -311,10 +253,8 @@ function copyUiLoadingAssets() {
   ensureUiDevDependencies()
   await ensureMonacoAssets()
   ensureRollupPlatformBinary()
-  ensureEsbuildPlatformBinary()
-  ensureServerBuild()
-  ensureStandaloneServerBuild()
   ensureServerDependencies()
+  ensureServerBuild()
   ensureUiBuild()
   syncServerUiBundle()
   copyServerArtifacts()

packages/tauri-app/scripts/sync-tauri-version.js

@@ -1,102 +0,0 @@
-#!/usr/bin/env node
-
-const fs = require("fs")
-const path = require("path")
-
-const root = path.resolve(__dirname, "..")
-const packageJsonPath = path.join(root, "package.json")
-const cargoTomlPath = path.join(root, "src-tauri", "Cargo.toml")
-const cargoLockPath = path.join(root, "Cargo.lock")
-const tauriConfigPath = path.join(root, "src-tauri", "tauri.conf.json")
-
-function readPackageVersion() {
-  const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"))
-  if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
-    throw new Error("Missing version in packages/tauri-app/package.json")
-  }
-  return packageJson.version
-}
-
-function syncCargoToml(version) {
-  const current = fs.readFileSync(cargoTomlPath, "utf8")
-  const packageVersionPattern = /(\[package\][\s\S]*?^version\s*=\s*")([^"]+)(")/m
-  const match = current.match(packageVersionPattern)
-
-  if (!match) {
-    throw new Error("Unable to find [package] version in packages/tauri-app/src-tauri/Cargo.toml")
-  }
-
-  if (match[2] === version) {
-    return false
-  }
-
-  const updated = current.replace(packageVersionPattern, (_, prefix, __, suffix) => `${prefix}${version}${suffix}`)
-  fs.writeFileSync(cargoTomlPath, updated)
-  return true
-}
-
-function syncCargoLock(version) {
-  if (!fs.existsSync(cargoLockPath)) {
-    return false
-  }
-
-  const current = fs.readFileSync(cargoLockPath, "utf8")
-  const packageVersionPattern = /(\[\[package\]\]\r?\nname = "codenomad-tauri"\r?\nversion = ")([^"]+)(")/
-  const match = current.match(packageVersionPattern)
-
-  if (!match) {
-    throw new Error("Unable to find codenomad-tauri version in packages/tauri-app/Cargo.lock")
-  }
-
-  if (match[2] === version) {
-    return false
-  }
-
-  const updated = current.replace(packageVersionPattern, (_, prefix, __, suffix) => `${prefix}${version}${suffix}`)
-  fs.writeFileSync(cargoLockPath, updated)
-  return true
-}
-
-function syncTauriConfig(version) {
-  const current = fs.readFileSync(tauriConfigPath, "utf8")
-  const config = JSON.parse(current)
-  if (config.version === version) {
-    return false
-  }
-
-  config.version = version
-  fs.writeFileSync(tauriConfigPath, `${JSON.stringify(config, null, 2)}\n`)
-  return true
-}
-
-function main() {
-  const version = readPackageVersion()
-  const changed = []
-
-  if (syncCargoToml(version)) {
-    changed.push(path.relative(root, cargoTomlPath))
-  }
-
-  if (syncCargoLock(version)) {
-    changed.push(path.relative(root, cargoLockPath))
-  }
-
-  if (syncTauriConfig(version)) {
-    changed.push(path.relative(root, tauriConfigPath))
-  }
-
-  if (changed.length === 0) {
-    console.log(`[sync-tauri-version] already aligned to ${version}`)
-    return
-  }
-
-  console.log(`[sync-tauri-version] synced ${version} -> ${changed.join(", ")}`)
-}
-
-try {
-  main()
-} catch (error) {
-  const message = error instanceof Error ? error.message : String(error)
-  console.error(`[sync-tauri-version] failed: ${message}`)
-  process.exit(1)
-}

packages/tauri-app/src-tauri/Cargo.toml

@@ -1,22 +1,21 @@
 [package]
 name = "codenomad-tauri"
-version = "0.14.0"
+version = "0.12.3"
 edition = "2021"
 license = "MIT"
 
 [build-dependencies]
-tauri-build = { version = "2.5.6", features = [] }
+tauri-build = { version = "2.5.2", features = [] }
 
 [dependencies]
-tauri = { version = "2.10.1", features = [ "devtools"] }
+tauri = { version = "2.5.2", features = [ "devtools"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_yaml = "0.9"
-base64 = "0.22"
-rustls = { version = "0.23", features = ["ring"] }
-reqwest = { version = "0.12", default-features = false, features = ["http2", "charset", "json", "stream", "rustls-tls"] }
 regex = "1"
+once_cell = "1"
 parking_lot = "0.12"
+thiserror = "1"
 anyhow = "1"
 which = "4"
 libc = "0.2"
@@ -29,7 +28,4 @@ url = "2"
 tauri-plugin-notification = "2"
 
 [target.'cfg(windows)'.dependencies]
-windows-sys = { version = "0.59", features = ["Win32_Foundation", "Win32_Security_Cryptography", "Win32_UI_Shell", "Win32_Security", "Win32_System_JobObjects"] }
-
-[target.'cfg(target_os = "linux")'.dependencies]
-webkit2gtk = "2.0.2"
+windows-sys = { version = "0.59", features = ["Win32_UI_Shell"] }

packages/tauri-app/src-tauri/Info.plist

@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>NSMicrophoneUsageDescription</key>
-  <string>CodeNomad needs microphone access for speech-to-text prompt input.</string>
-  <key>NSLocalNetworkUsageDescription</key>
-  <string>CodeNomad needs local network access to connect to locally hosted AI and speech services.</string>
-</dict>
-</plist>

packages/tauri-app/src-tauri/gen/schemas/capabilities.json

@@ -1 +1 @@
-{"main-window-native-dialogs":{"identifier":"main-window-native-dialogs","description":"Grant the main window access to required core features and native dialog commands.","remote":{"urls":["http://127.0.0.1:*","http://localhost:*","http://tauri.localhost/*","https://tauri.localhost/*"]},"local":true,"windows":["main"],"permissions":["core:default","core:menu:default","dialog:allow-open","opener:allow-default-urls","opener:allow-open-url","notification:allow-is-permission-granted","notification:allow-request-permission","notification:allow-notify","notification:allow-show","core:webview:allow-set-webview-zoom"]}}
+{"main-window-native-dialogs":{"identifier":"main-window-native-dialogs","description":"Grant the main window access to required core features and native dialog commands.","remote":{"urls":["http://127.0.0.1:*","http://localhost:*","http://tauri.localhost/*","https://tauri.localhost/*"]},"local":true,"windows":["main"],"permissions":["core:default","core:menu:default","dialog:allow-open","opener:allow-default-urls","opener:allow-open-url","notification:allow-is-permission-granted","notification:allow-request-permission","notification:allow-notify","notification:allow-show","core:webview:allow-set-webview-zoom"]}}

packages/tauri-app/src-tauri/gen/schemas/macOS-schema.json

@@ -2378,72 +2378,6 @@
           "const": "dialog:deny-save",
           "markdownDescription": "Denies the save command without any pre-configured scope."
         },
-        {
-          "description": "No features are enabled by default, as we believe\nthe shortcuts can be inherently dangerous and it is\napplication specific if specific shortcuts should be\nregistered or unregistered.\n",
-          "type": "string",
-          "const": "global-shortcut:default",
-          "markdownDescription": "No features are enabled by default, as we believe\nthe shortcuts can be inherently dangerous and it is\napplication specific if specific shortcuts should be\nregistered or unregistered.\n"
-        },
-        {
-          "description": "Enables the is_registered command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:allow-is-registered",
-          "markdownDescription": "Enables the is_registered command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the register command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:allow-register",
-          "markdownDescription": "Enables the register command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the register_all command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:allow-register-all",
-          "markdownDescription": "Enables the register_all command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the unregister command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:allow-unregister",
-          "markdownDescription": "Enables the unregister command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the unregister_all command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:allow-unregister-all",
-          "markdownDescription": "Enables the unregister_all command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the is_registered command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:deny-is-registered",
-          "markdownDescription": "Denies the is_registered command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the register command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:deny-register",
-          "markdownDescription": "Denies the register command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the register_all command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:deny-register-all",
-          "markdownDescription": "Denies the register_all command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the unregister command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:deny-unregister",
-          "markdownDescription": "Denies the unregister command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the unregister_all command without any pre-configured scope.",
-          "type": "string",
-          "const": "global-shortcut:deny-unregister-all",
-          "markdownDescription": "Denies the unregister_all command without any pre-configured scope."
-        },
         {
           "description": "This permission set configures which\nnotification features are by default exposed.\n\n#### Granted Permissions\n\nIt allows all notification related features.\n\n\n#### This default permission set includes:\n\n- `allow-is-permission-granted`\n- `allow-request-permission`\n- `allow-notify`\n- `allow-register-action-types`\n- `allow-register-listener`\n- `allow-cancel`\n- `allow-get-pending`\n- `allow-remove-active`\n- `allow-get-active`\n- `allow-check-permissions`\n- `allow-show`\n- `allow-batch`\n- `allow-list-channels`\n- `allow-delete-channel`\n- `allow-create-channel`\n- `allow-permission-state`",
           "type": "string",

packages/tauri-app/src-tauri/icons/linux/ai.neuralnomads.codenomad.client.desktop

@@ -1,9 +0,0 @@
-[Desktop Entry]
-Categories=
-Exec=codenomad-tauri
-StartupWMClass=codenomad-tauri
-Icon=codenomad-tauri
-Name=CodeNomad
-NoDisplay=true
-Terminal=false
-Type=Application

packages/tauri-app/src-tauri/src/cert_manager.rs

@@ -1,449 +0,0 @@
-use base64::Engine;
-use std::env;
-use std::fs;
-use std::path::{Path, PathBuf};
-
-const DEFAULT_CONFIG_PATH: &str = "~/.config/codenomad/config.json";
-const TLS_DIR_NAME: &str = "tls";
-const CA_CERT_FILE: &str = "ca-cert.pem";
-const SERVER_CERT_FILE: &str = "server-cert.pem";
-const SERVER_KEY_FILE: &str = "server-key.pem";
-const TRUSTED_MARKER: &str = "server-ca.trusted";
-#[cfg(windows)]
-const WINDOWS_APP_USER_MODEL_ID: &str = "ai.neuralnomads.codenomad.client";
-
-/// Holds the PEM-encoded certificate/key pair used by the local HTTPS proxy,
-/// plus the CA certificate DER used for trust-store installation.
-pub struct LocalCert {
-    pub cert_pem: String,
-    pub key_pem: String,
-    pub ca_cert_der: Vec<u8>,
-}
-
-struct TlsAssetPaths {
-    cert_path: PathBuf,
-    key_path: PathBuf,
-    trust_path: PathBuf,
-    append_ca_to_cert: bool,
-}
-
-/// Loads the TLS assets already managed by `packages/server`.
-pub fn ensure_local_cert() -> Result<LocalCert, String> {
-    let assets = resolve_tls_asset_paths()?;
-    let mut cert_pem = read_pem_file(&assets.cert_path)?;
-    let key_pem = read_pem_file(&assets.key_path)?;
-    let trust_pem = read_pem_file(&assets.trust_path)?;
-
-    if assets.append_ca_to_cert {
-        cert_pem = format!("{}\n{}\n", cert_pem.trim(), trust_pem.trim());
-    }
-
-    let ca_cert_der = pem_to_der(&trust_pem)?;
-
-    Ok(LocalCert {
-        cert_pem,
-        key_pem,
-        ca_cert_der,
-    })
-}
-
-fn read_pem_file(path: &Path) -> Result<String, String> {
-    fs::read_to_string(path).map_err(|e| format!("Failed to read {}: {e}", path.display()))
-}
-
-fn server_tls_dir() -> Result<PathBuf, String> {
-    Ok(resolve_server_config_base_dir()?.join(TLS_DIR_NAME))
-}
-
-fn resolve_tls_asset_paths() -> Result<TlsAssetPaths, String> {
-    let tls_key_path = env::var("CLI_TLS_KEY")
-        .ok()
-        .filter(|value| !value.trim().is_empty())
-        .map(|value| resolve_path_like_server(&value))
-        .transpose()?;
-    let tls_cert_path = env::var("CLI_TLS_CERT")
-        .ok()
-        .filter(|value| !value.trim().is_empty())
-        .map(|value| resolve_path_like_server(&value))
-        .transpose()?;
-    let tls_ca_path = env::var("CLI_TLS_CA")
-        .ok()
-        .filter(|value| !value.trim().is_empty())
-        .map(|value| resolve_path_like_server(&value))
-        .transpose()?;
-
-    match (tls_key_path, tls_cert_path) {
-        (Some(key_path), Some(cert_path)) => {
-            let append_ca_to_cert = tls_ca_path.is_some();
-            let trust_path = tls_ca_path.unwrap_or_else(|| cert_path.clone());
-            Ok(TlsAssetPaths {
-                cert_path,
-                key_path,
-                trust_path,
-                append_ca_to_cert,
-            })
-        }
-        (Some(_), None) | (None, Some(_)) => Err(
-            "CLI_TLS_KEY and CLI_TLS_CERT must both be set when using custom TLS files"
-                .to_string(),
-        ),
-        (None, None) => {
-            let tls_dir = server_tls_dir()?;
-            Ok(TlsAssetPaths {
-                cert_path: tls_dir.join(SERVER_CERT_FILE),
-                key_path: tls_dir.join(SERVER_KEY_FILE),
-                trust_path: tls_dir.join(CA_CERT_FILE),
-                append_ca_to_cert: true,
-            })
-        }
-    }
-}
-
-fn resolve_server_config_base_dir() -> Result<PathBuf, String> {
-    let raw = env::var("CLI_CONFIG")
-        .ok()
-        .filter(|value| !value.trim().is_empty())
-        .unwrap_or_else(|| DEFAULT_CONFIG_PATH.to_string());
-    let expanded = resolve_path_like_server(&raw)?;
-    let lower = raw.trim().to_lowercase();
-
-    if lower.ends_with(".yaml") || lower.ends_with(".yml") || lower.ends_with(".json") {
-        return expanded
-            .parent()
-            .map(Path::to_path_buf)
-            .ok_or_else(|| format!("Failed to determine config base dir from {}", expanded.display()));
-    }
-
-    Ok(expanded)
-}
-
-fn resolve_path_like_server(path: &str) -> Result<PathBuf, String> {
-    if path.starts_with("~/") {
-        let home = dirs::home_dir().or_else(|| env::var("HOME").ok().map(PathBuf::from));
-        let home = home.ok_or_else(|| "Cannot determine home directory".to_string())?;
-        return Ok(home.join(path.trim_start_matches("~/")));
-    }
-
-    let path = PathBuf::from(path);
-    if path.is_absolute() {
-        return Ok(path);
-    }
-
-    let cwd = env::current_dir().map_err(|e| format!("Failed to read current dir: {e}"))?;
-    Ok(cwd.join(path))
-}
-
-fn trusted_marker_path() -> Result<PathBuf, String> {
-    let base = dirs::data_local_dir()
-        .ok_or_else(|| "Cannot determine local app data directory".to_string())?;
-
-    #[cfg(windows)]
-    {
-        return Ok(base.join(WINDOWS_APP_USER_MODEL_ID).join(TRUSTED_MARKER));
-    }
-
-    #[cfg(not(windows))]
-    {
-        Ok(base.join("codenomad").join(TRUSTED_MARKER))
-    }
-}
-
-fn trusted_marker_value(cert_der: &[u8]) -> String {
-    cert_der.iter().map(|byte| format!("{byte:02x}")).collect()
-}
-
-fn trusted_marker_file_suffix(cert_der: &[u8]) -> String {
-    trusted_marker_value(cert_der).chars().take(16).collect()
-}
-
-fn has_matching_trusted_marker(cert_der: &[u8]) -> bool {
-    trusted_marker_path()
-        .ok()
-        .and_then(|path| fs::read_to_string(path).ok())
-        .map(|value| value.trim() == trusted_marker_value(cert_der))
-        .unwrap_or(false)
-}
-
-fn write_trusted_marker(cert_der: &[u8]) -> Result<(), String> {
-    let path = trusted_marker_path()?;
-    if let Some(parent) = path.parent() {
-        fs::create_dir_all(parent)
-            .map_err(|e| format!("Failed to create trust state dir {}: {e}", parent.display()))?;
-    }
-    fs::write(path, trusted_marker_value(cert_der))
-        .map_err(|e| format!("Failed to write trust marker: {e}"))
-}
-
-#[cfg(windows)]
-pub fn needs_trust_in_store(cert_der: &[u8]) -> Result<bool, String> {
-    Ok(!windows_cert_is_trusted(cert_der)?)
-}
-
-#[cfg(windows)]
-pub fn trust_cert_in_store(cert_der: &[u8]) -> Result<(), String> {
-    use windows_sys::Win32::Security::Cryptography::{
-        CertAddEncodedCertificateToStore, CertCloseStore, CertOpenSystemStoreW,
-        CERT_STORE_ADD_REPLACE_EXISTING, PKCS_7_ASN_ENCODING, X509_ASN_ENCODING,
-    };
-
-    if !needs_trust_in_store(cert_der)? {
-        return Ok(());
-    }
-
-    let store_name: Vec<u16> = "Root\0".encode_utf16().collect();
-
-    unsafe {
-        let store = CertOpenSystemStoreW(0, store_name.as_ptr());
-        if store.is_null() {
-            return Err("Failed to open CurrentUser\\Root certificate store".into());
-        }
-
-        let encoding = X509_ASN_ENCODING | PKCS_7_ASN_ENCODING;
-        let result = CertAddEncodedCertificateToStore(
-            store,
-            encoding,
-            cert_der.as_ptr(),
-            cert_der.len() as u32,
-            CERT_STORE_ADD_REPLACE_EXISTING,
-            std::ptr::null_mut(),
-        );
-
-        CertCloseStore(store, 0);
-
-        if result == 0 {
-            return Err(
-                "Failed to add certificate to trust store. The user may have declined the security dialog."
-                    .into(),
-            );
-        }
-    }
-
-    write_trusted_marker(cert_der)?;
-    Ok(())
-}
-
-#[cfg(target_os = "macos")]
-pub fn needs_trust_in_store(cert_der: &[u8]) -> Result<bool, String> {
-    Ok(!(has_matching_trusted_marker(cert_der) && macos_cert_is_trusted(cert_der)?))
-}
-
-#[cfg(target_os = "macos")]
-pub fn trust_cert_in_store(cert_der: &[u8]) -> Result<(), String> {
-    use std::process::Command;
-
-    if !needs_trust_in_store(cert_der)? {
-        return Ok(());
-    }
-
-    let temp_path = env::temp_dir().join(format!(
-        "codenomad-server-ca-{}.cer",
-        trusted_marker_file_suffix(cert_der)
-    ));
-    fs::write(&temp_path, cert_der)
-        .map_err(|e| format!("Failed to write temporary certificate {}: {e}", temp_path.display()))?;
-
-    let keychain_path = resolve_macos_user_keychain()?;
-
-    let mut command = Command::new("/usr/bin/security");
-    command.args(["add-trusted-cert", "-r", "trustRoot", "-k"]);
-    command.arg(&keychain_path);
-
-    let output = command.arg(&temp_path).output().map_err(|e| {
-        format!(
-            "Failed to launch macOS security tool to trust the local CA certificate: {e}"
-        )
-    })?;
-
-    let _ = fs::remove_file(&temp_path);
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
-        let detail = if stderr.is_empty() {
-            format!("security exited with status {}", output.status)
-        } else {
-            stderr
-        };
-        return Err(format!(
-            "Failed to add the local CodeNomad CA certificate to the macOS trust settings: {detail}"
-        ));
-    }
-
-    if !macos_cert_is_trusted(cert_der)? {
-        return Err(format!(
-            "Added the local CodeNomad CA certificate to {} but could not verify that macOS trusts it",
-            keychain_path.display()
-        ));
-    }
-
-    write_trusted_marker(cert_der)?;
-    Ok(())
-}
-
-#[cfg(windows)]
-fn windows_cert_is_trusted(cert_der: &[u8]) -> Result<bool, String> {
-    use windows_sys::Win32::Security::Cryptography::{
-        CertCloseStore, CertEnumCertificatesInStore, CertOpenSystemStoreW,
-    };
-
-    let store_name: Vec<u16> = "Root\0".encode_utf16().collect();
-
-    unsafe {
-        let store = CertOpenSystemStoreW(0, store_name.as_ptr());
-        if store.is_null() {
-            return Err("Failed to open CurrentUser\\Root certificate store".into());
-        }
-
-        let mut context = CertEnumCertificatesInStore(store, std::ptr::null());
-        while !context.is_null() {
-            let encoded = std::slice::from_raw_parts(
-                (*context).pbCertEncoded,
-                (*context).cbCertEncoded as usize,
-            );
-            if encoded == cert_der {
-                CertCloseStore(store, 0);
-                return Ok(true);
-            }
-
-            context = CertEnumCertificatesInStore(store, context);
-        }
-
-        CertCloseStore(store, 0);
-        Ok(false)
-    }
-}
-
-#[cfg(target_os = "macos")]
-fn resolve_macos_user_keychain() -> Result<PathBuf, String> {
-    let output = std::process::Command::new("/usr/bin/security")
-        .args(["default-keychain", "-d", "user"])
-        .output()
-        .map_err(|e| format!("Failed to resolve macOS default user keychain: {e}"))?;
-
-    if output.status.success() {
-        let stdout = String::from_utf8_lossy(&output.stdout);
-        let trimmed = stdout.trim().trim_matches('"');
-        if !trimmed.is_empty() {
-            return Ok(PathBuf::from(trimmed));
-        }
-    }
-
-    let home = dirs::home_dir().or_else(|| env::var("HOME").ok().map(PathBuf::from));
-    let home = home.ok_or_else(|| "Cannot determine home directory for macOS keychain lookup".to_string())?;
-    Ok(home.join("Library/Keychains/login.keychain-db"))
-}
-
-#[cfg(target_os = "macos")]
-fn macos_cert_is_trusted(cert_der: &[u8]) -> Result<bool, String> {
-    use std::process::Command;
-
-    let temp_path = env::temp_dir().join(format!(
-        "codenomad-server-ca-verify-{}.cer",
-        trusted_marker_file_suffix(cert_der)
-    ));
-    fs::write(&temp_path, cert_der)
-        .map_err(|e| format!("Failed to write temporary certificate {}: {e}", temp_path.display()))?;
-
-    let keychain_path = resolve_macos_user_keychain()?;
-    let fingerprint = macos_cert_sha256(&temp_path)?;
-    let find_output = Command::new("/usr/bin/security")
-        .args(["find-certificate", "-a", "-Z", "-c", "CodeNomad Local CA"])
-        .arg(&keychain_path)
-        .output()
-        .map_err(|e| format!("Failed to query macOS keychain certificates: {e}"))?;
-
-    if !find_output.status.success() {
-        let _ = fs::remove_file(&temp_path);
-        let stderr = String::from_utf8_lossy(&find_output.stderr).trim().to_string();
-        let detail = if stderr.is_empty() {
-            format!("security exited with status {}", find_output.status)
-        } else {
-            stderr
-        };
-        return Err(format!(
-            "Failed to inspect the macOS keychain for the local CodeNomad CA certificate: {detail}"
-        ));
-    }
-
-    let stdout = String::from_utf8_lossy(&find_output.stdout);
-    if !stdout.to_ascii_uppercase().contains(&fingerprint) {
-        let _ = fs::remove_file(&temp_path);
-        return Ok(false);
-    }
-
-    let verify_output = Command::new("/usr/bin/security")
-        .args(["verify-cert", "-q", "-L", "-l", "-p", "basic", "-c"])
-        .arg(&temp_path)
-        .args(["-k"])
-        .arg(&keychain_path)
-        .output()
-        .map_err(|e| format!("Failed to verify macOS trust for the local CodeNomad CA certificate: {e}"))?;
-
-    let _ = fs::remove_file(&temp_path);
-    Ok(verify_output.status.success())
-}
-
-#[cfg(target_os = "macos")]
-fn macos_cert_sha256(cert_path: &Path) -> Result<String, String> {
-    let output = std::process::Command::new("/usr/bin/shasum")
-        .args(["-a", "256"])
-        .arg(cert_path)
-        .output()
-        .map_err(|e| format!("Failed to compute SHA-256 for {}: {e}", cert_path.display()))?;
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
-        let detail = if stderr.is_empty() {
-            format!("shasum exited with status {}", output.status)
-        } else {
-            stderr
-        };
-        return Err(format!(
-            "Failed to compute SHA-256 for {}: {detail}",
-            cert_path.display()
-        ));
-    }
-
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    let hash = stdout
-        .split_whitespace()
-        .next()
-        .ok_or_else(|| format!("Failed to parse SHA-256 output for {}", cert_path.display()))?;
-    Ok(hash.to_ascii_uppercase())
-}
-
-#[cfg(all(not(windows), not(target_os = "macos")))]
-pub fn needs_trust_in_store(_cert_der: &[u8]) -> Result<bool, String> {
-    Ok(false)
-}
-
-#[cfg(all(not(windows), not(target_os = "macos")))]
-pub fn trust_cert_in_store(_cert_der: &[u8]) -> Result<(), String> {
-    // Non-Windows platforms use native webview-specific handling instead of OS trust-store writes.
-    Ok(())
-}
-
-fn pem_to_der(pem: &str) -> Result<Vec<u8>, String> {
-    let mut body = String::new();
-    let mut in_block = false;
-
-    for line in pem.lines() {
-        if line.starts_with("-----BEGIN CERTIFICATE-----") {
-            in_block = true;
-            continue;
-        }
-        if line.starts_with("-----END CERTIFICATE-----") {
-            break;
-        }
-        if in_block {
-            body.push_str(line.trim());
-        }
-    }
-
-    if body.is_empty() {
-        return Err("No certificate found in PEM file".to_string());
-    }
-
-    base64::engine::general_purpose::STANDARD
-        .decode(body)
-        .map_err(|e| format!("Failed to decode certificate PEM: {e}"))
-}

packages/tauri-app/src-tauri/src/cli_manager.rs

@@ -5,13 +5,9 @@ use serde::{Deserialize, Serialize};
 use serde_json::json;
 use std::collections::VecDeque;
 use std::env;
-#[cfg(windows)]
-use std::ffi::c_void;
 use std::ffi::OsStr;
 use std::fs;
 use std::io::{BufRead, BufReader, Read, Write};
-#[cfg(windows)]
-use std::mem::{size_of, zeroed};
 use std::net::TcpStream;
 #[cfg(unix)]
 use std::os::unix::process::CommandExt;
@@ -23,95 +19,11 @@ use std::thread;
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 use tauri::{webview::cookie::Cookie, AppHandle, Emitter, Manager, Url};
 
-#[cfg(windows)]
-use std::os::windows::io::AsRawHandle;
 #[cfg(windows)]
 use std::os::windows::process::CommandExt;
-#[cfg(windows)]
-use windows_sys::Win32::Foundation::{CloseHandle, HANDLE};
-#[cfg(windows)]
-use windows_sys::Win32::System::JobObjects::{
-    AssignProcessToJobObject, CreateJobObjectW, JobObjectExtendedLimitInformation,
-    SetInformationJobObject, JOBOBJECT_EXTENDED_LIMIT_INFORMATION,
-    JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
-};
 
 #[cfg(windows)]
 const CREATE_NO_WINDOW: u32 = 0x08000000;
-const MISSING_NODE_PREFIX: &str = "CODENOMAD_MISSING_NODE:";
-
-#[cfg(windows)]
-#[derive(Debug)]
-struct WindowsJobObject {
-    // The desktop wrapper may observe only a short-lived Node wrapper PID while the real
-    // server and workspace descendants continue running below it. KILL_ON_JOB_CLOSE gives
-    // Tauri an OS-owned handle for the whole subtree instead of relying on a single PID.
-    handle: HANDLE,
-}
-
-#[cfg(windows)]
-impl WindowsJobObject {
-    fn create() -> anyhow::Result<Self> {
-        let handle = unsafe { CreateJobObjectW(std::ptr::null_mut(), std::ptr::null()) };
-        if handle.is_null() {
-            return Err(anyhow::anyhow!(
-                "CreateJobObjectW failed: {}",
-                std::io::Error::last_os_error()
-            ));
-        }
-
-        let mut info: JOBOBJECT_EXTENDED_LIMIT_INFORMATION = unsafe { zeroed() };
-        info.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
-
-        let ok = unsafe {
-            SetInformationJobObject(
-                handle,
-                JobObjectExtendedLimitInformation,
-                &mut info as *mut _ as *mut c_void,
-                size_of::<JOBOBJECT_EXTENDED_LIMIT_INFORMATION>() as u32,
-            )
-        };
-        if ok == 0 {
-            let err = std::io::Error::last_os_error();
-            unsafe {
-                CloseHandle(handle);
-            }
-            return Err(anyhow::anyhow!("SetInformationJobObject failed: {}", err));
-        }
-
-        Ok(Self { handle })
-    }
-
-    fn assign_child(&self, child: &Child) -> anyhow::Result<()> {
-        let process_handle = child.as_raw_handle() as HANDLE;
-        let ok = unsafe { AssignProcessToJobObject(self.handle, process_handle) };
-        if ok == 0 {
-            return Err(anyhow::anyhow!(
-                "AssignProcessToJobObject failed: {}",
-                std::io::Error::last_os_error()
-            ));
-        }
-
-        Ok(())
-    }
-}
-
-#[cfg(windows)]
-impl Drop for WindowsJobObject {
-    fn drop(&mut self) {
-        if !self.handle.is_null() {
-            unsafe {
-                CloseHandle(self.handle);
-            }
-        }
-    }
-}
-
-#[cfg(windows)]
-unsafe impl Send for WindowsJobObject {}
-
-#[cfg(windows)]
-unsafe impl Sync for WindowsJobObject {}
 
 fn log_line(message: &str) {
     println!("[tauri-cli] {message}");
@@ -136,10 +48,6 @@ fn workspace_root() -> Option<PathBuf> {
     })
 }
 
-fn launch_cwd() -> Option<PathBuf> {
-    std::env::current_dir().ok()
-}
-
 const SESSION_COOKIE_NAME_PREFIX: &str = "codenomad_session";
 
 const CLI_STOP_GRACE_SECS: u64 = 30;
@@ -455,8 +363,6 @@ impl Default for CliStatus {
 pub struct CliProcessManager {
     status: Arc<Mutex<CliStatus>>,
     child: Arc<Mutex<Option<Child>>>,
-    #[cfg(windows)]
-    job: Arc<Mutex<Option<WindowsJobObject>>>,
     ready: Arc<AtomicBool>,
     bootstrap_token: Arc<Mutex<Option<String>>>,
 }
@@ -466,8 +372,6 @@ impl CliProcessManager {
         Self {
             status: Arc::new(Mutex::new(CliStatus::default())),
             child: Arc::new(Mutex::new(None)),
-            #[cfg(windows)]
-            job: Arc::new(Mutex::new(None)),
             ready: Arc::new(AtomicBool::new(false)),
             bootstrap_token: Arc::new(Mutex::new(None)),
         }
@@ -490,8 +394,6 @@ impl CliProcessManager {
 
         let status_arc = self.status.clone();
         let child_arc = self.child.clone();
-        #[cfg(windows)]
-        let job_arc = self.job.clone();
         let ready_flag = self.ready.clone();
         let token_arc = self.bootstrap_token.clone();
         thread::spawn(move || {
@@ -499,8 +401,6 @@ impl CliProcessManager {
                 app.clone(),
                 status_arc.clone(),
                 child_arc,
-                #[cfg(windows)]
-                job_arc,
                 ready_flag,
                 token_arc,
                 dev,
@@ -520,12 +420,11 @@ impl CliProcessManager {
     }
 
     pub fn stop(&self) -> anyhow::Result<()> {
-        #[cfg(windows)]
-        let _job = self.job.lock().take();
-
         let mut child_opt = self.child.lock();
         if let Some(mut child) = child_opt.take() {
             log_line(&format!("stopping CLI pid={}", child.id()));
+            #[cfg(windows)]
+            let mut forced_tree_shutdown = false;
             #[cfg(unix)]
             unsafe {
                 let pid = child.id() as i32;
@@ -547,16 +446,18 @@ impl CliProcessManager {
                     Ok(Some(_)) => break,
                     Ok(None) => {
                         #[cfg(windows)]
-                        if start.elapsed() > Duration::from_millis(CLI_WINDOWS_FORCE_GRACE_MS) {
+                        if !forced_tree_shutdown
+                            && start.elapsed() > Duration::from_millis(CLI_WINDOWS_FORCE_GRACE_MS)
+                        {
                             log_line(&format!(
                                 "regular Windows shutdown still running after {}ms; escalating pid={}",
                                 CLI_WINDOWS_FORCE_GRACE_MS,
                                 child.id()
                             ));
+                            forced_tree_shutdown = true;
                             if !kill_process_tree_windows(child.id(), true) {
                                 let _ = child.kill();
                             }
-                            break;
                         }
 
                         if start.elapsed() > Duration::from_secs(CLI_STOP_GRACE_SECS) {
@@ -575,7 +476,11 @@ impl CliProcessManager {
                             }
                             #[cfg(windows)]
                             {
-                                if !kill_process_tree_windows(child.id(), true) {
+                                if !forced_tree_shutdown
+                                    && !kill_process_tree_windows(child.id(), true)
+                                {
+                                    let _ = child.kill();
+                                } else if forced_tree_shutdown {
                                     let _ = child.kill();
                                 }
                             }
@@ -586,9 +491,6 @@ impl CliProcessManager {
                     Err(_) => break,
                 }
             }
-        } else {
-            #[cfg(windows)]
-            log_line("tracked CLI process already exited; dropping Windows job object to reap descendants");
         }
 
         let mut status = self.status.lock();
@@ -609,7 +511,6 @@ impl CliProcessManager {
         app: AppHandle,
         status: Arc<Mutex<CliStatus>>,
         child_holder: Arc<Mutex<Option<Child>>>,
-        #[cfg(windows)] job_holder: Arc<Mutex<Option<WindowsJobObject>>>,
         ready: Arc<AtomicBool>,
         bootstrap_token: Arc<Mutex<Option<String>>>,
         dev: bool,
@@ -628,54 +529,38 @@ impl CliProcessManager {
             log_line("development mode: will prefer tsx + source if present");
         }
 
-        let cwd = launch_cwd();
+        let cwd = workspace_root();
         if let Some(ref c) = cwd {
             log_line(&format!("using cwd={}", c.display()));
         }
 
-        let use_user_shell = supports_user_shell();
-
-        if resolution.runner == Runner::Tsx
-            && !use_user_shell
-            && which::which(&resolution.node_binary).is_err()
-        {
-            return Err(anyhow::anyhow!(
-                "Node binary '{}' not found. CodeNomad development mode requires Node.js installed on the system, or set NODE_BINARY to a valid runtime path.",
-                resolution.node_binary
-            ));
-        }
-
-        let command_info = if use_user_shell {
+        let command_info = if supports_user_shell() {
             log_line("spawning via user shell");
             ShellCommandType::UserShell(build_shell_command_string(&resolution, &args)?)
         } else {
-            log_line(if resolution.runner == Runner::Standalone {
-                "spawning directly with standalone executable"
-            } else {
-                "spawning directly with node"
-            });
+            log_line("spawning directly with node");
             ShellCommandType::Direct(DirectCommand {
-                program: if resolution.runner == Runner::Standalone {
-                    resolution.entry.clone()
-                } else {
-                    resolution.node_binary.clone()
-                },
+                program: resolution.node_binary.clone(),
                 args: resolution.runner_args(&args),
             })
         };
 
+        if !supports_user_shell() {
+            if which::which(&resolution.node_binary).is_err() {
+                return Err(anyhow::anyhow!(
+                    "Node binary not found. Make sure Node.js is installed."
+                ));
+            }
+        }
+
         let child = match &command_info {
             ShellCommandType::UserShell(cmd) => {
                 log_line(&format!("spawn command: {} {:?}", cmd.shell, cmd.args));
                 let mut c = Command::new(&cmd.shell);
                 c.args(&cmd.args)
-                    .env_remove("npm_config_prefix")
-                    .env_remove("NPM_CONFIG_PREFIX")
+                    .env("ELECTRON_RUN_AS_NODE", "1")
                     .stdout(Stdio::piped())
                     .stderr(Stdio::piped());
-                if resolution.runner != Runner::Standalone {
-                    c.env("ELECTRON_RUN_AS_NODE", "1");
-                }
                 configure_spawn(&mut c);
                 if let Some(ref cwd) = cwd {
                     c.current_dir(cwd);
@@ -688,11 +573,9 @@ impl CliProcessManager {
                 log_line(&format!("spawn command: {} {:?}", cmd.program, cmd.args));
                 let mut c = Command::new(&cmd.program);
                 c.args(&cmd.args)
+                    .env("ELECTRON_RUN_AS_NODE", "1")
                     .stdout(Stdio::piped())
                     .stderr(Stdio::piped());
-                if resolution.runner != Runner::Standalone {
-                    c.env("ELECTRON_RUN_AS_NODE", "1");
-                }
                 configure_spawn(&mut c);
                 if let Some(ref cwd) = cwd {
                     c.current_dir(cwd);
@@ -705,22 +588,6 @@ impl CliProcessManager {
 
         let pid = child.id();
         log_line(&format!("spawned pid={pid}"));
-        #[cfg(windows)]
-        match WindowsJobObject::create().and_then(|job| {
-            job.assign_child(&child)?;
-            Ok(job)
-        }) {
-            Ok(job) => {
-                log_line(&format!("attached pid={pid} to Windows job object"));
-                *job_holder.lock() = Some(job);
-            }
-            Err(err) => {
-                log_line(&format!(
-                    "failed to attach pid={pid} to Windows job object; falling back to taskkill-only cleanup: {err}"
-                ));
-            }
-        }
-
         {
             let mut locked = status.lock();
             locked.pid = Some(pid);
@@ -752,41 +619,26 @@ impl CliProcessManager {
                 .map(BufReader::new);
 
             if let Some(reader) = stdout {
-                let app = app_clone.clone();
-                let status = status_clone.clone();
-                let ready = ready_clone.clone();
-                let token = token_clone.clone();
-                let auth_cookie_name = auth_cookie_name_clone.clone();
-                thread::spawn(move || {
-                    Self::process_stream(
-                        reader,
-                        "stdout",
-                        &app,
-                        &status,
-                        &ready,
-                        &token,
-                        auth_cookie_name.as_str(),
-                    );
-                });
+                Self::process_stream(
+                    reader,
+                    "stdout",
+                    &app_clone,
+                    &status_clone,
+                    &ready_clone,
+                    &token_clone,
+                    auth_cookie_name_clone.as_str(),
+                );
             }
-
             if let Some(reader) = stderr {
-                let app = app_clone.clone();
-                let status = status_clone.clone();
-                let ready = ready_clone.clone();
-                let token = token_clone.clone();
-                let auth_cookie_name = auth_cookie_name_clone.clone();
-                thread::spawn(move || {
-                    Self::process_stream(
-                        reader,
-                        "stderr",
-                        &app,
-                        &status,
-                        &ready,
-                        &token,
-                        auth_cookie_name.as_str(),
-                    );
-                });
+                Self::process_stream(
+                    reader,
+                    "stderr",
+                    &app_clone,
+                    &status_clone,
+                    &ready_clone,
+                    &token_clone,
+                    auth_cookie_name_clone.as_str(),
+                );
             }
         });
 
@@ -794,8 +646,6 @@ impl CliProcessManager {
         let status_clone = status.clone();
         let ready_clone = ready.clone();
         let child_holder_clone = child_holder.clone();
-        #[cfg(windows)]
-        let job_holder_clone = job_holder.clone();
         thread::spawn(move || {
             let timeout = Duration::from_secs(60);
             thread::sleep(timeout);
@@ -850,10 +700,6 @@ impl CliProcessManager {
                             // Drop the handle after the process exits so other callers
                             // don't attempt to stop/kill a finished process.
                             *guard = None;
-                            #[cfg(windows)]
-                            {
-                                let _ = job_holder_clone.lock().take();
-                            }
                             Some(status)
                         }
                         None => None,
@@ -911,8 +757,8 @@ impl CliProcessManager {
         auth_cookie_name: &str,
     ) {
         let mut buffer = String::new();
-        let local_url_regex =
-            Regex::new(r"^Local\s+Connection\s+URL\s*:\s*(https?://\S+)\s*$").ok();
+        let local_url_regex = Regex::new(r"^Local\s+Connection\s+URL\s*:\s*(https?://\S+)").ok();
+        let http_regex = Regex::new(r":(\d{2,5})(?!.*:\d)").ok();
         let token_prefix = "CODENOMAD_BOOTSTRAP_TOKEN:";
 
         loop {
@@ -939,17 +785,6 @@ impl CliProcessManager {
                             continue;
                         }
 
-                        if let Some(node_binary) = line.strip_prefix(MISSING_NODE_PREFIX) {
-                            let mut locked = status.lock();
-                            if locked.error.is_none() {
-                                locked.error = Some(format!(
-                                    "Node binary '{}' not found in the desktop shell environment. CodeNomad development mode requires Node.js installed on the system, or set NODE_BINARY to a valid runtime path.",
-                                    node_binary.trim()
-                                ));
-                            }
-                            continue;
-                        }
-
                         if let Some(url) = local_url_regex
                             .as_ref()
                             .and_then(|re| re.captures(line).and_then(|c| c.get(1)))
@@ -965,6 +800,38 @@ impl CliProcessManager {
                             );
                             continue;
                         }
+
+                        if line.to_lowercase().contains("http server listening") {
+                            if let Some(port) = http_regex
+                                .as_ref()
+                                .and_then(|re| re.captures(line).and_then(|c| c.get(1)))
+                                .and_then(|m| m.as_str().parse::<u16>().ok())
+                            {
+                                Self::mark_ready(
+                                    app,
+                                    status,
+                                    ready,
+                                    bootstrap_token,
+                                    auth_cookie_name,
+                                    format!("http://localhost:{port}"),
+                                );
+                                continue;
+                            }
+
+                            if let Ok(value) = serde_json::from_str::<serde_json::Value>(line) {
+                                if let Some(port) = value.get("port").and_then(|p| p.as_u64()) {
+                                    Self::mark_ready(
+                                        app,
+                                        status,
+                                        ready,
+                                        bootstrap_token,
+                                        auth_cookie_name,
+                                        format!("http://localhost:{}", port),
+                                    );
+                                    continue;
+                                }
+                            }
+                        }
                     }
                 }
                 Err(_) => break,
@@ -1066,7 +933,7 @@ struct CliEntry {
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum Runner {
-    Standalone,
+    Node,
     Tsx,
 }
 
@@ -1087,17 +954,17 @@ impl CliEntry {
             }
         }
 
-        if let Some(entry) = resolve_standalone_entry(app) {
+        if let Some(entry) = resolve_dist_entry(app) {
             return Ok(Self {
                 entry,
-                runner: Runner::Standalone,
+                runner: Runner::Node,
                 runner_path: None,
-                node_binary: String::new(),
+                node_binary,
             });
         }
 
         Err(anyhow::anyhow!(
-            "Unable to locate the packaged CodeNomad standalone server. Please rebuild the desktop bundle."
+            "Unable to locate CodeNomad CLI build (dist/bin.js). Please build @neuralnomads/codenomad."
         ))
     }
 
@@ -1109,12 +976,10 @@ impl CliEntry {
             "--auth-cookie-name".to_string(),
             auth_cookie_name.to_string(),
             "--generate-token".to_string(),
-            "--unrestricted-root".to_string(),
         ];
 
         if dev {
-            // Dev: keep loopback HTTP for the Vite proxy, but also enable HTTPS so
-            // remote proxy sessions can still spin up secure local windows.
+            // Dev: plain HTTP + Vite dev server proxy.
             let ui_dev_server = std::env::var("VITE_DEV_SERVER_URL")
                 .ok()
                 .filter(|value| !value.trim().is_empty())
@@ -1131,7 +996,7 @@ impl CliEntry {
                 .unwrap_or_else(|| "info".to_string());
 
             args.push("--https".to_string());
-            args.push("true".to_string());
+            args.push("false".to_string());
             args.push("--http".to_string());
             args.push("true".to_string());
             args.push("--http-port".to_string());
@@ -1151,10 +1016,6 @@ impl CliEntry {
     }
 
     fn runner_args(&self, cli_args: &[String]) -> Vec<String> {
-        if self.runner == Runner::Standalone {
-            return cli_args.to_vec();
-        }
-
         let mut args = VecDeque::new();
         if self.runner == Runner::Tsx {
             if let Some(path) = &self.runner_path {
@@ -1170,94 +1031,71 @@ impl CliEntry {
 }
 
 fn resolve_tsx(_app: &AppHandle) -> Option<String> {
-    let cwd = std::env::current_dir().ok();
-    let workspace = workspace_root();
-    let mut candidates = vec![
-        cwd.as_ref()
-            .map(|p| p.join("node_modules/tsx/dist/cli.mjs")),
-        cwd.as_ref()
-            .map(|p| p.join("node_modules/tsx/dist/cli.cjs")),
-        cwd.as_ref().map(|p| p.join("node_modules/tsx/dist/cli.js")),
-        cwd.as_ref()
-            .map(|p| p.join("../node_modules/tsx/dist/cli.mjs")),
-        cwd.as_ref()
-            .map(|p| p.join("../node_modules/tsx/dist/cli.cjs")),
-        cwd.as_ref()
-            .map(|p| p.join("../node_modules/tsx/dist/cli.js")),
-        cwd.as_ref()
-            .map(|p| p.join("../../node_modules/tsx/dist/cli.mjs")),
-        cwd.as_ref()
-            .map(|p| p.join("../../node_modules/tsx/dist/cli.cjs")),
-        cwd.as_ref()
-            .map(|p| p.join("../../node_modules/tsx/dist/cli.js")),
-        workspace
-            .as_ref()
-            .map(|p| p.join("node_modules/tsx/dist/cli.mjs")),
-        workspace
-            .as_ref()
-            .map(|p| p.join("node_modules/tsx/dist/cli.cjs")),
-        workspace
-            .as_ref()
+    let candidates = vec![
+        std::env::current_dir()
+            .ok()
             .map(|p| p.join("node_modules/tsx/dist/cli.js")),
+        std::env::current_exe().ok().and_then(|ex| {
+            ex.parent()
+                .map(|p| p.join("../node_modules/tsx/dist/cli.js"))
+        }),
     ];
 
-    if let Ok(exe) = std::env::current_exe() {
-        if let Some(dir) = exe.parent() {
-            candidates.push(Some(dir.join("../node_modules/tsx/dist/cli.mjs")));
-            candidates.push(Some(dir.join("../node_modules/tsx/dist/cli.cjs")));
-            candidates.push(Some(dir.join("../node_modules/tsx/dist/cli.js")));
-        }
-    }
-
     first_existing(candidates)
 }
 
 fn resolve_dev_entry(_app: &AppHandle) -> Option<String> {
-    let cwd = std::env::current_dir().ok();
-    let workspace = workspace_root();
     let candidates = vec![
-        workspace
-            .as_ref()
+        std::env::current_dir()
+            .ok()
             .map(|p| p.join("packages/server/src/index.ts")),
-        cwd.as_ref().map(|p| p.join("packages/server/src/index.ts")),
-        cwd.as_ref().map(|p| p.join("../server/src/index.ts")),
-        cwd.as_ref().map(|p| p.join("../../server/src/index.ts")),
+        std::env::current_dir()
+            .ok()
+            .map(|p| p.join("../server/src/index.ts")),
     ];
 
     first_existing(candidates)
 }
 
-fn resolve_standalone_entry(_app: &AppHandle) -> Option<String> {
-    let executable_name = if cfg!(windows) {
-        "codenomad-server.exe"
-    } else {
-        "codenomad-server"
-    };
+fn resolve_dist_entry(_app: &AppHandle) -> Option<String> {
     let base = workspace_root();
-    let mut candidates = vec![base
-        .as_ref()
-        .map(|p| p.join("packages/server/dist").join(executable_name))];
+    let mut candidates: Vec<Option<PathBuf>> = vec![
+        base.as_ref().map(|p| p.join("packages/server/dist/bin.js")),
+        base.as_ref()
+            .map(|p| p.join("packages/server/dist/index.js")),
+        base.as_ref().map(|p| p.join("server/dist/bin.js")),
+        base.as_ref().map(|p| p.join("server/dist/index.js")),
+    ];
 
     if let Ok(exe) = std::env::current_exe() {
         if let Some(dir) = exe.parent() {
-            candidates.push(Some(
-                dir.join("resources/server/dist").join(executable_name),
-            ));
+            candidates.push(Some(dir.join("resources/server/dist/bin.js")));
+            candidates.push(Some(dir.join("resources/server/dist/index.js")));
+            candidates.push(Some(dir.join("resources/server/dist/server/bin.js")));
+            candidates.push(Some(dir.join("resources/server/dist/server/index.js")));
 
             let resources = dir.join("../Resources");
-            candidates.push(Some(resources.join("server/dist").join(executable_name)));
+            candidates.push(Some(resources.join("server/dist/bin.js")));
+            candidates.push(Some(resources.join("server/dist/index.js")));
+            candidates.push(Some(resources.join("server/dist/server/bin.js")));
+            candidates.push(Some(resources.join("server/dist/server/index.js")));
+            candidates.push(Some(resources.join("resources/server/dist/bin.js")));
+            candidates.push(Some(resources.join("resources/server/dist/index.js")));
+            candidates.push(Some(resources.join("resources/server/dist/server/bin.js")));
             candidates.push(Some(
-                resources
-                    .join("resources/server/dist")
-                    .join(executable_name),
+                resources.join("resources/server/dist/server/index.js"),
             ));
 
             let linux_resource_roots = [dir.join("../lib/CodeNomad"), dir.join("../lib/codenomad")];
             for root in linux_resource_roots {
-                candidates.push(Some(root.join("server/dist").join(executable_name)));
-                candidates.push(Some(
-                    root.join("resources/server/dist").join(executable_name),
-                ));
+                candidates.push(Some(root.join("server/dist/bin.js")));
+                candidates.push(Some(root.join("server/dist/index.js")));
+                candidates.push(Some(root.join("server/dist/server/bin.js")));
+                candidates.push(Some(root.join("server/dist/server/index.js")));
+                candidates.push(Some(root.join("resources/server/dist/bin.js")));
+                candidates.push(Some(root.join("resources/server/dist/index.js")));
+                candidates.push(Some(root.join("resources/server/dist/server/bin.js")));
+                candidates.push(Some(root.join("resources/server/dist/server/index.js")));
             }
         }
     }
@@ -1271,55 +1109,16 @@ fn build_shell_command_string(
 ) -> anyhow::Result<ShellCommand> {
     let shell = default_shell();
     let mut quoted: Vec<String> = Vec::new();
-    let command = if entry.runner == Runner::Standalone {
-        quoted.push(shell_escape(&entry.entry));
-        for arg in cli_args {
-            quoted.push(shell_escape(arg));
-        }
-        format!("exec {}", quoted.join(" "))
-    } else {
-        quoted.push(shell_escape(&entry.node_binary));
-        for arg in entry.runner_args(cli_args) {
-            quoted.push(shell_escape(&arg));
-        }
-        format!(
-            "if command -v {} >/dev/null 2>&1; then ELECTRON_RUN_AS_NODE=1 exec {}; else printf '%s%s\\n' '{}' {} >&2; exit 127; fi",
-            shell_escape(&entry.node_binary),
-            quoted.join(" "),
-            MISSING_NODE_PREFIX,
-            shell_escape(&entry.node_binary),
-        )
-    };
-    let wrapped_command = wrap_command_for_shell(&command, &shell);
-    let args = build_shell_args(&shell, &wrapped_command);
+    quoted.push(shell_escape(&entry.node_binary));
+    for arg in entry.runner_args(cli_args) {
+        quoted.push(shell_escape(&arg));
+    }
+    let command = format!("ELECTRON_RUN_AS_NODE=1 exec {}", quoted.join(" "));
+    let args = build_shell_args(&shell, &command);
     log_line(&format!("user shell command: {} {:?}", shell, args));
     Ok(ShellCommand { shell, args })
 }
 
-fn wrap_command_for_shell(command: &str, shell: &str) -> String {
-    let shell_name = std::path::Path::new(shell)
-        .file_name()
-        .and_then(OsStr::to_str)
-        .unwrap_or("")
-        .to_lowercase();
-
-    if shell_name.contains("bash") {
-        return format!(
-            "if [ -f ~/.bashrc ]; then source ~/.bashrc >/dev/null 2>&1; fi; {}",
-            command
-        );
-    }
-
-    if shell_name.contains("zsh") {
-        return format!(
-            "if [ -f ~/.zshrc ]; then source ~/.zshrc >/dev/null 2>&1; fi; {}",
-            command
-        );
-    }
-
-    command.to_string()
-}
-
 fn default_shell() -> String {
     if let Ok(shell) = std::env::var("SHELL") {
         if !shell.trim().is_empty() {

packages/tauri-app/src-tauri/src/linux_tls.rs

@@ -1,88 +0,0 @@
-use crate::AppState;
-use tauri::{AppHandle, Manager, WebviewWindow};
-use url::Url;
-use webkit2gtk::{WebContextExt, WebView, WebViewExt};
-
-pub fn should_bootstrap_tls_navigation(target_url: &Url, allow_tls_certificate: bool) -> bool {
-    allow_tls_certificate && target_url.scheme() == "https"
-}
-
-pub fn ensure_remote_window_tls_handler(
-    window: &WebviewWindow,
-    app_handle: &AppHandle,
-    window_label: &str,
-) -> Result<(), String> {
-    {
-        let state = app_handle.state::<AppState>();
-        let mut handlers = state
-            .remote_tls_handlers
-            .lock()
-            .map_err(|err| err.to_string())?;
-        if !handlers.insert(window_label.to_string()) {
-            return Ok(());
-        }
-    }
-
-    let app_handle = app_handle.clone();
-    let window_label = window_label.to_string();
-    window
-        .with_webview(move |platform_webview| {
-            let webview = platform_webview.inner();
-            let app_handle = app_handle.clone();
-            let window_label = window_label.clone();
-            webview.connect_load_failed_with_tls_errors(move |view, failing_uri, certificate, _| {
-                allow_remote_tls_certificate(
-                    &app_handle,
-                    &window_label,
-                    view,
-                    failing_uri,
-                    certificate,
-                )
-            });
-        })
-        .map_err(|err| err.to_string())
-}
-
-fn allow_remote_tls_certificate(
-    app_handle: &AppHandle,
-    window_label: &str,
-    view: &WebView,
-    failing_uri: &str,
-    certificate: &webkit2gtk::gio::TlsCertificate,
-) -> bool {
-    let Ok(parsed_uri) = Url::parse(failing_uri) else {
-        return false;
-    };
-    let Some(host) = parsed_uri.host_str() else {
-        return false;
-    };
-
-    let state = app_handle.state::<AppState>();
-    let skip_tls_verify = state
-        .remote_skip_tls_verify
-        .lock()
-        .ok()
-        .and_then(|values| values.get(window_label).copied())
-        .unwrap_or(false);
-    if !skip_tls_verify {
-        return false;
-    }
-
-    let expected_origin = state
-        .remote_origins
-        .lock()
-        .ok()
-        .and_then(|origins| origins.get(window_label).cloned());
-    let parsed_origin = parsed_uri.origin().ascii_serialization();
-    if expected_origin.as_deref() != Some(parsed_origin.as_str()) {
-        return false;
-    }
-
-    let Some(context) = view.context() else {
-        return false;
-    };
-
-    context.allow_tls_certificate_for_host(certificate, host);
-    view.load_uri(failing_uri);
-    true
-}

packages/tauri-app/src-tauri/src/main.rs

@@ -1,25 +1,18 @@
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
-#[allow(dead_code)]
-mod cert_manager;
 mod cli_manager;
-#[cfg(target_os = "linux")]
-mod linux_tls;
 
 use cli_manager::{CliProcessManager, CliStatus};
 use keepawake::KeepAwake;
 use serde::Deserialize;
 use serde_json::json;
-use std::collections::{HashMap, HashSet};
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Mutex;
 use std::time::{SystemTime, UNIX_EPOCH};
 use tauri::menu::{MenuBuilder, MenuItem, SubmenuBuilder};
 use tauri::plugin::{Builder as PluginBuilder, TauriPlugin};
 use tauri::webview::Webview;
-use tauri::{
-    AppHandle, Emitter, Manager, Runtime, WebviewUrl, WebviewWindowBuilder, WindowEvent, Wry,
-};
+use tauri::{AppHandle, Emitter, Manager, Runtime, WindowEvent, Wry};
 use tauri_plugin_global_shortcut::{
     Code as ShortcutCode, GlobalShortcutExt, Shortcut, ShortcutState,
 };
@@ -37,11 +30,9 @@ use windows_sys::Win32::UI::Shell::SetCurrentProcessExplicitAppUserModelID;
 
 static QUIT_REQUESTED: AtomicBool = AtomicBool::new(false);
 const DEFAULT_ZOOM_LEVEL: f64 = 1.0;
-const ZOOM_STEP: f64 = 0.1;
+const ZOOM_STEP: f64 = 0.2;
 const MIN_ZOOM_LEVEL: f64 = 0.2;
 const MAX_ZOOM_LEVEL: f64 = 5.0;
-const LOCAL_WINDOW_CONTEXT_SCRIPT: &str = "window.__CODENOMAD_WINDOW_CONTEXT__ = 'local';";
-const REMOTE_WINDOW_CONTEXT_SCRIPT: &str = "window.__CODENOMAD_WINDOW_CONTEXT__ = 'remote';";
 
 #[cfg(windows)]
 const WINDOWS_APP_USER_MODEL_ID: &str = "ai.neuralnomads.codenomad.client";
@@ -50,69 +41,6 @@ pub struct AppState {
     pub manager: CliProcessManager,
     pub wake_lock: Mutex<Option<KeepAwake>>,
     pub zoom_level: Mutex<f64>,
-    pub remote_origins: Mutex<HashMap<String, String>>,
-    pub remote_proxy_sessions: Mutex<HashMap<String, String>>,
-    pub remote_skip_tls_verify: Mutex<HashMap<String, bool>>,
-    pub remote_tls_handlers: Mutex<HashSet<String>>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct RemoteWindowPayload {
-    id: String,
-    name: String,
-    base_url: String,
-    entry_url: Option<String>,
-    proxy_session_id: Option<String>,
-    #[allow(dead_code)]
-    skip_tls_verify: bool,
-}
-
-fn schedule_remote_proxy_session_cleanup(app: AppHandle, session_id: String) {
-    tauri::async_runtime::spawn(async move {
-        if let Err(err) = cleanup_remote_proxy_session(&app, &session_id).await {
-            eprintln!(
-                "[tauri] failed to clean up remote proxy session {}: {}",
-                session_id, err
-            );
-        }
-    });
-}
-
-async fn cleanup_remote_proxy_session(app: &AppHandle, session_id: &str) -> Result<(), String> {
-    let status = app.state::<AppState>().manager.status();
-    let Some(base_url) = status.url else {
-        return Ok(());
-    };
-
-    let mut cleanup_url = Url::parse(&base_url).map_err(|err| err.to_string())?;
-    cleanup_url.set_path(&format!("/api/remote-proxy/sessions/{session_id}"));
-    cleanup_url.set_query(None);
-    cleanup_url.set_fragment(None);
-
-    let client = if cleanup_url.scheme() == "https" {
-        let local_cert = cert_manager::ensure_local_cert()?;
-        let ca_cert = reqwest::Certificate::from_der(&local_cert.ca_cert_der)
-            .map_err(|err| err.to_string())?;
-        reqwest::Client::builder()
-            .add_root_certificate(ca_cert)
-            .build()
-            .map_err(|err| err.to_string())?
-    } else {
-        reqwest::Client::new()
-    };
-
-    let response = client
-        .delete(cleanup_url.as_str())
-        .send()
-        .await
-        .map_err(|err| err.to_string())?;
-
-    if response.status().is_success() || response.status() == reqwest::StatusCode::NOT_FOUND {
-        return Ok(());
-    }
-
-    Err(format!("unexpected status {}", response.status()))
 }
 
 #[derive(Debug, Default, Deserialize)]
@@ -145,8 +73,8 @@ fn wake_lock_start(
     config: Option<WakeLockConfig>,
 ) -> Result<(), String> {
     let config = config.unwrap_or(WakeLockConfig {
-        display: false,
-        idle: true,
+        display: true,
+        idle: false,
         sleep: false,
     });
 
@@ -178,7 +106,7 @@ fn is_dev_mode() -> bool {
 
 fn should_allow_internal(url: &Url) -> bool {
     match url.scheme() {
-        "tauri" | "asset" | "file" | "about" => true,
+        "tauri" | "asset" | "file" => true,
         // On Windows/WebView2, Tauri serves the app assets from `tauri.localhost`.
         // This must be treated as an internal origin or the navigation guard will
         // redirect it to the system browser and the app will appear blank.
@@ -190,29 +118,8 @@ fn should_allow_internal(url: &Url) -> bool {
     }
 }
 
-fn should_allow_window_origin<R: Runtime>(
-    app_handle: &AppHandle<R>,
-    window_label: &str,
-    url: &Url,
-) -> bool {
-    if should_allow_internal(url) {
-        return true;
-    }
-
-    let state = app_handle.state::<AppState>();
-    let Ok(allowed) = state.remote_origins.lock() else {
-        return false;
-    };
-    if let Some(origin) = allowed.get(window_label) {
-        return origin == &url.origin().ascii_serialization();
-    }
-
-    false
-}
-
 fn intercept_navigation<R: Runtime>(webview: &Webview<R>, url: &Url) -> bool {
-    let window_label = webview.label().to_string();
-    if should_allow_window_origin(&webview.app_handle(), &window_label, url) {
+    if should_allow_internal(url) {
         return true;
     }
 
@@ -226,162 +133,6 @@ fn intercept_navigation<R: Runtime>(webview: &Webview<R>, url: &Url) -> bool {
     false
 }
 
-async fn open_remote_window_impl(
-    app: AppHandle,
-    payload: RemoteWindowPayload,
-) -> Result<(), String> {
-    let entry_url = payload.entry_url.as_deref().unwrap_or(payload.base_url.as_str());
-    let parsed = Url::parse(entry_url).map_err(|err| err.to_string())?;
-    let label = format!("remote-{}", payload.id);
-    let title = format!(
-        "{} - {}",
-        payload.name,
-        Url::parse(&payload.base_url)
-            .ok()
-            .and_then(|url| url.host_str().map(str::to_string))
-            .unwrap_or_else(|| payload.base_url.clone())
-    );
-
-    let window_url = parsed.clone();
-
-    let allow_linux_tls_certificate =
-        parsed.scheme() == "https" && (payload.proxy_session_id.is_some() || payload.skip_tls_verify);
-
-    app.state::<AppState>()
-        .remote_origins
-        .lock()
-        .map_err(|err| err.to_string())?
-        .insert(label.clone(), window_url.origin().ascii_serialization());
-    app.state::<AppState>()
-        .remote_skip_tls_verify
-        .lock()
-        .map_err(|err| err.to_string())?
-        .insert(label.clone(), allow_linux_tls_certificate);
-
-    let replaced_session = {
-        let state = app.state::<AppState>();
-        let mut sessions = state
-            .remote_proxy_sessions
-            .lock()
-            .map_err(|err| err.to_string())?;
-        match payload.proxy_session_id.clone() {
-            Some(session_id) => sessions.insert(label.clone(), session_id),
-            None => sessions.remove(&label),
-        }
-    };
-
-    if let Some(previous) = replaced_session {
-        if payload.proxy_session_id.as_deref() != Some(previous.as_str()) {
-            schedule_remote_proxy_session_cleanup(app.clone(), previous);
-        }
-    }
-
-    if let Some(existing) = app.get_webview_window(&label) {
-        #[cfg(target_os = "linux")]
-        linux_tls::ensure_remote_window_tls_handler(&existing, &app, &label)?;
-
-        let _ = existing.navigate(window_url.clone());
-        let _ = existing.set_title(&title);
-        let _ = existing.show();
-        let _ = existing.unminimize();
-        let _ = existing.set_focus();
-        return Ok(());
-    }
-
-    #[cfg(target_os = "linux")]
-    let initial_url = if linux_tls::should_bootstrap_tls_navigation(
-        &window_url,
-        allow_linux_tls_certificate,
-    ) {
-        Url::parse("about:blank").map_err(|err| err.to_string())?
-    } else {
-        window_url.clone()
-    };
-
-    #[cfg(not(target_os = "linux"))]
-    let initial_url = window_url.clone();
-
-    let window = WebviewWindowBuilder::new(&app, label.clone(), WebviewUrl::External(initial_url.clone()))
-        .initialization_script(REMOTE_WINDOW_CONTEXT_SCRIPT)
-        .title(title)
-        .inner_size(1400.0, 900.0)
-        .min_inner_size(800.0, 600.0)
-        .build()
-        .map_err(|err| err.to_string())?;
-
-    #[cfg(target_os = "linux")]
-    {
-        linux_tls::ensure_remote_window_tls_handler(&window, &app, &label)?;
-        if initial_url != window_url {
-            let _ = window.navigate(window_url.clone());
-        }
-    }
-
-    let app_handle = app.clone();
-    let label_for_cleanup = label.clone();
-    window.on_window_event(move |event| {
-        if let WindowEvent::Destroyed = event {
-            if let Ok(mut origins) = app_handle.state::<AppState>().remote_origins.lock() {
-                origins.remove(&label_for_cleanup);
-            }
-            if let Ok(mut sessions) = app_handle.state::<AppState>().remote_proxy_sessions.lock() {
-                if let Some(session_id) = sessions.remove(&label_for_cleanup) {
-                    schedule_remote_proxy_session_cleanup(app_handle.clone(), session_id);
-                }
-            }
-            if let Ok(mut values) = app_handle.state::<AppState>().remote_skip_tls_verify.lock() {
-                values.remove(&label_for_cleanup);
-            }
-            if let Ok(mut handlers) = app_handle.state::<AppState>().remote_tls_handlers.lock() {
-                handlers.remove(&label_for_cleanup);
-            }
-        }
-    });
-
-    Ok(())
-}
-
-#[tauri::command]
-fn needs_local_certificate_install() -> Result<bool, String> {
-    #[cfg(not(target_os = "linux"))]
-    {
-        let local_cert = cert_manager::ensure_local_cert().map_err(|err| {
-            format!("Failed to load the local HTTPS certificate for the remote proxy window: {err}")
-        })?;
-        return cert_manager::needs_trust_in_store(&local_cert.ca_cert_der).map_err(|err| {
-            format!("Failed to inspect the local CodeNomad certificate trust state: {err}")
-        });
-    }
-
-    #[cfg(target_os = "linux")]
-    {
-        Ok(false)
-    }
-}
-
-#[tauri::command]
-async fn open_remote_window(app: AppHandle, payload: RemoteWindowPayload) -> Result<(), String> {
-    #[cfg(not(target_os = "linux"))]
-    {
-        let entry_url = payload.entry_url.as_deref().unwrap_or(payload.base_url.as_str());
-        let parsed = Url::parse(entry_url).map_err(|err| err.to_string())?;
-        if payload.proxy_session_id.is_some() && parsed.scheme() == "https" {
-            let local_cert = cert_manager::ensure_local_cert().map_err(|err| {
-                format!(
-                    "Failed to load the local HTTPS certificate for the remote proxy window: {err}"
-                )
-            })?;
-            if let Err(err) = cert_manager::trust_cert_in_store(&local_cert.ca_cert_der) {
-                return Err(format!(
-                    "Failed to trust the local CodeNomad CA certificate. Accept the certificate installation prompt and try again: {err}"
-                ));
-            }
-        }
-    }
-
-    open_remote_window_impl(app, payload).await
-}
-
 fn collect_directory_paths(paths: &[std::path::PathBuf]) -> Vec<String> {
     paths
         .iter()
@@ -509,8 +260,6 @@ fn set_windows_app_user_model_id() {
 fn set_windows_app_user_model_id() {}
 
 fn main() {
-    let _ = rustls::crypto::ring::default_provider().install_default();
-
     let navigation_guard: TauriPlugin<Wry, ()> = PluginBuilder::new("external-link-guard")
         .on_navigation(|webview, url| intercept_navigation(webview, url))
         .build();
@@ -537,17 +286,10 @@ fn main() {
             manager: CliProcessManager::new(),
             wake_lock: Mutex::new(None),
             zoom_level: Mutex::new(DEFAULT_ZOOM_LEVEL),
-            remote_origins: Mutex::new(HashMap::new()),
-            remote_proxy_sessions: Mutex::new(HashMap::new()),
-            remote_skip_tls_verify: Mutex::new(HashMap::new()),
-            remote_tls_handlers: Mutex::new(HashSet::new()),
         })
         .setup(|app| {
             set_windows_app_user_model_id();
             build_menu(&app.handle())?;
-            if let Some(window) = app.get_webview_window("main") {
-                let _ = window.eval(LOCAL_WINDOW_CONTEXT_SCRIPT);
-            }
             if let Some(shortcut) = fullscreen_shortcut() {
                 let shortcut_manager = app.handle().global_shortcut();
                 let _ = shortcut_manager.register(shortcut.clone());
@@ -581,9 +323,7 @@ fn main() {
             cli_get_status,
             cli_restart,
             wake_lock_start,
-            wake_lock_stop,
-            needs_local_certificate_install,
-            open_remote_window
+            wake_lock_stop
         ])
         .on_menu_event(|app_handle, event| {
             match event.id().0.as_str() {
@@ -715,24 +455,11 @@ fn main() {
                 event: tauri::WindowEvent::CloseRequested { api, .. },
                 ..
             } => {
-                // Let windows close normally. App shutdown is handled only after the
-                // last window is actually gone so remote windows can outlive `main`.
-                let _ = api;
-            }
-            tauri::RunEvent::WindowEvent {
-                event: tauri::WindowEvent::Destroyed,
-                ..
-            } => {
-                if !app_handle.webview_windows().is_empty() {
-                    return;
-                }
-
-                // Stop the CLI only when the final window is gone and the app is
-                // truly exiting.
+                // Ensure we have time to stop the CLI process before the app exits.
                 if QUIT_REQUESTED.swap(true, Ordering::SeqCst) {
                     return;
                 }
-
+                api.prevent_close();
                 let app = app_handle.clone();
                 std::thread::spawn(move || {
                     if let Some(state) = app.try_state::<AppState>() {

packages/tauri-app/src-tauri/tauri.conf.json

@@ -1,15 +1,17 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "CodeNomad",
-  "version": "0.14.0",
+  "version": "0.12.3",
   "identifier": "ai.neuralnomads.codenomad.client",
   "build": {
     "beforeDevCommand": "npm run dev:bootstrap",
     "beforeBuildCommand": "npm run bundle:server",
     "frontendDist": "resources/ui-loading"
   },
+
+ 
+
   "app": {
-    "enableGTKAppId": true,
     "withGlobalTauri": true,
     "windows": [
       {
@@ -31,56 +33,18 @@
     ],
     "security": {
       "assetProtocol": {
-        "scope": [
-          "**"
-        ]
+        "scope": ["**"]
       },
-      "capabilities": [
-        "main-window-native-dialogs"
-      ]
+      "capabilities": ["main-window-native-dialogs"]
     }
   },
   "bundle": {
     "active": true,
-    "linux": {
-      "deb": {
-        "files": {
-          "/usr/share/applications/ai.neuralnomads.codenomad.client.desktop": "icons/linux/ai.neuralnomads.codenomad.client.desktop",
-          "/usr/share/icons/hicolor/32x32/apps/codenomad-tauri.png": "icons/linux/32x32.png",
-          "/usr/share/icons/hicolor/48x48/apps/codenomad-tauri.png": "icons/linux/48x48.png",
-          "/usr/share/icons/hicolor/64x64/apps/codenomad-tauri.png": "icons/linux/64x64.png",
-          "/usr/share/icons/hicolor/128x128/apps/codenomad-tauri.png": "icons/linux/128x128.png",
-          "/usr/share/icons/hicolor/256x256/apps/codenomad-tauri.png": "icons/linux/256x256.png",
-          "/usr/share/icons/hicolor/512x512/apps/codenomad-tauri.png": "icons/linux/512x512.png"
-        }
-      },
-      "rpm": {
-        "files": {
-          "/usr/share/applications/ai.neuralnomads.codenomad.client.desktop": "icons/linux/ai.neuralnomads.codenomad.client.desktop",
-          "/usr/share/icons/hicolor/32x32/apps/codenomad-tauri.png": "icons/linux/32x32.png",
-          "/usr/share/icons/hicolor/48x48/apps/codenomad-tauri.png": "icons/linux/48x48.png",
-          "/usr/share/icons/hicolor/64x64/apps/codenomad-tauri.png": "icons/linux/64x64.png",
-          "/usr/share/icons/hicolor/128x128/apps/codenomad-tauri.png": "icons/linux/128x128.png",
-          "/usr/share/icons/hicolor/256x256/apps/codenomad-tauri.png": "icons/linux/256x256.png",
-          "/usr/share/icons/hicolor/512x512/apps/codenomad-tauri.png": "icons/linux/512x512.png"
-        }
-      }
-    },
     "resources": [
       "resources/server",
       "resources/ui-loading"
     ],
-    "icon": [
-      "icon.icns",
-      "icon.ico",
-      "icon.png"
-    ],
-    "targets": [
-      "app",
-      "appimage",
-      "deb",
-      "rpm",
-      "nsis"
-    ]
+    "icon": ["icon.icns", "icon.ico", "icon.png"],
+    "targets": ["app", "appimage", "deb", "rpm", "nsis"]
   }
 }

packages/ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codenomad/ui",
-  "version": "0.14.0",
+  "version": "0.13.1",
   "private": true,
   "license": "MIT",
   "type": "module",

packages/ui/src/App.tsx

@@ -10,10 +10,7 @@ import InstanceTabs from "./components/instance-tabs"
 import InstanceDisconnectedModal from "./components/instance-disconnected-modal"
 import InstanceShell from "./components/instance/instance-shell2"
 import { SettingsScreen } from "./components/settings-screen"
-import { SideCarPickerDialog } from "./components/sidecar-picker-dialog"
-import { SideCarView } from "./components/sidecar-view"
 import { InstanceMetadataProvider } from "./lib/contexts/instance-metadata-context"
-import { showAlertDialog } from "./stores/alerts"
 import { initGithubStars } from "./stores/github-stars"
 
 import { useCommands } from "./lib/hooks/use-commands"
@@ -22,10 +19,11 @@ import { getLogger } from "./lib/logger"
 import { launchError, showLaunchError, clearLaunchError } from "./stores/launch-errors"
 import { formatLaunchErrorMessage, isMissingBinaryMessage } from "./lib/launch-errors"
 import { initReleaseNotifications } from "./stores/releases"
-import { isTauriHost, isWebHost, runtimeEnv } from "./lib/runtime-env"
+import { runtimeEnv } from "./lib/runtime-env"
 import { useI18n } from "./lib/i18n"
 import { setWakeLockDesired } from "./lib/native/wake-lock"
 import {
+  hasInstances,
   isSelectingFolder,
   setIsSelectingFolder,
   showFolderSelection,
@@ -35,7 +33,10 @@ import { useConfig } from "./stores/preferences"
 import {
   createInstance,
   instances,
+  activeInstanceId,
+  setActiveInstanceId,
   stopInstance,
+  getActiveInstance,
   disconnectedInstance,
   acknowledgeDisconnectedInstance,
 } from "./stores/instances"
@@ -50,24 +51,8 @@ import {
   updateSessionModel,
 } from "./stores/sessions"
 
-import { hasWakeLockEligibleWork } from "./stores/session-status"
+import { getInstanceSessionIndicatorStatus } from "./stores/session-status"
 import { openSettings } from "./stores/settings-screen"
-import {
-  closeSidecarTab,
-  ensureSidecarsLoaded,
-  openSidecarTab,
-} from "./stores/sidecars"
-import {
-  activeAppTab,
-  activeAppTabId,
-  appTabs,
-  ensureActiveAppTab,
-  getAdjacentAppTabId,
-  getAppTabById,
-  selectAppTab,
-  selectInstanceTab,
-  selectSidecarTab,
-} from "./stores/app-tabs"
 
 const log = getLogger("actions")
 
@@ -92,7 +77,6 @@ const App: Component = () => {
   } = useConfig()
   const [escapeInDebounce, setEscapeInDebounce] = createSignal(false)
   const [instanceTabBarHeight, setInstanceTabBarHeight] = createSignal(0)
-  const [sidecarPickerOpen, setSidecarPickerOpen] = createSignal(false)
 
   const phoneQuery = useMediaQuery("(max-width: 767px)")
   const isPhoneLayout = createMemo(() => phoneQuery())
@@ -137,7 +121,7 @@ const App: Component = () => {
   createEffect(() => {
     if (typeof document === "undefined") return
     const shouldShow =
-      !isWebHost() && runtimeEnv.platform !== "mobile" && (preferences().showKeyboardShortcutHints ?? true)
+      runtimeEnv.host !== "web" && runtimeEnv.platform !== "mobile" && (preferences().showKeyboardShortcutHints ?? true)
     document.documentElement.dataset.keyboardHints = shouldShow ? "show" : "hide"
   })
 
@@ -204,7 +188,8 @@ const App: Component = () => {
   const shouldHoldWakeLock = createMemo(() => {
     const map = instances()
     for (const id of map.keys()) {
-      if (hasWakeLockEligibleWork(id)) {
+      const status = getInstanceSessionIndicatorStatus(id)
+      if (status !== "idle") {
         return true
       }
     }
@@ -221,7 +206,8 @@ const App: Component = () => {
   })
 
   createEffect(() => {
-    appTabs()
+    instances()
+    hasInstances()
     requestAnimationFrame(() => updateInstanceTabBarHeight())
   })
 
@@ -233,15 +219,7 @@ const App: Component = () => {
     onCleanup(() => window.removeEventListener("resize", handleResize))
   })
 
-  createEffect(() => {
-    appTabs()
-    ensureActiveAppTab()
-  })
-
-  const activeInstance = createMemo(() => {
-    const tab = activeAppTab()
-    return tab?.kind === "instance" ? tab.instance : null
-  })
+  const activeInstance = createMemo(() => getActiveInstance())
   const activeSessionIdForInstance = createMemo(() => {
     const instance = activeInstance()
     if (!instance) return null
@@ -266,7 +244,6 @@ const App: Component = () => {
       recordWorkspaceLaunch(folderPath, selectedBinary)
       clearLaunchError()
       const instanceId = await createInstance(folderPath, selectedBinary)
-      selectInstanceTab(instanceId)
       setShowFolderSelection(false)
 
       log.info("Created instance", {
@@ -293,27 +270,8 @@ const App: Component = () => {
   }
 
   function handleNewInstanceRequest() {
-    setShowFolderSelection(true)
-  }
-
-  function handleOpenSidecarPicker() {
-    setSidecarPickerOpen(true)
-    void ensureSidecarsLoaded()
-  }
-
-  async function handleOpenSidecar(sidecarId: string) {
-    try {
-      const tab = await openSidecarTab(sidecarId)
-      selectSidecarTab(tab.token)
-      setShowFolderSelection(false)
-      setSidecarPickerOpen(false)
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error)
-      showAlertDialog(message, {
-        variant: "error",
-        title: t("sidecars.open.errorTitle"),
-      })
-      log.error("Failed to open SideCar", error)
+    if (hasInstances()) {
+      setShowFolderSelection(true)
     }
   }
 
@@ -374,23 +332,6 @@ const App: Component = () => {
     }
   }
 
-  async function handleCloseAppTab(tabId: string) {
-    const tab = getAppTabById(tabId)
-    if (!tab) return
-
-    const fallbackTabId = activeAppTabId() === tabId ? getAdjacentAppTabId(tabId) : activeAppTabId()
-
-    if (tab.kind === "instance") {
-      await handleCloseInstance(tab.instance.id)
-    } else {
-      closeSidecarTab(tab.sidecarTab.token)
-    }
-
-    if (!getAppTabById(tabId)) {
-      ensureActiveAppTab(fallbackTabId)
-    }
-  }
-
   const handleSidebarAgentChange = async (instanceId: string, sessionId: string, agent: string) => {
     if (!instanceId || !sessionId || sessionId === "info") return
     await updateSessionAgent(instanceId, sessionId, agent)
@@ -420,7 +361,6 @@ const App: Component = () => {
     setThinkingBlocksExpansion,
     setToolInputsVisibility,
     handleNewInstanceRequest,
-    handleCloseActiveTab: () => handleCloseAppTab(activeAppTabId() ?? ""),
     handleCloseInstance,
     handleNewSession,
     handleCloseSession,
@@ -431,7 +371,6 @@ const App: Component = () => {
   useAppLifecycle({
     setEscapeInDebounce,
     handleNewInstanceRequest,
-    handleCloseActiveTab: () => handleCloseAppTab(activeAppTabId() ?? ""),
     handleCloseInstance,
     handleNewSession,
     handleCloseSession,
@@ -443,7 +382,7 @@ const App: Component = () => {
 
   // Listen for Tauri menu events
   onMount(() => {
-    if (isTauriHost()) {
+    if (runtimeEnv.host === "tauri") {
       const tauriBridge = (window as { __TAURI__?: { event?: { listen: (event: string, handler: (event: { payload: unknown }) => void) => Promise<() => void> } } }).__TAURI__
       if (tauriBridge?.event) {
         let unlistenMenu: (() => void) | null = null
@@ -531,60 +470,52 @@ const App: Component = () => {
           </div>
         </Show>
         <Show
-          when={appTabs().length === 0}
+          when={!hasInstances()}
           fallback={
             <>
               <Show when={!isPhoneLayout() || !mobileFullscreenMode()}>
                 <InstanceTabs
-                  tabs={appTabs()}
-                  activeTabId={activeAppTabId()}
-                  onSelect={selectAppTab}
-                  onClose={(tabId) => void handleCloseAppTab(tabId)}
+                  instances={instances()}
+                  activeInstanceId={activeInstanceId()}
+                  onSelect={setActiveInstanceId}
+                  onClose={handleCloseInstance}
                   onNew={handleNewInstanceRequest}
                 />
               </Show>
+ 
+              <For each={Array.from(instances().values())}>
+                {(instance) => {
+                  const isActiveInstance = () => activeInstanceId() === instance.id
+                  const isVisible = () => isActiveInstance() && !showFolderSelection()
+                    return (
+                       <div
+                         class="flex-1 min-h-0 overflow-hidden"
+                         style={{ display: isVisible() ? "flex" : "none" }}
+                         data-instance-id={instance.id}
+                         data-instance-active={isActiveInstance() ? "true" : "false"}
+                         data-instance-visible={isVisible() ? "true" : "false"}
+                       >
+                         <InstanceMetadataProvider instance={instance}>
+                           <InstanceShell
+                             instance={instance}
+                             isActiveInstance={isActiveInstance()}
+                             escapeInDebounce={escapeInDebounce()}
+                             paletteCommands={paletteCommands}
+                             onCloseSession={(sessionId) => handleCloseSession(instance.id, sessionId)}
+                             onNewSession={() => handleNewSession(instance.id)}
+                             handleSidebarAgentChange={(sessionId, agent) => handleSidebarAgentChange(instance.id, sessionId, agent)}
+                             handleSidebarModelChange={(sessionId, model) => handleSidebarModelChange(instance.id, sessionId, model)}
+                             onExecuteCommand={executeCommand}
+                            tabBarOffset={isPhoneLayout() && mobileFullscreenMode() ? 0 : instanceTabBarHeight()}
+                            mobileFullscreenMode={isPhoneLayout() && mobileFullscreenMode()}
+                            onEnterMobileFullscreen={() => void enterMobileFullscreen()}
+                            onExitMobileFullscreen={() => void exitMobileFullscreen()}
+                          />
+                        </InstanceMetadataProvider>
+
+                      </div>
+                    )
 
-              <For each={appTabs()}>
-                {(tab) => {
-                  const isVisible = () => activeAppTabId() === tab.id && !showFolderSelection()
-                  return tab.kind === "instance" ? (
-                    <div
-                      class="flex-1 min-h-0 overflow-hidden"
-                      style={{ display: isVisible() ? "flex" : "none" }}
-                      data-instance-id={tab.instance.id}
-                      data-tab-id={tab.id}
-                      data-tab-kind={tab.kind}
-                      data-tab-visible={isVisible() ? "true" : "false"}
-                    >
-                      <InstanceMetadataProvider instance={tab.instance}>
-                        <InstanceShell
-                          instance={tab.instance}
-                          isActiveInstance={isVisible()}
-                          escapeInDebounce={escapeInDebounce()}
-                          paletteCommands={paletteCommands}
-                          onCloseSession={(sessionId) => handleCloseSession(tab.instance.id, sessionId)}
-                          onNewSession={() => handleNewSession(tab.instance.id)}
-                          handleSidebarAgentChange={(sessionId, agent) => handleSidebarAgentChange(tab.instance.id, sessionId, agent)}
-                          handleSidebarModelChange={(sessionId, model) => handleSidebarModelChange(tab.instance.id, sessionId, model)}
-                          onExecuteCommand={executeCommand}
-                          tabBarOffset={isPhoneLayout() && mobileFullscreenMode() ? 0 : instanceTabBarHeight()}
-                          mobileFullscreenMode={isPhoneLayout() && mobileFullscreenMode()}
-                          onEnterMobileFullscreen={() => void enterMobileFullscreen()}
-                          onExitMobileFullscreen={() => void exitMobileFullscreen()}
-                        />
-                      </InstanceMetadataProvider>
-                    </div>
-                  ) : (
-                    <div
-                      class="flex-1 min-h-0 overflow-hidden"
-                      style={{ display: isVisible() ? "flex" : "none" }}
-                      data-tab-id={tab.id}
-                      data-tab-kind={tab.kind}
-                      data-tab-visible={isVisible() ? "true" : "false"}
-                    >
-                      <SideCarView tab={tab.sidecarTab} />
-                    </div>
-                  )
                 }}
               </For>
 
@@ -594,7 +525,6 @@ const App: Component = () => {
           <FolderSelectionView
             onSelectFolder={handleSelectFolder}
             isLoading={isSelectingFolder()}
-            onOpenSidecar={handleOpenSidecarPicker}
           />
         </Show>
 
@@ -604,7 +534,6 @@ const App: Component = () => {
               <FolderSelectionView
                 onSelectFolder={handleSelectFolder}
                 isLoading={isSelectingFolder()}
-                onOpenSidecar={handleOpenSidecarPicker}
                 onClose={() => {
                   setShowFolderSelection(false)
                   clearLaunchError()
@@ -615,7 +544,6 @@ const App: Component = () => {
         </Show>
  
         <SettingsScreen />
-        <SideCarPickerDialog open={sidecarPickerOpen()} onClose={() => setSidecarPickerOpen(false)} onOpenSidecar={handleOpenSidecar} />
  
         <AlertDialog />
 

packages/ui/src/components/alert-dialog.tsx

@@ -108,15 +108,15 @@ const AlertDialog: Component = () => {
             open
             modal
             onOpenChange={(open) => {
-              // Only handle dismiss if dialog is dismissible (default: true)
-              if (!open && payload.dismissible !== false) {
+              if (!open) {
                 dismiss(false, payload)
               }
             }}
           >
             <Dialog.Portal>
-              <Dialog.Overlay class="modal-overlay z-[60]" />
-              <Dialog.Content class="modal-surface fixed left-1/2 top-1/2 z-[1310] w-full max-w-sm -translate-x-1/2 -translate-y-1/2 p-6 border border-base shadow-2xl" tabIndex={-1}>
+              <Dialog.Overlay class="modal-overlay" />
+               <div class="fixed inset-0 z-50 flex items-center justify-center p-4">
+                 <Dialog.Content class="modal-surface w-full max-w-sm p-6 border border-base shadow-2xl" tabIndex={-1}>
                    <div class="flex items-start gap-3">
                      <div
                        class="flex h-12 w-12 shrink-0 items-center justify-center rounded-xl border text-base font-semibold"
@@ -140,11 +140,10 @@ const AlertDialog: Component = () => {
 
                     <Show when={isPrompt}>
                       <div class="mt-4">
-                        <label for="prompt-input" class="text-sm font-medium text-secondary">
+                        <label class="text-sm font-medium text-secondary">
                           {payload.inputLabel || t("alertDialog.prompt.inputLabel")}
                         </label>
                         <input
-                          id="prompt-input"
                           ref={(el) => {
                             promptInputRef = el
                           }}
@@ -185,10 +184,11 @@ const AlertDialog: Component = () => {
                      >
                        {confirmLabel}
                      </button>
-                    </div>
-                  </Dialog.Content>
-                </Dialog.Portal>
-              </Dialog>
+                   </div>
+                 </Dialog.Content>
+               </div>
+             </Dialog.Portal>
+           </Dialog>
          )
        }}
      </Show>

packages/ui/src/components/diff-viewer.tsx

@@ -1,4 +1,4 @@
-import { createMemo, Show, createEffect } from "solid-js"
+import { createMemo, Show, createEffect, onCleanup } from "solid-js"
 import { DiffView, DiffModeEnum } from "@git-diff-view/solid"
 import "@git-diff-view/solid/styles/diff-view-pure.css"
 import { disableCache } from "@git-diff-view/core"
@@ -20,7 +20,6 @@ interface ToolCallDiffViewerProps {
   filePath?: string
   theme: "light" | "dark"
   mode: DiffViewMode
-  wrap?: boolean
   onRendered?: () => void
   cachedHtml?: string
   cacheEntryParams?: CacheEntryParams
@@ -32,183 +31,11 @@ type DiffData = {
   hunks: string[]
 }
 
-function measureTextWidth(container: HTMLElement, text: string, source: HTMLElement) {
-  const computed = window.getComputedStyle(source)
-  const probe = document.createElement("span")
-  probe.textContent = text || ""
-  probe.style.position = "absolute"
-  probe.style.visibility = "hidden"
-  probe.style.pointerEvents = "none"
-  probe.style.display = "inline-block"
-  probe.style.width = "auto"
-  probe.style.maxWidth = "none"
-  probe.style.whiteSpace = "nowrap"
-  probe.style.fontFamily = computed.fontFamily
-  probe.style.fontSize = computed.fontSize
-  probe.style.fontWeight = computed.fontWeight
-  probe.style.fontStyle = computed.fontStyle
-  probe.style.letterSpacing = computed.letterSpacing
-  probe.style.fontVariant = computed.fontVariant
-  probe.style.textTransform = computed.textTransform
-  probe.style.lineHeight = computed.lineHeight
-  container.appendChild(probe)
-  const width = Math.ceil(probe.getBoundingClientRect().width)
-  probe.remove()
-  return width
-}
-
-function computeCompactWidth(
-  container: HTMLElement,
-  entries: Array<{ text: string; source: HTMLElement }>,
-  maxWidthPx = 40,
-) {
-  const measuredLabelWidthPx = entries.reduce((max, entry) => {
-    return Math.max(max, measureTextWidth(container, entry.text, entry.source))
-  }, 0)
-  const fallbackTextLength = entries.reduce((max, entry) => Math.max(max, entry.text.length), 1)
-  const fallbackWidthPx = Math.round(fallbackTextLength * 7 + 4)
-  return Math.max(2, Math.min(maxWidthPx, measuredLabelWidthPx > 0 ? measuredLabelWidthPx + 2 : fallbackWidthPx))
-}
-
-function applyCompactUnifiedGutter(container: HTMLElement, wrap: boolean) {
-  const tableWrapper = container.querySelector<HTMLElement>(".unified-diff-table-wrapper")
-  const table = container.querySelector<HTMLTableElement>(".unified-diff-table")
-  const numberCol = container.querySelector<HTMLTableColElement>(".unified-diff-table-num-col")
-  const gutterRows = container.querySelectorAll<HTMLElement>(".diff-line-num")
-  const hunkGutters = container.querySelectorAll<HTMLElement>(".diff-line-hunk-action, .diff-line-widget-wrapper, .diff-line-extend-wrapper")
-  const entries: Array<{ gutter: HTMLElement; label: HTMLElement; text: string }> = []
-
-  if (table) {
-    if (wrap) {
-      table.classList.add("table-fixed")
-      table.style.tableLayout = "fixed"
-      table.style.width = "100%"
-      table.style.minWidth = "100%"
-    } else {
-      table.classList.remove("table-fixed")
-      table.style.tableLayout = "auto"
-      table.style.width = "max-content"
-      table.style.minWidth = "100%"
-    }
-  }
-
-  gutterRows.forEach((gutter) => {
-    const oldSpan = gutter.querySelector<HTMLElement>("[data-line-old-num]")
-    const newSpan = gutter.querySelector<HTMLElement>("[data-line-new-num]")
-    const spacer = gutter.querySelector<HTMLElement>(".shrink-0")
-    const flexWrapper = gutter.querySelector<HTMLElement>(":scope > .flex")
-    const currentLabel = gutter.querySelector<HTMLElement>(":scope > .tool-call-diff-compact-line-number")
-
-    const oldText = oldSpan?.textContent?.trim() ?? ""
-    const newText = newSpan?.textContent?.trim() ?? ""
-    const hasUsableNew = newText.length > 0 && newText !== "0"
-    const hasUsableOld = oldText.length > 0 && oldText !== "0"
-    const visibleText = hasUsableNew ? newText : hasUsableOld ? oldText : newText || oldText
-
-    if (flexWrapper) flexWrapper.style.display = "none"
-    if (spacer) spacer.style.display = "none"
-    if (oldSpan) { oldSpan.style.display = "none"; oldSpan.style.width = "auto" }
-    if (newSpan) { newSpan.style.display = "none"; newSpan.style.width = "auto" }
-
-    gutter.style.paddingLeft = "1px"
-    gutter.style.paddingRight = "1px"
-    gutter.style.textAlign = "left"
-
-    const label = currentLabel ?? document.createElement("span")
-    label.className = "tool-call-diff-compact-line-number"
-    label.textContent = visibleText
-    label.setAttribute("aria-hidden", visibleText ? "false" : "true")
-    if (!currentLabel) gutter.appendChild(label)
-
-    entries.push({ gutter, label, text: visibleText })
-  })
-
-  const gutterWidthPx = computeCompactWidth(container, entries.map((entry) => ({ text: entry.text, source: entry.label })))
-  const gutterWidth = `${gutterWidthPx}px`
-  const compactAsideWidth = `${Math.max(8, gutterWidthPx - 10)}px`
-
-  if (tableWrapper) {
-    tableWrapper.style.setProperty("--diff-aside-width", compactAsideWidth)
-    tableWrapper.style.setProperty("--diff-aside-width--", compactAsideWidth)
-  }
-  if (numberCol) {
-    numberCol.style.width = gutterWidth
-  }
-
-  entries.forEach(({ gutter, label }) => {
-    gutter.style.width = gutterWidth
-    gutter.style.minWidth = gutterWidth
-    gutter.style.maxWidth = gutterWidth
-    label.style.width = "auto"
-    label.style.maxWidth = "none"
-  })
-
-  hunkGutters.forEach((gutter) => {
-    gutter.style.width = gutterWidth
-    gutter.style.minWidth = gutterWidth
-    gutter.style.maxWidth = gutterWidth
-    gutter.style.paddingLeft = "0"
-    gutter.style.paddingRight = "0"
-  })
-}
-
-function applyCompactSplitGutter(container: HTMLElement) {
-  const oldWrapper = container.querySelector<HTMLElement>(".old-diff-table-wrapper")
-  const newWrapper = container.querySelector<HTMLElement>(".new-diff-table-wrapper")
-  const numberCells = Array.from(container.querySelectorAll<HTMLElement>(".diff-line-old-num, .diff-line-new-num"))
-  const hunkActions = Array.from(container.querySelectorAll<HTMLElement>(".diff-line-hunk-action, .diff-line-widget-wrapper, .diff-line-extend-wrapper"))
-  const numberSpans = numberCells
-    .map((cell) => ({ cell, span: cell.querySelector<HTMLElement>("[data-line-num]") }))
-    .filter((entry): entry is { cell: HTMLElement; span: HTMLElement } => Boolean(entry.span))
-
-  const gutterWidthPx = computeCompactWidth(
-    container,
-    numberSpans.map(({ span }) => ({ text: span.textContent?.trim() ?? "", source: span })),
-    64,
-  )
-  const gutterWidth = `${gutterWidthPx}px`
-
-  ;[oldWrapper, newWrapper].forEach((wrapper) => {
-    if (wrapper) {
-      wrapper.style.setProperty("--diff-aside-width", gutterWidth)
-    }
-  })
-
-  numberCells.forEach((cell) => {
-    cell.style.width = gutterWidth
-    cell.style.minWidth = gutterWidth
-    cell.style.maxWidth = gutterWidth
-    cell.style.paddingLeft = "2px"
-    cell.style.paddingRight = "2px"
-    cell.style.textAlign = "left"
-    cell.style.whiteSpace = "nowrap"
-    cell.style.overflowWrap = "normal"
-    cell.style.wordBreak = "normal"
-  })
-
-  numberSpans.forEach(({ span }) => {
-    span.style.whiteSpace = "nowrap"
-    span.style.overflowWrap = "normal"
-    span.style.wordBreak = "normal"
-  })
-
-  hunkActions.forEach((cell) => {
-    cell.style.width = gutterWidth
-    cell.style.minWidth = gutterWidth
-    cell.style.maxWidth = gutterWidth
-    cell.style.paddingLeft = "0"
-    cell.style.paddingRight = "0"
-  })
-}
-
-function applyCompactDiffLayout(container: HTMLElement, mode: DiffViewMode, wrap = false) {
-  if (mode === "unified") {
-    applyCompactUnifiedGutter(container, wrap)
-    return
-  }
-  if (mode === "split") {
-    applyCompactSplitGutter(container)
-  }
+type CaptureContext = {
+  theme: ToolCallDiffViewerProps["theme"]
+  mode: DiffViewMode
+  diffText: string
+  cacheEntryParams?: CacheEntryParams
 }
 
 export function ToolCallDiffViewer(props: ToolCallDiffViewerProps) {
@@ -240,15 +67,12 @@ export function ToolCallDiffViewer(props: ToolCallDiffViewerProps) {
   const contextKey = createMemo(() => {
     const data = diffData()
     if (!data) return ""
-    return `${props.theme}|${props.mode}|${props.wrap ? "wrap" : "nowrap"}|${props.diffText}`
+    return `${props.theme}|${props.mode}|${props.diffText}`
   })
  
   createEffect(() => {
     const cachedHtml = props.cachedHtml
     if (cachedHtml) {
-      if (diffContainerRef) {
-        applyCompactDiffLayout(diffContainerRef, props.mode, Boolean(props.wrap))
-      }
       // When we are given cached HTML, we rely on the caller's cache
       // and simply notify once rendered.
       props.onRendered?.()
@@ -259,10 +83,9 @@ export function ToolCallDiffViewer(props: ToolCallDiffViewerProps) {
     if (!key) return
     if (!diffContainerRef) return
     if (lastCapturedKey === key) return
-
+ 
     requestAnimationFrame(() => {
       if (!diffContainerRef) return
-      applyCompactDiffLayout(diffContainerRef, props.mode, Boolean(props.wrap))
       const markup = diffContainerRef.innerHTML
       if (!markup) return
       lastCapturedKey = key
@@ -272,7 +95,6 @@ export function ToolCallDiffViewer(props: ToolCallDiffViewerProps) {
           html: markup,
           theme: props.theme,
           mode: props.mode,
-          wrap: props.wrap,
         })
       }
       props.onRendered?.()
@@ -300,7 +122,7 @@ export function ToolCallDiffViewer(props: ToolCallDiffViewerProps) {
                     diffViewMode={props.mode === "split" ? DiffModeEnum.Split : DiffModeEnum.Unified}
                     diffViewTheme={props.theme}
                     diffViewHighlight
-                    diffViewWrap={Boolean(props.wrap)}
+                    diffViewWrap={false}
                     diffViewFontSize={13}
                   />
                 </ErrorBoundary>
@@ -309,7 +131,7 @@ export function ToolCallDiffViewer(props: ToolCallDiffViewerProps) {
           </div>
         }
       >
-        <div ref={diffContainerRef} innerHTML={props.cachedHtml} />
+        <div innerHTML={props.cachedHtml} />
       </Show>
     </div>
   )

packages/ui/src/components/directory-browser-dialog.tsx

@@ -58,16 +58,6 @@ function resolveAbsolutePath(root: string, relativePath: string) {
   return `${trimmedRoot}${normalized}`
 }
 
-function getAbsolutePathFromMetadata(metadata: FileSystemListingMetadata | null) {
-  if (!metadata || metadata.pathKind === "drives") {
-    return ""
-  }
-  if (metadata.pathKind === "relative") {
-    return resolveAbsolutePath(metadata.rootPath, metadata.currentPath)
-  }
-  return metadata.displayPath
-}
-
 type FolderRow =
   | { type: "up"; path: string }
   | { type: "folder"; entry: FileSystemEntry }
@@ -77,8 +67,6 @@ const DirectoryBrowserDialog: Component<DirectoryBrowserDialogProps> = (props) =
   const [rootPath, setRootPath] = createSignal("")
   const [loading, setLoading] = createSignal(false)
   const [error, setError] = createSignal<string | null>(null)
-  const [pathInput, setPathInput] = createSignal("")
-  const [pathInputDirty, setPathInputDirty] = createSignal(false)
   const [creatingFolder, setCreatingFolder] = createSignal(false)
   const [directoryChildren, setDirectoryChildren] = createSignal<Map<string, FileSystemEntry[]>>(new Map())
   const [loadingPaths, setLoadingPaths] = createSignal<Set<string>>(new Set())
@@ -87,16 +75,12 @@ const DirectoryBrowserDialog: Component<DirectoryBrowserDialogProps> = (props) =
 
   const metadataCache = new Map<string, FileSystemListingMetadata>()
   const inFlightRequests = new Map<string, Promise<FileSystemListingMetadata>>()
-  let latestNavigationId = 0
 
   function resetState() {
-    setRootPath("")
     setDirectoryChildren(new Map<string, FileSystemEntry[]>())
     setLoadingPaths(new Set<string>())
     setCurrentPathKey(null)
     setCurrentMetadata(null)
-    setPathInput("")
-    setPathInputDirty(false)
     metadataCache.clear()
     inFlightRequests.clear()
     setError(null)
@@ -125,7 +109,11 @@ const DirectoryBrowserDialog: Component<DirectoryBrowserDialogProps> = (props) =
   async function initialize() {
     setLoading(true)
     try {
-      await navigateTo()
+      const metadata = await loadDirectory()
+      applyMetadata(metadata)
+    } catch (err) {
+      const message = err instanceof Error ? err.message : t("directoryBrowser.load.errorFallback")
+      setError(message)
     } finally {
       setLoading(false)
     }
@@ -209,22 +197,13 @@ const DirectoryBrowserDialog: Component<DirectoryBrowserDialogProps> = (props) =
   }
 
   async function navigateTo(path?: string) {
-    const navigationId = ++latestNavigationId
     setError(null)
     try {
       const metadata = await loadDirectory(path)
-      if (navigationId !== latestNavigationId) {
-        return null
-      }
       applyMetadata(metadata)
-      return metadata
     } catch (err) {
-      if (navigationId !== latestNavigationId) {
-        return null
-      }
       const message = err instanceof Error ? err.message : t("directoryBrowser.load.errorFallback")
       setError(message)
-      return null
     }
   }
 
@@ -246,58 +225,31 @@ const DirectoryBrowserDialog: Component<DirectoryBrowserDialogProps> = (props) =
   })
 
   function handleNavigateTo(path: string) {
-    setPathInputDirty(false)
     void navigateTo(path)
   }
 
   function handleNavigateUp() {
     const parent = currentMetadata()?.parentPath
     if (parent) {
-      setPathInputDirty(false)
       void navigateTo(parent)
     }
   }
 
   const currentAbsolutePath = createMemo(() => {
-    return getAbsolutePathFromMetadata(currentMetadata())
-  })
-
-  createEffect(() => {
-    const absolutePath = currentAbsolutePath()
-    if (!pathInputDirty()) {
-      setPathInput(absolutePath)
+    const metadata = currentMetadata()
+    if (!metadata) {
+      return ""
     }
+    if (metadata.pathKind === "drives") {
+      return ""
+    }
+    if (metadata.pathKind === "relative") {
+      return resolveAbsolutePath(metadata.rootPath, metadata.currentPath)
+    }
+    return metadata.displayPath
   })
 
   const canSelectCurrent = createMemo(() => Boolean(currentAbsolutePath()))
-  const canSubmitPath = createMemo(() => pathInput().trim().length > 0)
-
-  async function handlePathSubmit() {
-    const target = pathInput().trim()
-    if (!target) {
-      return
-    }
-    const metadata = await navigateTo(target)
-    if (!metadata) {
-      return
-    }
-    setPathInputDirty(false)
-    setPathInput(getAbsolutePathFromMetadata(metadata))
-  }
-
-  async function handleSelectCurrent() {
-    const target = pathInput().trim()
-    const metadata = target && target !== currentAbsolutePath() ? await navigateTo(target) : currentMetadata()
-    if (!metadata) {
-      return
-    }
-    setPathInputDirty(false)
-    const absolute = getAbsolutePathFromMetadata(metadata)
-    if (absolute) {
-      setPathInput(absolute)
-      props.onSelect(absolute)
-    }
-  }
 
   function handleEntrySelect(entry: FileSystemEntry) {
     const absolutePath = entry.absolutePath
@@ -310,13 +262,10 @@ const DirectoryBrowserDialog: Component<DirectoryBrowserDialogProps> = (props) =
 
   async function handleCreateFolder() {
     if (creatingFolder()) return
-    const target = pathInput().trim()
-    const metadata = target && target !== currentAbsolutePath() ? await navigateTo(target) : currentMetadata()
+    const metadata = currentMetadata()
     if (!metadata || metadata.pathKind === "drives") {
       return
     }
-    setPathInputDirty(false)
-    setPathInput(getAbsolutePathFromMetadata(metadata))
 
     const name =
       (await showPromptDialog(t("directoryBrowser.createFolder.promptMessage"), {
@@ -389,29 +338,19 @@ const DirectoryBrowserDialog: Component<DirectoryBrowserDialogProps> = (props) =
                 <div class="directory-browser-current">
                   <div class="directory-browser-current-meta">
                     <span class="directory-browser-current-label">{t("directoryBrowser.currentFolder")}</span>
-                    <input
-                      type="text"
-                      value={pathInput()}
-                      onInput={(event) => {
-                        setPathInput(event.currentTarget.value)
-                        setPathInputDirty(true)
-                      }}
-                      onKeyDown={(event) => {
-                        if (event.key === "Enter") {
-                          event.preventDefault()
-                          void handlePathSubmit()
-                        }
-                      }}
-                      spellcheck={false}
-                      class="selector-input directory-browser-current-path"
-                    />
+                    <span class="directory-browser-current-path">{currentAbsolutePath()}</span>
                   </div>
                   <div class="directory-browser-current-actions">
                     <button
                       type="button"
                       class="selector-button selector-button-secondary directory-browser-select directory-browser-current-select"
-                      disabled={(!canSelectCurrent() && !canSubmitPath()) || creatingFolder()}
-                      onClick={() => void handleSelectCurrent()}
+                      disabled={!canSelectCurrent() || creatingFolder()}
+                      onClick={() => {
+                        const absolute = currentAbsolutePath()
+                        if (absolute) {
+                          props.onSelect(absolute)
+                        }
+                      }}
                     >
                       {t("directoryBrowser.selectCurrent")}
                     </button>